about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/workflows/backport.yml2
-rw-r--r--.github/workflows/basic-eval.yml4
-rw-r--r--.github/workflows/check-by-name.yml6
-rw-r--r--.github/workflows/check-cherry-picks.yml2
-rw-r--r--.github/workflows/check-maintainers-sorted.yaml2
-rw-r--r--.github/workflows/check-nix-format.yml2
-rw-r--r--.github/workflows/editorconfig.yml2
-rw-r--r--.github/workflows/manual-nixos.yml2
-rw-r--r--.github/workflows/manual-nixpkgs.yml2
-rw-r--r--.github/workflows/nix-parse.yml2
-rw-r--r--.github/workflows/periodic-merge-24h.yml2
-rw-r--r--.github/workflows/periodic-merge-6h.yml2
-rw-r--r--.github/workflows/update-terraform-providers.yml2
-rw-r--r--lib/default.nix4
-rw-r--r--lib/deprecated/README.md11
-rw-r--r--lib/deprecated/misc.nix (renamed from lib/deprecated.nix)0
-rw-r--r--lib/lists.nix50
-rw-r--r--lib/tests/misc.nix27
-rw-r--r--maintainers/maintainer-list.nix48
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md63
-rw-r--r--nixos/lib/systemd-lib.nix15
-rw-r--r--nixos/modules/misc/documentation.nix1
-rw-r--r--nixos/modules/module-list.nix5
-rw-r--r--nixos/modules/programs/fcast-receiver.nix4
-rw-r--r--nixos/modules/programs/fzf.nix5
-rw-r--r--nixos/modules/security/duosec.nix6
-rw-r--r--nixos/modules/services/mail/roundcube.nix2
-rw-r--r--nixos/modules/services/misc/greenclip.nix5
-rw-r--r--nixos/modules/services/misc/ollama.nix38
-rw-r--r--nixos/modules/services/networking/deconz.nix2
-rw-r--r--nixos/modules/services/networking/firewall-nftables.nix18
-rw-r--r--nixos/modules/services/networking/inadyn.nix250
-rw-r--r--nixos/modules/services/networking/netbird/coturn.nix160
-rw-r--r--nixos/modules/services/networking/netbird/dashboard.nix186
-rw-r--r--nixos/modules/services/networking/netbird/management.nix460
-rw-r--r--nixos/modules/services/networking/netbird/server.md42
-rw-r--r--nixos/modules/services/networking/netbird/server.nix67
-rw-r--r--nixos/modules/services/networking/netbird/signal.nix123
-rw-r--r--nixos/modules/services/networking/sunshine.nix156
-rw-r--r--nixos/modules/services/networking/wpa_supplicant.nix13
-rw-r--r--nixos/modules/services/search/manticore.nix131
-rw-r--r--nixos/modules/services/security/oauth2_proxy.nix10
-rw-r--r--nixos/modules/services/system/earlyoom.nix39
-rw-r--r--nixos/modules/services/web-apps/firefly-iii.nix367
-rw-r--r--nixos/modules/services/web-apps/limesurvey.nix16
-rw-r--r--nixos/modules/services/web-apps/pretalx.nix8
-rw-r--r--nixos/modules/services/web-servers/nginx/default.nix2
-rw-r--r--nixos/modules/virtualisation/digital-ocean-config.nix2
-rw-r--r--nixos/release-combined.nix5
-rw-r--r--nixos/release-small.nix2
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/caddy.nix2
-rw-r--r--nixos/tests/earlyoom.nix2
-rw-r--r--nixos/tests/firefly-iii.nix26
-rw-r--r--nixos/tests/phosh.nix11
-rw-r--r--nixos/tests/radicale.nix2
-rw-r--r--nixos/tests/sunshine.nix70
-rw-r--r--nixos/tests/wpa_supplicant.nix29
-rw-r--r--pkgs/applications/audio/audacity/default.nix4
-rw-r--r--pkgs/applications/audio/csound/csound-qt/default.nix8
-rw-r--r--pkgs/applications/audio/reaper/default.nix8
-rw-r--r--pkgs/applications/blockchains/bitcoin/default.nix3
-rw-r--r--pkgs/applications/blockchains/terra-station/default.nix4
-rw-r--r--pkgs/applications/display-managers/greetd/wlgreet.nix13
-rw-r--r--pkgs/applications/editors/neovim/wrapper.nix6
-rw-r--r--pkgs/applications/editors/poke/default.nix69
-rw-r--r--pkgs/applications/editors/standardnotes/default.nix14
-rw-r--r--pkgs/applications/editors/vim/plugins/deprecated.json2
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix1116
-rw-r--r--pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix508
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix12
-rw-r--r--pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch10
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-plugin-names2
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix249
-rw-r--r--pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix4
-rw-r--r--pkgs/applications/emulators/cemu/default.nix4
-rw-r--r--pkgs/applications/emulators/dolphin-emu/default.nix1
-rw-r--r--pkgs/applications/emulators/lambda-delta/default.nix4
-rw-r--r--pkgs/applications/emulators/mednafen/server.nix22
-rw-r--r--pkgs/applications/emulators/mednaffe/default.nix42
-rw-r--r--pkgs/applications/emulators/melonDS/default.nix1
-rw-r--r--pkgs/applications/emulators/retroarch/hashes.json72
-rw-r--r--pkgs/applications/emulators/retroarch/retroarch-assets.nix6
-rw-r--r--pkgs/applications/emulators/snes9x/default.nix2
-rw-r--r--pkgs/applications/gis/qgis/unwrapped-ltr.nix4
-rw-r--r--pkgs/applications/gis/qgis/unwrapped.nix4
-rw-r--r--pkgs/applications/graphics/gscan2pdf/default.nix9
-rw-r--r--pkgs/applications/graphics/meshlab/default.nix58
-rw-r--r--pkgs/applications/graphics/pymeshlab/default.nix107
-rw-r--r--pkgs/applications/graphics/sane/backends/brscan5/default.nix13
-rw-r--r--pkgs/applications/misc/albert/default.nix3
-rw-r--r--pkgs/applications/misc/blender/default.nix4
-rw-r--r--pkgs/applications/misc/calibre/default.nix6
-rw-r--r--pkgs/applications/misc/faircamp/Cargo.lock487
-rw-r--r--pkgs/applications/misc/faircamp/default.nix6
-rw-r--r--pkgs/applications/misc/freemind/default.nix83
-rw-r--r--pkgs/applications/misc/gallery-dl/default.nix10
-rw-r--r--pkgs/applications/misc/logseq/default.nix3
-rw-r--r--pkgs/applications/misc/orca/default.nix2
-rw-r--r--pkgs/applications/misc/rtfm/default.nix27
-rw-r--r--pkgs/applications/misc/rtfm/enable-write-permissions.patch (renamed from pkgs/applications/misc/rtfm/patches/enable-write-permissions.patch)4
-rw-r--r--pkgs/applications/misc/rtfm/make.patch39
-rw-r--r--pkgs/applications/misc/rtfm/patches/friendly-docs-path.patch11
-rw-r--r--pkgs/applications/misc/rtfm/patches/make.patch21
-rw-r--r--pkgs/applications/misc/rtfm/shards.nix20
-rw-r--r--pkgs/applications/misc/shell-genie/default.nix9
-rw-r--r--pkgs/applications/misc/skytemple/default.nix2
-rw-r--r--pkgs/applications/misc/terminal-stocks/default.nix6
-rw-r--r--pkgs/applications/misc/ttyper/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix12
-rw-r--r--pkgs/applications/networking/browsers/firefox-bin/release_sources.nix818
-rw-r--r--pkgs/applications/networking/browsers/firefox/packages.nix4
-rw-r--r--pkgs/applications/networking/browsers/librewolf/src.json14
-rw-r--r--pkgs/applications/networking/cluster/hubble/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/k3s/README.md6
-rw-r--r--pkgs/applications/networking/cluster/kubectl-klock/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kubefirst/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubelogin/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kubevpn/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/linkerd/edge.nix4
-rw-r--r--pkgs/applications/networking/cluster/pachyderm/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/pv-migrate/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/velero/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix30
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/default.nix24
-rw-r--r--pkgs/applications/networking/instant-messengers/element/element-desktop.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/webcord/default.nix9
-rw-r--r--pkgs/applications/networking/instant-messengers/wire-desktop/default.nix8
-rw-r--r--pkgs/applications/networking/maestral-qt/default.nix4
-rw-r--r--pkgs/applications/networking/protonvpn-gui/default.nix4
-rw-r--r--pkgs/applications/networking/synology-drive-client/default.nix8
-rw-r--r--pkgs/applications/office/super-productivity/default.nix3
-rw-r--r--pkgs/applications/science/biology/nest/default.nix2
-rw-r--r--pkgs/applications/science/engineering/brmodelo/default.nix58
-rw-r--r--pkgs/applications/science/misc/snakemake/default.nix4
-rw-r--r--pkgs/applications/version-management/delta/default.nix5
-rw-r--r--pkgs/applications/version-management/forgejo/default.nix4
-rw-r--r--pkgs/applications/version-management/git-interactive-rebase-tool/default.nix7
-rw-r--r--pkgs/applications/version-management/git-town/default.nix4
-rw-r--r--pkgs/applications/video/kodi/addons/jellyfin/default.nix4
-rw-r--r--pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix4
-rw-r--r--pkgs/applications/video/subtitleedit/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman-compose/default.nix15
-rw-r--r--pkgs/applications/virtualization/podman/default.nix6
-rw-r--r--pkgs/applications/window-managers/miriway/default.nix6
-rw-r--r--pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix6
-rw-r--r--pkgs/build-support/fetchurl/mirrors.nix1
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/Cargo.lock509
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/Cargo.toml21
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/default.nix4
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/src/cacache.rs11
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/src/main.rs7
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs2
-rw-r--r--pkgs/build-support/node/fetch-npm-deps/src/util.rs19
-rw-r--r--pkgs/build-support/trivial-builders/default.nix10
-rw-r--r--pkgs/by-name/_6/_64gram/package.nix4
-rw-r--r--pkgs/by-name/ab/ab-av1/package.nix33
-rw-r--r--pkgs/by-name/ad/adminerevo/index.php35
-rw-r--r--pkgs/by-name/ad/adminerevo/package.nix73
-rw-r--r--pkgs/by-name/ae/aeron-cpp/package.nix12
-rw-r--r--pkgs/by-name/ap/aphorme/package.nix52
-rw-r--r--pkgs/by-name/be/betula/package.nix6
-rw-r--r--pkgs/by-name/bi/biglybt/package.nix66
-rw-r--r--pkgs/by-name/ca/cargo-expand/package.nix6
-rw-r--r--pkgs/by-name/cl/clatd/package.nix63
-rw-r--r--pkgs/by-name/cl/clipcat/package.nix17
-rw-r--r--pkgs/by-name/co/corto/package.nix27
-rw-r--r--pkgs/by-name/cr/crunchy-cli/Cargo.lock52
-rw-r--r--pkgs/by-name/cr/crunchy-cli/package.nix4
-rw-r--r--pkgs/by-name/do/dogedns/package.nix48
-rw-r--r--pkgs/by-name/do/dogedns/remove-date-info.patch11
-rw-r--r--pkgs/by-name/do/dorion/package.nix4
-rw-r--r--pkgs/by-name/do/doublecmd/package.nix4
-rw-r--r--pkgs/by-name/du/dublin-traceroute/package.nix7
-rw-r--r--pkgs/by-name/ea/earlyoom/0000-fix-dbus-path.patch (renamed from pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch)0
-rw-r--r--pkgs/by-name/ea/earlyoom/package.nix64
-rw-r--r--pkgs/by-name/ei/eigenlayer/package.nix6
-rw-r--r--pkgs/by-name/et/etlegacy-unwrapped/package.nix4
-rw-r--r--pkgs/by-name/et/etlegacy/package.nix2
-rw-r--r--pkgs/by-name/ez/eza/package.nix6
-rw-r--r--pkgs/by-name/fe/feather/package.nix2
-rw-r--r--pkgs/by-name/fi/files-cli/package.nix6
-rw-r--r--pkgs/by-name/fi/find-billy/package.nix70
-rw-r--r--pkgs/by-name/fi/firefly-iii/package.nix60
-rw-r--r--pkgs/by-name/fi/firefoxpwa/package.nix72
-rw-r--r--pkgs/by-name/fo/fork-cleaner/package.nix41
-rw-r--r--pkgs/by-name/ga/gamescope/package.nix4
-rw-r--r--pkgs/by-name/ga/gatus/package.nix6
-rw-r--r--pkgs/by-name/gi/gitu/package.nix6
-rw-r--r--pkgs/by-name/gl/glider/package.nix37
-rw-r--r--pkgs/by-name/go/go-camo/package.nix6
-rw-r--r--pkgs/by-name/gv/gvisor/package.nix2
-rw-r--r--pkgs/by-name/ho/home-manager/package.nix6
-rw-r--r--pkgs/by-name/in/incus/client.nix5
-rw-r--r--pkgs/by-name/in/inshellisense/package.nix6
-rw-r--r--pkgs/by-name/js/jsoncons/package.nix4
-rw-r--r--pkgs/by-name/kc/kcl-cli/package.nix6
-rw-r--r--pkgs/by-name/ko/koodo-reader/fix-isdev.patch13
-rw-r--r--pkgs/by-name/ko/koodo-reader/mime-types.xml58
-rw-r--r--pkgs/by-name/ko/koodo-reader/package.json312
-rw-r--r--pkgs/by-name/ko/koodo-reader/package.nix130
-rw-r--r--pkgs/by-name/ko/koodo-reader/update-react-i18next.patch58
-rw-r--r--pkgs/by-name/kt/ktfmt/package.nix7
-rw-r--r--pkgs/by-name/kt/ktfmt/pin-default-maven-plugin-versions.patch60
-rw-r--r--pkgs/by-name/lb/lbd/package.nix48
-rw-r--r--pkgs/by-name/li/libigl/package.nix31
-rw-r--r--pkgs/by-name/li/limine/package.nix5
-rw-r--r--pkgs/by-name/ll/llama-cpp/package.nix4
-rw-r--r--pkgs/by-name/lu/luneta/dub-lock.json24
-rw-r--r--pkgs/by-name/lu/luneta/package.nix44
-rw-r--r--pkgs/by-name/lx/lxd-lts/package.nix2
-rw-r--r--pkgs/by-name/ma/maa-assistant-arknights/pin.json8
-rw-r--r--pkgs/by-name/ma/matrix-authentication-service/Cargo.lock2129
-rw-r--r--pkgs/by-name/ma/matrix-authentication-service/package.nix8
-rw-r--r--pkgs/by-name/me/mednafen-server/package.nix30
-rw-r--r--pkgs/by-name/me/mednafen/package.nix (renamed from pkgs/applications/emulators/mednafen/default.nix)69
-rw-r--r--pkgs/by-name/me/mednaffe/package.nix52
-rw-r--r--pkgs/by-name/mo/mosdepth/package.nix4
-rw-r--r--pkgs/by-name/mq/mqttui/Cargo.lock402
-rw-r--r--pkgs/by-name/mq/mqttui/package.nix20
-rw-r--r--pkgs/by-name/my/mystmd/package.nix6
-rw-r--r--pkgs/by-name/na/namespace-cli/package.nix6
-rw-r--r--pkgs/by-name/ne/nemu/package.nix108
-rw-r--r--pkgs/by-name/ne/netbird-dashboard/package.nix35
-rw-r--r--pkgs/by-name/nh/nh/package.nix6
-rw-r--r--pkgs/by-name/ni/niri/Cargo.lock13
-rw-r--r--pkgs/by-name/ni/niri/package.nix6
-rw-r--r--pkgs/by-name/no/normcap/package.nix5
-rw-r--r--pkgs/by-name/no/novops/package.nix6
-rw-r--r--pkgs/by-name/nr/nrr/package.nix11
-rw-r--r--pkgs/by-name/nw/nwg-hello/package.nix4
-rw-r--r--pkgs/by-name/of/offat/package.nix4
-rw-r--r--pkgs/by-name/om/omnictl/package.nix40
-rw-r--r--pkgs/by-name/op/open-scq30/package.nix6
-rw-r--r--pkgs/by-name/op/openctm/package.nix59
-rw-r--r--pkgs/by-name/ot/oterm/package.nix4
-rw-r--r--pkgs/by-name/pi/pingtunnel/package.nix32
-rw-r--r--pkgs/by-name/po/pokemon-cursor/package.nix50
-rw-r--r--pkgs/by-name/po/poppins/package.nix35
-rw-r--r--pkgs/by-name/pr/primecount/package.nix4
-rw-r--r--pkgs/by-name/pr/promptfoo/package.nix6
-rw-r--r--pkgs/by-name/re/renode-unstable/package.nix4
-rw-r--r--pkgs/by-name/rp/rpcs3/package.nix8
-rw-r--r--pkgs/by-name/sa/sandbar/package.nix47
-rw-r--r--pkgs/by-name/sh/shadow-tls/package.nix32
-rw-r--r--pkgs/by-name/sh/shopware-cli/package.nix6
-rw-r--r--pkgs/by-name/so/sopwith/package.nix4
-rw-r--r--pkgs/by-name/ss/ssh-tpm-agent/package.nix2
-rw-r--r--pkgs/by-name/sw/swayosd/package.nix19
-rw-r--r--pkgs/by-name/sy/syncall/package.nix73
-rw-r--r--pkgs/by-name/sy/systemctl-tui/package.nix6
-rw-r--r--pkgs/by-name/te/ternimal/package.nix44
-rw-r--r--pkgs/by-name/te/tetrio-desktop/package.json22
-rw-r--r--pkgs/by-name/te/tetrio-desktop/package.nix98
-rw-r--r--pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix160
-rw-r--r--pkgs/by-name/te/tetrio-desktop/yarn.lock348
-rw-r--r--pkgs/by-name/tk/tkey-ssh-agent/package.nix27
-rw-r--r--pkgs/by-name/to/tootik/package.nix4
-rw-r--r--pkgs/by-name/tp/tplay/cargo.diff13
-rw-r--r--pkgs/by-name/tp/tplay/package.nix9
-rw-r--r--pkgs/by-name/tr/troubadix/package.nix4
-rw-r--r--pkgs/by-name/tu/tuifimanager/package.nix17
-rw-r--r--pkgs/by-name/ug/ugrep-indexer/package.nix4
-rw-r--r--pkgs/by-name/un/universal-android-debloater/package.nix2
-rw-r--r--pkgs/by-name/uv/uv/Cargo.lock11
-rw-r--r--pkgs/by-name/uv/uv/package.nix4
-rw-r--r--pkgs/by-name/va/vaults/package.nix85
-rw-r--r--pkgs/by-name/ve/vesktop/package.nix14
-rw-r--r--pkgs/by-name/vl/vlc-bittorrent/package.nix2
-rw-r--r--pkgs/by-name/wa/warp-terminal/versions.json8
-rw-r--r--pkgs/by-name/wa/waycheck/package.nix15
-rw-r--r--pkgs/by-name/we/wechat-uos/package.nix10
-rw-r--r--pkgs/by-name/wi/wireproxy/package.nix (renamed from pkgs/tools/networking/wireproxy/default.nix)8
-rw-r--r--pkgs/by-name/wt/wtfis/package.nix4
-rw-r--r--pkgs/by-name/yt/ytdownloader/package.nix4
-rw-r--r--pkgs/by-name/ze/zed-editor/Cargo.lock213
-rw-r--r--pkgs/by-name/ze/zed-editor/package.nix7
-rw-r--r--pkgs/by-name/zw/zwave-js-server/package.nix6
-rw-r--r--pkgs/data/fonts/iosevka/default.nix6
-rw-r--r--pkgs/data/icons/gruppled-cursors/default.nix30
-rw-r--r--pkgs/data/icons/gruppled-lite-cursors/default.nix30
-rw-r--r--pkgs/data/icons/numix-icon-theme-circle/default.nix4
-rw-r--r--pkgs/data/icons/tela-circle-icon-theme/default.nix4
-rw-r--r--pkgs/data/icons/whitesur-icon-theme/default.nix4
-rw-r--r--pkgs/desktops/gnome/extensions/buildGnomeExtension.nix1
-rw-r--r--pkgs/development/compilers/cakelisp/default.nix6
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix18
-rw-r--r--pkgs/development/compilers/haxe/default.nix8
-rw-r--r--pkgs/development/compilers/llvm/12/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/13/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/14/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/15/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/16/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/17/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/18/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/common/libcxx/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/git/default.nix4
-rw-r--r--pkgs/development/compilers/miranda/default.nix6
-rw-r--r--pkgs/development/compilers/ocaml/5.2.nix6
-rw-r--r--pkgs/development/compilers/scryer-prolog/default.nix8
-rw-r--r--pkgs/development/compilers/zig/0.12.nix37
-rw-r--r--pkgs/development/compilers/zig/generic.nix5
-rw-r--r--pkgs/development/embedded/avrdude/default.nix52
-rw-r--r--pkgs/development/embedded/avrdude/libelf.nix36
-rw-r--r--pkgs/development/interpreters/babashka/clojure-tools.nix4
-rw-r--r--pkgs/development/interpreters/babashka/default.nix4
-rw-r--r--pkgs/development/libraries/embree/default.nix18
-rw-r--r--pkgs/development/libraries/flatpak/default.nix4
-rw-r--r--pkgs/development/libraries/gensio/default.nix4
-rw-r--r--pkgs/development/libraries/glfw/3.x.nix31
-rw-r--r--pkgs/development/libraries/gumbo/default.nix4
-rw-r--r--pkgs/development/libraries/libcxxrt/default.nix6
-rw-r--r--pkgs/development/libraries/libtiff/4.5.nix86
-rw-r--r--pkgs/development/libraries/libtiff/default.nix5
-rw-r--r--pkgs/development/libraries/libtiff/headers-4.5.patch16
-rw-r--r--pkgs/development/libraries/libtiff/libtiff_t.nix73
-rw-r--r--pkgs/development/libraries/libtiff/rename-version-4.5.patch21
-rw-r--r--pkgs/development/libraries/libucl/default.nix4
-rw-r--r--pkgs/development/libraries/libzim/default.nix29
-rw-r--r--pkgs/development/libraries/pipewire/wireplumber.nix4
-rw-r--r--pkgs/development/libraries/python-qt/default.nix56
-rw-r--r--pkgs/development/libraries/structuresynth/default.nix61
-rw-r--r--pkgs/development/libraries/v8/default.nix8
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal/default.nix4
-rw-r--r--pkgs/development/libraries/zziplib/default.nix25
-rw-r--r--pkgs/development/lua-modules/overrides.nix19
-rw-r--r--pkgs/development/ocaml-modules/ca-certs-nss/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/janestreet/old.nix639
-rw-r--r--pkgs/development/ocaml-modules/letsencrypt/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix4
-rw-r--r--pkgs/development/php-packages/composer/default.nix8
-rw-r--r--pkgs/development/python-modules/aiojobs/default.nix8
-rw-r--r--pkgs/development/python-modules/aiomisc/default.nix4
-rw-r--r--pkgs/development/python-modules/airtouch5py/default.nix53
-rw-r--r--pkgs/development/python-modules/apkinspector/default.nix38
-rw-r--r--pkgs/development/python-modules/aranet4/default.nix37
-rw-r--r--pkgs/development/python-modules/aspy-yaml/default.nix (renamed from pkgs/development/python-modules/aspy.yaml/default.nix)5
-rw-r--r--pkgs/development/python-modules/awscrt/default.nix4
-rw-r--r--pkgs/development/python-modules/backports-shutil-get-terminal-size/default.nix (renamed from pkgs/development/python-modules/backports_shutil_get_terminal_size/default.nix)2
-rw-r--r--pkgs/development/python-modules/bellows/default.nix8
-rw-r--r--pkgs/development/python-modules/boto3-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/botocore-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/bubop/default.nix52
-rw-r--r--pkgs/development/python-modules/cachelib/default.nix4
-rw-r--r--pkgs/development/python-modules/camel-converter/default.nix37
-rw-r--r--pkgs/development/python-modules/clarifai/default.nix4
-rw-r--r--pkgs/development/python-modules/cloudsmith-api/default.nix4
-rw-r--r--pkgs/development/python-modules/dbt-redshift/default.nix4
-rw-r--r--pkgs/development/python-modules/ducc0/default.nix25
-rw-r--r--pkgs/development/python-modules/dungeon-eos/default.nix2
-rw-r--r--pkgs/development/python-modules/editdistpy/default.nix6
-rw-r--r--pkgs/development/python-modules/etelemetry/default.nix40
-rw-r--r--pkgs/development/python-modules/explorerscript/default.nix2
-rw-r--r--pkgs/development/python-modules/gios/default.nix19
-rw-r--r--pkgs/development/python-modules/githubkit/default.nix57
-rw-r--r--pkgs/development/python-modules/google-generativeai/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-health-checking/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-reflection/default.nix4
-rw-r--r--pkgs/development/python-modules/influxdb-client/default.nix4
-rw-r--r--pkgs/development/python-modules/influxdb3-python/default.nix33
-rw-r--r--pkgs/development/python-modules/item-synchronizer/default.nix43
-rw-r--r--pkgs/development/python-modules/jedi-language-server/default.nix13
-rw-r--r--pkgs/development/python-modules/lacuscore/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-embeddings-openai/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-llms-openai/default.nix4
-rw-r--r--pkgs/development/python-modules/maestral/default.nix17
-rw-r--r--pkgs/development/python-modules/marimo/default.nix4
-rw-r--r--pkgs/development/python-modules/mdformat-admon/default.nix4
-rw-r--r--pkgs/development/python-modules/mechanize/default.nix9
-rw-r--r--pkgs/development/python-modules/mitmproxy/default.nix6
-rw-r--r--pkgs/development/python-modules/ndspy/default.nix2
-rw-r--r--pkgs/development/python-modules/nettigo-air-monitor/default.nix43
-rw-r--r--pkgs/development/python-modules/nextdns/default.nix40
-rw-r--r--pkgs/development/python-modules/nvchecker/default.nix10
-rw-r--r--pkgs/development/python-modules/oelint-parser/default.nix4
-rw-r--r--pkgs/development/python-modules/ondilo/default.nix29
-rw-r--r--pkgs/development/python-modules/openai-triton/default.nix3
-rw-r--r--pkgs/development/python-modules/openai/default.nix4
-rw-r--r--pkgs/development/python-modules/openstacksdk/default.nix4
-rw-r--r--pkgs/development/python-modules/openusd/default.nix9
-rw-r--r--pkgs/development/python-modules/ovoenergy/default.nix46
-rw-r--r--pkgs/development/python-modules/pipdeptree/default.nix4
-rw-r--r--pkgs/development/python-modules/playwrightcapture/default.nix4
-rw-r--r--pkgs/development/python-modules/plexapi/default.nix4
-rw-r--r--pkgs/development/python-modules/plugwise/default.nix47
-rw-r--r--pkgs/development/python-modules/pluthon/default.nix2
-rw-r--r--pkgs/development/python-modules/pmdsky-debug-py/default.nix2
-rw-r--r--pkgs/development/python-modules/prefixed/default.nix4
-rw-r--r--pkgs/development/python-modules/proton-core/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-keyring-linux-secretservice/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-keyring-linux/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-vpn-api-core/default.nix6
-rw-r--r--pkgs/development/python-modules/proton-vpn-connection/default.nix4
-rw-r--r--pkgs/development/python-modules/proton-vpn-killswitch-network-manager/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-vpn-killswitch/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix8
-rw-r--r--pkgs/development/python-modules/proton-vpn-network-manager/default.nix4
-rw-r--r--pkgs/development/python-modules/proton-vpn-session/default.nix4
-rw-r--r--pkgs/development/python-modules/publicsuffixlist/default.nix4
-rw-r--r--pkgs/development/python-modules/pulsectl-asyncio/default.nix33
-rw-r--r--pkgs/development/python-modules/py-desmume/default.nix2
-rw-r--r--pkgs/development/python-modules/pyfritzhome/default.nix4
-rw-r--r--pkgs/development/python-modules/pygtkspellcheck/default.nix2
-rw-r--r--pkgs/development/python-modules/pylitterbot/default.nix4
-rw-r--r--pkgs/development/python-modules/pyowm/default.nix52
-rw-r--r--pkgs/development/python-modules/pypresence/default.nix2
-rw-r--r--pkgs/development/python-modules/pyqtdarktheme/add-missing-argument-to-the-proxy-style-initializer.patch25
-rw-r--r--pkgs/development/python-modules/pyqtdarktheme/default.nix70
-rw-r--r--pkgs/development/python-modules/pysolcast/default.nix46
-rw-r--r--pkgs/development/python-modules/python-homeassistant-analytics/default.nix69
-rw-r--r--pkgs/development/python-modules/qtile-extras/default.nix62
-rw-r--r--pkgs/development/python-modules/qtile/default.nix6
-rw-r--r--pkgs/development/python-modules/recurring-ical-events/default.nix8
-rw-r--r--pkgs/development/python-modules/result/default.nix17
-rw-r--r--pkgs/development/python-modules/rustworkx/default.nix6
-rw-r--r--pkgs/development/python-modules/setuptools-dso/default.nix2
-rw-r--r--pkgs/development/python-modules/skytemple-dtef/default.nix2
-rw-r--r--pkgs/development/python-modules/skytemple-eventserver/default.nix2
-rw-r--r--pkgs/development/python-modules/skytemple-files/default.nix2
-rw-r--r--pkgs/development/python-modules/skytemple-icons/default.nix2
-rw-r--r--pkgs/development/python-modules/skytemple-rust/default.nix2
-rw-r--r--pkgs/development/python-modules/skytemple-ssb-debugger/default.nix2
-rw-r--r--pkgs/development/python-modules/skytemple-ssb-emulator/default.nix2
-rw-r--r--pkgs/development/python-modules/smpp-pdu/default.nix (renamed from pkgs/development/python-modules/smpp.pdu/default.nix)2
-rw-r--r--pkgs/development/python-modules/snorkel/default.nix4
-rw-r--r--pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix4
-rw-r--r--pkgs/development/python-modules/spacy/annotation-test/default.nix4
-rw-r--r--pkgs/development/python-modules/spacy/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx-codeautolink/default.nix4
-rw-r--r--pkgs/development/python-modules/srpenergy/default.nix23
-rw-r--r--pkgs/development/python-modules/std-uritemplate/default.nix4
-rw-r--r--pkgs/development/python-modules/taskw-ng/default.nix56
-rw-r--r--pkgs/development/python-modules/tencentcloud-sdk-python/default.nix4
-rw-r--r--pkgs/development/python-modules/tilequant/default.nix2
-rw-r--r--pkgs/development/python-modules/txtai/default.nix4
-rw-r--r--pkgs/development/python-modules/types-psycopg2/default.nix4
-rw-r--r--pkgs/development/python-modules/types-redis/default.nix4
-rw-r--r--pkgs/development/python-modules/types-tqdm/default.nix8
-rw-r--r--pkgs/development/python-modules/unidata-blocks/default.nix4
-rw-r--r--pkgs/development/python-modules/vt-py/default.nix44
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/analysis/cppcheck/default.nix4
-rw-r--r--pkgs/development/tools/coder/default.nix32
-rwxr-xr-xpkgs/development/tools/coder/update.sh49
-rw-r--r--pkgs/development/tools/continuous-integration/codeberg-pages/default.nix8
-rw-r--r--pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch9
-rw-r--r--pkgs/development/tools/continuous-integration/jenkins/default.nix8
-rw-r--r--pkgs/development/tools/database/dbmate/default.nix6
-rw-r--r--pkgs/development/tools/database/sqlfluff/default.nix4
-rw-r--r--pkgs/development/tools/electron/common.nix22
-rw-r--r--pkgs/development/tools/go-migrate/default.nix6
-rw-r--r--pkgs/development/tools/go-minimock/default.nix6
-rw-r--r--pkgs/development/tools/gqlgenc/default.nix4
-rw-r--r--pkgs/development/tools/kubeswitch/default.nix4
-rw-r--r--pkgs/development/tools/language-servers/ccls/default.nix4
-rw-r--r--pkgs/development/tools/micronaut/default.nix4
-rw-r--r--pkgs/development/tools/misc/hydra/unstable.nix10
-rw-r--r--pkgs/development/tools/misc/one_gadget/Gemfile.lock6
-rw-r--r--pkgs/development/tools/misc/one_gadget/default.nix1
-rw-r--r--pkgs/development/tools/misc/one_gadget/gemset.nix8
-rw-r--r--pkgs/development/tools/misc/reviewdog/default.nix6
-rw-r--r--pkgs/development/tools/misc/sccache/default.nix6
-rw-r--r--pkgs/development/tools/msgpack-tools/default.nix2
-rw-r--r--pkgs/development/tools/ocaml/dune/3.nix4
-rw-r--r--pkgs/development/tools/oh-my-posh/default.nix6
-rw-r--r--pkgs/development/tools/pscale/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-dist/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-modules/default.nix31
-rw-r--r--pkgs/development/tools/rust/cargo-mutants/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-semver-checks/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-spellcheck/default.nix5
-rw-r--r--pkgs/development/tools/rust/cargo-tauri/default.nix6
-rw-r--r--pkgs/development/tools/rust/svd2rust/default.nix6
-rw-r--r--pkgs/development/tools/rust/typeshare/default.nix6
-rw-r--r--pkgs/development/tools/scenebuilder/default.nix104
-rw-r--r--pkgs/development/tools/scenebuilder/fix-default-maven-plugin-versions.patch60
-rw-r--r--pkgs/development/tools/scenebuilder/pom-remove-javafx.patch28
-rw-r--r--pkgs/development/tools/sqldef/default.nix6
-rw-r--r--pkgs/development/tools/turso-cli/default.nix4
-rw-r--r--pkgs/development/tools/vsce/default.nix6
-rw-r--r--pkgs/development/web/flyctl/default.nix6
-rw-r--r--pkgs/games/gogui/default.nix45
-rw-r--r--pkgs/games/rocksndiamonds/default.nix2
-rw-r--r--pkgs/games/shattered-pixel-dungeon/rkpd2.nix4
-rw-r--r--pkgs/kde/frameworks/extra-cmake-modules/default.nix12
-rw-r--r--pkgs/kde/frameworks/extra-cmake-modules/ecm-hook.sh2
-rw-r--r--pkgs/kde/frameworks/solid/default.nix14
-rw-r--r--pkgs/os-specific/bsd/freebsd/default.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix1099
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/column.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/common.nix3
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-cxx-safe-header.patch (renamed from pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-dont-configure-twice.patch (renamed from pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-no-force-native.patch (renamed from pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-setup-hook.sh (renamed from pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc (renamed from pkgs/os-specific/bsd/netbsd/libbsd-overlay.pc)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix120
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/config.nix18
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/csu.nix24
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/dict.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/fts/fts-setup-hook.sh (renamed from pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix41
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/getent/getent.patch (renamed from pkgs/os-specific/bsd/netbsd/getent.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/headers.nix11
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/include.nix40
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/install/install-setup-hook.sh (renamed from pkgs/os-specific/bsd/netbsd/install-setup-hook.sh)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix49
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix18
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libc.nix76
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix27
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix26
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libm.nix10
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix11
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix6
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix15
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/librt.nix13
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix32
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/locale/locale.patch (renamed from pkgs/os-specific/bsd/netbsd/locale.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix16
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/make.nix60
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix43
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/man.nix17
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/misc.nix9
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix82
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix5
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh (renamed from pkgs/os-specific/bsd/netbsd/setup-hook.sh)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix7
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix14
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix19
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix72
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/no-dynamic-linker.patch (renamed from pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix21
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/sys/sys-headers-incsdir.patch (renamed from pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch)0
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/tic.nix28
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix16
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix10
-rw-r--r--pkgs/os-specific/linux/busybox/default.nix2
-rw-r--r--pkgs/os-specific/linux/dbus-broker/default.nix4
-rw-r--r--pkgs/os-specific/linux/dbus-broker/disable-test.patch23
-rw-r--r--pkgs/os-specific/linux/earlyoom/default.nix38
-rw-r--r--pkgs/os-specific/linux/fw-ectool/default.nix33
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix4
-rw-r--r--pkgs/os-specific/linux/lenovo-legion/app.nix15
-rw-r--r--pkgs/os-specific/linux/mwprocapture/default.nix2
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh8
-rw-r--r--pkgs/os-specific/linux/r8125/default.nix4
-rw-r--r--pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix6
-rw-r--r--pkgs/os-specific/linux/sgx/psw/default.nix10
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch26
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/default.nix48
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch26
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix4
-rw-r--r--pkgs/os-specific/linux/sgx/ssl/default.nix36
-rw-r--r--pkgs/os-specific/linux/sgx/ssl/tests.nix95
-rw-r--r--pkgs/servers/aeron/default.nix20
-rw-r--r--pkgs/servers/deconz/default.nix11
-rw-r--r--pkgs/servers/dns/trust-dns/default.nix4
-rw-r--r--pkgs/servers/elasticmq-server-bin/default.nix4
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix9
-rw-r--r--pkgs/servers/home-assistant/custom-components/better_thermostat/default.nix4
-rw-r--r--pkgs/servers/home-assistant/custom-components/miele/default.nix4
-rw-r--r--pkgs/servers/home-assistant/default.nix8
-rw-r--r--pkgs/servers/home-assistant/frontend.nix4
-rw-r--r--pkgs/servers/home-assistant/stubs.nix4
-rw-r--r--pkgs/servers/http/envoy/default.nix16
-rw-r--r--pkgs/servers/hylafaxplus/default.nix4
-rw-r--r--pkgs/servers/hylafaxplus/libtiff-4.patch4
-rw-r--r--pkgs/servers/mail/spamassassin/default.nix8
-rw-r--r--pkgs/servers/minio/default.nix6
-rw-r--r--pkgs/servers/misc/irrd/default.nix3
-rw-r--r--pkgs/servers/monitoring/prometheus/fastly-exporter.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/nats-exporter.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/redis-exporter.nix6
-rw-r--r--pkgs/servers/monitoring/unpoller/default.nix6
-rw-r--r--pkgs/servers/nosql/influxdb2/cli.nix4
-rw-r--r--pkgs/servers/plex/raw.nix6
-rw-r--r--pkgs/servers/pocketbase/default.nix6
-rw-r--r--pkgs/servers/readarr/default.nix8
-rw-r--r--pkgs/servers/search/qdrant/1.7.4-CVE-2024-3078.patch142
-rw-r--r--pkgs/servers/search/qdrant/default.nix4
-rw-r--r--pkgs/servers/search/weaviate/default.nix6
-rw-r--r--pkgs/servers/sql/dolt/default.nix6
-rw-r--r--pkgs/servers/sql/postgresql/ext/lantern.nix2
-rw-r--r--pkgs/servers/sunshine/default.nix6
-rw-r--r--pkgs/servers/tailscale/default.nix4
-rw-r--r--pkgs/servers/web-apps/changedetection-io/default.nix6
-rw-r--r--pkgs/servers/x11/xorg/default.nix6
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list2
-rw-r--r--pkgs/shells/bash/bash-completion/default.nix2
-rw-r--r--pkgs/shells/hishtory/default.nix4
-rw-r--r--pkgs/tools/admin/balena-cli/default.nix6
-rw-r--r--pkgs/tools/admin/pulumi-packages/base.nix8
-rw-r--r--pkgs/tools/admin/pulumi-packages/default.nix1
-rw-r--r--pkgs/tools/admin/pulumi-packages/pulumi-yandex-unofficial.nix27
-rw-r--r--pkgs/tools/audio/beets/builtin-plugins.nix3
-rw-r--r--pkgs/tools/audio/beets/default.nix6
-rw-r--r--pkgs/tools/audio/yabridge/default.nix10
-rw-r--r--pkgs/tools/audio/yabridge/hardcode-dependencies.patch15
-rw-r--r--pkgs/tools/backup/borgbackup/default.nix42
-rw-r--r--pkgs/tools/backup/borgmatic/default.nix4
-rw-r--r--pkgs/tools/backup/zfs-replicate/default.nix4
-rw-r--r--pkgs/tools/backup/zfsbackup/default.nix2
-rw-r--r--pkgs/tools/compression/flips/default.nix2
-rw-r--r--pkgs/tools/filesystems/mount-zip/default.nix4
-rw-r--r--pkgs/tools/filesystems/stratis-cli/default.nix6
-rw-r--r--pkgs/tools/graphics/asymptote/default.nix82
-rw-r--r--pkgs/tools/misc/broadlink-cli/default.nix4
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix4
-rw-r--r--pkgs/tools/misc/leanify/default.nix11
-rw-r--r--pkgs/tools/misc/markdown-anki-decks/default.nix17
-rw-r--r--pkgs/tools/misc/phrase-cli/default.nix6
-rw-r--r--pkgs/tools/misc/pspg/default.nix4
-rw-r--r--pkgs/tools/misc/shelldap/default.nix10
-rw-r--r--pkgs/tools/misc/tbls/default.nix6
-rw-r--r--pkgs/tools/misc/upterm/default.nix6
-rw-r--r--pkgs/tools/misc/vtm/default.nix4
-rw-r--r--pkgs/tools/networking/calendar-cli/default.nix8
-rw-r--r--pkgs/tools/networking/ddns-go/default.nix4
-rw-r--r--pkgs/tools/networking/dnsproxy/default.nix6
-rw-r--r--pkgs/tools/networking/getmail6/default.nix15
-rw-r--r--pkgs/tools/networking/juicity/default.nix4
-rw-r--r--pkgs/tools/networking/knock/package.nix13
-rw-r--r--pkgs/tools/networking/maubot/default.nix1
-rw-r--r--pkgs/tools/networking/maubot/plugins/generated.json165
-rwxr-xr-xpkgs/tools/networking/maubot/plugins/update.py2
-rw-r--r--pkgs/tools/networking/minio-client/default.nix6
-rw-r--r--pkgs/tools/networking/ockam/default.nix27
-rw-r--r--pkgs/tools/networking/openapi-generator-cli/default.nix4
-rw-r--r--pkgs/tools/networking/shadowsocks-rust/default.nix6
-rw-r--r--pkgs/tools/nix/nixci/default.nix20
-rw-r--r--pkgs/tools/package-management/disnix/DisnixWebService/default.nix45
-rw-r--r--pkgs/tools/security/afl/README.md19
-rw-r--r--pkgs/tools/security/afl/default.nix82
-rw-r--r--pkgs/tools/security/afl/libdislocator.nix35
-rw-r--r--pkgs/tools/security/afl/qemu-patches/no-etc-install.patch13
-rw-r--r--pkgs/tools/security/afl/qemu-patches/syscall-glibc2_30.diff51
-rw-r--r--pkgs/tools/security/afl/qemu.nix77
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/keepwn/default.nix25
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock73
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix130
-rw-r--r--pkgs/tools/security/osv-scanner/default.nix17
-rw-r--r--pkgs/tools/security/pwdsafety/default.nix25
-rw-r--r--pkgs/tools/security/rbw/default.nix6
-rw-r--r--pkgs/tools/security/snow/default.nix4
-rw-r--r--pkgs/tools/security/step-cli/default.nix2
-rw-r--r--pkgs/tools/system/gdu/default.nix34
-rw-r--r--pkgs/tools/text/goawk/default.nix4
-rw-r--r--pkgs/tools/text/ov/default.nix6
-rw-r--r--pkgs/tools/text/vale/default.nix32
-rw-r--r--pkgs/tools/text/vale/styles.nix144
-rw-r--r--pkgs/tools/typesetting/tex/texlive/bin.nix33
-rw-r--r--pkgs/tools/typesetting/tex/texpresso/default.nix6
-rw-r--r--pkgs/tools/video/lux/default.nix6
-rw-r--r--pkgs/tools/virtualization/cri-tools/default.nix4
-rw-r--r--pkgs/tools/wayland/clipman/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix105
-rw-r--r--pkgs/top-level/make-tarball.nix3
-rw-r--r--pkgs/top-level/nixpkgs-basic-release-checks.nix4
-rw-r--r--pkgs/top-level/ocaml-packages.nix10
-rw-r--r--pkgs/top-level/python-aliases.nix2
-rw-r--r--pkgs/top-level/python-packages.nix24
-rw-r--r--pkgs/top-level/release.nix4
688 files changed, 14415 insertions, 7380 deletions
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index d4e91e6a2a0c5..612923fbe6f15 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -20,7 +20,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
diff --git a/.github/workflows/basic-eval.yml b/.github/workflows/basic-eval.yml
index 9008ca208e174..ff9e6d5a3814e 100644
--- a/.github/workflows/basic-eval.yml
+++ b/.github/workflows/basic-eval.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
     - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
     - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
       with:
@@ -26,4 +26,4 @@ jobs:
         name: nixpkgs-ci
         signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
     # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset
-    - run: nix-build pkgs/top-level/release.nix -A tarball.nixpkgs-basic-release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'
+    - run: nix-build pkgs/top-level/release.nix -A release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'
diff --git a/.github/workflows/check-by-name.yml b/.github/workflows/check-by-name.yml
index bdc223e3d32c0..a5070679c9d07 100644
--- a/.github/workflows/check-by-name.yml
+++ b/.github/workflows/check-by-name.yml
@@ -84,7 +84,7 @@ jobs:
             exit 1
           fi
           echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           # pull_request_target checks out the base branch by default
           ref: ${{ env.mergedSha }}
@@ -107,6 +107,10 @@ jobs:
           # Adds a result symlink as a GC root
           nix-store --realise "$toolPath" --add-root result
       - name: Running nixpkgs-check-by-name
+        env:
+          # Force terminal colors to be enabled. The library that
+          # nixpkgs-check-by-name uses respects: https://bixense.com/clicolors/
+          CLICOLOR_FORCE: 1
         run: |
           if result/bin/nixpkgs-check-by-name --base "$base" .; then
             exit 0
diff --git a/.github/workflows/check-cherry-picks.yml b/.github/workflows/check-cherry-picks.yml
index 8dfc3f6c06062..82a8eca01adf0 100644
--- a/.github/workflows/check-cherry-picks.yml
+++ b/.github/workflows/check-cherry-picks.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
       with:
         fetch-depth: 0
         filter: blob:none
diff --git a/.github/workflows/check-maintainers-sorted.yaml b/.github/workflows/check-maintainers-sorted.yaml
index 74012e2663657..6c3eb37236682 100644
--- a/.github/workflows/check-maintainers-sorted.yaml
+++ b/.github/workflows/check-maintainers-sorted.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/check-nix-format.yml b/.github/workflows/check-nix-format.yml
index c1d87faca2133..31e105281a77d 100644
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index 168e5bccaea44..e0a264cf485f9 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -24,7 +24,7 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/manual-nixos.yml b/.github/workflows/manual-nixos.yml
index 2ad0917205116..8e6dd17d3168d 100644
--- a/.github/workflows/manual-nixos.yml
+++ b/.github/workflows/manual-nixos.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/manual-nixpkgs.yml b/.github/workflows/manual-nixpkgs.yml
index b56d89eccd613..f3347a92d1f88 100644
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/nix-parse.yml b/.github/workflows/nix-parse.yml
index da2e942414e25..a45198f1475e1 100644
--- a/.github/workflows/nix-parse.yml
+++ b/.github/workflows/nix-parse.yml
@@ -24,7 +24,7 @@ jobs:
         if [[ -s "$HOME/changed_files" ]]; then
           echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
         fi
-    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index 6adada59c5a5b..eba0d6cae3e2c 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -41,7 +41,7 @@ jobs:
             into: staging-23.11
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
diff --git a/.github/workflows/periodic-merge-6h.yml b/.github/workflows/periodic-merge-6h.yml
index 6f188ee28d17b..986b7013d0e7e 100644
--- a/.github/workflows/periodic-merge-6h.yml
+++ b/.github/workflows/periodic-merge-6h.yml
@@ -39,7 +39,7 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
index 9b7ec5cc59b07..2da89a0441af6 100644
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
       - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
diff --git a/lib/default.nix b/lib/default.nix
index 486d412fbb6fd..d5d47defb8e64 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -47,7 +47,7 @@ let
     # misc
     asserts = callLibs ./asserts.nix;
     debug = callLibs ./debug.nix;
-    misc = callLibs ./deprecated.nix;
+    misc = callLibs ./deprecated/misc.nix;
 
     # domain-specific
     fetchers = callLibs ./fetchers.nix;
@@ -89,7 +89,7 @@ let
       recurseIntoAttrs dontRecurseIntoAttrs cartesianProduct cartesianProductOfSets
       mapCartesianProduct updateManyAttrsByPath;
     inherit (self.lists) singleton forEach foldr fold foldl foldl' imap0 imap1
-      concatMap flatten remove findSingle findFirst any all count
+      ifilter0 concatMap flatten remove findSingle findFirst any all count
       optional optionals toList range replicate partition zipListsWith zipLists
       reverseList listDfs toposort sort sortOn naturalSort compareLists take
       drop sublist last init crossLists unique allUnique intersectLists
diff --git a/lib/deprecated/README.md b/lib/deprecated/README.md
new file mode 100644
index 0000000000000..afeb34d449f56
--- /dev/null
+++ b/lib/deprecated/README.md
@@ -0,0 +1,11 @@
+
+# lib/deprecated
+
+Do not add any new functions to this directory.
+
+This directory contains the `lib.misc` sublibrary, which - as a location - is deprecated.
+Furthermore, some of the functions inside are of *dubious* utility, and should perhaps be avoided,
+while some functions *may still be needed*.
+
+This directory does not play a role in the deprecation process for library functions.
+They should be deprecated in place, by putting a `lib.warn` or `lib.warnIf` call around the function.
diff --git a/lib/deprecated.nix b/lib/deprecated/misc.nix
index d556bccbec0bc..d556bccbec0bc 100644
--- a/lib/deprecated.nix
+++ b/lib/deprecated/misc.nix
diff --git a/lib/lists.nix b/lib/lists.nix
index 28fa277b22b1f..ca436d7a9c94b 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -4,7 +4,7 @@
 { lib }:
 let
   inherit (lib.strings) toInt;
-  inherit (lib.trivial) compare min id warn;
+  inherit (lib.trivial) compare min id warn pipe;
   inherit (lib.attrsets) mapAttrs;
 in
 rec {
@@ -334,6 +334,54 @@ rec {
   imap1 = f: list: genList (n: f (n + 1) (elemAt list n)) (length list);
 
   /**
+    Filter a list for elements that satisfy a predicate function.
+    The predicate function is called with both the index and value for each element.
+    It must return `true`/`false` to include/exclude a given element in the result.
+    This function is strict in the result of the predicate function for each element.
+    This function has O(n) complexity.
+
+    Also see [`builtins.filter`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-filter) (available as `lib.lists.filter`),
+    which can be used instead when the index isn't needed.
+
+    # Inputs
+
+    `ipred`
+
+    : The predicate function, it takes two arguments:
+      - 1. (int): the index of the element.
+      - 2. (a): the value of the element.
+
+      It must return `true`/`false` to include/exclude a given element from the result.
+
+    `list`
+
+    : The list to filter using the predicate.
+
+    # Type
+    ```
+    ifilter0 :: (int -> a -> bool) -> [a] -> [a]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.lists.ifilter0` usage example
+
+    ```nix
+    ifilter0 (i: v: i == 0 || v > 2) [ 1 2 3 ]
+    => [ 1 3 ]
+    ```
+    :::
+  */
+  ifilter0 =
+    ipred:
+    input:
+    map (idx: elemAt input idx) (
+      filter (idx: ipred idx (elemAt input idx)) (
+        genList (x: x) (length input)
+      )
+    );
+
+  /**
     Map and concatenate the result.
 
     # Type
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index cf4a185c14689..6774939023d20 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -63,8 +63,10 @@ let
     hasAttrByPath
     hasInfix
     id
+    ifilter0
     isStorePath
     lazyDerivation
+    length
     lists
     listToAttrs
     makeExtensible
@@ -651,6 +653,31 @@ runTests {
     expected = ["b" "c"];
   };
 
+  testIfilter0Example = {
+    expr = ifilter0 (i: v: i == 0 || v > 2) [ 1 2 3 ];
+    expected = [ 1 3 ];
+  };
+  testIfilter0Empty = {
+    expr = ifilter0 (i: v: abort "shouldn't be evaluated!") [ ];
+    expected = [ ];
+  };
+  testIfilter0IndexOnly = {
+    expr = length (ifilter0 (i: v: mod i 2 == 0) [ (throw "0") (throw "1") (throw "2") (throw "3")]);
+    expected = 2;
+  };
+  testIfilter0All = {
+    expr = ifilter0 (i: v: true) [ 10 11 12 13 14 15 ];
+    expected = [ 10 11 12 13 14 15 ];
+  };
+  testIfilter0First = {
+    expr = ifilter0 (i: v: i == 0) [ 10 11 12 13 14 15 ];
+    expected = [ 10 ];
+  };
+  testIfilter0Last = {
+    expr = ifilter0 (i: v: i == 5) [ 10 11 12 13 14 15 ];
+    expected = [ 15 ];
+  };
+
   testFold =
     let
       f = op: fold: fold op 0 (range 0 100);
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 39b6894e7540d..d2f7df1217a14 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -800,6 +800,12 @@
     githubId = 20405311;
     name = "Aksh Gupta";
   };
+  aktaboot = {
+    email = "akhtaboo@protonmail.com";
+    github = "aktaboot";
+    githubId = 120214979;
+    name = "aktaboot";
+  };
   al3xtjames = {
     email = "nix@alextjam.es";
     github = "al3xtjames";
@@ -1442,6 +1448,12 @@
     githubId = 4194320;
     name = "Anton Schirg";
   };
+  anytimetraveler = {
+    email = "simon@simonscode.org";
+    github = "AnyTimeTraveler";
+    githubId = 19378309;
+    name = "Simon Struck";
+  };
   aorith = {
     email = "aomanu+nixpkgs@gmail.com";
     github = "aorith";
@@ -6456,6 +6468,12 @@
     githubId = 4246921;
     name = "Florian Beeres";
   };
+  fccapria = {
+    email = "francesco@capria.eu";
+    github = "fccapria";
+    githubId = 62179193;
+    name = "Francesco Carmelo Capria";
+  };
   fd = {
     email = "simon.menke@gmail.com";
     github = "fd";
@@ -14810,6 +14828,12 @@
     githubId = 127548;
     name = "Judson Lester";
   };
+  nyawox = {
+    name = "nyawox";
+    email = "nyawox.git@gmail.com";
+    github = "nyawox";
+    githubId = 93813719;
+  };
   nzbr = {
     email = "nixos@nzbr.de";
     github = "nzbr";
@@ -16491,6 +16515,13 @@
       fingerprint = "7573 56D7 79BB B888 773E  415E 736C CDF9 EF51 BD97";
     }];
   };
+  qyriad = {
+    email = "qyriad@qyriad.me";
+    github = "Qyriad";
+    githubId = 1542224;
+    matrix = "@qyriad:katesiria.org";
+    name = "Qyriad";
+  };
   r3dl3g = {
     email = "redleg@rothfuss-web.de";
     github = "r3dl3g";
@@ -16695,6 +16726,12 @@
     githubId = 145816;
     name = "David McKay";
   };
+  raylas = {
+    email = "r@raymond.sh";
+    github = "raylas";
+    githubId = 8099415;
+    name = "Raymond Douglas";
+  };
   rayslash = {
     email = "stevemathewjoy@tutanota.com";
     github = "rayslash";
@@ -18139,6 +18176,11 @@
     githubId = 863807;
     name = "Serge Guelton";
   };
+  sergioribera = {
+    github = "SergioRibera";
+    githubId = 56278796;
+    name = "Sergio Ribera";
+  };
   sersorrel = {
     email = "ash@sorrel.sh";
     github = "sersorrel";
@@ -21869,12 +21911,6 @@
     githubId = 36407913;
     name = "Uli Baum";
   };
-  xfix = {
-    email = "kamila@borowska.pw";
-    github = "KamilaBorowska";
-    githubId = 1297598;
-    name = "Kamila Borowska";
-  };
   xfnw = {
     email = "xfnw+nixos@riseup.net";
     github = "xfnw";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index a3a9980bc58fe..cc614a1ae1ffc 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -50,7 +50,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - `virtualisation.docker.enableNvidia` and `virtualisation.podman.enableNvidia` options are deprecated. `virtualisation.containers.cdi.dynamic.nvidia.enable` should be used instead. This option will expose GPUs on containers with the `--device` CLI option. This is supported by Docker 25, Podman 3.2.0 and Singularity 4. Any container runtime that supports the CDI specification will take advantage of this feature.
 
-- A new option `system.etc.overlay.enable` was added. If enabled, `/etc` is
+- `system.etc.overlay.enable` option was added. If enabled, `/etc` is
   mounted via an overlayfs instead of being created by a custom perl script.
 
 - NixOS AMIs are now uploaded regularly to a new AWS Account.
@@ -108,6 +108,8 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - [dnsproxy](https://github.com/AdguardTeam/dnsproxy), a simple DNS proxy with DoH, DoT, DoQ and DNSCrypt support. Available as [services.dnsproxy](#opt-services.dnsproxy.enable).
 
+- [manticoresearch](https://manticoresearch.com), easy to use open source fast database for search. Available as [services.manticore](#opt-services.manticore.enable).
+
 - [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.
 
 - [ollama](https://ollama.ai), server for running large language models locally.
@@ -137,6 +139,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [Suwayomi Server](https://github.com/Suwayomi/Suwayomi-Server), a free and open source manga reader server that runs extensions built for [Tachiyomi](https://tachiyomi.org). Available as [services.suwayomi-server](#opt-services.suwayomi-server.enable).
 
+- A self-hosted management server for the [Netbird](https://netbird.io). Available as [services.netbird.server](#opt-services.netbird.server.enable).
+
 - [ping_exporter](https://github.com/czerwonk/ping_exporter), a Prometheus exporter for ICMP echo requests. Available as [services.prometheus.exporters.ping](#opt-services.prometheus.exporters.ping.enable).
 
 - [Prometheus DNSSEC Exporter](https://github.com/chrj/prometheus-dnssec-exporter), check for validity and expiration in DNSSEC signatures and expose metrics for Prometheus. Available as [services.prometheus.exporters.dnssec](#opt-services.prometheus.exporters.dnssec.enable).
@@ -151,6 +155,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [microsocks](https://github.com/rofl0r/microsocks), a tiny, portable SOCKS5 server with very moderate resource usage. Available as [services.microsocks]($opt-services-microsocks.enable).
 
+- [inadyn](https://github.com/troglobit/inadyn), a Dynamic DNS client with built-in support for multiple providers. Available as [services.inadyn](#opt-services.inadyn.enable).
+
 - [Clevis](https://github.com/latchset/clevis), a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as [boot.initrd.clevis.enable](#opt-boot.initrd.clevis.enable).
 
 - [fritz-exporter](https://github.com/pdreker/fritz_exporter), a Prometheus exporter for extracting metrics from [FRITZ!](https://avm.de/produkte/) devices. Available as [services.prometheus.exporters.fritz](#opt-services.prometheus.exporters.fritz.enable).
@@ -173,12 +179,16 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [davis](https://github.com/tchapi/davis), a simple CardDav and CalDav server inspired by Baïkal. Available as [services.davis]($opt-services-davis.enable).
 
+- [Firefly-iii](https://www.firefly-iii.org), a free and open source personal finance manager. Available as [services.firefly-iii](#opt-services.firefly-iii.enable)
+
 - [systemd-lock-handler](https://git.sr.ht/~whynothugo/systemd-lock-handler/), a bridge between logind D-Bus events and systemd targets. Available as [services.systemd-lock-handler.enable](#opt-services.systemd-lock-handler.enable).
 
 - [wastebin](https://github.com/matze/wastebin), a pastebin server written in rust. Available as [services.wastebin](#opt-services.wastebin.enable).
 
 - [Mealie](https://nightly.mealie.io/), a self-hosted recipe manager and meal planner with a RestAPI backend and a reactive frontend application built in NuxtJS for a pleasant user experience for the whole family. Available as [services.mealie](#opt-services.mealie.enable)
 
+- [Sunshine](https://app.lizardbyte.dev/Sunshine), a self-hosted game stream host for Moonlight. Available as [services.sunshine](#opt-services.sunshine.enable).
+
 - [Uni-Sync](https://github.com/EightB1ts/uni-sync), a synchronization tool for Lian Li Uni Controllers. Available as [hardware.uni-sync](#opt-hardware.uni-sync.enable)
 
 - [prometheus-nats-exporter](https://github.com/nats-io/prometheus-nats-exporter), a Prometheus exporter for NATS. Available as [services.prometheus.exporters.nats](#opt-services.prometheus.exporters.nats.enable).
@@ -227,7 +237,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `nvtop` family of packages was reorganized into nested attrset. `nvtop` has been renamed to `nvtopPackages.full`, and all `nvtop-{amd,nvidia,intel,msm}` packages are now named as `nvtopPackages.{amd,nvidia,intel,msm}`
 
-- `neo4j` has been updated to 5, you may want to read the [release notes for Neo4j 5](https://neo4j.com/release-notes/database/neo4j-5/)
+- `neo4j` has been updated to version 5, you may want to read the [release notes for Neo4j 5](https://neo4j.com/release-notes/database/neo4j-5/)
 
 - `services.neo4j.allowUpgrade` was removed and no longer has any effect. Neo4j 5 supports automatic rolling upgrades.
 
@@ -241,31 +251,31 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `services.aria2.rpcSecret` has been replaced with `services.aria2.rpcSecretFile`.
   This was done so that secrets aren't stored in the world-readable nix store.
-  To migrate, you will have create a file with the same exact string, and change
+  To migrate, you will have to create a file with the same exact string, and change
   your module options to point to that file. For example, `services.aria2.rpcSecret =
   "mysecret"` becomes `services.aria2.rpcSecretFile = "/path/to/secret_file"`
   where the file `secret_file` contains the string `mysecret`.
 
 - `openssh`, `openssh_hpn` and `openssh_gssapi` are now compiled without support for the DSA signature algorithm as it is being deprecated upstream. Users still relying on DSA keys should consider upgrading
-  to another signature algorithm. It is however possible, for the time being, to restore the DSA keys support using `override` to set `dsaKeysSupport = true`.
+  to another signature algorithm. However, for the time being it is possible to restore DSA key support using `override` to set `dsaKeysSupport = true`.
 
-- `buildGoModule` now throws error when `vendorHash` is not specified. `vendorSha256`, deprecated in Nixpkgs 23.11, is now ignored and is no longer a `vendorHash` alias.
+- `buildGoModule` now throws an error when `vendorHash` is not specified. `vendorSha256`, deprecated in Nixpkgs 23.11, is now ignored and is no longer a `vendorHash` alias.
 
-- Invidious has changed its default database username from `kemal` to `invidious`. Setups involving an externally provisioned database (i.e. `services.invidious.database.createLocally == false`) should adjust their configuration accordingly. The old `kemal` user will not be removed automatically even when the database is provisioned automatically.(https://github.com/NixOS/nixpkgs/pull/265857)
+- `services.invidious.settings.db.user`, the default database username, has changed from `kemal` to `invidious`. Setups involving an externally-provisioned database (i.e. `services.invidious.database.createLocally == false`) should adjust their configuration accordingly. The old `kemal` user will not be removed automatically even when the database is provisioned automatically.(https://github.com/NixOS/nixpkgs/pull/265857)
 
 - `writeReferencesToFile` is deprecated in favour of the new trivial build helper `writeClosure`. The latter accepts a list of paths and has an unambiguous name and cleaner implementation.
 
 - `inetutils` now has a lower priority to avoid shadowing the commonly used `util-linux`. If one wishes to restore the default priority, simply use `lib.setPrio 5 inetutils` or override with `meta.priority = 5`.
 
-- `paperless`' `services.paperless.extraConfig` setting has been removed and converted to the freeform type and option named `services.paperless.settings`.
+- `paperless`' `services.paperless.extraConfig` setting has been removed and converted to the free-form type and option named `services.paperless.settings`.
 
-- `davfs2`' `services.davfs2.extraConfig` setting has been deprecated and converted to the freeform type option named `services.davfs2.settings` according to RFC42.
+- `davfs2`' `services.davfs2.extraConfig` setting has been deprecated and converted to the free-form type option named `services.davfs2.settings` according to RFC42.
 
-- `services.homepage-dashboard` now takes it's configuration using native Nix expressions, rather than dumping templated configurations into `/var/lib/homepage-dashboard` where they were previously managed manually. There are now new options which allow the configuration of bookmarks, services, widgets and custom CSS/JS natively in Nix.
+- `services.homepage-dashboard` now takes its configuration using native Nix expressions, rather than dumping templated configurations into `/var/lib/homepage-dashboard` where they were previously managed manually. There are now new options which allow the configuration of bookmarks, services, widgets and custom CSS/JS natively in Nix.
 
 - `hare` may now be cross-compiled. For that to work, however, `haredoc` needed to stop being built together with it. Thus, the latter is now its own package with the name of `haredoc`.
 
-- The legacy and long deprecated systemd target `network-interfaces.target` has been removed. Use `network.target` instead.
+- `network-interfaces.target` system target was removed as it has been deprecated for a long time. Use `network.target` instead.
 
 - `azure-cli` now has extension support. For example, to install the `aks-preview` extension, use
 
@@ -341,6 +351,9 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - Ada packages (libraries and tools) have been moved into the `gnatPackages` scope. `gnatPackages` uses the default GNAT compiler, `gnat12Packages` and `gnat13Packages` use the respective matching compiler version.
 
+- Paths provided as `restartTriggers` and `reloadTriggers` for systemd units will now be copied into the nix store to make the behavior consistent.
+  Previously, `restartTriggers = [ ./config.txt ]`, if defined in a flake, would trigger a restart when any part of the flake changed; and if not defined in a flake, would never trigger a restart even if the contents of `config.txt` changed.
+
 - `spark2014` has been renamed to `gnatprove`. A version of `gnatprove` matching different GNAT versions is available from the different `gnatPackages` sets.
 
 - `services.resolved.fallbackDns` can now be used to disable the upstream fallback servers entirely by setting it to an empty list. To get the previous behaviour of the upstream defaults set it to null, the new default, instead.
@@ -388,7 +401,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   upgrade NetBox by changing `services.netbox.package`. Database migrations
   will be run automatically.
 
-- The executable file names for `firefox-devedition`, `firefox-beta`, `firefox-esr` now matches their package names, which is consistent with the `firefox-*-bin` packages. The desktop entries are also updated so that you can have multiple editions of firefox in your app launcher.
+- `firefox-devedition`, `firefox-beta`, `firefox-esr` executable file names for now match their package names, which is consistent with the `firefox-*-bin` packages. The desktop entries are also updated so that you can have multiple editions of firefox in your app launcher.
 
 - switch-to-configuration does not directly call systemd-tmpfiles anymore.
   Instead, the new artificial sysinit-reactivation.target is introduced which
@@ -459,14 +472,14 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `addDriverRunpath` has been added to facilitate the deprecation of the old `addOpenGLRunpath` setuphook. This change is motivated by the evolution of the setuphook to include all hardware acceleration.
 
-- Cinnamon has been updated to 6.0. Please beware that the [Wayland session](https://blog.linuxmint.com/?p=4591) is still experimental in this release and could potentially [affect Xorg sessions](https://blog.linuxmint.com/?p=4639). We suggest a reboot when switching between sessions.
+- (TODO awaiting feedback on code-casing package names) Cinnamon has been updated to 6.0. Please beware that the [Wayland session](https://blog.linuxmint.com/?p=4591) is still experimental in this release and could potentially [affect Xorg sessions](https://blog.linuxmint.com/?p=4639). We suggest a reboot when switching between sessions.
 
-- MATE has been updated to 1.28.
+- (TODO awaiting feedback on code-casing package names) MATE has been updated to 1.28.
   - To properly support panel plugins built with Wayland (in-process) support, we are introducing `services.xserver.desktopManager.mate.extraPanelApplets` option, please use that for installing panel applets.
   - Similarly, please use `services.xserver.desktopManager.mate.extraCajaExtensions` option for installing Caja extensions.
   - To use the Wayland session, enable `services.xserver.desktopManager.mate.enableWaylandSession`. This is opt-in for now as it is in early stage and introduces a new set of Wayfire closure. Due to [known issues with LightDM](https://github.com/canonical/lightdm/issues/63), we suggest using SDDM for display manager.
 
-- The Budgie module installs gnome-terminal by default (instead of mate-terminal).
+- The (TODO awaiting feedback on code-casing package names) Budgie module installs gnome-terminal by default (instead of mate-terminal).
 
 - New `boot.loader.systemd-boot.xbootldrMountPoint` allows setting up a separate [XBOOTLDR partition](https://uapi-group.org/specifications/specs/boot_loader_specification/) to store boot files. Useful on systems with a small EFI System partition that cannot be easily repartitioned.
 
@@ -478,7 +491,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - The Matrix homeserver [Synapse](https://element-hq.github.io/synapse/) module now supports configuring UNIX domain socket [listeners](#opt-services.matrix-synapse.settings.listeners) through the `path` option.
   The default replication worker on the main instance has been migrated away from TCP sockets to UNIX domain sockets.
 
-- The initrd ssh daemon module got a new option to add authorized keys via a list of files using `boot.initrd.network.ssh.authorizedKeyFiles`.
+- `boot.initrd.network.ssh.authorizedKeyFiles` is a new option in the initrd ssh daemon module, for adding authorized keys via list of files.
 
 - Programs written in [Nim](https://nim-lang.org/) are built with libraries selected by lockfiles.
   The `nimPackages` and `nim2Packages` sets have been removed.
@@ -496,9 +509,9 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `libass` now uses the native CoreText backend on Darwin, which may fix subtitle rendering issues with `mpv`, `ffmpeg`, etc.
 
-- [Lilypond](https://lilypond.org/index.html) and [Denemo](https://www.denemo.org) are now compiled with Guile 3.0.
+- (TODO awaiting feedback on code-casing package names) [Lilypond](https://lilypond.org/index.html) and [Denemo](https://www.denemo.org) are now compiled with Guile 3.0.
 
-- Garage has been updated to v1.x.x. Users should read the [upstream release notes](https://git.deuxfleurs.fr/Deuxfleurs/garage/releases/tag/v1.0.0) and follow the documentation when changing over their `services.garage.package` and performing this manual upgrade.
+- (TODO awaiting feedback on code-casing package names) Garage has been updated to v1.x.x. Users should read the [upstream release notes](https://git.deuxfleurs.fr/Deuxfleurs/garage/releases/tag/v1.0.0) and follow the documentation when changing over their `services.garage.package` and performing this manual upgrade.
 
 - The EC2 image module now enables the [Amazon SSM Agent](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html) by default.
 
@@ -533,7 +546,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - New options were added to the dnsdist module to enable and configure a DNSCrypt endpoint (see `services.dnsdist.dnscrypt.enable`, etc.).
   The module can generate the DNSCrypt provider key pair, certificates and also performs their rotation automatically with no downtime.
 
-- With a bump to `sonarr` v4, existing config database files will be upgraded automatically, but note that some old apparently-working configs [might actually be corrupt and fail to upgrade cleanly](https://forums.sonarr.tv/t/sonarr-v4-released/33089).
+- `sonarr` bumped to v4. Consequently existing config database files will be upgraded automatically, but note that some old apparently-working configs [might actually be corrupt and fail to upgrade cleanly](https://forums.sonarr.tv/t/sonarr-v4-released/33089).
 
 - The Yama LSM is now enabled by default in the kernel, which prevents ptracing
   non-child processes. This means you will not be able to attach gdb to an
@@ -543,15 +556,13 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - The netbird module now allows running multiple tunnels in parallel through [`services.netbird.tunnels`](#opt-services.netbird.tunnels).
 
 - [Nginx virtual hosts](#opt-services.nginx.virtualHosts) using `forceSSL` or
-  `globalRedirect` can now have redirect codes other than 301 through
+  `globalRedirect` can now have redirect codes other than 301 through `redirectCode`.
 
 - `bacula` now allows to configure `TLS` for encrypted communication.
 
-  `redirectCode`.
-
 - `libjxl` 0.9.0 [dropped support for the butteraugli API](https://github.com/libjxl/libjxl/pull/2576). You will no longer be able to set `enableButteraugli` on `libaom`.
 
-- The source of the `mockgen` package has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).
+- `mockgen` package source has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).
 
 - `security.pam.enableSSHAgentAuth` was renamed to `security.pam.sshAgentAuth.enable` and an `authorizedKeysFiles`
   option was added, to control which `authorized_keys` files are trusted.  It defaults to the previous behaviour,
@@ -568,7 +579,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `nextcloud-setup.service` no longer changes the group of each file & directory inside `/var/lib/nextcloud/{config,data,store-apps}` if one of these directories has the wrong owner group. This was part of transitioning the group used for `/var/lib/nextcloud`, but isn't necessary anymore.
 
-- `services.kavita` now uses the freeform option `services.kavita.settings` for the application settings file.
+- `services.kavita` now uses the free-form option `services.kavita.settings` for the application settings file.
   The options `services.kavita.ipAdresses` and `services.kavita.port` now exist at `services.kavita.settings.IpAddresses`
   and `services.kavita.settings.IpAddresses`. The file at `services.kavita.tokenKeyFile` now needs to contain a secret with
   512+ bits instead of 128+ bits.
@@ -579,7 +590,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `services.soju` now has a wrapper for the `sojuctl` command, pointed at the service config file. It also has the new option `adminSocket.enable`, which creates a unix admin socket at `/run/soju/admin`.
 
-- Gitea 1.21 upgrade has several breaking changes, including:
+- `gitea` upgrade to 1.21 has several breaking changes, including:
   - Custom themes and other assets that were previously stored in `custom/public/*` now belong in `custom/public/assets/*`
   - New instances of Gitea using MySQL now ignore the `[database].CHARSET` config option and always use the `utf8mb4` charset, existing instances should migrate via the `gitea doctor convert` CLI command.
 
@@ -591,10 +602,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - The `services.networkmanager.extraConfig` was renamed to `services.networkmanager.settings` and was changed to use the ini type instead of using a multiline string.
 
-- The module `services.github-runner` has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.
+- `services.github-runner` module has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.
 
 - The `services.slskd` has been refactored to include more configuation options in
-  the freeform `services.slskd.settings` option, and some defaults (including listen ports)
+  the free-form `services.slskd.settings` option, and some defaults (including listen ports)
   have been changed to match the upstream defaults. Additionally, disk logging is now
   disabled by default, and the log rotation timer has been removed.
   The nginx virtualhost option is now of the `vhost-options` type.
diff --git a/nixos/lib/systemd-lib.nix b/nixos/lib/systemd-lib.nix
index 198a710f052dd..54ca88d4a9a0c 100644
--- a/nixos/lib/systemd-lib.nix
+++ b/nixos/lib/systemd-lib.nix
@@ -14,10 +14,12 @@ let
     elem
     filter
     filterAttrs
+    flatten
     flip
     head
     isInt
     isList
+    isPath
     length
     makeBinPath
     makeSearchPathOutput
@@ -28,6 +30,7 @@ let
     optional
     optionalAttrs
     optionalString
+    pipe
     range
     replaceStrings
     reverseList
@@ -366,9 +369,17 @@ in rec {
         // optionalAttrs (config.requisite != [])
           { Requisite = toString config.requisite; }
         // optionalAttrs (config ? restartTriggers && config.restartTriggers != [])
-          { X-Restart-Triggers = "${pkgs.writeText "X-Restart-Triggers-${name}" (toString config.restartTriggers)}"; }
+          { X-Restart-Triggers = "${pkgs.writeText "X-Restart-Triggers-${name}" (pipe config.restartTriggers [
+              flatten
+              (map (x: if isPath x then "${x}" else x))
+              toString
+            ])}"; }
         // optionalAttrs (config ? reloadTriggers && config.reloadTriggers != [])
-          { X-Reload-Triggers = "${pkgs.writeText "X-Reload-Triggers-${name}" (toString config.reloadTriggers)}"; }
+          { X-Reload-Triggers = "${pkgs.writeText "X-Reload-Triggers-${name}" (pipe config.reloadTriggers [
+              flatten
+              (map (x: if isPath x then "${x}" else x))
+              toString
+            ])}"; }
         // optionalAttrs (config.description != "") {
           Description = config.description; }
         // optionalAttrs (config.documentation != []) {
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index 2a25f8e564684..26323e14b9017 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -101,6 +101,7 @@ let
           libPath = filter (pkgs.path + "/lib");
           pkgsLibPath = filter (pkgs.path + "/pkgs/pkgs-lib");
           nixosPath = filter (pkgs.path + "/nixos");
+          NIX_ABORT_ON_WARN = warningsAreErrors;
           modules =
             "[ "
             + concatMapStringsSep " " (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 2a25561047316..511d991e919cd 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1012,6 +1012,7 @@
   ./services/networking/icecream/daemon.nix
   ./services/networking/icecream/scheduler.nix
   ./services/networking/imaginary.nix
+  ./services/networking/inadyn.nix
   ./services/networking/inspircd.nix
   ./services/networking/iodine.nix
   ./services/networking/iperf3.nix
@@ -1070,6 +1071,7 @@
   ./services/networking/ndppd.nix
   ./services/networking/nebula.nix
   ./services/networking/netbird.nix
+  ./services/networking/netbird/server.nix
   ./services/networking/netclient.nix
   ./services/networking/networkd-dispatcher.nix
   ./services/networking/networkmanager.nix
@@ -1160,6 +1162,7 @@
   ./services/networking/strongswan.nix
   ./services/networking/stubby.nix
   ./services/networking/stunnel.nix
+  ./services/networking/sunshine.nix
   ./services/networking/supplicant.nix
   ./services/networking/supybot.nix
   ./services/networking/syncplay.nix
@@ -1223,6 +1226,7 @@
   ./services/search/elasticsearch-curator.nix
   ./services/search/elasticsearch.nix
   ./services/search/hound.nix
+  ./services/search/manticore.nix
   ./services/search/meilisearch.nix
   ./services/search/opensearch.nix
   ./services/search/qdrant.nix
@@ -1334,6 +1338,7 @@
   ./services/web-apps/dolibarr.nix
   ./services/web-apps/engelsystem.nix
   ./services/web-apps/ethercalc.nix
+  ./services/web-apps/firefly-iii.nix
   ./services/web-apps/fluidd.nix
   ./services/web-apps/freshrss.nix
   ./services/web-apps/galene.nix
diff --git a/nixos/modules/programs/fcast-receiver.nix b/nixos/modules/programs/fcast-receiver.nix
index 8da07a66e2223..2e4e6bf8b242a 100644
--- a/nixos/modules/programs/fcast-receiver.nix
+++ b/nixos/modules/programs/fcast-receiver.nix
@@ -11,11 +11,11 @@ in
   };
 
   options.programs.fcast-receiver = {
-    enable = mkEnableOption (lib.mdDoc "FCast Receiver");
+    enable = mkEnableOption "FCast Receiver";
     openFirewall = mkOption {
       type = types.bool;
       default = false;
-      description = lib.mdDoc ''
+      description = ''
         Open ports needed for the functionality of the program.
       '';
     };
diff --git a/nixos/modules/programs/fzf.nix b/nixos/modules/programs/fzf.nix
index 0e7e519f0436d..66ad7d418de68 100644
--- a/nixos/modules/programs/fzf.nix
+++ b/nixos/modules/programs/fzf.nix
@@ -15,11 +15,12 @@ in
     environment.systemPackages = lib.mkIf (cfg.keybindings || cfg.fuzzyCompletion) [ pkgs.fzf ];
 
     programs = {
-      bash.interactiveShellInit = lib.optionalString cfg.fuzzyCompletion ''
+      # load after programs.bash.enableCompletion
+      bash.promptPluginInit = lib.mkAfter (lib.optionalString cfg.fuzzyCompletion ''
         source ${pkgs.fzf}/share/fzf/completion.bash
       '' + lib.optionalString cfg.keybindings ''
         source ${pkgs.fzf}/share/fzf/key-bindings.bash
-      '';
+      '');
 
       zsh = {
         interactiveShellInit = lib.optionalString (!config.programs.zsh.ohMyZsh.enable)
diff --git a/nixos/modules/security/duosec.nix b/nixos/modules/security/duosec.nix
index 7fb75f42db1f8..e755b5f0ee534 100644
--- a/nixos/modules/security/duosec.nix
+++ b/nixos/modules/security/duosec.nix
@@ -200,7 +200,8 @@ in
       unitConfig.DefaultDependencies = false;
       script = ''
         if test -f "${cfg.secretKeyFile}"; then
-          mkdir -m 0755 -p /etc/duo
+          mkdir -p /etc/duo
+          chmod 0755 /etc/duo
 
           umask 0077
           conf="$(mktemp)"
@@ -222,7 +223,8 @@ in
       unitConfig.DefaultDependencies = false;
       script = ''
         if test -f "${cfg.secretKeyFile}"; then
-          mkdir -m 0755 -p /etc/duo
+          mkdir -p /etc/duo
+          chmod 0755 /etc/duo
 
           umask 0077
           conf="$(mktemp)"
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 4499532ace897..dfbdff7fb0113 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -7,7 +7,7 @@ let
   fpm = config.services.phpfpm.pools.roundcube;
   localDB = cfg.database.host == "localhost";
   user = cfg.database.username;
-  phpWithPspell = pkgs.php81.withExtensions ({ enabled, all }: [ all.pspell ] ++ enabled);
+  phpWithPspell = pkgs.php83.withExtensions ({ enabled, all }: [ all.pspell ] ++ enabled);
 in
 {
   options.services.roundcube = {
diff --git a/nixos/modules/services/misc/greenclip.nix b/nixos/modules/services/misc/greenclip.nix
index 9d1483a5a047a..d92cd1854877f 100644
--- a/nixos/modules/services/misc/greenclip.nix
+++ b/nixos/modules/services/misc/greenclip.nix
@@ -18,7 +18,10 @@ in {
       description = "greenclip daemon";
       wantedBy = [ "graphical-session.target" ];
       after    = [ "graphical-session.target" ];
-      serviceConfig.ExecStart = "${cfg.package}/bin/greenclip daemon";
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/greenclip daemon";
+        Restart = "always";
+      };
     };
 
     environment.systemPackages = [ cfg.package ];
diff --git a/nixos/modules/services/misc/ollama.nix b/nixos/modules/services/misc/ollama.nix
index 948c8f17f9894..c0341984aa351 100644
--- a/nixos/modules/services/misc/ollama.nix
+++ b/nixos/modules/services/misc/ollama.nix
@@ -21,6 +21,8 @@ in
         example = "/home/foo";
         description = ''
           The home directory that the ollama service is started in.
+
+          See also `services.ollama.writablePaths` and `services.ollama.sandbox`.
         '';
       };
       models = lib.mkOption {
@@ -29,6 +31,37 @@ in
         example = "/path/to/ollama/models";
         description = ''
           The directory that the ollama service will read models from and download new models to.
+
+          See also `services.ollama.writablePaths` and `services.ollama.sandbox`
+          if downloading models or other mutation of the filesystem is required.
+        '';
+      };
+      sandbox = lib.mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to enable systemd's sandboxing capabilities.
+
+          This sets [`DynamicUser`](
+          https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
+          ), which runs the server as a unique user with read-only access to most of the filesystem.
+
+          See also `services.ollama.writablePaths`.
+        '';
+      };
+      writablePaths = lib.mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        example = [ "/home/foo" "/mnt/foo" ];
+        description = ''
+          Paths that the server should have write access to.
+
+          This sets [`ReadWritePaths`](
+          https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ReadWritePaths=
+          ), which allows specified paths to be written to through the default sandboxing.
+
+          See also `services.ollama.sandbox`.
         '';
       };
       listenAddress = lib.mkOption {
@@ -59,8 +92,8 @@ in
         type = types.attrsOf types.str;
         default = { };
         example = {
-          HOME = "/tmp";
           OLLAMA_LLM_LIBRARY = "cpu";
+          HIP_VISIBLE_DEVICES = "0,1";
         };
         description = ''
           Set arbitrary environment variables for the ollama service.
@@ -87,7 +120,8 @@ in
         ExecStart = "${lib.getExe ollamaPackage} serve";
         WorkingDirectory = cfg.home;
         StateDirectory = [ "ollama" ];
-        DynamicUser = true;
+        DynamicUser = cfg.sandbox;
+        ReadWritePaths = cfg.writablePaths;
       };
     };
 
diff --git a/nixos/modules/services/networking/deconz.nix b/nixos/modules/services/networking/deconz.nix
index eaa7759d0407c..88b0ee612d871 100644
--- a/nixos/modules/services/networking/deconz.nix
+++ b/nixos/modules/services/networking/deconz.nix
@@ -95,7 +95,7 @@ in
       '';
       postStart = ''
         # Delay signalling service readiness until it's actually up.
-        while ! "${lib.getExe pkgs.curl}" -sSfl -o /dev/null "http://${cfg.listenAddress}:${toString cfg.httpPort}"; do
+        while ! "${lib.getExe pkgs.curl}" -sSfL -o /dev/null "http://${cfg.listenAddress}:${toString cfg.httpPort}"; do
             echo "Waiting for TCP port ${toString cfg.httpPort} to be open..."
             sleep 1
         done
diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix
index de336113843ef..a5ee7efc3c324 100644
--- a/nixos/modules/services/networking/firewall-nftables.nix
+++ b/nixos/modules/services/networking/firewall-nftables.nix
@@ -45,6 +45,18 @@ in
           This option only works with the nftables based firewall.
         '';
       };
+
+      extraReversePathFilterRules = mkOption {
+        type = types.lines;
+        default = "";
+        example = "fib daddr . mark . iif type local accept";
+        description = ''
+          Additional nftables rules to be appended to the rpfilter-allow
+          chain.
+
+          This option only works with the nftables based firewall.
+        '';
+      };
     };
 
   };
@@ -79,6 +91,8 @@ in
             meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server"
             fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
 
+            jump rpfilter-allow
+
             ${optionalString cfg.logReversePathDrops ''
               log level info prefix "rpfilter drop: "
             ''}
@@ -86,6 +100,10 @@ in
           }
         ''}
 
+        chain rpfilter-allow {
+          ${cfg.extraReversePathFilterRules}
+        }
+
         chain input {
           type filter hook input priority filter; policy drop;
 
diff --git a/nixos/modules/services/networking/inadyn.nix b/nixos/modules/services/networking/inadyn.nix
new file mode 100644
index 0000000000000..baa4302096c2c
--- /dev/null
+++ b/nixos/modules/services/networking/inadyn.nix
@@ -0,0 +1,250 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.inadyn;
+
+  # check if a value of an attrset is not null or an empty collection
+  nonEmptyValue = _: v: v != null && v != [ ] && v != { };
+
+  renderOption = k: v:
+    if builtins.elem k [ "provider" "custom" ] then
+      lib.concatStringsSep "\n"
+        (mapAttrsToList
+          (name: config: ''
+            ${k} ${name} {
+                ${lib.concatStringsSep "\n    " (mapAttrsToList renderOption (filterAttrs nonEmptyValue config))}
+            }'')
+          v)
+    else if k == "include" then
+      "${k}(\"${v}\")"
+    else if k == "hostname" && builtins.isList v then
+      "${k} = { ${builtins.concatStringsSep ", " (map (s: "\"${s}\"") v)} }"
+    else if builtins.isBool v then
+      "${k} = ${boolToString v}"
+    else if builtins.isString v then
+      "${k} = \"${v}\""
+    else
+      "${k} = ${toString v}";
+
+  configFile' = pkgs.writeText "inadyn.conf"
+    ''
+      # This file was generated by nix
+      # do not edit
+
+      ${(lib.concatStringsSep "\n" (mapAttrsToList renderOption (filterAttrs nonEmptyValue cfg.settings)))}
+    '';
+
+  configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
+in
+{
+  options.services.inadyn = with types;
+    let
+      providerOptions =
+        {
+          include = mkOption {
+            default = null;
+            description = "File to include additional settings for this provider from.";
+            type = nullOr path;
+          };
+          ssl = mkOption {
+            default = true;
+            description = "Whether to use HTTPS for this DDNS provider.";
+            type = bool;
+          };
+          username = mkOption {
+            default = null;
+            description = "Username for this DDNS provider.";
+            type = nullOr str;
+          };
+          password = mkOption {
+            default = null;
+            description = ''
+              Password for this DDNS provider.
+
+              WARNING: This will be world-readable in the nix store.
+              To store credentials securely, use the `include` or `configFile` options.
+            '';
+            type = nullOr str;
+          };
+          hostname = mkOption {
+            default = "*";
+            example = "your.cool-domain.com";
+            description = "Hostname alias(es).";
+            type = either str (listOf str);
+          };
+        };
+    in
+    {
+      enable = mkEnableOption (''
+        synchronise your machine's IP address with a dynamic DNS provider using inadyn
+      '');
+      user = mkOption {
+        default = "inadyn";
+        type = types.str;
+        description = ''
+          User account under which inadyn runs.
+
+          ::: {.note}
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the inadyn service starts.
+          :::
+        '';
+      };
+      group = mkOption {
+        default = "inadyn";
+        type = types.str;
+        description = ''
+          Group account under which inadyn runs.
+
+          ::: {.note}
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the inadyn service starts.
+          :::
+        '';
+      };
+      interval = mkOption {
+        default = "*-*-* *:*:00";
+        description = ''
+          How often to check the current IP.
+          Uses the format described in {manpage}`systemd.time(7)`";
+        '';
+        type = str;
+      };
+      logLevel = lib.mkOption {
+        type = lib.types.enum [ "none" "err" "warning" "info" "notice" "debug" ];
+        default = "notice";
+        description = "Set inadyn's log level.";
+      };
+      settings = mkOption {
+        default = { };
+        description = "See `inadyn.conf (5)`";
+        type = submodule {
+          freeformType = attrs;
+          options = {
+            allow-ipv6 = mkOption {
+              default = config.networking.enableIPv6;
+              defaultText = "`config.networking.enableIPv6`";
+              description = "Whether to get IPv6 addresses from interfaces.";
+              type = bool;
+            };
+            forced-update = mkOption {
+              default = 2592000;
+              description = "Duration (in seconds) after which an update is forced.";
+              type = ints.positive;
+            };
+            provider = mkOption {
+              default = { };
+              description = ''
+                Settings for DDNS providers built-in to inadyn.
+
+                For a list of built-in providers, see `inadyn.conf (5)`.
+              '';
+              type = attrsOf (submodule {
+                freeformType = attrs;
+                options = providerOptions;
+              });
+            };
+            custom = mkOption {
+              default = { };
+              description = ''
+                Settings for custom DNS providers.
+              '';
+              type = attrsOf (submodule {
+                freeformType = attrs;
+                options = providerOptions // {
+                  ddns-server = mkOption {
+                    description = "DDNS server name.";
+                    type = str;
+                  };
+                  ddns-path = mkOption {
+                    description = ''
+                      DDNS server path.
+
+                      See `inadnyn.conf (5)` for a list for format specifiers that can be used.
+                    '';
+                    example = "/update?user=%u&password=%p&domain=%h&myip=%i";
+                    type = str;
+                  };
+                };
+              });
+            };
+          };
+        };
+      };
+      configFile = mkOption {
+        default = null;
+        description = ''
+          Configuration file for inadyn.
+
+          Setting this will override all other configuration options.
+
+          Passed to the inadyn service using LoadCredential.
+        '';
+        type = nullOr path;
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    systemd = {
+      services.inadyn = {
+        description = "Update nameservers using inadyn";
+        documentation = [
+          "man:inadyn"
+          "man:inadyn.conf"
+          "file:${pkgs.inadyn}/share/doc/inadyn/README.md"
+        ];
+        requires = [ "network-online.target" ];
+        wantedBy = [ "multi-user.target" ];
+        startAt = cfg.interval;
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = ''${lib.getExe pkgs.inadyn} -f ${configFile} --cache-dir ''${CACHE_DIRECTORY}/inadyn -1 --foreground -l ${cfg.logLevel}'';
+          LoadCredential = "config:${configFile}";
+          CacheDirectory = "inadyn";
+
+          User = cfg.user;
+          Group = cfg.group;
+          UMask = "0177";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK";
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectSystem = "strict";
+          ProtectProc = "invisible";
+          ProtectHome = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallErrorNumber = "EPERM";
+          SystemCallFilter = "@system-service";
+          CapabilityBoundingSet = "";
+        };
+      };
+
+      timers.inadyn.timerConfig.Persistent = true;
+    };
+
+    users.users.inadyn = mkIf (cfg.user == "inadyn") {
+      group = cfg.group;
+      isSystemUser = true;
+    };
+
+    users.groups = mkIf (cfg.group == "inadyn") {
+      inadyn = { };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/netbird/coturn.nix b/nixos/modules/services/networking/netbird/coturn.nix
new file mode 100644
index 0000000000000..dd032abb2d75e
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/coturn.nix
@@ -0,0 +1,160 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe
+    literalExpression
+    mkAfter
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    optionalAttrs
+    optionalString
+    ;
+
+  inherit (lib.types)
+    bool
+    listOf
+    nullOr
+    path
+    port
+    str
+    ;
+
+  cfg = config.services.netbird.server.coturn;
+in
+
+{
+  options.services.netbird.server.coturn = {
+    enable = mkEnableOption "a Coturn server for Netbird, will also open the firewall on the configured range";
+
+    useAcmeCertificates = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to use ACME certificates corresponding to the given domain for the server.
+      '';
+    };
+
+    domain = mkOption {
+      type = str;
+      description = "The domain under which the coturn server runs.";
+    };
+
+    user = mkOption {
+      type = str;
+      default = "netbird";
+      description = ''
+        The username used by netbird to connect to the coturn server.
+      '';
+    };
+
+    password = mkOption {
+      type = nullOr str;
+      default = null;
+      description = ''
+        The password of the user used by netbird to connect to the coturn server.
+      '';
+    };
+
+    passwordFile = mkOption {
+      type = nullOr path;
+      default = null;
+      description = ''
+        The path to a file containing the password of the user used by netbird to connect to the coturn server.
+      '';
+    };
+
+    openPorts = mkOption {
+      type = listOf port;
+      default = with config.services.coturn; [
+        listening-port
+        alt-listening-port
+        tls-listening-port
+        alt-tls-listening-port
+      ];
+      defaultText = literalExpression ''
+        with config.services.coturn; [
+          listening-port
+          alt-listening-port
+          tls-listening-port
+          alt-tls-listening-port
+        ];
+      '';
+
+      description = ''
+        The list of ports used by coturn for listening to open in the firewall.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = (cfg.password == null) != (cfg.passwordFile == null);
+          message = "Exactly one of `password` or `passwordFile` must be given for the coturn setup.";
+        }
+      ];
+
+      services.coturn =
+        {
+          enable = true;
+
+          realm = cfg.domain;
+          lt-cred-mech = true;
+          no-cli = true;
+
+          extraConfig = ''
+            fingerprint
+            user=${cfg.user}:${if cfg.password != null then cfg.password else "@password@"}
+            no-software-attribute
+          '';
+        }
+        // (optionalAttrs cfg.useAcmeCertificates {
+          cert = "@cert@";
+          pkey = "@pkey@";
+        });
+
+      systemd.services.coturn =
+        let
+          dir = config.security.acme.certs.${cfg.domain}.directory;
+          preStart' =
+            (optionalString (cfg.passwordFile != null) ''
+              ${getExe pkgs.replace-secret} @password@ ${cfg.passwordFile} /run/coturn/turnserver.cfg
+            '')
+            + (optionalString cfg.useAcmeCertificates ''
+              ${getExe pkgs.replace-secret} @cert@ "$CREDENTIALS_DIRECTORY/cert.pem" /run/coturn/turnserver.cfg
+              ${getExe pkgs.replace-secret} @pkey@ "$CREDENTIALS_DIRECTORY/pkey.pem" /run/coturn/turnserver.cfg
+            '');
+        in
+        (optionalAttrs (preStart' != "") { preStart = mkAfter preStart'; })
+        // (optionalAttrs cfg.useAcmeCertificates {
+          serviceConfig.LoadCredential = [
+            "cert.pem:${dir}/fullchain.pem"
+            "pkey.pem:${dir}/key.pem"
+          ];
+        });
+
+      security.acme.certs.${cfg.domain}.postRun = optionalString cfg.useAcmeCertificates "systemctl restart coturn.service";
+
+      networking.firewall = {
+        allowedUDPPorts = cfg.openPorts;
+        allowedTCPPorts = cfg.openPorts;
+
+        allowedUDPPortRanges = [
+          {
+            from = cfg.minPort;
+            to = cfg.maxPort;
+          }
+        ];
+      };
+    }
+  ]);
+}
diff --git a/nixos/modules/services/networking/netbird/dashboard.nix b/nixos/modules/services/networking/netbird/dashboard.nix
new file mode 100644
index 0000000000000..6fc3086155900
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/dashboard.nix
@@ -0,0 +1,186 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    boolToString
+    concatStringsSep
+    hasAttr
+    isBool
+    mapAttrs
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    ;
+
+  inherit (lib.types)
+    attrsOf
+    bool
+    either
+    package
+    str
+    submodule
+    ;
+
+  toStringEnv = value: if isBool value then boolToString value else toString value;
+
+  cfg = config.services.netbird.server.dashboard;
+in
+
+{
+  options.services.netbird.server.dashboard = {
+    enable = mkEnableOption "the static netbird dashboard frontend";
+
+    package = mkPackageOption pkgs "netbird-dashboard" { };
+
+    enableNginx = mkEnableOption "Nginx reverse-proxy to serve the dashboard.";
+
+    domain = mkOption {
+      type = str;
+      default = "localhost";
+      description = "The domain under which the dashboard runs.";
+    };
+
+    managementServer = mkOption {
+      type = str;
+      description = "The address of the management server, used for the API endpoints.";
+    };
+
+    settings = mkOption {
+      type = submodule { freeformType = attrsOf (either str bool); };
+
+      defaultText = ''
+        {
+          AUTH_AUDIENCE = "netbird";
+          AUTH_CLIENT_ID = "netbird";
+          AUTH_SUPPORTED_SCOPES = "openid profile email";
+          NETBIRD_TOKEN_SOURCE = "idToken";
+          USE_AUTH0 = false;
+        }
+      '';
+
+      description = ''
+        An attribute set that will be used to substitute variables when building the dashboard.
+        Any values set here will be templated into the frontend and be public for anyone that can reach your website.
+        The exact values sadly aren't documented anywhere.
+        A starting point when searching for valid values is this [script](https://github.com/netbirdio/dashboard/blob/main/docker/init_react_envs.sh)
+        The only mandatory value is 'AUTH_AUTHORITY' as we cannot set a default value here.
+      '';
+    };
+
+    finalDrv = mkOption {
+      readOnly = true;
+      type = package;
+      description = ''
+        The derivation containing the final templated dashboard.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = hasAttr "AUTH_AUTHORITY" cfg.settings;
+        message = "The setting AUTH_AUTHORITY is required for the dasboard to function.";
+      }
+    ];
+
+    services.netbird.server.dashboard = {
+      settings =
+        {
+          # Due to how the backend and frontend work this secret will be templated into the backend
+          # and then served statically from your website
+          # This enables you to login without the normally needed indirection through the backend
+          # but this also means anyone that can reach your website can
+          # fetch this secret, which is why there is no real need to put it into
+          # special options as its public anyway
+          # As far as I know leaking this secret is just
+          # an information leak as one can fetch some basic app
+          # informations from the IDP
+          # To actually do something one still needs to have login
+          # data and this secret so this being public will not
+          # suffice for anything just decreasing security
+          AUTH_CLIENT_SECRET = "";
+
+          NETBIRD_MGMT_API_ENDPOINT = cfg.managementServer;
+          NETBIRD_MGMT_GRPC_API_ENDPOINT = cfg.managementServer;
+        }
+        // (mapAttrs (_: mkDefault) {
+          # Those values have to be easily overridable
+          AUTH_AUDIENCE = "netbird"; # must be set for your devices to be able to log in
+          AUTH_CLIENT_ID = "netbird";
+          AUTH_SUPPORTED_SCOPES = "openid profile email";
+          NETBIRD_TOKEN_SOURCE = "idToken";
+          USE_AUTH0 = false;
+        });
+
+      # The derivation containing the templated dashboard
+      finalDrv =
+        pkgs.runCommand "netbird-dashboard"
+          {
+            nativeBuildInputs = [ pkgs.gettext ];
+            env = {
+              ENV_STR = concatStringsSep " " [
+                "$AUTH_AUDIENCE"
+                "$AUTH_AUTHORITY"
+                "$AUTH_CLIENT_ID"
+                "$AUTH_CLIENT_SECRET"
+                "$AUTH_REDIRECT_URI"
+                "$AUTH_SILENT_REDIRECT_URI"
+                "$AUTH_SUPPORTED_SCOPES"
+                "$NETBIRD_DRAG_QUERY_PARAMS"
+                "$NETBIRD_GOOGLE_ANALYTICS_ID"
+                "$NETBIRD_HOTJAR_TRACK_ID"
+                "$NETBIRD_MGMT_API_ENDPOINT"
+                "$NETBIRD_MGMT_GRPC_API_ENDPOINT"
+                "$NETBIRD_TOKEN_SOURCE"
+                "$USE_AUTH0"
+              ];
+            } // (mapAttrs (_: toStringEnv) cfg.settings);
+          }
+          ''
+            cp -R ${cfg.package} build
+
+            find build -type d -exec chmod 755 {} \;
+            OIDC_TRUSTED_DOMAINS="build/OidcTrustedDomains.js"
+
+            envsubst "$ENV_STR" < "$OIDC_TRUSTED_DOMAINS.tmpl" > "$OIDC_TRUSTED_DOMAINS"
+
+            for f in $(grep -R -l AUTH_SUPPORTED_SCOPES build/); do
+              mv "$f" "$f.copy"
+              envsubst "$ENV_STR" < "$f.copy" > "$f"
+              rm "$f.copy"
+            done
+
+            cp -R build $out
+          '';
+    };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        locations = {
+          "/" = {
+            root = cfg.finalDrv;
+            tryFiles = "$uri $uri.html $uri/ =404";
+          };
+
+          "/404.html".extraConfig = ''
+            internal;
+          '';
+        };
+
+        extraConfig = ''
+          error_page 404 /404.html;
+        '';
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/netbird/management.nix b/nixos/modules/services/networking/netbird/management.nix
new file mode 100644
index 0000000000000..52f033959143c
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/management.nix
@@ -0,0 +1,460 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  inherit (lib)
+    any
+    concatMap
+    getExe'
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optional
+    recursiveUpdate
+    ;
+
+  inherit (lib.types)
+    bool
+    enum
+    listOf
+    port
+    str
+    ;
+
+  inherit (utils) escapeSystemdExecArgs genJqSecretsReplacementSnippet;
+
+  stateDir = "/var/lib/netbird-mgmt";
+
+  settingsFormat = pkgs.formats.json { };
+
+  defaultSettings = {
+    Stuns = [
+      {
+        Proto = "udp";
+        URI = "stun:${cfg.turnDomain}:3478";
+        Username = "";
+        Password = null;
+      }
+    ];
+
+    TURNConfig = {
+      Turns = [
+        {
+          Proto = "udp";
+          URI = "turn:${cfg.turnDomain}:${builtins.toString cfg.turnPort}";
+          Username = "netbird";
+          Password = "netbird";
+        }
+      ];
+
+      CredentialsTTL = "12h";
+      Secret = "not-secure-secret";
+      TimeBasedCredentials = false;
+    };
+
+    Signal = {
+      Proto = "https";
+      URI = "${cfg.domain}:443";
+      Username = "";
+      Password = null;
+    };
+
+    ReverseProxy = {
+      TrustedHTTPProxies = [ ];
+      TrustedHTTPProxiesCount = 0;
+      TrustedPeers = [ "0.0.0.0/0" ];
+    };
+
+    Datadir = "${stateDir}/data";
+    DataStoreEncryptionKey = "very-insecure-key";
+    StoreConfig = {
+      Engine = "sqlite";
+    };
+
+    HttpConfig = {
+      Address = "127.0.0.1:${builtins.toString cfg.port}";
+      IdpSignKeyRefreshEnabled = true;
+      OIDCConfigEndpoint = cfg.oidcConfigEndpoint;
+    };
+
+    IdpManagerConfig = {
+      ManagerType = "none";
+      ClientConfig = {
+        Issuer = "";
+        TokenEndpoint = "";
+        ClientID = "netbird";
+        ClientSecret = "";
+        GrantType = "client_credentials";
+      };
+
+      ExtraConfig = { };
+      Auth0ClientCredentials = null;
+      AzureClientCredentials = null;
+      KeycloakClientCredentials = null;
+      ZitadelClientCredentials = null;
+    };
+
+    DeviceAuthorizationFlow = {
+      Provider = "none";
+      ProviderConfig = {
+        Audience = "netbird";
+        Domain = null;
+        ClientID = "netbird";
+        TokenEndpoint = null;
+        DeviceAuthEndpoint = "";
+        Scope = "openid profile email";
+        UseIDToken = false;
+      };
+    };
+
+    PKCEAuthorizationFlow = {
+      ProviderConfig = {
+        Audience = "netbird";
+        ClientID = "netbird";
+        ClientSecret = "";
+        AuthorizationEndpoint = "";
+        TokenEndpoint = "";
+        Scope = "openid profile email";
+        RedirectURLs = [ "http://localhost:53000" ];
+        UseIDToken = false;
+      };
+    };
+  };
+
+  managementConfig = recursiveUpdate defaultSettings cfg.settings;
+
+  managementFile = settingsFormat.generate "config.json" managementConfig;
+
+  cfg = config.services.netbird.server.management;
+in
+
+{
+  options.services.netbird.server.management = {
+    enable = mkEnableOption "Netbird Management Service.";
+
+    package = mkPackageOption pkgs "netbird" { };
+
+    domain = mkOption {
+      type = str;
+      description = "The domain under which the management API runs.";
+    };
+
+    turnDomain = mkOption {
+      type = str;
+      description = "The domain of the TURN server to use.";
+    };
+
+    turnPort = mkOption {
+      type = port;
+      default = 3478;
+      description = ''
+        The port of the TURN server to use.
+      '';
+    };
+
+    dnsDomain = mkOption {
+      type = str;
+      default = "netbird.selfhosted";
+      description = "Domain used for peer resolution.";
+    };
+
+    singleAccountModeDomain = mkOption {
+      type = str;
+      default = "netbird.selfhosted";
+      description = ''
+        Enables single account mode.
+        This means that all the users will be under the same account grouped by the specified domain.
+        If the installation has more than one account, the property is ineffective.
+      '';
+    };
+
+    disableAnonymousMetrics = mkOption {
+      type = bool;
+      default = true;
+      description = "Disables push of anonymous usage metrics to NetBird.";
+    };
+
+    disableSingleAccountMode = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        If set to true, disables single account mode.
+        The `singleAccountModeDomain` property will be ignored and every new user will have a separate NetBird account.
+      '';
+    };
+
+    port = mkOption {
+      type = port;
+      default = 8011;
+      description = "Internal port of the management server.";
+    };
+
+    extraOptions = mkOption {
+      type = listOf str;
+      default = [ ];
+      description = ''
+        Additional options given to netbird-mgmt as commandline arguments.
+      '';
+    };
+
+    oidcConfigEndpoint = mkOption {
+      type = str;
+      description = "The oidc discovery endpoint.";
+      example = "https://example.eu.auth0.com/.well-known/openid-configuration";
+    };
+
+    settings = mkOption {
+      inherit (settingsFormat) type;
+
+      defaultText = literalExpression ''
+        defaultSettings = {
+          Stuns = [
+            {
+              Proto = "udp";
+              URI = "stun:''${cfg.turnDomain}:3478";
+              Username = "";
+              Password = null;
+            }
+          ];
+
+          TURNConfig = {
+            Turns = [
+              {
+                Proto = "udp";
+                URI = "turn:''${cfg.turnDomain}:3478";
+                Username = "netbird";
+                Password = "netbird";
+              }
+            ];
+
+            CredentialsTTL = "12h";
+            Secret = "not-secure-secret";
+            TimeBasedCredentials = false;
+          };
+
+          Signal = {
+            Proto = "https";
+            URI = "''${cfg.domain}:443";
+            Username = "";
+            Password = null;
+          };
+
+          ReverseProxy = {
+            TrustedHTTPProxies = [ ];
+            TrustedHTTPProxiesCount = 0;
+            TrustedPeers = [ "0.0.0.0/0" ];
+          };
+
+          Datadir = "''${stateDir}/data";
+          DataStoreEncryptionKey = "genEVP6j/Yp2EeVujm0zgqXrRos29dQkpvX0hHdEUlQ=";
+          StoreConfig = { Engine = "sqlite"; };
+
+          HttpConfig = {
+            Address = "127.0.0.1:''${builtins.toString cfg.port}";
+            IdpSignKeyRefreshEnabled = true;
+            OIDCConfigEndpoint = cfg.oidcConfigEndpoint;
+          };
+
+          IdpManagerConfig = {
+            ManagerType = "none";
+            ClientConfig = {
+              Issuer = "";
+              TokenEndpoint = "";
+              ClientID = "netbird";
+              ClientSecret = "";
+              GrantType = "client_credentials";
+            };
+
+            ExtraConfig = { };
+            Auth0ClientCredentials = null;
+            AzureClientCredentials = null;
+            KeycloakClientCredentials = null;
+            ZitadelClientCredentials = null;
+          };
+
+          DeviceAuthorizationFlow = {
+            Provider = "none";
+            ProviderConfig = {
+              Audience = "netbird";
+              Domain = null;
+              ClientID = "netbird";
+              TokenEndpoint = null;
+              DeviceAuthEndpoint = "";
+              Scope = "openid profile email offline_access api";
+              UseIDToken = false;
+            };
+          };
+
+          PKCEAuthorizationFlow = {
+            ProviderConfig = {
+              Audience = "netbird";
+              ClientID = "netbird";
+              ClientSecret = "";
+              AuthorizationEndpoint = "";
+              TokenEndpoint = "";
+              Scope = "openid profile email offline_access api";
+              RedirectURLs = "http://localhost:53000";
+              UseIDToken = false;
+            };
+          };
+        };
+      '';
+
+      default = { };
+
+      description = ''
+        Configuration of the netbird management server.
+        Options containing secret data should be set to an attribute set containing the attribute _secret
+        - a string pointing to a file containing the value the option should be set to.
+        See the example to get a better picture of this: in the resulting management.json file,
+        the `DataStoreEncryptionKey` key will be set to the contents of the /run/agenix/netbird_mgmt-data_store_encryption_key file.
+      '';
+
+      example = {
+        DataStoreEncryptionKey = {
+          _secret = "/run/agenix/netbird_mgmt-data_store_encryption_key";
+        };
+      };
+    };
+
+    logLevel = mkOption {
+      type = enum [
+        "ERROR"
+        "WARN"
+        "INFO"
+        "DEBUG"
+      ];
+      default = "INFO";
+      description = "Log level of the netbird services.";
+    };
+
+    enableNginx = mkEnableOption "Nginx reverse-proxy for the netbird management service.";
+  };
+
+  config = mkIf cfg.enable {
+    warnings =
+      concatMap
+        (
+          { check, name }:
+          optional check "${name} is world-readable in the Nix Store, you should provide it as a _secret."
+        )
+        [
+          {
+            check = builtins.isString managementConfig.TURNConfig.Secret;
+            name = "The TURNConfig.secret";
+          }
+          {
+            check = builtins.isString managementConfig.DataStoreEncryptionKey;
+            name = "The DataStoreEncryptionKey";
+          }
+          {
+            check = any (T: (T ? Password) && builtins.isString T.Password) managementConfig.TURNConfig.Turns;
+            name = "A Turn configuration's password";
+          }
+        ];
+
+    systemd.services.netbird-management = {
+      description = "The management server for Netbird, a wireguard VPN";
+      documentation = [ "https://netbird.io/docs/" ];
+
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ managementFile ];
+
+      preStart = genJqSecretsReplacementSnippet managementConfig "${stateDir}/management.json";
+
+      serviceConfig = {
+        ExecStart = escapeSystemdExecArgs (
+          [
+            (getExe' cfg.package "netbird-mgmt")
+            "management"
+            # Config file
+            "--config"
+            "${stateDir}/management.json"
+            # Data directory
+            "--datadir"
+            "${stateDir}/data"
+            # DNS domain
+            "--dns-domain"
+            cfg.dnsDomain
+            # Port to listen on
+            "--port"
+            cfg.port
+            # Log to stdout
+            "--log-file"
+            "console"
+            # Log level
+            "--log-level"
+            cfg.logLevel
+            #
+            "--idp-sign-key-refresh-enabled"
+            # Domain for internal resolution
+            "--single-account-mode-domain"
+            cfg.singleAccountModeDomain
+          ]
+          ++ (optional cfg.disableAnonymousMetrics "--disable-anonymous-metrics")
+          ++ (optional cfg.disableSingleAccountMode "--disable-single-account-mode")
+          ++ cfg.extraOptions
+        );
+        Restart = "always";
+        RuntimeDirectory = "netbird-mgmt";
+        StateDirectory = [
+          "netbird-mgmt"
+          "netbird-mgmt/data"
+        ];
+        WorkingDirectory = stateDir;
+
+        # hardening
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+
+      stopIfChanged = false;
+    };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        locations = {
+          "/api".proxyPass = "http://localhost:${builtins.toString cfg.port}";
+
+          "/management.ManagementService/".extraConfig = ''
+            # This is necessary so that grpc connections do not get closed early
+            # see https://stackoverflow.com/a/67805465
+            client_body_timeout 1d;
+
+            grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+            grpc_pass grpc://localhost:${builtins.toString cfg.port};
+            grpc_read_timeout 1d;
+            grpc_send_timeout 1d;
+            grpc_socket_keepalive on;
+          '';
+        };
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/netbird/server.md b/nixos/modules/services/networking/netbird/server.md
new file mode 100644
index 0000000000000..3649e97b379e5
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/server.md
@@ -0,0 +1,42 @@
+# Netbird server {#module-services-netbird-server}
+
+NetBird is a VPN built on top of WireGuard® making it easy to create secure private networks for your organization or home.
+
+## Quickstart {#module-services-netbird-server-quickstart}
+
+To fully setup Netbird as a self-hosted server, we need both a Coturn server and an identity provider, the list of supported SSOs and their setup are available [on Netbird's documentation](https://docs.netbird.io/selfhosted/selfhosted-guide#step-3-configure-identity-provider-idp).
+
+There are quite a few settings that need to be passed to Netbird for it to function, and a minimal config looks like :
+
+```nix
+services.netbird.server = {
+  enable = true;
+
+  domain = "netbird.example.selfhosted";
+
+  enableNginx = true;
+
+  coturn = {
+    enable = true;
+
+    passwordFile = "/path/to/a/secret/password";
+  };
+
+  management = {
+    oidcConfigEndpoint = "https://sso.example.selfhosted/oauth2/openid/netbird/.well-known/openid-configuration";
+
+    settings = {
+      TURNConfig = {
+        Turns = [
+          {
+            Proto = "udp";
+            URI = "turn:netbird.example.selfhosted:3478";
+            Username = "netbird";
+            Password._secret = "/path/to/a/secret/password";
+          }
+        ];
+      };
+    };
+  };
+};
+```
diff --git a/nixos/modules/services/networking/netbird/server.nix b/nixos/modules/services/networking/netbird/server.nix
new file mode 100644
index 0000000000000..a4de0fda6a134
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/server.nix
@@ -0,0 +1,67 @@
+{ config, lib, ... }:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    optionalAttrs
+    ;
+
+  inherit (lib.types) str;
+
+  cfg = config.services.netbird.server;
+in
+
+{
+  meta = {
+    maintainers = with lib.maintainers; [ thubrecht ];
+    doc = ./server.md;
+  };
+
+  # Import the separate components
+  imports = [
+    ./coturn.nix
+    ./dashboard.nix
+    ./management.nix
+    ./signal.nix
+  ];
+
+  options.services.netbird.server = {
+    enable = mkEnableOption "Netbird Server stack, comprising the dashboard, management API and signal service";
+
+    enableNginx = mkEnableOption "Nginx reverse-proxy for the netbird server services.";
+
+    domain = mkOption {
+      type = str;
+      description = "The domain under which the netbird server runs.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.netbird.server = {
+      dashboard = {
+        inherit (cfg) enable domain enableNginx;
+
+        managementServer = "https://${cfg.domain}";
+      };
+
+      management =
+        {
+          inherit (cfg) enable domain enableNginx;
+        }
+        // (optionalAttrs cfg.coturn.enable {
+          turnDomain = cfg.domain;
+          turnPort = config.services.coturn.tls-listening-port;
+        });
+
+      signal = {
+        inherit (cfg) enable domain enableNginx;
+      };
+
+      coturn = {
+        inherit (cfg) domain;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/netbird/signal.nix b/nixos/modules/services/networking/netbird/signal.nix
new file mode 100644
index 0000000000000..8408d20e874b5
--- /dev/null
+++ b/nixos/modules/services/networking/netbird/signal.nix
@@ -0,0 +1,123 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe'
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    mkOption
+    ;
+
+  inherit (lib.types) enum port str;
+
+  inherit (utils) escapeSystemdExecArgs;
+
+  cfg = config.services.netbird.server.signal;
+in
+
+{
+  options.services.netbird.server.signal = {
+    enable = mkEnableOption "Netbird's Signal Service";
+
+    package = mkPackageOption pkgs "netbird" { };
+
+    enableNginx = mkEnableOption "Nginx reverse-proxy for the netbird signal service.";
+
+    domain = mkOption {
+      type = str;
+      description = "The domain name for the signal service.";
+    };
+
+    port = mkOption {
+      type = port;
+      default = 8012;
+      description = "Internal port of the signal server.";
+    };
+
+    logLevel = mkOption {
+      type = enum [
+        "ERROR"
+        "WARN"
+        "INFO"
+        "DEBUG"
+      ];
+      default = "INFO";
+      description = "Log level of the netbird signal service.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.netbird-signal = {
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = escapeSystemdExecArgs [
+          (getExe' cfg.package "netbird-signal")
+          "run"
+          # Port to listen on
+          "--port"
+          cfg.port
+          # Log to stdout
+          "--log-file"
+          "console"
+          # Log level
+          "--log-level"
+          cfg.logLevel
+        ];
+
+        Restart = "always";
+        RuntimeDirectory = "netbird-mgmt";
+        StateDirectory = "netbird-mgmt";
+        WorkingDirectory = "/var/lib/netbird-mgmt";
+
+        # hardening
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+
+      stopIfChanged = false;
+    };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        locations."/signalexchange.SignalExchange/".extraConfig = ''
+          # This is necessary so that grpc connections do not get closed early
+          # see https://stackoverflow.com/a/67805465
+          client_body_timeout 1d;
+
+          grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+          grpc_pass grpc://localhost:${builtins.toString cfg.port};
+          grpc_read_timeout 1d;
+          grpc_send_timeout 1d;
+          grpc_socket_keepalive on;
+        '';
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/sunshine.nix b/nixos/modules/services/networking/sunshine.nix
new file mode 100644
index 0000000000000..c115b9cd5cf99
--- /dev/null
+++ b/nixos/modules/services/networking/sunshine.nix
@@ -0,0 +1,156 @@
+{ config, lib, pkgs, utils, ... }:
+let
+  inherit (lib) mkEnableOption mkPackageOption mkOption mkIf mkDefault types optionals getExe;
+  inherit (utils) escapeSystemdExecArgs;
+  cfg = config.services.sunshine;
+
+  # ports used are offset from a single base port, see https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#port
+  generatePorts = port: offsets: map (offset: port + offset) offsets;
+  defaultPort = 47989;
+
+  appsFormat = pkgs.formats.json { };
+  settingsFormat = pkgs.formats.keyValue { };
+
+  appsFile = appsFormat.generate "apps.json" cfg.applications;
+  configFile = settingsFormat.generate "sunshine.conf" cfg.settings;
+in
+{
+  options.services.sunshine = with types; {
+    enable = mkEnableOption "Sunshine, a self-hosted game stream host for Moonlight";
+    package = mkPackageOption pkgs "sunshine" { };
+    openFirewall = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to automatically open ports in the firewall.
+      '';
+    };
+    capSysAdmin = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to give the Sunshine binary CAP_SYS_ADMIN, required for DRM/KMS screen capture.
+      '';
+    };
+    settings = mkOption {
+      default = { };
+      description = ''
+        Settings to be rendered into the configuration file. If this is set, no configuration is possible from the web UI.
+
+        See https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#configuration for syntax.
+      '';
+      example = ''
+        {
+          sunshine_name = "nixos";
+        }
+      '';
+      type = submodule (settings: {
+        freeformType = settingsFormat.type;
+        options.port = mkOption {
+          type = port;
+          default = defaultPort;
+          description = ''
+            Base port -- others used are offset from this one, see https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#port for details.
+          '';
+        };
+      });
+    };
+    applications = mkOption {
+      default = { };
+      description = ''
+        Configuration for applications to be exposed to Moonlight. If this is set, no configuration is possible from the web UI, and must be by the `settings` option.
+      '';
+      example = ''
+        {
+          env = {
+            PATH = "$(PATH):$(HOME)/.local/bin";
+          };
+          apps = [
+            {
+              name = "1440p Desktop";
+              prep-cmd = [
+                {
+                  do = "''${pkgs.kdePackages.libkscreen}/bin/kscreen-doctor output.DP-4.mode.2560x1440@144";
+                  undo = "''${pkgs.kdePackages.libkscreen}/bin/kscreen-doctor output.DP-4.mode.3440x1440@144";
+                }
+              ];
+              exclude-global-prep-cmd = "false";
+              auto-detach = "true";
+            }
+          ];
+        }
+      '';
+      type = submodule {
+        options = {
+          env = mkOption {
+            default = { };
+            description = ''
+              Environment variables to be set for the applications.
+            '';
+            type = attrsOf str;
+          };
+          apps = mkOption {
+            default = [ ];
+            description = ''
+              Applications to be exposed to Moonlight.
+            '';
+            type = listOf attrs;
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.sunshine.settings.file_apps = mkIf (cfg.applications.apps != [ ]) "${appsFile}";
+
+    environment.systemPackages = [
+      cfg.package
+    ];
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = generatePorts cfg.settings.port [ (-5) 0 1 21 ];
+      allowedUDPPorts = generatePorts cfg.settings.port [ 9 10 11 13 21 ];
+    };
+
+    boot.kernelModules = [ "uinput" ];
+
+    services.udev.packages = [ cfg.package ];
+
+    services.avahi = {
+      enable = mkDefault true;
+      publish = {
+        enable = mkDefault true;
+        userServices = mkDefault true;
+      };
+    };
+
+    security.wrappers.sunshine = mkIf cfg.capSysAdmin {
+      owner = "root";
+      group = "root";
+      capabilities = "cap_sys_admin+p";
+      source = getExe cfg.package;
+    };
+
+    systemd.user.services.sunshine = {
+      description = "Self-hosted game stream host for Moonlight";
+
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      wants = [ "graphical-session.target" ];
+      after = [ "graphical-session.target" ];
+
+      startLimitIntervalSec = 500;
+      startLimitBurst = 5;
+
+      serviceConfig = {
+        # only add configFile if an application or a setting other than the default port is set to allow configuration from web UI
+        ExecStart = escapeSystemdExecArgs ([
+          (if cfg.capSysAdmin then "${config.security.wrapperDir}/sunshine" else "${getExe cfg.package}")
+        ] ++ optionals (cfg.applications.apps != [ ] || (builtins.length (builtins.attrNames cfg.settings) > 1 || cfg.settings.port != defaultPort)) [ "${configFile}" ]);
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index c9dd1d1b0f01f..435cd530c18d4 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -124,11 +124,20 @@ let
           fi
         ''}
 
+        # ensure wpa_supplicant.conf exists, or the daemon will fail to start
+        ${optionalString cfg.allowAuxiliaryImperativeNetworks ''
+          touch /etc/wpa_supplicant.conf
+        ''}
+
         # substitute environment variables
         if [ -f "${configFile}" ]; then
           ${pkgs.gawk}/bin/awk '{
-            for(varname in ENVIRON)
-              gsub("@"varname"@", ENVIRON[varname])
+            for(varname in ENVIRON) {
+              find = "@"varname"@"
+              repl = ENVIRON[varname]
+              if (i = index($0, find))
+                $0 = substr($0, 1, i-1) repl substr($0, i+length(find))
+            }
             print
           }' "${configFile}" > "${finalConfig}"
         else
diff --git a/nixos/modules/services/search/manticore.nix b/nixos/modules/services/search/manticore.nix
new file mode 100644
index 0000000000000..a8fcd9d0b3820
--- /dev/null
+++ b/nixos/modules/services/search/manticore.nix
@@ -0,0 +1,131 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.manticore;
+  format = pkgs.formats.json { };
+
+  toSphinx = {
+    mkKeyValue    ? mkKeyValueDefault {} "=",
+    listsAsDuplicateKeys ? true
+  }: attrsOfAttrs:
+    let
+        # map function to string for each key val
+        mapAttrsToStringsSep = sep: mapFn: attrs:
+          concatStringsSep sep
+            (mapAttrsToList mapFn attrs);
+        mkSection = sectName: sectValues: ''
+          ${sectName} {
+        '' + lib.generators.toKeyValue { inherit mkKeyValue listsAsDuplicateKeys; } sectValues + ''}'';
+    in
+      # map input to ini sections
+      mapAttrsToStringsSep "\n" mkSection attrsOfAttrs;
+
+  configFile = pkgs.writeText "manticore.conf" (
+    toSphinx {
+        mkKeyValue = k: v: "  ${k} = ${v}";
+    } cfg.settings
+  );
+
+in {
+
+  options = {
+    services.manticore = {
+
+      enable = mkEnableOption "Manticoresearch";
+
+      settings = mkOption {
+        default = {
+          searchd = {
+            listen = [
+              "127.0.0.1:9312"
+              "127.0.0.1:9306:mysql"
+              "127.0.0.1:9308:http"
+            ];
+            log = "/var/log/manticore/searchd.log";
+            query_log = "/var/log/manticore/query.log";
+            pid_file = "/run/manticore/searchd.pid";
+            data_dir = "/var/lib/manticore";
+          };
+        };
+        description = ''
+          Configuration for Manticoresearch. See
+          <https://manual.manticoresearch.com/Server%20settings>
+          for more information.
+        '';
+        type = types.submodule {
+          freeformType = format.type;
+        };
+        example = literalExpression ''
+          {
+            searchd = {
+                listen = [
+                  "127.0.0.1:9312"
+                  "127.0.0.1:9306:mysql"
+                  "127.0.0.1:9308:http"
+                ];
+                log = "/var/log/manticore/searchd.log";
+                query_log = "/var/log/manticore/query.log";
+                pid_file = "/run/manticore/searchd.pid";
+                data_dir = "/var/lib/manticore";
+            };
+          }
+        '';
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd = {
+      packages = [ pkgs.manticoresearch ];
+      services.manticore = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          ExecStart = [
+            ""
+            "${pkgs.manticoresearch}/bin/searchd --config ${configFile}"
+          ];
+          ExecStop = [
+            ""
+            "${pkgs.manticoresearch}/bin/searchd --config ${configFile} --stopwait"
+          ];
+          ExecStartPre = [ "" ];
+          DynamicUser = true;
+          LogsDirectory = "manticore";
+          RuntimeDirectory = "manticore";
+          StateDirectory = "manticore";
+          ReadWritePaths = "";
+          CapabilityBoundingSet = "";
+          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [ "@system-service" "~@privileged" ];
+          RestrictRealtime = true;
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          UMask = "0066";
+          ProtectHostname = true;
+        } // lib.optionalAttrs (cfg.settings.searchd.pid_file != null) {
+          PIDFile = cfg.settings.searchd.pid_file;
+        };
+      };
+    };
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ onny ];
+
+}
diff --git a/nixos/modules/services/security/oauth2_proxy.nix b/nixos/modules/services/security/oauth2_proxy.nix
index abf1ce9ba0200..d2992a196bf87 100644
--- a/nixos/modules/services/security/oauth2_proxy.nix
+++ b/nixos/modules/services/security/oauth2_proxy.nix
@@ -47,6 +47,7 @@ let
     reverse-proxy = reverseProxy;
     proxy-prefix = proxyPrefix;
     profile-url = profileURL;
+    oidc-issuer-url = oidcIssuerUrl;
     redeem-url = redeemURL;
     redirect-url = redirectURL;
     request-logging = requestLogging;
@@ -131,6 +132,15 @@ in
       example = "123456.apps.googleusercontent.com";
     };
 
+    oidcIssuerUrl = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The OAuth issuer URL.
+      '';
+      example = "https://login.microsoftonline.com/{TENANT_ID}/v2.0";
+    };
+
     clientSecret = mkOption {
       type = types.nullOr types.str;
       description = ''
diff --git a/nixos/modules/services/system/earlyoom.nix b/nixos/modules/services/system/earlyoom.nix
index bcdf7d6512d5a..7e012dee02cbf 100644
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@@ -4,15 +4,29 @@ let
   cfg = config.services.earlyoom;
 
   inherit (lib)
-    mkDefault mkEnableOption mkIf mkOption types
-    mkRemovedOptionModule literalExpression
-    escapeShellArg concatStringsSep optional optionalString;
-
+    concatStringsSep
+    escapeShellArg
+    literalExpression
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    mkRemovedOptionModule
+    optionalString
+    optionals
+    types;
 in
 {
+  meta = {
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+  };
+
   options.services.earlyoom = {
     enable = mkEnableOption "early out of memory killing";
 
+    package = mkPackageOption pkgs "earlyoom" { };
+
     freeMemThreshold = mkOption {
       type = types.ints.between 1 100;
       default = 10;
@@ -138,22 +152,21 @@ in
     systemd.services.earlyoom = {
       description = "Early OOM Daemon for Linux";
       wantedBy = [ "multi-user.target" ];
-      path = optional cfg.enableNotifications pkgs.dbus;
+      path = optionals cfg.enableNotifications [ pkgs.dbus ];
       serviceConfig = {
         StandardError = "journal";
         ExecStart = concatStringsSep " " ([
-          "${pkgs.earlyoom}/bin/earlyoom"
+          "${lib.getExe cfg.package}"
           ("-m ${toString cfg.freeMemThreshold}"
-            + optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}")
+           + optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}")
           ("-s ${toString cfg.freeSwapThreshold}"
-            + optionalString (cfg.freeSwapKillThreshold != null) ",${toString cfg.freeSwapKillThreshold}")
+           + optionalString (cfg.freeSwapKillThreshold != null) ",${toString cfg.freeSwapKillThreshold}")
           "-r ${toString cfg.reportInterval}"
         ]
-        ++ optional cfg.enableDebugInfo "-d"
-        ++ optional cfg.enableNotifications "-n"
-        ++ optional (cfg.killHook != null) "-N ${escapeShellArg cfg.killHook}"
-        ++ cfg.extraArgs
-        );
+        ++ optionals cfg.enableDebugInfo [ "-d" ]
+        ++ optionals cfg.enableNotifications [ "-n" ]
+        ++ optionals (cfg.killHook != null) [ "-N ${escapeShellArg cfg.killHook}" ]
+        ++ cfg.extraArgs);
       };
     };
   };
diff --git a/nixos/modules/services/web-apps/firefly-iii.nix b/nixos/modules/services/web-apps/firefly-iii.nix
new file mode 100644
index 0000000000000..b0024ce09c38e
--- /dev/null
+++ b/nixos/modules/services/web-apps/firefly-iii.nix
@@ -0,0 +1,367 @@
+{ pkgs, config, lib, ... }:
+
+let
+  inherit (lib) optionalString mkDefault mkIf mkOption mkEnableOption literalExpression;
+  inherit (lib.types) nullOr attrsOf oneOf str int bool path package enum submodule;
+  inherit (lib.strings) concatMapStringsSep removePrefix toShellVars removeSuffix hasSuffix;
+  inherit (lib.attrsets) attrValues genAttrs filterAttrs mapAttrs' nameValuePair;
+  inherit (builtins) isInt isString toString typeOf;
+
+  cfg = config.services.firefly-iii;
+
+  user = cfg.user;
+  group = cfg.group;
+
+  defaultUser = "firefly-iii";
+  defaultGroup = "firefly-iii";
+
+  artisan = "${cfg.package}/artisan";
+
+  env-file-values = mapAttrs' (n: v: nameValuePair (removeSuffix "_FILE" n) v)
+    (filterAttrs (n: v: hasSuffix "_FILE" n) cfg.settings);
+  env-nonfile-values = filterAttrs (n: v: ! hasSuffix "_FILE" n) cfg.settings;
+
+  envfile = pkgs.writeText "firefly-iii-env" ''
+    ${toShellVars env-file-values}
+    ${toShellVars env-nonfile-values}
+  '';
+
+  fileenv-func = ''
+    cp --no-preserve=mode ${envfile} /tmp/firefly-iii-env
+    ${concatMapStringsSep "\n"
+      (n: "${pkgs.replace-secret}/bin/replace-secret ${n} ${n} /tmp/firefly-iii-env")
+      (attrValues env-file-values)}
+    set -a
+    . /tmp/firefly-iii-env
+    set +a
+  '';
+
+  firefly-iii-maintenance = pkgs.writeShellScript "firefly-iii-maintenance.sh" ''
+    ${fileenv-func}
+
+    ${optionalString (cfg.settings.DB_CONNECTION == "sqlite")
+      "touch ${cfg.dataDir}/storage/database/database.sqlite"}
+    ${artisan} migrate --seed --no-interaction --force
+    ${artisan} firefly-iii:decrypt-all
+    ${artisan} firefly-iii:upgrade-database
+    ${artisan} firefly-iii:correct-database
+    ${artisan} firefly-iii:report-integrity
+    ${artisan} firefly-iii:laravel-passport-keys
+    ${artisan} cache:clear
+
+    mv /tmp/firefly-iii-env /run/phpfpm/firefly-iii-env
+  '';
+
+  commonServiceConfig = {
+    Type = "oneshot";
+    User = user;
+    Group = group;
+    StateDirectory = "${removePrefix "/var/lib/" cfg.dataDir}";
+    WorkingDirectory = cfg.package;
+    PrivateTmp = true;
+    PrivateDevices = true;
+    CapabilityBoundingSet = "";
+    AmbientCapabilities = "";
+    ProtectSystem = "strict";
+    ProtectKernelTunables = true;
+    ProtectKernelModules = true;
+    ProtectControlGroups = true;
+    ProtectClock = true;
+    ProtectHostname = true;
+    ProtectHome = "tmpfs";
+    ProtectKernelLogs = true;
+    ProtectProc = "invisible";
+    ProcSubset = "pid";
+    PrivateNetwork = false;
+    RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service @resources"
+      "~@obsolete @privileged"
+    ];
+    RestrictSUIDSGID = true;
+    RemoveIPC = true;
+    NoNewPrivileges = true;
+    RestrictRealtime = true;
+    RestrictNamespaces = true;
+    LockPersonality = true;
+    PrivateUsers = true;
+  };
+
+in {
+
+  options.services.firefly-iii = {
+
+    enable = mkEnableOption "Firefly III: A free and open source personal finance manager";
+
+    user = mkOption {
+      type = str;
+      default = defaultUser;
+      description = "User account under which firefly-iii runs.";
+    };
+
+    group = mkOption {
+      type = str;
+      default = if cfg.enableNginx then "nginx" else defaultGroup;
+      defaultText = "If `services.firefly-iii.enableNginx` is true then `nginx` else ${defaultGroup}";
+      description = ''
+        Group under which firefly-iii runs. It is best to set this to the group
+        of whatever webserver is being used as the frontend.
+      '';
+    };
+
+    dataDir = mkOption {
+      type = path;
+      default = "/var/lib/firefly-iii";
+      description = ''
+        The place where firefly-iii stores its state.
+      '';
+    };
+
+    package = mkOption {
+      type = package;
+      default = pkgs.firefly-iii;
+      defaultText = literalExpression "pkgs.firefly-iii";
+      description = ''
+        The firefly-iii package served by php-fpm and the webserver of choice.
+        This option can be used to point the webserver to the correct root. It
+        may also be used to set the package to a different version, say a
+        development version.
+      '';
+      apply = firefly-iii : firefly-iii.override (prev: {
+        dataDir = cfg.dataDir;
+      });
+    };
+
+    enableNginx = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to enable nginx or not. If enabled, an nginx virtual host will
+        be created for access to firefly-iii. If not enabled, then you may use
+        `''${config.services.firefly-iii.package}` as your document root in
+        whichever webserver you wish to setup.
+      '';
+    };
+
+    virtualHost = mkOption {
+      type = str;
+      description = ''
+        The hostname at which you wish firefly-iii to be served. If you have
+        enabled nginx using `services.firefly-iii.enableNginx` then this will
+        be used.
+      '';
+    };
+
+    poolConfig = mkOption {
+      type = attrsOf (oneOf [ str int bool ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = ''
+        Options for the Firefly III PHP pool. See the documentation on <literal>php-fpm.conf</literal>
+        for details on configuration directives.
+      '';
+    };
+
+    settings = mkOption {
+      description = ''
+        Options for firefly-iii configuration. Refer to
+        <https://github.com/firefly-iii/firefly-iii/blob/main/.env.example> for
+        details on supported values. All <option>_FILE values supported by
+        upstream are supported here.
+
+        APP_URL will be set by `services.firefly-iii.virtualHost`, do not
+        redefine it here.
+      '';
+      example = literalExpression ''
+        {
+          APP_ENV = "production";
+          APP_KEY_FILE = "/var/secrets/firefly-iii-app-key.txt";
+          SITE_OWNER = "mail@example.com";
+          DB_CONNECTION = "mysql";
+          DB_HOST = "db";
+          DB_PORT = 3306;
+          DB_DATABASE = "firefly";
+          DB_USERNAME = "firefly";
+          DB_PASSWORD_FILE = "/var/secrets/firefly-iii-mysql-password.txt;
+        }
+      '';
+      default = {};
+      type = submodule {
+        freeformType = attrsOf (oneOf [str int bool]);
+        options = {
+          DB_CONNECTION = mkOption {
+            type = enum [ "sqlite" "pgsql" "mysql" ];
+            default = "sqlite";
+            example = "pgsql";
+            description = ''
+              The type of database you wish to use. Can be one of "sqlite",
+              "mysql" or "pgsql".
+            '';
+          };
+          APP_ENV = mkOption {
+            type = enum [ "local" "production" "testing" ];
+            default = "local";
+            example = "production";
+            description = ''
+              The app environment. It is recommended to keep this at "local".
+              Possible values are "local", "production" and "testing"
+            '';
+          };
+          DB_PORT = mkOption {
+            type = nullOr int;
+            default = if cfg.settings.DB_CONNECTION == "sqlite" then null
+                      else if cfg.settings.DB_CONNECTION == "mysql" then 3306
+                      else 5432;
+            defaultText = ''
+              `null` if DB_CONNECTION is "sqlite", `3306` if "mysql", `5432` if "pgsql"
+            '';
+            description = ''
+              The port your database is listening at. sqlite does not require
+              this value to be filled.
+            '';
+          };
+          APP_KEY_FILE = mkOption {
+            type = path;
+            description = ''
+              The path to your appkey. The file should contain a 32 character
+              random app key. This may be set using `echo "base64:$(head -c 32
+              /dev/urandom | base64)" > /path/to/key-file`.
+            '';
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    services.firefly-iii = {
+      settings = {
+        APP_URL = cfg.virtualHost;
+      };
+    };
+
+    services.phpfpm.pools.firefly-iii = {
+      inherit user group;
+      phpPackage = cfg.package.phpPackage;
+      phpOptions = ''
+        log_errors = on
+      '';
+      settings = {
+        "listen.mode" = "0660";
+        "listen.owner" = user;
+        "listen.group" = group;
+        "clear_env" = "no";
+      } // cfg.poolConfig;
+    };
+
+    systemd.services.phpfpm-firefly-iii.serviceConfig = {
+      EnvironmentFile = "/run/phpfpm/firefly-iii-env";
+      ExecStartPost = "${pkgs.coreutils}/bin/rm /run/phpfpm/firefly-iii-env";
+    };
+
+    systemd.services.firefly-iii-setup = {
+      requiredBy = [ "phpfpm-firefly-iii.service" ];
+      before = [ "phpfpm-firefly-iii.service" ];
+      serviceConfig = {
+        ExecStart = firefly-iii-maintenance;
+        RuntimeDirectory = "phpfpm";
+        RuntimeDirectoryPreserve = true;
+      } // commonServiceConfig;
+      unitConfig.JoinsNamespaceOf = "phpfpm-firefly-iii.service";
+    };
+
+    systemd.services.firefly-iii-cron = {
+      description = "Daily Firefly III cron job";
+      script = ''
+        ${fileenv-func}
+        ${artisan} firefly-iii:cron
+      '';
+      serviceConfig = commonServiceConfig;
+    };
+
+    systemd.timers.firefly-iii-cron = {
+      description = "Trigger Firefly Cron";
+      timerConfig = {
+        OnCalendar = "Daily";
+        RandomizedDelaySec = "1800s";
+        Persistent = true;
+      };
+      wantedBy = [ "timers.target" ];
+    };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+      recommendedTlsSettings = mkDefault true;
+      recommendedOptimisation = mkDefault true;
+      recommendedGzipSettings = mkDefault true;
+      virtualHosts.${cfg.virtualHost} = {
+        root = "${cfg.package}/public";
+        locations = {
+          "/" = {
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+            index = "index.php";
+            extraConfig = ''
+              sendfile off;
+            '';
+          };
+          "~ \.php$" = {
+            extraConfig = ''
+              include ${config.services.nginx.package}/conf/fastcgi_params ;
+              fastcgi_param SCRIPT_FILENAME $request_filename;
+              fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
+              fastcgi_pass unix:${config.services.phpfpm.pools.firefly-iii.socket};
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.tmpfiles.settings."10-firefly-iii" = genAttrs [
+      "${cfg.dataDir}/storage"
+      "${cfg.dataDir}/storage/app"
+      "${cfg.dataDir}/storage/database"
+      "${cfg.dataDir}/storage/export"
+      "${cfg.dataDir}/storage/framework"
+      "${cfg.dataDir}/storage/framework/cache"
+      "${cfg.dataDir}/storage/framework/sessions"
+      "${cfg.dataDir}/storage/framework/views"
+      "${cfg.dataDir}/storage/logs"
+      "${cfg.dataDir}/storage/upload"
+      "${cfg.dataDir}/cache"
+    ] (n: {
+      d = {
+        group = group;
+        mode = "0700";
+        user = user;
+      };
+    }) // {
+      "${cfg.dataDir}".d = {
+        group = group;
+        mode = "0710";
+        user = user;
+      };
+    };
+
+    users = {
+      users = mkIf (user == defaultUser) {
+        ${defaultUser} = {
+          description = "Firefly-iii service user";
+          inherit group;
+          isSystemUser = true;
+          home = cfg.dataDir;
+        };
+      };
+      groups = mkIf (group == defaultGroup) {
+        ${defaultGroup} = {};
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index 0d0361584c3a0..cdd60f572b990 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -2,7 +2,7 @@
 
 let
 
-  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption;
+  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption mkPackageOption;
   inherit (lib) literalExpression mapAttrs optional optionalString types;
 
   cfg = config.services.limesurvey;
@@ -12,8 +12,6 @@ let
   group = config.services.httpd.group;
   stateDir = "/var/lib/limesurvey";
 
-  pkg = pkgs.limesurvey;
-
   configType = with types; oneOf [ (attrsOf configType) str int bool ] // {
     description = "limesurvey config type (str, int, bool or attribute set thereof)";
   };
@@ -34,6 +32,8 @@ in
   options.services.limesurvey = {
     enable = mkEnableOption "Limesurvey web application";
 
+    package = mkPackageOption pkgs "limesurvey" { };
+
     encryptionKey = mkOption {
       type = types.str;
       default = "E17687FC77CEE247F0E22BB3ECF27FDE8BEC310A892347EC13013ABA11AA7EB5";
@@ -240,7 +240,7 @@ in
       adminAddr = mkDefault cfg.virtualHost.adminAddr;
       extraModules = [ "proxy_fcgi" ];
       virtualHosts.${cfg.virtualHost.hostName} = mkMerge [ cfg.virtualHost {
-        documentRoot = mkForce "${pkg}/share/limesurvey";
+        documentRoot = mkForce "${cfg.package}/share/limesurvey";
         extraConfig = ''
           Alias "/tmp" "${stateDir}/tmp"
           <Directory "${stateDir}">
@@ -256,7 +256,7 @@ in
             Options -Indexes
           </Directory>
 
-          <Directory "${pkg}/share/limesurvey">
+          <Directory "${cfg.package}/share/limesurvey">
             <FilesMatch "\.php$">
               <If "-f %{REQUEST_FILENAME}">
                 SetHandler "proxy:unix:${fpm.socket}|fcgi://localhost/"
@@ -277,7 +277,7 @@ in
       "d ${stateDir}/tmp/assets 0750 ${user} ${group} - -"
       "d ${stateDir}/tmp/runtime 0750 ${user} ${group} - -"
       "d ${stateDir}/tmp/upload 0750 ${user} ${group} - -"
-      "C ${stateDir}/upload 0750 ${user} ${group} - ${pkg}/share/limesurvey/upload"
+      "C ${stateDir}/upload 0750 ${user} ${group} - ${cfg.package}/share/limesurvey/upload"
     ];
 
     systemd.services.limesurvey-init = {
@@ -288,8 +288,8 @@ in
       environment.LIMESURVEY_CONFIG = limesurveyConfig;
       script = ''
         # update or install the database as required
-        ${pkgs.php81}/bin/php ${pkg}/share/limesurvey/application/commands/console.php updatedb || \
-        ${pkgs.php81}/bin/php ${pkg}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
+        ${pkgs.php81}/bin/php ${cfg.package}/share/limesurvey/application/commands/console.php updatedb || \
+        ${pkgs.php81}/bin/php ${cfg.package}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
       '';
       serviceConfig = {
         User = user;
diff --git a/nixos/modules/services/web-apps/pretalx.nix b/nixos/modules/services/web-apps/pretalx.nix
index e80eedf9f8590..b062a8b7eeeac 100644
--- a/nixos/modules/services/web-apps/pretalx.nix
+++ b/nixos/modules/services/web-apps/pretalx.nix
@@ -286,16 +286,16 @@ in
         virtualHosts.${cfg.nginx.domain} = {
           # https://docs.pretalx.org/administrator/installation.html#step-7-ssl
           extraConfig = ''
-            more_set_headers Referrer-Policy same-origin;
-            more_set_headers X-Content-Type-Options nosniff;
+            more_set_headers "Referrer-Policy: same-origin";
+            more_set_headers "X-Content-Type-Options: nosniff";
           '';
           locations = {
             "/".proxyPass = "http://pretalx";
             "/media/" = {
-              alias = "${cfg.settings.filesystem.data}/data/media/";
+              alias = "${cfg.settings.filesystem.data}/media/";
               extraConfig = ''
                 access_log off;
-                more_set_headers Content-Disposition 'attachment; filename="$1"';
+                more_set_headers 'Content-Disposition: attachment; filename="$1"';
                 expires 7d;
               '';
             };
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 40470f535bf61..337d53e869efe 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -829,7 +829,7 @@ in
       sslCiphers = mkOption {
         type = types.nullOr types.str;
         # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate
-        default = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+        default = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305";
         description = "Ciphers to choose from when negotiating TLS handshakes.";
       };
 
diff --git a/nixos/modules/virtualisation/digital-ocean-config.nix b/nixos/modules/virtualisation/digital-ocean-config.nix
index 2d5bc0661d48d..4ef2b85551c66 100644
--- a/nixos/modules/virtualisation/digital-ocean-config.nix
+++ b/nixos/modules/virtualisation/digital-ocean-config.nix
@@ -41,7 +41,7 @@ with lib;
         kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
         initrd.kernelModules = [ "virtio_scsi" ];
         kernelModules = [ "virtio_pci" "virtio_net" ];
-        loader.grub.devices = lib.mkDefault ["/dev/vda"];
+        loader.grub.devices = ["/dev/vda"];
       };
       services.openssh = {
         enable = mkDefault true;
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 96b24feeb0631..39cbe85579ae9 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -168,7 +168,10 @@ in rec {
         (onFullSupported "nixpkgs.emacs")
         (onFullSupported "nixpkgs.jdk")
         (onSystems ["x86_64-linux"] "nixpkgs.mesa_i686") # i686 sanity check + useful
-        ["nixpkgs.tarball"]
+        [
+          "nixpkgs.tarball"
+          "nixpkgs.release-checks"
+        ]
       ];
     };
 }
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
index cac20b63925f0..091c2b1f305be 100644
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@@ -81,6 +81,7 @@ in rec {
       php
       postgresql
       python
+      release-checks
       rsyslog
       stdenv
       subversion
@@ -103,6 +104,7 @@ in rec {
       [
         "nixos.channel"
         "nixpkgs.tarball"
+        "nixpkgs.release-checks"
       ]
       (map (onSystems [ "x86_64-linux" ]) [
         "nixos.tests.boot.biosCdrom"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 23c5a94ed12ca..232f10d7c24dd 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -308,6 +308,7 @@ in {
   ferm = handleTest ./ferm.nix {};
   ferretdb = handleTest ./ferretdb.nix {};
   filesystems-overlayfs = runTest ./filesystems-overlayfs.nix;
+  firefly-iii = handleTest ./firefly-iii.nix {};
   firefox = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox; };
   firefox-beta = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-beta; };
   firefox-devedition = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-devedition; };
@@ -857,6 +858,7 @@ in {
   stunnel = handleTest ./stunnel.nix {};
   sudo = handleTest ./sudo.nix {};
   sudo-rs = handleTest ./sudo-rs.nix {};
+  sunshine = handleTest ./sunshine.nix {};
   suwayomi-server = handleTest ./suwayomi-server.nix {};
   swap-file-btrfs = handleTest ./swap-file-btrfs.nix {};
   swap-partition = handleTest ./swap-partition.nix {};
diff --git a/nixos/tests/caddy.nix b/nixos/tests/caddy.nix
index 41d8e57de4686..0efe8f94e39dd 100644
--- a/nixos/tests/caddy.nix
+++ b/nixos/tests/caddy.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "caddy";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ xfix Br1ght0ne ];
+    maintainers = [ Br1ght0ne ];
   };
 
   nodes = {
diff --git a/nixos/tests/earlyoom.nix b/nixos/tests/earlyoom.nix
index 75bdf56899b30..b7850ddeaaab3 100644
--- a/nixos/tests/earlyoom.nix
+++ b/nixos/tests/earlyoom.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ lib, ... }: {
   name = "earlyoom";
   meta = {
-    maintainers = with lib.maintainers; [ ncfavier ];
+    maintainers = with lib.maintainers; [ ncfavier AndersonTorres ];
   };
 
   machine = {
diff --git a/nixos/tests/firefly-iii.nix b/nixos/tests/firefly-iii.nix
new file mode 100644
index 0000000000000..c93d799320a48
--- /dev/null
+++ b/nixos/tests/firefly-iii.nix
@@ -0,0 +1,26 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "firefly-iii";
+  meta.maintainers = [ lib.maintainers.savyajha ];
+
+  nodes.machine = { config, ... }: {
+    environment.etc = {
+      "firefly-iii-appkey".text = "TestTestTestTestTestTestTestTest";
+    };
+    services.firefly-iii = {
+      enable = true;
+      virtualHost = "http://localhost";
+      enableNginx = true;
+      settings = {
+        APP_KEY_FILE = "/etc/firefly-iii-appkey";
+        LOG_CHANNEL = "stdout";
+        SITE_OWNER = "mail@example.com";
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("phpfpm-firefly-iii.service")
+    machine.wait_for_unit("nginx.service")
+    machine.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
+  '';
+})
diff --git a/nixos/tests/phosh.nix b/nixos/tests/phosh.nix
index 78d6da31beee1..d505f0ffc5245 100644
--- a/nixos/tests/phosh.nix
+++ b/nixos/tests/phosh.nix
@@ -25,6 +25,10 @@ in {
         };
       };
 
+      environment.systemPackages = [
+        pkgs.phosh-mobile-settings
+      ];
+
       systemd.services.phosh = {
         environment = {
           # Accelerated graphics fail on phoc 0.20 (wlroots 0.15)
@@ -63,8 +67,13 @@ in {
         phone.screenshot("03launcher")
 
     with subtest("Check the on-screen keyboard shows"):
-        phone.send_chars("setting", delay=0.2)
+        phone.send_chars("mobile setting", delay=0.2)
         phone.wait_for_text("123") # A button on the OSK
         phone.screenshot("04osk")
+
+    with subtest("Check mobile-phosh-settings starts"):
+       phone.send_chars("\n")
+       phone.wait_for_text("Tweak advanced mobile settings");
+       phone.screenshot("05settings")
   '';
 })
diff --git a/nixos/tests/radicale.nix b/nixos/tests/radicale.nix
index 66650dce4a008..868b28085a675 100644
--- a/nixos/tests/radicale.nix
+++ b/nixos/tests/radicale.nix
@@ -6,7 +6,7 @@ let
   port = "5232";
   filesystem_folder = "/data/radicale";
 
-  cli = "${pkgs.calendar-cli}/bin/calendar-cli --caldav-user ${user} --caldav-pass ${password}";
+  cli = "${lib.getExe pkgs.calendar-cli} --caldav-user ${user} --caldav-pass ${password}";
 in {
   name = "radicale3";
   meta.maintainers = with lib.maintainers; [ dotlambda ];
diff --git a/nixos/tests/sunshine.nix b/nixos/tests/sunshine.nix
new file mode 100644
index 0000000000000..7c7e86de203a0
--- /dev/null
+++ b/nixos/tests/sunshine.nix
@@ -0,0 +1,70 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "sunshine";
+  meta = {
+    # test is flaky on aarch64
+    broken = pkgs.stdenv.isAarch64;
+    maintainers = [ lib.maintainers.devusb ];
+  };
+
+  nodes.sunshine = { config, pkgs, ... }: {
+    imports = [
+      ./common/x11.nix
+    ];
+
+    services.sunshine = {
+      enable = true;
+      openFirewall = true;
+      settings = {
+        capture = "x11";
+        encoder = "software";
+        output_name = 0;
+      };
+    };
+
+    environment.systemPackages = with pkgs; [
+      gxmessage
+    ];
+
+  };
+
+  nodes.moonlight = { config, pkgs, ... }: {
+    imports = [
+      ./common/x11.nix
+    ];
+
+    environment.systemPackages = with pkgs; [
+      moonlight-qt
+    ];
+
+  };
+
+  enableOCR = true;
+
+  testScript = ''
+    # start the tests, wait for sunshine to be up
+    start_all()
+    sunshine.wait_for_open_port(48010,"localhost")
+
+    # set the admin username/password, restart sunshine
+    sunshine.execute("sunshine --creds sunshine sunshine")
+    sunshine.systemctl("restart sunshine","root")
+    sunshine.wait_for_open_port(48010,"localhost")
+
+    # initiate pairing from moonlight
+    moonlight.execute("moonlight pair sunshine --pin 1234 >&2 & disown")
+    moonlight.wait_for_console_text("Executing request")
+
+    # respond to pairing request from sunshine
+    sunshine.succeed("curl --insecure -u sunshine:sunshine -d '{\"pin\": \"1234\"}' https://localhost:47990/api/pin")
+
+    # close moonlight once pairing complete
+    moonlight.send_key("kp_enter")
+
+    # put words on the sunshine screen for moonlight to see
+    sunshine.execute("gxmessage 'hello world' -center -font 'sans 75' >&2 & disown")
+
+    # connect to sunshine from moonlight and look for the words
+    moonlight.execute("moonlight --video-decoder software stream sunshine 'Desktop' >&2 & disown")
+    moonlight.wait_for_text("hello world")
+  '';
+})
diff --git a/nixos/tests/wpa_supplicant.nix b/nixos/tests/wpa_supplicant.nix
index 8c701ca7d5f71..5e3b39f27ecf3 100644
--- a/nixos/tests/wpa_supplicant.nix
+++ b/nixos/tests/wpa_supplicant.nix
@@ -102,17 +102,34 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
           test2.psk = "@PSK_SPECIAL@";            # should be replaced
           test3.psk = "@PSK_MISSING@";            # should not be replaced
           test4.psk = "P@ssowrdWithSome@tSymbol"; # should not be replaced
+          test5.psk = "@PSK_AWK_REGEX@";          # should be replaced
         };
 
         # secrets
         environmentFile = pkgs.writeText "wpa-secrets" ''
           PSK_VALID="S0m3BadP4ssw0rd";
           # taken from https://github.com/minimaxir/big-list-of-naughty-strings
-          PSK_SPECIAL=",./;'[]\-= <>?:\"{}|_+ !@#$%^\&*()`~";
+          PSK_SPECIAL=",./;'[]\/\-= <>?:\"{}|_+ !@#$%^&*()`~";
+          PSK_AWK_REGEX="PassowrdWith&symbol";
         '';
       };
     };
 
+    imperative = { ... }: {
+      imports = [ ../modules/profiles/minimal.nix ];
+
+      # add a virtual wlan interface
+      boot.kernelModules = [ "mac80211_hwsim" ];
+
+      # wireless client
+      networking.wireless = {
+        enable = lib.mkOverride 0 true;
+        userControlled.enable = true;
+        allowAuxiliaryImperativeNetworks = true;
+        interfaces = [ "wlan1" ];
+      };
+    };
+
     # Test connecting to the SAE-only hotspot using SAE
     machineSae = machineWithHostapd {
       networking.wireless = {
@@ -171,6 +188,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
           basic.fail(f"grep -q @PSK_SPECIAL@ {config_file}")
           basic.succeed(f"grep -q @PSK_MISSING@ {config_file}")
           basic.succeed(f"grep -q P@ssowrdWithSome@tSymbol {config_file}")
+          basic.succeed(f"grep -q 'PassowrdWith&symbol' {config_file}")
 
       with subtest("WPA2 fallbacks have been generated"):
           assert int(basic.succeed(f"grep -c sae-only {config_file}")) == 1
@@ -185,6 +203,15 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
           assert "Failed to connect" not in status, \
                  "Failed to connect to the daemon"
 
+      with subtest("Daemon can be configured imperatively"):
+          imperative.wait_for_unit("wpa_supplicant-wlan1.service")
+          imperative.wait_until_succeeds("wpa_cli -i wlan1 status")
+          imperative.succeed("wpa_cli -i wlan1 add_network")
+          imperative.succeed("wpa_cli -i wlan1 set_network 0 ssid '\"nixos-test\"'")
+          imperative.succeed("wpa_cli -i wlan1 set_network 0 psk '\"reproducibility\"'")
+          imperative.succeed("wpa_cli -i wlan1 save_config")
+          imperative.succeed("grep -q nixos-test /etc/wpa_supplicant.conf")
+
       machineSae.wait_for_unit("hostapd.service")
       machineSae.copy_from_vm("/run/hostapd/wlan0.hostapd.conf")
       with subtest("Daemon can connect to the SAE access point using SAE"):
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 74af177d0e278..871b8767b1a15 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -62,13 +62,13 @@
 
 stdenv.mkDerivation rec {
   pname = "audacity";
-  version = "3.4.2";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "audacity";
     repo = "audacity";
     rev = "Audacity-${version}";
-    hash = "sha256-YlRWCu6kQYdzast7Mf29p4FvpXJHQLG7vqqo/5SNQCQ=";
+    hash = "sha256-vJhCONoEC4Bdd1ZOLLobjNgLb/DT6auuMGk8L9lj6TU=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/audio/csound/csound-qt/default.nix b/pkgs/applications/audio/csound/csound-qt/default.nix
index e48b45aec3e42..c2c9432eaeb0b 100644
--- a/pkgs/applications/audio/csound/csound-qt/default.nix
+++ b/pkgs/applications/audio/csound/csound-qt/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, csound, desktop-file-utils,
-  fetchFromGitHub, python, python-qt, qmake,
+  fetchFromGitHub, python3, python-qt, qmake,
   qtwebengine, qtxmlpatterns, rtmidi, wrapQtAppsHook }:
 
 stdenv.mkDerivation rec {
@@ -26,13 +26,13 @@ stdenv.mkDerivation rec {
                  "CSOUND_INCLUDE_DIR=${csound}/include/csound"
                  "CSOUND_LIBRARY_DIR=${csound}/lib"
                  "RTMIDI_DIR=${rtmidi.src}"
-                 "PYTHONQT_SRC_DIR=${python-qt}/include/PythonQt"
+                 "PYTHONQT_SRC_DIR=${python-qt.src}"
                  "PYTHONQT_LIB_DIR=${python-qt}/lib"
                  "LIBS+=-L${python-qt}/lib"
-                 "INCLUDEPATH+=${python-qt}/include/PythonQt"
-                 "INCLUDEPATH+=${python}/include/python${python.pythonVersion}"
                  "INSTALL_DIR=${placeholder "out"}"
                  "SHARE_DIR=${placeholder "out"}/share"
+                 "PYTHON_DIR=${python3}"
+                 "PYTHON_VERSION=3.${python3.sourceVersion.minor}"
                  ];
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index d2a2170609c1f..7adba1d0c1566 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "7.14";
+  version = "7.15";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
-    hash = if stdenv.isDarwin then "sha256-cPxHriUNIG1EUmvOoW00V2Y0j+7BuxSIEbPy+qy5ZEM=" else {
-      x86_64-linux = "sha256-RgKteq157r4r088mr9wvPPa/rhmX88/lmVJ7mS17px4=";
-      aarch64-linux = "sha256-Qnb6ZoDIkfRct6dvqXKeYHgXyyEFLSj9R0hwa2bUiXo=";
+    hash = if stdenv.isDarwin then "sha256-7tWgbHIkARgsPi0buvbQb4qTqndyPwRRqut1Gj4WNZE=" else {
+      x86_64-linux = "sha256-O1xh+DKwPKTcQrNhWMX5ErKa1hXq0yeyt/XJMQav11c=";
+      aarch64-linux = "sha256-rQE8Aa+iFWpA18udCXm4JW8BPTEDeEQAupy353Sbcl8=";
     }.${stdenv.hostPlatform.system};
   };
 
diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
index 0a2ea1937ad98..aaa3564890f2d 100644
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -13,7 +13,6 @@
 , miniupnpc
 , zeromq
 , zlib
-, db48
 , sqlite
 , qrencode
 , qtbase ? null
@@ -51,7 +50,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withGui [ wrapQtAppsHook ];
 
   buildInputs = [ boost libevent miniupnpc zeromq zlib ]
-    ++ lib.optionals withWallet [ db48 sqlite ]
+    ++ lib.optionals withWallet [ sqlite ]
     ++ lib.optionals withGui [ qrencode qtbase qttools ];
 
   postInstall = ''
diff --git a/pkgs/applications/blockchains/terra-station/default.nix b/pkgs/applications/blockchains/terra-station/default.nix
index cf684e062c5cb..5c4a7cc8b3549 100644
--- a/pkgs/applications/blockchains/terra-station/default.nix
+++ b/pkgs/applications/blockchains/terra-station/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchurl
-, gcc-unwrapped
 , dpkg
 , util-linux
 , bash
@@ -57,8 +56,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ gcc-unwrapped.lib ]}"
+      --add-flags $out/share/${pname}/resources/app.aasar
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/display-managers/greetd/wlgreet.nix b/pkgs/applications/display-managers/greetd/wlgreet.nix
index 803b61caa8bee..1026f3a61e779 100644
--- a/pkgs/applications/display-managers/greetd/wlgreet.nix
+++ b/pkgs/applications/display-managers/greetd/wlgreet.nix
@@ -1,6 +1,10 @@
 { lib
 , rustPlatform
 , fetchFromSourcehut
+, autoPatchelfHook
+, gcc-unwrapped
+, wayland
+, libxkbcommon
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -16,6 +20,15 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-1ugExUtrzqyd9dTlBHcc44UrtEfYrfUryuG79IkTv2Y=";
 
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = [ gcc-unwrapped ];
+
+  runtimeDependencies = map lib.getLib [
+    gcc-unwrapped
+    wayland
+    libxkbcommon
+  ];
+
   meta = with lib; {
     description = "Raw wayland greeter for greetd, to be run under sway or similar";
     mainProgram = "wlgreet";
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index 3ff760b21885e..391bf102f749b 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -83,8 +83,12 @@ let
       ;
 
     perlEnv = perl.withPackages (p: [ p.NeovimExt p.Appcpanminus ]);
+
+    pname = "neovim";
+    version = lib.getVersion neovim-unwrapped;
   in {
-      name = "neovim-${lib.getVersion neovim-unwrapped}${extraName}";
+      name = "${pname}-${version}${extraName}";
+      inherit pname version;
 
       __structuredAttrs = true;
       dontUnpack = true;
diff --git a/pkgs/applications/editors/poke/default.nix b/pkgs/applications/editors/poke/default.nix
index 4d715d8c7cc4d..36d35bc44dc1a 100644
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@@ -1,37 +1,35 @@
 { lib
 , stdenv
 , fetchurl
-, gettext
 , help2man
 , pkg-config
 , texinfo
 , boehmgc
 , readline
-, guiSupport ? false, makeWrapper, tcl, tcllib, tk
-, miSupport ? true, json_c
 , nbdSupport ? !stdenv.isDarwin, libnbd
-, textStylingSupport ? true
+, textStylingSupport ? true, gettext
 , dejagnu
 
-# update script only
+  # update script only
 , writeScript
 }:
 
 let
   isCross = stdenv.hostPlatform != stdenv.buildPlatform;
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "poke";
-  version = "3.2";
+  version = "4.0";
 
   src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-dY5VHdU6bM5U7JTY/CH6TWtSon0cJmcgbVmezcdPDZc=";
+    url = "mirror://gnu/poke/poke-${finalAttrs.version}.tar.gz";
+    hash = "sha256-ArqyLLH6YVOhtqknyLs81Y1QhUPBRIQqbX7nTxmXOnc=";
   };
 
   outputs = [ "out" "dev" "info" "lib" ]
-  # help2man can't cross compile because it runs `poke --help` to
-  # generate the man page
-  ++ lib.optional (!isCross) "man";
+    # help2man can't cross compile because it runs `poke --help` to
+    # generate the man page
+    ++ lib.optional (!isCross) "man";
 
   postPatch = ''
     patchShebangs .
@@ -40,53 +38,33 @@ in stdenv.mkDerivation rec {
   strictDeps = true;
 
   nativeBuildInputs = [
-    gettext
     pkg-config
     texinfo
   ] ++ lib.optionals (!isCross) [
     help2man
-  ] ++ lib.optionals guiSupport [
-    makeWrapper
-    tcl.tclPackageHook
   ];
 
   buildInputs = [ boehmgc readline ]
-  ++ lib.optionals guiSupport [ tcl tcllib tk ]
-  ++ lib.optional miSupport json_c
-  ++ lib.optional nbdSupport libnbd
-  ++ lib.optional textStylingSupport gettext
-  ++ lib.optional (!isCross) dejagnu;
+    ++ lib.optional nbdSupport libnbd
+    ++ lib.optional textStylingSupport gettext
+    ++ lib.optional finalAttrs.finalPackage.doCheck dejagnu;
 
   configureFlags = [
     # libpoke depends on $datadir/poke, so we specify the datadir in
     # $lib, and later move anything else it doesn't depend on to $out
     "--datadir=${placeholder "lib"}/share"
-  ] ++ lib.optionals guiSupport [
-    "--enable-gui"
-    "--with-tcl=${tcl}/lib"
-    "--with-tk=${tk}/lib"
-    "--with-tkinclude=${tk.dev}/include"
   ];
 
   enableParallelBuilding = true;
 
-  doCheck = !isCross;
-  nativeCheckInputs = lib.optionals (!isCross) [ dejagnu ];
+  doCheck = true;
+  nativeCheckInputs = [ dejagnu ];
 
   postInstall = ''
     moveToOutput share/emacs "$out"
     moveToOutput share/vim "$out"
   '';
 
-  # Prevent tclPackageHook from auto-wrapping all binaries, we only
-  # need to wrap poke-gui
-  dontWrapTclBinaries = true;
-
-  postFixup = lib.optionalString guiSupport ''
-    wrapProgram "$out/bin/poke-gui" \
-      --prefix TCLLIBPATH ' ' "$TCLLIBPATH"
-  '';
-
   passthru = {
     updateScript = writeScript "update-poke" ''
       #!/usr/bin/env nix-shell
@@ -97,18 +75,17 @@ in stdenv.mkDerivation rec {
       # Expect the text in format of '<a href="...">poke 2.0</a>'
       new_version="$(curl -s https://www.jemarch.net/poke |
           pcregrep -o1 '>poke ([0-9.]+)</a>')"
-      update-source-version ${pname} "$new_version"
+      update-source-version poke "$new_version"
     '';
   };
 
-  meta = with lib; {
+  meta = {
     description = "Interactive, extensible editor for binary data";
     homepage = "http://www.jemarch.net/poke";
-    changelog = "https://git.savannah.gnu.org/cgit/poke.git/plain/ChangeLog?h=releases/poke-${version}";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ AndersonTorres kira-bruneau ];
-    platforms = platforms.unix;
+    changelog = "https://git.savannah.gnu.org/cgit/poke.git/plain/ChangeLog?h=releases/poke-${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres kira-bruneau ];
+    platforms = lib.platforms.unix;
+    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
-}
-
-# TODO: Enable guiSupport by default once it's more than just a stub
+})
diff --git a/pkgs/applications/editors/standardnotes/default.nix b/pkgs/applications/editors/standardnotes/default.nix
index 8d535f6f5534d..e61f57c76448c 100644
--- a/pkgs/applications/editors/standardnotes/default.nix
+++ b/pkgs/applications/editors/standardnotes/default.nix
@@ -1,5 +1,12 @@
-{ lib, stdenv, fetchurl, dpkg, makeWrapper, electron, libsecret
-, desktop-file-utils , callPackage }:
+{ lib
+, stdenv
+, fetchurl
+, dpkg
+, makeWrapper
+, electron
+, desktop-file-utils
+, callPackage
+}:
 
 let
 
@@ -33,8 +40,7 @@ stdenv.mkDerivation rec {
     cp -R opt/Standard\ Notes/resources/app.asar $out/share/standardnotes/
 
     makeWrapper ${electron}/bin/electron $out/bin/standardnotes \
-      --add-flags $out/share/standardnotes/app.asar \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libsecret stdenv.cc.cc.lib ]}
+      --add-flags $out/share/standardnotes/app.asar
 
     ${desktop-file-utils}/bin/desktop-file-install --dir $out/share/applications \
       --set-key Exec --set-value standardnotes usr/share/applications/standard-notes.desktop
diff --git a/pkgs/applications/editors/vim/plugins/deprecated.json b/pkgs/applications/editors/vim/plugins/deprecated.json
index d855a3d2cd4bd..e73899e66fea8 100644
--- a/pkgs/applications/editors/vim/plugins/deprecated.json
+++ b/pkgs/applications/editors/vim/plugins/deprecated.json
@@ -48,7 +48,7 @@
         "new": "sqlite-lua"
     },
     "vim-fsharp": {
-        "date": "2024-04-03",
+        "date": "2024-04-21",
         "new": "zarchive-vim-fsharp"
     },
     "vim-jade": {
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ac5fe0cc16a16..48f6720104b17 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -65,12 +65,12 @@ final: prev:
 
   Coqtail = buildVimPlugin {
     pname = "Coqtail";
-    version = "2024-03-30";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "whonore";
       repo = "Coqtail";
-      rev = "c881047dd32cbd9524b0c733821c113ebcc03b07";
-      sha256 = "1my43cd1shgjg0f111qq14n217l3msdxgx2ks2hdil9vbrvn530s";
+      rev = "c74271e68dfc9e125e6ae197879eb50c7b34512d";
+      sha256 = "1x2yhdmmm5sbfpqbkrivwa05hx8vk5xa3468db3554clawkp2mnj";
     };
     meta.homepage = "https://github.com/whonore/Coqtail/";
   };
@@ -173,24 +173,24 @@ final: prev:
 
   LazyVim = buildVimPlugin {
     pname = "LazyVim";
-    version = "2024-03-29";
+    version = "2024-04-11";
     src = fetchFromGitHub {
       owner = "LazyVim";
       repo = "LazyVim";
-      rev = "97480dc5d2dbb717b45a351e0b04835f138a9094";
-      sha256 = "0p5qrqk958rp85vskh5di05s0v9a02phmpdk6gy61z632ycvym6w";
+      rev = "bb36f71b77d8e15788a5b62c82a1c9ec7b209e49";
+      sha256 = "1vjckraf062d7dybf1iphp7i7lwphzgc1bns0jzfardbd1q9gw3f";
     };
     meta.homepage = "https://github.com/LazyVim/LazyVim/";
   };
 
   LeaderF = buildVimPlugin {
     pname = "LeaderF";
-    version = "2024-03-29";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "Yggdroot";
       repo = "LeaderF";
-      rev = "735a2f36d3a25e320182bf3f385f5530d674600e";
-      sha256 = "058m5ry3lc4wz7978vd0a2a2wqv7q1z3adzasfzsddhah07dkxa3";
+      rev = "d4eded0ab36ba60aa7e13893a2064a74d2cdb6bd";
+      sha256 = "0xzdm4ggh5bggnxjgcaxkzdiwfxs11yblgmpwvzqjhpzv8qnzkx1";
     };
     meta.homepage = "https://github.com/Yggdroot/LeaderF/";
   };
@@ -305,12 +305,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "2024-04-03";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "32e3a9654693f513a2cbb76ba99cbc9947b1352d";
-      sha256 = "1sazs3a8zzbjy6g83fm1kqah8cc3x3pihbzqplmllrw2nbc29qxk";
+      rev = "f7cae6f1b38cb296f48ce1a9c5ed1a419d912a42";
+      sha256 = "0mdriqqna37a9fjbilaq2qkkn4ik4jn2dz1x6ra51pgh42r86qhl";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -522,12 +522,12 @@ final: prev:
 
   aerial-nvim = buildVimPlugin {
     pname = "aerial.nvim";
-    version = "2024-03-28";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "aerial.nvim";
-      rev = "24ebacab5821107c50f628e8e7774f105c08fe9b";
-      sha256 = "148d8v57g7sxh1xy3df2bzq8jvgp70k52rw9ihr88f0dd3x7zsfj";
+      rev = "7045e7cb0017d222122a1f6e5795e69754d8b9db";
+      sha256 = "04mclw1drrkr4x4gnb26p6szg6glbkkff7cbrxy4g7fyx6lhl9fy";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/aerial.nvim/";
@@ -583,12 +583,12 @@ final: prev:
 
   ale = buildVimPlugin {
     pname = "ale";
-    version = "2024-03-20";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "dense-analysis";
       repo = "ale";
-      rev = "6c10a519f1460179cf8f8e329d8eb3186247be2b";
-      sha256 = "122hsm461cqs3k48fqzsizqnknm7pg4v8pnpady3zzjwijzgq9h7";
+      rev = "adee52fba040428264aee956d99033572fc405a3";
+      sha256 = "125hcnl146bh8bpsp3v62dbdqpzwma5n69f8y6gpk5anh4yc1sai";
     };
     meta.homepage = "https://github.com/dense-analysis/ale/";
   };
@@ -689,14 +689,26 @@ final: prev:
     meta.homepage = "https://github.com/vim-scripts/argtextobj.vim/";
   };
 
+  arrow-nvim = buildVimPlugin {
+    pname = "arrow.nvim";
+    version = "2024-04-19";
+    src = fetchFromGitHub {
+      owner = "otavioschwanck";
+      repo = "arrow.nvim";
+      rev = "37f32c94cf6e01826af5d96337c70d2f9be0a280";
+      sha256 = "0v23gw86rmciaqbi27ifd3f5mw0vknm2482yznb30dpq3pk53327";
+    };
+    meta.homepage = "https://github.com/otavioschwanck/arrow.nvim/";
+  };
+
   astrotheme = buildVimPlugin {
     pname = "astrotheme";
-    version = "2024-04-01";
+    version = "2024-04-10";
     src = fetchFromGitHub {
       owner = "AstroNvim";
       repo = "astrotheme";
-      rev = "e056b8216214f7140eda3e0adcfc27efba705231";
-      sha256 = "1l17d68y3p1gyhp8w2ll3v9mcvnbc4gyck2qlc595w79d0hgzfhr";
+      rev = "8b316aa3ecd8c4206430379c0b1da0b4e7969ab9";
+      sha256 = "120fz8z6bmsp7dqjhg8dygbgv1q4bzwk0k8ji55xa2w6bc8ji3ii";
     };
     meta.homepage = "https://github.com/AstroNvim/astrotheme/";
   };
@@ -895,12 +907,12 @@ final: prev:
 
   auto-session = buildVimPlugin {
     pname = "auto-session";
-    version = "2024-04-01";
+    version = "2024-04-14";
     src = fetchFromGitHub {
       owner = "rmagatti";
       repo = "auto-session";
-      rev = "64dc86e43c85f0062baafb0b607a6162efc99c91";
-      sha256 = "051l736qzpmnljindha84zbbl5i6ckzn2ys1gpmcj93l80nf2jc7";
+      rev = "9e0a169b6fce8791278abbd110717b921afe634d";
+      sha256 = "0d1rbdsrlprr8dsw948i352c8564hglh56vwg80qxqib2ssfxvy2";
     };
     meta.homepage = "https://github.com/rmagatti/auto-session/";
   };
@@ -1015,24 +1027,24 @@ final: prev:
 
   bamboo-nvim = buildVimPlugin {
     pname = "bamboo.nvim";
-    version = "2024-03-16";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "ribru17";
       repo = "bamboo.nvim";
-      rev = "5c826c8ad27010ac2fcaf7deb4c36b16d00ef5a1";
-      sha256 = "1651b4lyll7902817bi4ndx115k7pxsvbx8mdddmmkw863zl60db";
+      rev = "aaeda8100e3a7ebcc65b5897c9027eca2bd9cbf2";
+      sha256 = "1734skv1z9qd8p6dspda1hhq79rd4y4bkyggf0iphz8qw7g0qm8m";
     };
     meta.homepage = "https://github.com/ribru17/bamboo.nvim/";
   };
 
   barbar-nvim = buildVimPlugin {
     pname = "barbar.nvim";
-    version = "2024-04-01";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "romgrk";
       repo = "barbar.nvim";
-      rev = "e7521487be265773f81200a2628b141c836c089b";
-      sha256 = "11hx8vbspf5ai547x5r3cc217qn40mxrxcasblhcwmjgg9ybnvdd";
+      rev = "88fe247ba6453b6ac422f26eb047acaac1a6000a";
+      sha256 = "0amim3cminq310rzqyylkf7afkyjpmxcvp1y42ml00vdl7av2484";
     };
     meta.homepage = "https://github.com/romgrk/barbar.nvim/";
   };
@@ -1051,12 +1063,12 @@ final: prev:
 
   base16-nvim = buildVimPlugin {
     pname = "base16-nvim";
-    version = "2024-02-17";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "RRethy";
       repo = "base16-nvim";
-      rev = "b3e9ec6a82c05b562cd71f40fe8964438a9ba64a";
-      sha256 = "1qb8g6q8vwq99030nqw719xgrizbqcnmj4n25fqakjq8pbclwh4p";
+      rev = "eec6882101dd189117f79c5d18d389d20cfc0415";
+      sha256 = "060cm7071gr3vpizd7iinpgk50igsqrgcrffa0ali2r6mdhxcwd7";
     };
     meta.homepage = "https://github.com/RRethy/base16-nvim/";
   };
@@ -1279,12 +1291,12 @@ final: prev:
 
   bufferline-nvim = buildVimPlugin {
     pname = "bufferline.nvim";
-    version = "2024-03-07";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "bufferline.nvim";
-      rev = "64e2c5def50dfd6b6f14d96a45fa3d815a4a1eef";
-      sha256 = "1r9bb6jmcj2048ny86v7ha8scjv1qispmxhj98l11jb2xb1f1fvn";
+      rev = "f6f00d9ac1a51483ac78418f9e63126119a70709";
+      sha256 = "1681xqpvxb7zhfig69d0qf287qzxfwcwb6vipnhykiisd8vn9inv";
     };
     meta.homepage = "https://github.com/akinsho/bufferline.nvim/";
   };
@@ -1303,12 +1315,12 @@ final: prev:
 
   bullets-vim = buildVimPlugin {
     pname = "bullets.vim";
-    version = "2024-03-08";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "bullets-vim";
       repo = "bullets.vim";
-      rev = "0cc28d53e9da628e006c89bb2d3b03b94a0dee33";
-      sha256 = "0gxa73q89w7mkhhmy3f2zdcsys4p9m4z61ff1c9lmbvd1r8dh898";
+      rev = "4ed0785a5a812d9dc96164f2ceab10f5dce68270";
+      sha256 = "0dpbh9l4a3009k0qi016zm03wjc12jbf31lhj78mmqnpazfn7gfh";
     };
     meta.homepage = "https://github.com/bullets-vim/bullets.vim/";
   };
@@ -1351,24 +1363,24 @@ final: prev:
 
   ccc-nvim = buildVimPlugin {
     pname = "ccc.nvim";
-    version = "2024-04-01";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "uga-rosa";
       repo = "ccc.nvim";
-      rev = "46b8a38a3bc287f27789800d3d26480d093d65b5";
-      sha256 = "0cgmvjkyvrn9c77hl1i5qbak8v8ypl8m0pqkpz886x2f95xa68xd";
+      rev = "1283eef5494c092a047baa34ed3e667f3cb2715e";
+      sha256 = "1wipfpypa2zjdc2n4cjkiaxcfh0mraiwiripg3vmd4mf37wbxphv";
     };
     meta.homepage = "https://github.com/uga-rosa/ccc.nvim/";
   };
 
   chadtree = buildVimPlugin {
     pname = "chadtree";
-    version = "2024-04-03";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "f085e2363ed170b3d90a95e614954395a0a541c0";
-      sha256 = "01cfzcm2f6vr67w2l4f80iqmp74l827mmzcfjgcxjc68a70y2y8f";
+      rev = "a8271021ec4f5cae4b9a276ab8662e9a7d6074f9";
+      sha256 = "0cpzpz17smp3dc4lwid3gkkjwangndy1d6fbijrl1l2jpa8dzrgq";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -1423,12 +1435,12 @@ final: prev:
 
   citruszest-nvim = buildVimPlugin {
     pname = "citruszest.nvim";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "zootedb0t";
       repo = "citruszest.nvim";
-      rev = "b30d441088d579d22e773f4cb28550fb9a65a604";
-      sha256 = "03j3n1rjmvylllhhpp6qz5v6n3h1hb12bsp186jvamb3wqky48la";
+      rev = "ea9cb04feadc1f7fbd2902fc65f0308354583f5d";
+      sha256 = "0mqnh1155pg0dw07hzn7jd5x42gwvffkpn7w1pk4jnmaas3yxpkh";
     };
     meta.homepage = "https://github.com/zootedb0t/citruszest.nvim/";
   };
@@ -1519,12 +1531,12 @@ final: prev:
 
   cmake-tools-nvim = buildVimPlugin {
     pname = "cmake-tools.nvim";
-    version = "2024-03-19";
+    version = "2024-04-14";
     src = fetchFromGitHub {
       owner = "Civitasv";
       repo = "cmake-tools.nvim";
-      rev = "a4cd0b3a2c8a166a54b36bc00579954426748959";
-      sha256 = "1bi79pv0wd97rvjx1dx60y87c7shw8xrg02mf08rl3l6827zq3p8";
+      rev = "8506c426d5b361dbaa7c61c0490a2589a9c555ce";
+      sha256 = "1kmrfbxwzi60mf88qfcwjcwn0js9wci0yz89d99zgrm0vxl5jpkh";
     };
     meta.homepage = "https://github.com/Civitasv/cmake-tools.nvim/";
   };
@@ -1747,12 +1759,12 @@ final: prev:
 
   cmp-git = buildVimPlugin {
     pname = "cmp-git";
-    version = "2023-12-29";
+    version = "2024-04-15";
     src = fetchFromGitHub {
       owner = "petertriho";
       repo = "cmp-git";
-      rev = "8d8993680d627c8f13bd85094eba84604107dbdd";
-      sha256 = "1p7jq14rcljkg2d216498gr0gj76p493vy0h4jzgsz8ncmfxk6qw";
+      rev = "b9603f18496bc3ca07e6bd474607081af709e750";
+      sha256 = "0r27gf1j77fmqi2m8n5q3s326wp3ns81p7vcfhn6j74y979v11jg";
     };
     meta.homepage = "https://github.com/petertriho/cmp-git/";
   };
@@ -1867,12 +1879,12 @@ final: prev:
 
   cmp-nvim-tags = buildVimPlugin {
     pname = "cmp-nvim-tags";
-    version = "2023-05-10";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "quangnguyen30192";
       repo = "cmp-nvim-tags";
-      rev = "30bdc2eec86eb66730af541bb06d24d4a67e3eeb";
-      sha256 = "0dlpw2z9amb4klsr0mjviin73bj7zqfh3lz0g2lwb2n5g6jnakfn";
+      rev = "3580b6c97c35831afc25a23f1e7f4aa8ad070481";
+      sha256 = "074y4h2p5dx72s7y6spi1iqqpmva3f2mr33pra155ahzqpzqi3v7";
     };
     meta.homepage = "https://github.com/quangnguyen30192/cmp-nvim-tags/";
   };
@@ -2203,12 +2215,12 @@ final: prev:
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "2024-03-28";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "196d8f0314bc6199f8243f00411ca7d87adc3c30";
-      sha256 = "1gq1kqinyqj5d2w7420kvyvs9wkbr29zhhibbrac287smpqvgkw0";
+      rev = "a8823eed914f89cdd3940ed9f5f62786e6d585c1";
+      sha256 = "1s3hcbhx5kn3b6m1793m02kl94g8hb53jc5lhjhgkg4qhx27hsq9";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
   };
@@ -2227,12 +2239,12 @@ final: prev:
 
   codeium-nvim = buildVimPlugin {
     pname = "codeium.nvim";
-    version = "2024-03-21";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "Exafunction";
       repo = "codeium.nvim";
-      rev = "a070f57c0f54bd940436b94c8b679bcad5a48811";
-      sha256 = "1r2sshdl7afgy5c5v5jc1lffvw4wbb4fv9fhn1fgxvn61r0xm005";
+      rev = "dfcac077fa023b7194c6403ac9a8f931b9c24f28";
+      sha256 = "03lykrm0d5xm8i5f002xfy7l8wmzji5bqy4ygl3vals12ni5ymph";
     };
     meta.homepage = "https://github.com/Exafunction/codeium.nvim/";
   };
@@ -2491,12 +2503,12 @@ final: prev:
 
   conform-nvim = buildVimPlugin {
     pname = "conform.nvim";
-    version = "2024-03-28";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "conform.nvim";
-      rev = "9d5ba06d6ee7418c674f498634617416d15b6239";
-      sha256 = "0xpgpjaq40qf686qg0m5hhqpqahjz5wgxviyxny2i7zk4r832bqm";
+      rev = "a6965ac128eba75537ec2bc5ddd5d5e357062bdc";
+      sha256 = "00knvdl5msvn178skxqxb0ip722cnqrpp8xr1id4z6j5vbysmhiy";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/conform.nvim/";
@@ -2564,12 +2576,12 @@ final: prev:
 
   copilot-vim = buildVimPlugin {
     pname = "copilot.vim";
-    version = "2024-03-14";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "github";
       repo = "copilot.vim";
-      rev = "9484e35cf222e9360e05450622a884f95c662c4c";
-      sha256 = "1c7dabbyk5124xw5k5b29h9nmv04ix6p3j3p7qns7ssqinvfphmm";
+      rev = "1e135c5303bc60598f6314a2276f31dc91aa34dd";
+      sha256 = "06b5c0xgs3xiajdw7ag3qbv4i0qwn4s084r4pj5v8d9iyc834kiz";
     };
     meta.homepage = "https://github.com/github/copilot.vim/";
   };
@@ -2588,12 +2600,12 @@ final: prev:
 
   coq-thirdparty = buildVimPlugin {
     pname = "coq.thirdparty";
-    version = "2024-02-03";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.thirdparty";
-      rev = "d9c1492ee60d627b171c7a9bcd0c3bb35af3e0fd";
-      sha256 = "0q8fv58v2sy9kq737ddmrrf0vvqpz8wrybnrks3vazq017jc5y7v";
+      rev = "5f45777bcb0c14266a7e07ed474cb70c4e8b6397";
+      sha256 = "0h2rq7aqxrf58cgwh6iwm2gs2fghkipyz20gdwqcy5hqmy2l0mi1";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.thirdparty/";
   };
@@ -2612,12 +2624,12 @@ final: prev:
 
   coq_nvim = buildVimPlugin {
     pname = "coq_nvim";
-    version = "2024-04-03";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "c7fc9a764f91d7152c6a435de730eb436aeeed49";
-      sha256 = "0ljpylgxir8sbcxh9qmvwm1vpabs2l4s3im81yfcyj1164hwsk84";
+      rev = "98e389717df1a29f557f7a5d8f1d8a7e5c0560dd";
+      sha256 = "16ngidw3lg1virbd731pp9z1s20j8mva6569blkj7cnk08kprh7l";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
   };
@@ -2648,12 +2660,12 @@ final: prev:
 
   crates-nvim = buildVimPlugin {
     pname = "crates.nvim";
-    version = "2024-03-13";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "saecki";
       repo = "crates.nvim";
-      rev = "b4f4987ccdb1cc3899ee541ef4375c73c48c4570";
-      sha256 = "0r9l018sfymmbg7lc31bp4q2aqdljaqini5s14mg3r7lwcg15z61";
+      rev = "786d12a70c9b91fa2d0d102bb07df02be0db31a1";
+      sha256 = "1krd7srvzjrikpirfypw09cv2flcy22jv8amrbxfxykrgg2vn6dd";
     };
     meta.homepage = "https://github.com/saecki/crates.nvim/";
   };
@@ -2744,12 +2756,12 @@ final: prev:
 
   cyberdream-nvim = buildVimPlugin {
     pname = "cyberdream.nvim";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "scottmckendry";
       repo = "cyberdream.nvim";
-      rev = "10bae2c37bc76e812af769687acb88b11283d38b";
-      sha256 = "1w7k5x8da0a3ifw0hgs5wcph5kixx52jd0zqqdf7v76ci3158g95";
+      rev = "9a7f07ad318a96f19845683014d27be00495ea98";
+      sha256 = "1w8ic8ngfk1x99yl7bx7kfqmwi0py6xj198yczvxwzmgfxby5sjc";
     };
     meta.homepage = "https://github.com/scottmckendry/cyberdream.nvim/";
   };
@@ -2780,24 +2792,24 @@ final: prev:
 
   dashboard-nvim = buildVimPlugin {
     pname = "dashboard-nvim";
-    version = "2024-04-03";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "nvimdev";
       repo = "dashboard-nvim";
-      rev = "7c0c09d55118a2afeb8874e885f87ae80d8ff452";
-      sha256 = "0ipn3cbivi04hn1qixxp8cd4kxfsjnkd3a8hz5j3bpn4x74c6qxk";
+      rev = "6d06924b562de6f0bb136edf1bf549afbf6b7d00";
+      sha256 = "1c5xhwsj84rs00zds9279wfvxc2xjmdfix36mvxdklrq6f083ifd";
     };
     meta.homepage = "https://github.com/nvimdev/dashboard-nvim/";
   };
 
   debugprint-nvim = buildVimPlugin {
     pname = "debugprint.nvim";
-    version = "2024-04-03";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "andrewferrier";
       repo = "debugprint.nvim";
-      rev = "ff44034c8f52feb252bd88311f91b8c9b9abe0f0";
-      sha256 = "1gxfimxg422bgz631nrdxwmmvx1l40vy3qjwawnp0jgi0b32nlfv";
+      rev = "4ac809ff035eb246392ce4593c49705e894dbbea";
+      sha256 = "1zjycn3qj6mpa7c5aknka2dfq8d05ac8rc6sfh81sal2hwdnq1d1";
     };
     meta.homepage = "https://github.com/andrewferrier/debugprint.nvim/";
   };
@@ -2900,24 +2912,24 @@ final: prev:
 
   denops-vim = buildVimPlugin {
     pname = "denops.vim";
-    version = "2024-03-27";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "vim-denops";
       repo = "denops.vim";
-      rev = "c057cdff217e3f7de9f19c8da270b23523bb19a4";
-      sha256 = "1sjsc04ssjblcyxlpp944qhhpf6qizw6d595cgj2i8pap0vpx4bf";
+      rev = "c727a3f05a804d1f04b11735f8241518465de9a7";
+      sha256 = "1h08jrxa07b59ipxqlk2ni78bn1h2w4qdg0m46bwgn7pb24479f6";
     };
     meta.homepage = "https://github.com/vim-denops/denops.vim/";
   };
 
   deol-nvim = buildVimPlugin {
     pname = "deol.nvim";
-    version = "2024-03-21";
+    version = "2024-04-15";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "deol.nvim";
-      rev = "f61f59979c073b663977dbb659f1c9c5a91d88e1";
-      sha256 = "0a0dgnh3rk8b6739pb3nacg8pbqw1yj2aib0sgspsvd0zirqwisw";
+      rev = "c77537a563a58221eb996ea64304dbe22ebc6f64";
+      sha256 = "0gnrx5ll1hmpxsn5jw229w8sa2kkswyw6bdd1ffgx7bvfk7z2k4m";
     };
     meta.homepage = "https://github.com/Shougo/deol.nvim/";
   };
@@ -3298,12 +3310,12 @@ final: prev:
 
   dropbar-nvim = buildVimPlugin {
     pname = "dropbar.nvim";
-    version = "2024-04-01";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "Bekaboo";
       repo = "dropbar.nvim";
-      rev = "26173fd5347bddc28fdc645d7020abd860754a73";
-      sha256 = "1lwzl4c9bkw06k875hg9b3yhavqbd1p5xr8zlfcspc05ip57y9l4";
+      rev = "e3c7de9f733587373959b220d5a1970c476a3d9f";
+      sha256 = "02ipdrrian2s0ddbjaga681sgflcw6nqcq707g7v1f094fc2rvj5";
     };
     meta.homepage = "https://github.com/Bekaboo/dropbar.nvim/";
   };
@@ -3358,12 +3370,12 @@ final: prev:
 
   editorconfig-vim = buildVimPlugin {
     pname = "editorconfig-vim";
-    version = "2024-01-15";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "editorconfig";
       repo = "editorconfig-vim";
-      rev = "0956bc257ca4eaa3e087e0ba2253a3e980805820";
-      sha256 = "1w64bpv4hanyxml0hbqqsbm96fckx1imcvksr2raq9al0qlfk4gn";
+      rev = "8b7da79e9daee7a3f3a8d4fe29886b9756305aff";
+      sha256 = "1ix80rgylpjimv3x13f8nf3gs33lf99wzydswyzyd5mpvz5p8i55";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/editorconfig/editorconfig-vim/";
@@ -3383,24 +3395,24 @@ final: prev:
 
   efmls-configs-nvim = buildVimPlugin {
     pname = "efmls-configs-nvim";
-    version = "2024-04-02";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "creativenull";
       repo = "efmls-configs-nvim";
-      rev = "479505abe49a554c0d31104a2fee730188240944";
-      sha256 = "1qgwxxwdqk6nqdaka11p5cpyms1d2h5yqcgq3wfcy8f2j94hpbxg";
+      rev = "2bd059ef683c232f9d6fa898bfe93173f0d4253e";
+      sha256 = "1phyrapplsn5iivl1vfnvg4nfilxdp8digcfy6d9khsbpggjhcmq";
     };
     meta.homepage = "https://github.com/creativenull/efmls-configs-nvim/";
   };
 
   elixir-tools-nvim = buildVimPlugin {
     pname = "elixir-tools.nvim";
-    version = "2024-03-11";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "elixir-tools";
       repo = "elixir-tools.nvim";
-      rev = "4d003f4b41ab9b4f8b569104fa7818f048ed4e25";
-      sha256 = "08qz9azq1m4rfw8s2sd6hhrds5zx0vv2azyjnwyk05q2v95xwl55";
+      rev = "3c4f8344a341818417b3d75c04eb96d894cb4640";
+      sha256 = "1jwqflzdr9qk27gqsd0h4nfi2scq274l2rgbmyccybj5kmdjv654";
     };
     meta.homepage = "https://github.com/elixir-tools/elixir-tools.nvim/";
   };
@@ -3564,12 +3576,12 @@ final: prev:
 
   feline-nvim = buildVimPlugin {
     pname = "feline.nvim";
-    version = "2024-01-05";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "freddiehaddad";
       repo = "feline.nvim";
-      rev = "6cfbe0608d2552a7d947c6f521670b10379fbe42";
-      sha256 = "1hkypnpaws9ijw4k3gqc03y5hmwnjp9jax8k9dxgqiasixk0wqs9";
+      rev = "2aa8b757313cc01f7779865bef7c7cc391753bd8";
+      sha256 = "1xbaa553l7hc2jfgdj9q44xxgv8bkia51w54297p548w90by3kfl";
     };
     meta.homepage = "https://github.com/freddiehaddad/feline.nvim/";
   };
@@ -3612,12 +3624,12 @@ final: prev:
 
   fidget-nvim = buildNeovimPlugin {
     pname = "fidget.nvim";
-    version = "2024-03-20";
+    version = "2024-04-04";
     src = fetchFromGitHub {
       owner = "j-hui";
       repo = "fidget.nvim";
-      rev = "933db4596e4bab1b09b6d48a10e21819e4cc458f";
-      sha256 = "15dngi9zink0sq5nvc2qdag8nr9j9i8qqq8l6hrrb8rdwkr6147j";
+      rev = "1ba38e4cbb24683973e00c2e36f53ae64da38ef5";
+      sha256 = "0g0z1g1nmrjmg9298vg2ski6m41f1yhpas8kr9mi8pa6ibk4m63x";
     };
     meta.homepage = "https://github.com/j-hui/fidget.nvim/";
   };
@@ -3709,12 +3721,12 @@ final: prev:
 
   flit-nvim = buildVimPlugin {
     pname = "flit.nvim";
-    version = "2024-03-20";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "ggandor";
       repo = "flit.nvim";
-      rev = "04f744bbb2b91fb2ad2c702b5eb8e23d17924fa6";
-      sha256 = "1jg7acb4qmq7yb679w1r3jxvf7acgzm9kkpj8i8wnilfy3b6n8xc";
+      rev = "56490317983218b09698f8c960c3669958b12b32";
+      sha256 = "1m1l9dh7gwphf7ry7wzvx1hrha3i9b5alp6kpazpjidnjr1mjzb9";
     };
     meta.homepage = "https://github.com/ggandor/flit.nvim/";
   };
@@ -3769,12 +3781,12 @@ final: prev:
 
   flutter-tools-nvim = buildVimPlugin {
     pname = "flutter-tools.nvim";
-    version = "2024-03-28";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "flutter-tools.nvim";
-      rev = "4f18033c3b78aa5450e538d81dfbbb3e67aeadec";
-      sha256 = "0xppabjh206gppm7ip0h3i6654k951am80v5ckrsksp0q7c7612d";
+      rev = "f04131d6b2c82c2a7624a8843642d6269b50b437";
+      sha256 = "0i8nincmm9jnq36hhgmygq2101993mabya61mmjgpcf96dl1mdwj";
     };
     meta.homepage = "https://github.com/akinsho/flutter-tools.nvim/";
   };
@@ -4021,12 +4033,12 @@ final: prev:
 
   git-blame-nvim = buildVimPlugin {
     pname = "git-blame.nvim";
-    version = "2024-02-29";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "f-person";
       repo = "git-blame.nvim";
-      rev = "a0282d05adbee80aaf4e2ff35b81b52940b67bed";
-      sha256 = "0r678sln1ixgwby2kl6z344iq3dq2xpkyilrq2zpdrq4gfjhmanx";
+      rev = "ad1d1365c9189d89797fe8d559677d5f55dc2830";
+      sha256 = "1saw496nx8pimq1sn0ws2k10cvwg4r5q5dizfclm1rpxfp13485j";
     };
     meta.homepage = "https://github.com/f-person/git-blame.nvim/";
   };
@@ -4067,6 +4079,18 @@ final: prev:
     meta.homepage = "https://github.com/ThePrimeagen/git-worktree.nvim/";
   };
 
+  gitignore-nvim = buildVimPlugin {
+    pname = "gitignore.nvim";
+    version = "2024-03-25";
+    src = fetchFromGitHub {
+      owner = "wintermute-cell";
+      repo = "gitignore.nvim";
+      rev = "2455191ec94da8ed222806a4fe3aa358eac1e558";
+      sha256 = "sha256-p6k0NP3Vne6Kl98YodzSruVmJwxyrXziJj8N7u79o1w=";
+    };
+    meta.homepage = "https://github.com/wintermute-cell/gitignore.nvim/";
+  };
+
   gitignore-vim = buildVimPlugin {
     pname = "gitignore.vim";
     version = "2014-03-16";
@@ -4093,12 +4117,12 @@ final: prev:
 
   gitsigns-nvim = buildNeovimPlugin {
     pname = "gitsigns.nvim";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "gitsigns.nvim";
-      rev = "b45ff86f5618d1421a88c12d4feb286b80a1e2d3";
-      sha256 = "0wdz87n5k1wh0c9kzvrqf163nr33iwyvys2j355ql082qwlywhdq";
+      rev = "035da036e68e509ed158414416c827d022d914bd";
+      sha256 = "1k5qd4k7izirgvc8yvg1hjgfx00f9fml7k0ayzk45lnhzb5c7bah";
     };
     meta.homepage = "https://github.com/lewis6991/gitsigns.nvim/";
   };
@@ -4129,12 +4153,12 @@ final: prev:
 
   gleam-vim = buildVimPlugin {
     pname = "gleam.vim";
-    version = "2024-03-19";
+    version = "2024-04-10";
     src = fetchFromGitHub {
       owner = "gleam-lang";
       repo = "gleam.vim";
-      rev = "6739d8b656adb5d2807675b7652afb6e257b2b1c";
-      sha256 = "15pz1pzcajz6j146my418xr332dnd5rdr1pxssk7nx2bd2brxj3s";
+      rev = "f9e82b70425dc0726ee173ecddf176ffa364e30d";
+      sha256 = "1z4vvrxddhncfnr14a7kqc2k6gwknx8ydvs6n4my0nkz9jxh3v6s";
     };
     meta.homepage = "https://github.com/gleam-lang/gleam.vim/";
   };
@@ -4153,12 +4177,12 @@ final: prev:
 
   go-nvim = buildVimPlugin {
     pname = "go.nvim";
-    version = "2024-03-27";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "go.nvim";
-      rev = "abd282564a31c5dec14e2038ebf04fdac9ea3278";
-      sha256 = "03slm6dwfm62y2fmcfbyja86d51hks6lfcqrd697g5w7qpny5y96";
+      rev = "cbc6aca611cdc664f9bfc3c0a9aa9f9912fa9720";
+      sha256 = "1a1a7ddg70l74ngwwrygg5r39h1yzwws0myzy5jk837lmr909sb1";
     };
     meta.homepage = "https://github.com/ray-x/go.nvim/";
   };
@@ -4201,12 +4225,12 @@ final: prev:
 
   goto-preview = buildVimPlugin {
     pname = "goto-preview";
-    version = "2024-02-17";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "rmagatti";
       repo = "goto-preview";
-      rev = "527fd81a827234e26ca47891abe90497215db2a6";
-      sha256 = "123gbz6313b0qz2ydzv1gi4nlv9a1p0lg2ywp0p365lx3684nqfg";
+      rev = "3552fad4a0244ffd9ac86508e29ccc5166f19eb8";
+      sha256 = "1a7dbzr3sgabcidwls7mnjbdbhjqayh1xfxwhl96ml3cqhari2k7";
     };
     meta.homepage = "https://github.com/rmagatti/goto-preview/";
   };
@@ -4319,6 +4343,18 @@ final: prev:
     meta.homepage = "https://github.com/sainnhe/gruvbox-material/";
   };
 
+  gruvbox-material-nvim = buildVimPlugin {
+    pname = "gruvbox-material.nvim";
+    version = "2024-04-19";
+    src = fetchFromGitHub {
+      owner = "f4z3r";
+      repo = "gruvbox-material.nvim";
+      rev = "9143e172617e708d6588f424772ef20340877dd9";
+      sha256 = "0ad1s2l7vd9h2ycva5wwxisadsiqlr55pfjas23cra8gw5ngn9cj";
+    };
+    meta.homepage = "https://github.com/f4z3r/gruvbox-material.nvim/";
+  };
+
   gruvbox-nvim = buildVimPlugin {
     pname = "gruvbox.nvim";
     version = "2024-01-29";
@@ -4393,35 +4429,35 @@ final: prev:
 
   hardhat-nvim = buildVimPlugin {
     pname = "hardhat.nvim";
-    version = "2024-04-01";
+    version = "2024-04-03";
     src = fetchFromGitHub {
       owner = "TheSnakeWitcher";
       repo = "hardhat.nvim";
-      rev = "9d9f03c27319198ca6f692ce4b12b50bc8ca9d9f";
-      sha256 = "156cpcnjgsdynk0d8h8rmcczsi4ipbcdflc12kcnb9a5c87lgk4h";
+      rev = "ad39b73b07aab7d1f48a624ba6f3ae35ad0a2e56";
+      sha256 = "0fpn0sif0y7xrp8f01fkz0qq0c29l6r5shc6q9bvl32dzp7n2ryp";
     };
     meta.homepage = "https://github.com/TheSnakeWitcher/hardhat.nvim/";
   };
 
   hardtime-nvim = buildVimPlugin {
     pname = "hardtime.nvim";
-    version = "2024-03-17";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "hardtime.nvim";
-      rev = "21b0f9146198bb43fbc9f5ec66c8af3234f278ed";
-      sha256 = "0i95llvcgdwizhxr7ml8hvb1r9mwm0j19z143i7acbfy0dv4sdcd";
+      rev = "eaf4bc31b86419c26ad7b3a142dd36ca545ca2e4";
+      sha256 = "0z2ppcfqd9zkhmr8xkckq7a7a8pjgma0f6jyyzg83yb3f4443yhw";
     };
     meta.homepage = "https://github.com/m4xshen/hardtime.nvim/";
   };
 
   hare-vim = buildVimPlugin {
     pname = "hare.vim";
-    version = "2024-04-01";
+    version = "2024-04-21";
     src = fetchgit {
       url = "https://git.sr.ht/~sircmpwn/hare.vim";
-      rev = "d88953356be21eccd3a61671ba50bdd527d0f537";
-      sha256 = "0hab1j7hycz44k3k0bymyp865gmj8mms4rhq51ri3rl5dilm7f5d";
+      rev = "960c7a342609f373414c1e7fe4be0dcc369716ff";
+      sha256 = "1dzpp050gl1a39vdmn57941qzxmyws0x1fqykq82babppn23hzpb";
     };
     meta.homepage = "https://git.sr.ht/~sircmpwn/hare.vim";
   };
@@ -4464,12 +4500,12 @@ final: prev:
 
   haskell-tools-nvim = buildNeovimPlugin {
     pname = "haskell-tools.nvim";
-    version = "2024-03-25";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "haskell-tools.nvim";
-      rev = "b53d4f2faef93c4b85c1510adef280747b37ec67";
-      sha256 = "0lai1w94256x458rhpkmkjy276m6rwql89calqbdvb4ci3hwzv7b";
+      rev = "4fdb49333093c0a8aae35cfac68e71cf595666ef";
+      sha256 = "0qgrkxmqzlp1z5zxkdzy37lwfc7y3bpqgiy17hxszdrjy6n44vih";
     };
     meta.homepage = "https://github.com/MrcJkb/haskell-tools.nvim/";
   };
@@ -4631,24 +4667,24 @@ final: prev:
 
   hop-nvim = buildVimPlugin {
     pname = "hop.nvim";
-    version = "2024-01-01";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "smoka7";
       repo = "hop.nvim";
-      rev = "6d853addd6e11df8338b26e869a29b36f2c3e893";
-      sha256 = "0h7dcrqyb5d67pxg4pmky4cw3qhl1z8z217nxnkvrwxfdl0khwn8";
+      rev = "059e88e9dcaad3280ea1fd5c757f6904f274aed5";
+      sha256 = "1m5li7gy18d4z2fzzm6ipghn67m2i9a5fq7v1l6qy3vxgh9vzrq7";
     };
     meta.homepage = "https://github.com/smoka7/hop.nvim/";
   };
 
   hotpot-nvim = buildVimPlugin {
     pname = "hotpot.nvim";
-    version = "2024-03-28";
+    version = "2024-04-04";
     src = fetchFromGitHub {
       owner = "rktjmp";
       repo = "hotpot.nvim";
-      rev = "0b5d34f00836400ca80f68dfcd56b2a110c323d6";
-      sha256 = "0z0h4b574s2dvvxzw5rpmajjxhkhh4v25d3mrr33y14lczn9fjaa";
+      rev = "5c96b423a6663c91c47d6184f810acf1dacf4615";
+      sha256 = "136jawqxirrs130ka15hnbwlgplrkisahcv91v4avcbr46rx09d6";
     };
     meta.homepage = "https://github.com/rktjmp/hotpot.nvim/";
   };
@@ -4751,12 +4787,12 @@ final: prev:
 
   image-nvim = buildNeovimPlugin {
     pname = "image.nvim";
-    version = "2024-03-30";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "3rd";
       repo = "image.nvim";
-      rev = "a0b756d589c1623ebbfe344666e6d7c49bdc9d71";
-      sha256 = "15c6pz8hhb3mnahzppx46mx0xwq4gc85j7xc5rpjf5jf6ra346z3";
+      rev = "301de7919b2c0378cb7a782663f67abbcb198b17";
+      sha256 = "0cxqffdync3hfg7xfahwnsd5rwz1gd2mqcgsgm615qbx364as8d9";
     };
     meta.homepage = "https://github.com/3rd/image.nvim/";
   };
@@ -5064,12 +5100,12 @@ final: prev:
 
   jsonfly-nvim = buildVimPlugin {
     pname = "jsonfly.nvim";
-    version = "2024-04-12";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "Myzel394";
       repo = "jsonfly.nvim";
-      rev = "539a0b79a5ea75d201e1e90cebfe9367154d04fc";
-      sha256 = "1v1i4x2px0zs65rxkf2yhnxn6clx33vdr54r9gaqq713qj5ddlfm";
+      rev = "e47fd7713b083120af6cdb1548de8af513a0ec6f";
+      sha256 = "0wnjzqx68kqwza2pnaazmp1l986pys86ncj8hrdfcp4nvmz2i3xv";
     };
     meta.homepage = "https://github.com/Myzel394/jsonfly.nvim/";
   };
@@ -5088,12 +5124,12 @@ final: prev:
 
   jupytext-nvim = buildVimPlugin {
     pname = "jupytext.nvim";
-    version = "2024-03-25";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "GCBallesteros";
       repo = "jupytext.nvim";
-      rev = "6e439dc048986bcc00f8ba8695cb452de932127b";
-      sha256 = "1y0mi94q97lykvk4pzx3x6ifgns09pvj08xyv5274j2ykp4hmm9d";
+      rev = "c8baf3ad344c59b3abd461ecc17fc16ec44d0f7b";
+      sha256 = "1lz8ajcy9gm02bwgq5rr5ppx4g1irzvgx074mqmbv7xawij5241c";
     };
     meta.homepage = "https://github.com/GCBallesteros/jupytext.nvim/";
   };
@@ -5208,12 +5244,12 @@ final: prev:
 
   lazy-lsp-nvim = buildVimPlugin {
     pname = "lazy-lsp.nvim";
-    version = "2024-03-26";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "dundalek";
       repo = "lazy-lsp.nvim";
-      rev = "d341dd528ad6c2199ab20911ed6b56db43af6e3a";
-      sha256 = "1bjgpbf9v91pw9x6r23dl6d5cchvl8s4d8fvrbd09jjacbswc1v8";
+      rev = "19d2a4de3a57deed4aab304704c1f5e77454f4f3";
+      sha256 = "089drz8djyhsksi19ixcpfnci7ag121gsj17cq2a91l8m430j0y4";
     };
     meta.homepage = "https://github.com/dundalek/lazy-lsp.nvim/";
   };
@@ -5244,12 +5280,12 @@ final: prev:
 
   lean-nvim = buildVimPlugin {
     pname = "lean.nvim";
-    version = "2024-03-29";
+    version = "2024-04-09";
     src = fetchFromGitHub {
       owner = "Julian";
       repo = "lean.nvim";
-      rev = "023cde8c59ecd02b7478587737450a88041d5856";
-      sha256 = "0ivdflbk1qqshnmf5pyn9xn7dn3jbygnyvyqn532d3ic85vqiafi";
+      rev = "2828898ad6f6ac6c1c9f404d72bd3d56546b0c72";
+      sha256 = "16wxih5nhdybzrm04z18cjwhjvdxq3yjdsq02v7q4kxwkbz5sy1a";
     };
     meta.homepage = "https://github.com/Julian/lean.nvim/";
   };
@@ -5280,24 +5316,24 @@ final: prev:
 
   leap-nvim = buildVimPlugin {
     pname = "leap.nvim";
-    version = "2024-04-01";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "ggandor";
       repo = "leap.nvim";
-      rev = "7a9407d17fab3a1c3cfe201965d680a408776152";
-      sha256 = "1nfkcn6xbrzklmx2v1rjzim9wp26w82hay3vhfhvkylzmil8vjqx";
+      rev = "626be4c4ec040aeaf6466c9aae17ee0ab09f1a5b";
+      sha256 = "1glf2xf4frr1in0yyar3aybmhrymrn5lzc261jdflpi749yfhadi";
     };
     meta.homepage = "https://github.com/ggandor/leap.nvim/";
   };
 
   legendary-nvim = buildVimPlugin {
     pname = "legendary.nvim";
-    version = "2024-03-29";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "mrjones2014";
       repo = "legendary.nvim";
-      rev = "3a47364508503f0f44e26433cd0c0e4876f2136e";
-      sha256 = "183s62zjkamsxf0g78vl2isgrd1373r90lp1jn6p7j9lkwv49v73";
+      rev = "02a7799750a56865c58e3ea58e13b19ae1d2dc31";
+      sha256 = "1y7v6xa9n620vlzcvvcf7xc1pfbzidz7ybr7yf1k30gyv3sxpp4j";
     };
     meta.homepage = "https://github.com/mrjones2014/legendary.nvim/";
   };
@@ -5592,12 +5628,12 @@ final: prev:
 
   lsp-overloads-nvim = buildVimPlugin {
     pname = "lsp-overloads.nvim";
-    version = "2024-02-03";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "Issafalcon";
       repo = "lsp-overloads.nvim";
-      rev = "6b023414d7a6264ce1880148f1a61cf10294546e";
-      sha256 = "1svxn4kvhr666hcjfm3qii03wl2djxch52ffn7a2fggv7116vjnn";
+      rev = "be3486a501fdda84ea91a0949178b75e8476030d";
+      sha256 = "097vn7y6gal2fimpvvqm70jz6im3pnb370dxvc7zmw1yrr3zjhc4";
     };
     meta.homepage = "https://github.com/Issafalcon/lsp-overloads.nvim/";
   };
@@ -5628,12 +5664,12 @@ final: prev:
 
   lsp-zero-nvim = buildVimPlugin {
     pname = "lsp-zero.nvim";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "VonHeikemen";
       repo = "lsp-zero.nvim";
-      rev = "74441a6309cf12232da52520e210387dc95412f8";
-      sha256 = "0q96939hfqn29svgqrj1cskmxiax5h05yz8lxqmhn9cvpkzm5s4k";
+      rev = "b93f040edd57888cd6a1e7d9dee47dddc4463f8f";
+      sha256 = "02nhnm7lfdrx6yfwm754khndkq4732qnv99j91d46q68xi305p0n";
     };
     meta.homepage = "https://github.com/VonHeikemen/lsp-zero.nvim/";
   };
@@ -5711,12 +5747,12 @@ final: prev:
 
   ltex_extra-nvim = buildVimPlugin {
     pname = "ltex_extra.nvim";
-    version = "2024-02-03";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "barreiroleo";
       repo = "ltex_extra.nvim";
-      rev = "42dd3572cb09b52a137e91e515f2dff5eb631b1e";
-      sha256 = "1hirgy2w7lqn22qb20xkcxd7p1212wvra1xbyy43ky3an0bn6ivs";
+      rev = "4296c2c7aefbca721d02a011366a1de30598046c";
+      sha256 = "07ql6j5m3sdkwdn273xmqryksrz4ggw3plgxr4f6n7s07jq05qrs";
     };
     meta.homepage = "https://github.com/barreiroleo/ltex_extra.nvim/";
   };
@@ -5735,24 +5771,24 @@ final: prev:
 
   lualine-nvim = buildVimPlugin {
     pname = "lualine.nvim";
-    version = "2024-03-21";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "nvim-lualine";
       repo = "lualine.nvim";
-      rev = "b5e8bb642138f787a2c1c5aedc2a78cb2cebbd67";
-      sha256 = "0c2ncxj66p90r3wmc0y96ywqbmvll9gr5zpfs3gfv558q7ky4rzv";
+      rev = "0a5a66803c7407767b799067986b4dc3036e1983";
+      sha256 = "1llhfs5wgv87k5hv8mdyv4qjpw37zq27488lq0j063jicxszdhar";
     };
     meta.homepage = "https://github.com/nvim-lualine/lualine.nvim/";
   };
 
   luasnip = buildNeovimPlugin {
     pname = "luasnip";
-    version = "2024-04-02";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "l3mon4d3";
       repo = "luasnip";
-      rev = "825a61bad1d60d917a7962d73cf3c683f4e0407e";
-      sha256 = "002ksxnplfmvwclm1713x2m25zd8dkjm6bhfxv56r24i174h3dfb";
+      rev = "03c8e67eb7293c404845b3982db895d59c0d1538";
+      sha256 = "1abfssd3352kp7r54rnbl85cjz1cbxl4w48vr437k1dr6b3zcgcq";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/l3mon4d3/luasnip/";
@@ -5772,12 +5808,12 @@ final: prev:
 
   lush-nvim = buildNeovimPlugin {
     pname = "lush.nvim";
-    version = "2024-03-17";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "rktjmp";
       repo = "lush.nvim";
-      rev = "bc12f010b34cfeefac35720656eb777753b165d9";
-      sha256 = "06am05fcipfxz8nfr6yg8yhkcdir53asl9h3k40hl0sscx4a03s9";
+      rev = "7c0e27f50901481fe83b974493c4ea67a4296aeb";
+      sha256 = "0cacfxrvm1fx73q5mch72gglrg6hvi39w78wgfb7dfkby1j8hl8r";
     };
     meta.homepage = "https://github.com/rktjmp/lush.nvim/";
   };
@@ -5856,24 +5892,24 @@ final: prev:
 
   mason-lspconfig-nvim = buildVimPlugin {
     pname = "mason-lspconfig.nvim";
-    version = "2024-03-22";
+    version = "2024-04-06";
     src = fetchFromGitHub {
       owner = "williamboman";
       repo = "mason-lspconfig.nvim";
-      rev = "9dfcf2036c223920826140f0151d929a43f9eceb";
-      sha256 = "18fhp9qgadxh8csp1l91m61kxycb302dlcy7d1yvqmvvrhwmsl1j";
+      rev = "44509689b9bf3984d729cc264aacb31cb7f41668";
+      sha256 = "1z65m3hfx1avi4wfzsf8ypin5d37j3mcipay9rnriwhc8q8vwbb1";
     };
     meta.homepage = "https://github.com/williamboman/mason-lspconfig.nvim/";
   };
 
   mason-tool-installer-nvim = buildVimPlugin {
     pname = "mason-tool-installer.nvim";
-    version = "2024-02-13";
+    version = "2024-04-11";
     src = fetchFromGitHub {
       owner = "WhoIsSethDaniel";
       repo = "mason-tool-installer.nvim";
-      rev = "1212fb6082b7177dde17ea65e429e027835aeb40";
-      sha256 = "0zrdpdqklmk1f9gsim209x28h4qisf1hljmwq2imc4lzpwca39kc";
+      rev = "b129892f783740e6cf741f2ea09fa5dd512aa584";
+      sha256 = "08152z7smaxv82v7ivp92n58lvr3ys7976795k0pxi8a99qj9kw7";
     };
     meta.homepage = "https://github.com/WhoIsSethDaniel/mason-tool-installer.nvim/";
   };
@@ -5904,12 +5940,12 @@ final: prev:
 
   material-nvim = buildVimPlugin {
     pname = "material.nvim";
-    version = "2024-03-27";
+    version = "2024-04-04";
     src = fetchFromGitHub {
       owner = "marko-cerovac";
       repo = "material.nvim";
-      rev = "ba56aeea3db29c8c9ffd55158aed7b2e6a749a46";
-      sha256 = "1j19q1lczx57s6qci76rxhi0wxp6k5f7ivcsg1pq5g439wj2vab8";
+      rev = "772e41a7f33743224f30799a3a887dc7dd853f8d";
+      sha256 = "0knb5d6z1hjzn3ib0nznv54rpyyk0ms6g2na59apmcwdqh1wyz6a";
     };
     meta.homepage = "https://github.com/marko-cerovac/material.nvim/";
   };
@@ -6000,12 +6036,12 @@ final: prev:
 
   mini-nvim = buildVimPlugin {
     pname = "mini.nvim";
-    version = "2024-04-02";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "echasnovski";
       repo = "mini.nvim";
-      rev = "5d841fcca666bc27ca777807a63381ce2cf6e2f9";
-      sha256 = "0sg82lbzf1s7qkmvc4sdpw25nms61xgdym2pqk8szmm400jk74n1";
+      rev = "e623d29561746637b49d30d6434338f88f44e856";
+      sha256 = "1if6r4w7qpi3d0z1zdwfwz211n5rfiizxvjjsywdb4659ap5b0mw";
     };
     meta.homepage = "https://github.com/echasnovski/mini.nvim/";
   };
@@ -6036,12 +6072,12 @@ final: prev:
 
   mkdnflow-nvim = buildVimPlugin {
     pname = "mkdnflow.nvim";
-    version = "2024-03-04";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "jakewvincent";
       repo = "mkdnflow.nvim";
-      rev = "0a42aa3c7c2c982a1503e63ce8f0f065e0eb63df";
-      sha256 = "1p5vwzl48bgfzxk4nwxlyf98ymjyglm44942lpm8al908ysnpwc2";
+      rev = "3486f98dfed4cfbfa83922f73c7189cc88e9e2f2";
+      sha256 = "055kcpcjbr011rmccns63k21sg8x24yn9f2r45n30pl92irpvmqa";
     };
     meta.homepage = "https://github.com/jakewvincent/mkdnflow.nvim/";
   };
@@ -6072,12 +6108,12 @@ final: prev:
 
   modus-themes-nvim = buildVimPlugin {
     pname = "modus-themes.nvim";
-    version = "2024-03-24";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "miikanissi";
       repo = "modus-themes.nvim";
-      rev = "7cef53b10b6964a0be483fa27a3d66069cefaa6c";
-      sha256 = "0lvr83jirmcn5k8704wmz3kgcc3fhxfmi5yjk7acwih7ib7x821q";
+      rev = "08b7268c59f6d4b4030107d9b9fa934f4063d9e7";
+      sha256 = "10f9m8jji4yq7pxbrk46wi2s4awvshm8hi6wq50ckwsabfn1wjb5";
     };
     meta.homepage = "https://github.com/miikanissi/modus-themes.nvim/";
   };
@@ -6096,24 +6132,24 @@ final: prev:
 
   molten-nvim = buildVimPlugin {
     pname = "molten-nvim";
-    version = "2024-03-31";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "benlubas";
       repo = "molten-nvim";
-      rev = "66b11de7c3132dcc4521d50039ce2b5f81e64ca2";
-      sha256 = "0wijwv3mw3qvr3zmjq1f5mr89l66rrj8pgiyy8a6h4sxrna8wv9x";
+      rev = "f3a40c744d177862682f0787eef7e5ab0f4e0118";
+      sha256 = "1p9x9zqb3lsi6gzp9n0yh62w69im265yg2xp1dfhvzg3nn2s7pkw";
     };
     meta.homepage = "https://github.com/benlubas/molten-nvim/";
   };
 
   monokai-pro-nvim = buildVimPlugin {
     pname = "monokai-pro.nvim";
-    version = "2024-04-01";
+    version = "2024-04-09";
     src = fetchFromGitHub {
       owner = "loctvl842";
       repo = "monokai-pro.nvim";
-      rev = "8940b2f87343db96ee2c62404a4e4ff9257ed514";
-      sha256 = "1vnzyikp9mf4wgs5rh666vjpmk3y7ccz4kwaq8ib47l8kcrywxy7";
+      rev = "aafde73a622435891d36b411d8623e705ead6293";
+      sha256 = "14cdrkglg0swn5nfs23z0j7jpf5gjdm1cgz1arhi1afi8dx8cr6g";
     };
     meta.homepage = "https://github.com/loctvl842/monokai-pro.nvim/";
   };
@@ -6144,12 +6180,12 @@ final: prev:
 
   multicursors-nvim = buildVimPlugin {
     pname = "multicursors.nvim";
-    version = "2024-02-21";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "smoka7";
       repo = "multicursors.nvim";
-      rev = "8b3e14682eed06a532b155c7eae33e174846b3fd";
-      sha256 = "02ar7m9g92lg7rhz7l1vm2sn8c353wk1rvl32wdbqsbi70ac8pi7";
+      rev = "b959ad0f38881e81e757208c6adfc9e6dc24dfc7";
+      sha256 = "0x4v0bpahwqcrwqv5nc0hnfc0qyc21sgd996h5nksnxykrxvf462";
     };
     meta.homepage = "https://github.com/smoka7/multicursors.nvim/";
   };
@@ -6408,12 +6444,12 @@ final: prev:
 
   neo-tree-nvim = buildVimPlugin {
     pname = "neo-tree.nvim";
-    version = "2024-03-21";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "nvim-neo-tree";
       repo = "neo-tree.nvim";
-      rev = "16d1b194376bf1fc2acd89ccb3c29ba8315bfcea";
-      sha256 = "0imgbzf9k98az077zqscf82iilf5rlkawxci2c1p3djb3nf8h43m";
+      rev = "25bfdbe802eb913276bb83874b043be57bd70347";
+      sha256 = "12z784x1ij1j3dnh71dcx2a0vcz5pnlls00j01gadybxbz4r6y39";
     };
     meta.homepage = "https://github.com/nvim-neo-tree/neo-tree.nvim/";
   };
@@ -6432,24 +6468,24 @@ final: prev:
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "2024-04-02";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "f41d28e3f9c873de17ecab12e767fc8cfd94c7a2";
-      sha256 = "10ycpk5ipvb8rafx1bpakm6r3c07vqskbjv87cxqy3bk4nc3smq8";
+      rev = "19cd99ec623de29a9d0e649b606a13d1775058af";
+      sha256 = "16dj2b3vw9zv7p01qiyf6wnnn3lwrh271kx3b4gismg1zbbrhzwi";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
   };
 
   neocord = buildVimPlugin {
     pname = "neocord";
-    version = "2024-03-28";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "IogaMaster";
       repo = "neocord";
-      rev = "6269823e78a2d2d8c3954068da196879cf2f0fe6";
-      sha256 = "1hsjp04gfdrpb1z5ij2psnyap66ism19pxg6d8n05sgzv6v7p4b5";
+      rev = "014e78cff9f1fc7b3b46ec67fdca68a91a9b7c65";
+      sha256 = "1dyw315fhh6fll1gxq764yqlrd7xb153y4g7dvc7rih9rnqi3h4m";
     };
     meta.homepage = "https://github.com/IogaMaster/neocord/";
   };
@@ -6480,12 +6516,12 @@ final: prev:
 
   neoformat = buildVimPlugin {
     pname = "neoformat";
-    version = "2024-03-30";
+    version = "2024-04-07";
     src = fetchFromGitHub {
       owner = "sbdchd";
       repo = "neoformat";
-      rev = "29e8d9c1e1da985e363d8f87c417adfdd50a5a75";
-      sha256 = "13xggjfk8fqxbghyyw7138jvl1i14bam2xacn1v9a2bd7a0iyxza";
+      rev = "4372abb846f43ec121df40e620682c985ebc8286";
+      sha256 = "1wk6vzigd6kbjfqfbayv5jbrr9lvmkxqc9b4fj5r90qqcqmfp399";
     };
     meta.homepage = "https://github.com/sbdchd/neoformat/";
   };
@@ -6504,12 +6540,12 @@ final: prev:
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "2024-03-31";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "c0b1d4dfc8ba6371857868ca7c4d33954cf002fd";
-      sha256 = "1sqgwp835wjz0cb1j5gfdxvfml1wz9zrgj81973b4dqdqzfcqkm9";
+      rev = "0cae7abc30cb91d661f28257c331fcb5b5198e31";
+      sha256 = "0alyscd5qhh30p6bsd3qr2h7qsc57yb4g8c0g7abc5z0jsw58cg9";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
   };
@@ -6576,36 +6612,36 @@ final: prev:
 
   neorg = buildVimPlugin {
     pname = "neorg";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg";
-      rev = "89f9a79179e179e9e0d96d6adce14473bed896bc";
-      sha256 = "1mfq1d6s8npnm35hflz80zxiln7wx1d4m90zpbb4vhv7nap975za";
+      rev = "e03e82bdf6a2c3173f6e417a63087c7255533b81";
+      sha256 = "1n83wjzxd7y8cmbxgmszxlh3anb32cbrzk9zrlfdpawyn2dyby48";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg/";
   };
 
   neorg-telescope = buildVimPlugin {
     pname = "neorg-telescope";
-    version = "2024-02-10";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg-telescope";
-      rev = "418f8fd4bd7360d954613a2322b4eb2888ac3ad9";
-      sha256 = "0r09xwvzb2ma25ngfiilwd9i6ci2llkv98scdzjkq5z96m1h6vnx";
+      rev = "92c1c6064429c74505de8e5d84a6dc8488a6f8e3";
+      sha256 = "0varnp4wm1sp9mr8yglj2kb5wl8cdf4q9ymxf3szvbv2xw1bbnb2";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg-telescope/";
   };
 
   neoscroll-nvim = buildVimPlugin {
     pname = "neoscroll.nvim";
-    version = "2024-03-10";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "karb94";
       repo = "neoscroll.nvim";
-      rev = "21d52973bde32db998fc8b6590f87eb3c3c6d8e4";
-      sha256 = "1hxf9218asn22lpa28zb6kmj64a8ak4njxj0whl60a1p0349s4qb";
+      rev = "c513218d864d4ccfdaaea991c6de67bdb84bc116";
+      sha256 = "0i6xy9xqplv9aii148g1nnwv3shnjqiq9m0gab6gav9l6144mzz9";
     };
     meta.homepage = "https://github.com/karb94/neoscroll.nvim/";
   };
@@ -6648,24 +6684,24 @@ final: prev:
 
   neotest = buildNeovimPlugin {
     pname = "neotest";
-    version = "2024-03-20";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest";
-      rev = "e07fe8241112274aae9947b98d255763738a1d52";
-      sha256 = "0wcsngcpz8ih6s5amnm1c7c09xr4xsi2bil5iiw8vlr8gbrj8rl2";
+      rev = "f03a78cef74db5638e4312e18b767294a90de8da";
+      sha256 = "1lvwmgicnqm5r7wg0325ijjfkyl5wyawx7hbzmlmr87g3z1cp62j";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest/";
   };
 
   neotest-bash = buildVimPlugin {
     pname = "neotest-bash";
-    version = "2023-11-18";
+    version = "2024-04-15";
     src = fetchFromGitHub {
       owner = "rcasia";
       repo = "neotest-bash";
-      rev = "2eaad2ae4577fadf4af1eec32ec169d0fb2698bb";
-      sha256 = "0w1x9ya843pa8514974frdd8qmzycnvj418igni4y3wy3s0dc65v";
+      rev = "a3480f53300842922ecb79693e64bf51d4f22337";
+      sha256 = "1dbjv5zyw5nqqwgqagq0q2255byzgc9ckrzsbm2dc7svqp04hki9";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/rcasia/neotest-bash/";
@@ -6697,12 +6733,12 @@ final: prev:
 
   neotest-dotnet = buildVimPlugin {
     pname = "neotest-dotnet";
-    version = "2024-03-13";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "Issafalcon";
       repo = "neotest-dotnet";
-      rev = "15943dd05e2d4d9393531b647ad661e60820c608";
-      sha256 = "0vcx6avfbsjxv3nwbmy6101yb33msx6s3l1mzmnb7rprgcy53zm5";
+      rev = "3844d16706d7655f4c84387bdb68eb8fb0155ef2";
+      sha256 = "0dh66m1yyzzsrcxrhaydqm7ymqspggnd345c8mfjprp7312x3yc5";
     };
     meta.homepage = "https://github.com/Issafalcon/neotest-dotnet/";
   };
@@ -6771,24 +6807,24 @@ final: prev:
 
   neotest-haskell = buildVimPlugin {
     pname = "neotest-haskell";
-    version = "2024-03-25";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "neotest-haskell";
-      rev = "a4e73415548d2de91912d9f015cced49e82af4c0";
-      sha256 = "171qrv5nmdywz8zakc73hi1rkrdy6j63p582igbsf83zp06hnswk";
+      rev = "0367f44e49aa64d8b66fc9f736a61e9a60ce9526";
+      sha256 = "1yb9l9gac08sqx6maxhfhb1dj796l48gflx1l59l4fxm9sw7djkj";
     };
     meta.homepage = "https://github.com/MrcJkb/neotest-haskell/";
   };
 
   neotest-java = buildVimPlugin {
     pname = "neotest-java";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "rcasia";
       repo = "neotest-java";
-      rev = "9af20dbc445f568b5f6b6f3241f07259ee95cfe8";
-      sha256 = "1v87jb7fm3xgnhzfxbp6wn5dk4m8r0asff4d0ap3zcc4sr771cl5";
+      rev = "68dd64e296c6da73aacd7ad795ac789e15087ee6";
+      sha256 = "03iap2dsawqj1c8jac6lm1knc16ikiwzgp7hnpv2k43vny52l492";
     };
     meta.homepage = "https://github.com/rcasia/neotest-java/";
   };
@@ -6807,12 +6843,12 @@ final: prev:
 
   neotest-minitest = buildVimPlugin {
     pname = "neotest-minitest";
-    version = "2024-04-01";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "zidhuss";
       repo = "neotest-minitest";
-      rev = "45718d7995d590aae1371e3758f1f0f582ec0f6f";
-      sha256 = "1wk1qyqzi1v6c9b84fg06mkjwyl2x5jgcbfmji4a94r4pnrhpx8b";
+      rev = "f56e5a84fc89aafb6e0be368a58ad1a6f8723444";
+      sha256 = "18xi436a164ly3d1wb0a8pzsa1fb8rshqm4r9rp0da85ms2nl14c";
     };
     meta.homepage = "https://github.com/zidhuss/neotest-minitest/";
   };
@@ -6879,24 +6915,24 @@ final: prev:
 
   neotest-rspec = buildVimPlugin {
     pname = "neotest-rspec";
-    version = "2024-04-01";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "neotest-rspec";
-      rev = "b27bb629d201a2fd24d453d68b44d73bf801c665";
-      sha256 = "0lcf4pwhwimjq77gymyg4z5x0rva4rb6l9v6kibh9sl8cm9zfnn7";
+      rev = "c1c3f36e1b1a23698534e6326e90876f87b773a4";
+      sha256 = "0yfd23mkvpzddgxxsfnzcix0qr4l1cjfk0i8crw8kzb01n6dh5v3";
     };
     meta.homepage = "https://github.com/olimorris/neotest-rspec/";
   };
 
   neotest-rust = buildVimPlugin {
     pname = "neotest-rust";
-    version = "2024-02-28";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "rouge8";
       repo = "neotest-rust";
-      rev = "9e9df68064bd6fa3b5e40b32fcb7c52af130cdbf";
-      sha256 = "0h8fhylg1rhgjxjhg2d3y77fhril6ng3cj49yz2g8hh1p5xassfr";
+      rev = "0418811e1e3499b2501593f2e131d02f5e6823d4";
+      sha256 = "1ffa0in8zvw6fc9lwga67s9gjqmvn1a69i3wpajrslf2d0ngmw3y";
     };
     meta.homepage = "https://github.com/rouge8/neotest-rust/";
   };
@@ -6927,12 +6963,12 @@ final: prev:
 
   neotest-vitest = buildVimPlugin {
     pname = "neotest-vitest";
-    version = "2024-03-12";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "marilari88";
       repo = "neotest-vitest";
-      rev = "102e7494bbe0f205d28c31a3fd75a9dfbcc78c73";
-      sha256 = "03j5vfqryi419d5x0ssxpasx93jkpraj2vhwfclbhwfjf1d20jkl";
+      rev = "6965a714793d9d156dadbe734c99b3a307f65c61";
+      sha256 = "0dxcnkvhdlxlxa6vrjfgn5pfi3a2g78c3xz13sxggw559wmzp9lr";
     };
     meta.homepage = "https://github.com/marilari88/neotest-vitest/";
   };
@@ -6951,12 +6987,12 @@ final: prev:
 
   neovim-ayu = buildVimPlugin {
     pname = "neovim-ayu";
-    version = "2024-02-05";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "Shatur";
       repo = "neovim-ayu";
-      rev = "0a9804db5c08dba63be9774a57e4214fd0473ce1";
-      sha256 = "17324y4ywxmijappa9sb194xc2mwa8ijfxvb3s4302bnd6ggdw7h";
+      rev = "e03beacbc51f1a985d7a4b69828fd7612a4151e0";
+      sha256 = "1yf3j0lqcsng1ksq5wb1l8pcw6r9f6apzn6y2w5j431sm2by5jw4";
     };
     meta.homepage = "https://github.com/Shatur/neovim-ayu/";
   };
@@ -7095,24 +7131,24 @@ final: prev:
 
   night-owl-nvim = buildVimPlugin {
     pname = "night-owl.nvim";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "oxfist";
       repo = "night-owl.nvim";
-      rev = "1afa7f158feb79987ca0d017f65558492e6c8a8e";
-      sha256 = "1gypvdfbg7s3l3j9hlf6n2d22pjq4q54xv48gsg2zvczzg3c77ww";
+      rev = "94aead739b6223feb19650077c9694e6c1c63fbf";
+      sha256 = "0baw75s3r09pf747rm3mni07pszkba5ykk1vky2lqq2ga7xplalf";
     };
     meta.homepage = "https://github.com/oxfist/night-owl.nvim/";
   };
 
   nightfox-nvim = buildVimPlugin {
     pname = "nightfox.nvim";
-    version = "2024-03-18";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "EdenEast";
       repo = "nightfox.nvim";
-      rev = "e352a32e0f54feb2550ebdab815ae8f7f26ed63b";
-      sha256 = "11r0hlabysrxqxsh09c42mqfy2zzi6gkafkwqi430ngxc09yzln0";
+      rev = "ce0cdf8538c8c0b9c8fb2884d3d1090c8faf515d";
+      sha256 = "09hij99myk1ry8sik71sd2cdicaqrhidpkay6yzs0j67wr0705yv";
     };
     meta.homepage = "https://github.com/EdenEast/nightfox.nvim/";
   };
@@ -7155,12 +7191,12 @@ final: prev:
 
   nlsp-settings-nvim = buildVimPlugin {
     pname = "nlsp-settings.nvim";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "tamago324";
       repo = "nlsp-settings.nvim";
-      rev = "5c4e0796937a3d732f8d489188d55312d802050a";
-      sha256 = "12pvrvcd339y8f0pzx398fn7c4shjmdy68xq7rfq6bg245mnd04j";
+      rev = "78064fe0dbb67d2f449854bd2fe7fc2b1af0a8c0";
+      sha256 = "0yh9xalsj4y2yh7avabvnw2jj7b1nl1amsxmcxm9jiz0xw50nkbf";
     };
     meta.homepage = "https://github.com/tamago324/nlsp-settings.nvim/";
   };
@@ -7227,12 +7263,12 @@ final: prev:
 
   none-ls-nvim = buildVimPlugin {
     pname = "none-ls.nvim";
-    version = "2024-04-02";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "nvimtools";
       repo = "none-ls.nvim";
-      rev = "fff481b65d88415933b9574dc0e1947724bcf64a";
-      sha256 = "0qpnsj7pd7lg9qli3pgwxk8m50k65866mxk1id42n85v558hd9nx";
+      rev = "88821b67e6007041f43b802f58e3d9fa9bfce684";
+      sha256 = "09mv5ndk0xnij3nv2p1qcm6k59xh0j2nl949960d24aln4h354dl";
     };
     meta.homepage = "https://github.com/nvimtools/none-ls.nvim/";
   };
@@ -7323,12 +7359,12 @@ final: prev:
 
   nvchad = buildVimPlugin {
     pname = "nvchad";
-    version = "2024-03-26";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "nvchad";
-      rev = "6833c60694a626615911e379d201dd723511546d";
-      sha256 = "0wdl610n3060ipsplsb8rrlpxa1xh72vpczpmwswdvwp3y67lmy4";
+      rev = "f8e6c59985f1d5f820f051395e88064a8d16ef2a";
+      sha256 = "1ss67kpn8lkgcdj90yjg69dfdy3w2v32znqc2nbl6hblgmxfakd4";
     };
     meta.homepage = "https://github.com/nvchad/nvchad/";
   };
@@ -7347,12 +7383,12 @@ final: prev:
 
   nvim-FeMaco-lua = buildVimPlugin {
     pname = "nvim-FeMaco.lua";
-    version = "2023-10-21";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "AckslD";
       repo = "nvim-FeMaco.lua";
-      rev = "6af458f0196215f397db31a6e1fb2df795811693";
-      sha256 = "0pvdbk48pyqvi75pzpsz9wsvhfrp5rya2dbccg2gfx3h5yvks6fn";
+      rev = "96bbf843595dbe865838b3f2484b73557f34700c";
+      sha256 = "0lqqjzzysl5n152z2j93fk536w2vdi67hss76ai881jr9l4xscvq";
     };
     meta.homepage = "https://github.com/AckslD/nvim-FeMaco.lua/";
   };
@@ -7371,36 +7407,36 @@ final: prev:
 
   nvim-autopairs = buildVimPlugin {
     pname = "nvim-autopairs";
-    version = "2024-03-20";
+    version = "2024-04-06";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "dbfc1c34bed415906395db8303c71039b3a3ffb4";
-      sha256 = "1xbyx5fy9mp8x2yshah810zxdkm8f94ng64al2kpx8rjf7iqk28z";
+      rev = "4f41e5940bc0443fdbe5f995e2a596847215cd2a";
+      sha256 = "0cfi0wmqy8vrrf17s71jyg6c5s8ghb7xjapzhj9l9l6g1s7v9bxm";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
   };
 
   nvim-bacon = buildVimPlugin {
     pname = "nvim-bacon";
-    version = "2024-02-12";
+    version = "2024-04-10";
     src = fetchFromGitHub {
       owner = "Canop";
       repo = "nvim-bacon";
-      rev = "3f8e7a80a0e715952a3066fefe7447f1347207ca";
-      sha256 = "sha256-jIoRzMjOZlTHR7q4piyY7MjEUgZIR5pjobfOdY/IpeM=";
+      rev = "94f684baacf22c65e5ef889cfa943cfc90ee1cf4";
+      sha256 = "0b4xpmk6cv6k9h2vqk9773hszwy90d7y3fpjz1yqg9nxfvbdjp2b";
     };
     meta.homepage = "https://github.com/Canop/nvim-bacon/";
   };
 
   nvim-biscuits = buildVimPlugin {
     pname = "nvim-biscuits";
-    version = "2023-03-28";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "code-biscuits";
       repo = "nvim-biscuits";
-      rev = "0224be36b60588e88b21b8244a0bcd069699720e";
-      sha256 = "1pw7ad9x4jn1ciam72bdc2087mrmxwr4przivfpkhjj6vjgfpn1v";
+      rev = "ff1d12c8b47cd28723da593b2cfa2e98391d439a";
+      sha256 = "18dvvg32nxrdp1ydbvxrzkdg7q214naq2bphs7y1s9zmjhyj25pm";
     };
     meta.homepage = "https://github.com/code-biscuits/nvim-biscuits/";
   };
@@ -7563,12 +7599,12 @@ final: prev:
 
   nvim-dap = buildVimPlugin {
     pname = "nvim-dap";
-    version = "2024-03-25";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "405df1dcc2e395ab5173a9c3d00e03942c023074";
-      sha256 = "00mmxasay25ha4l63jrn3b440xp7k39xr2al6d3kmw9mw1hyg0hy";
+      rev = "6ae8a14828b0f3bff1721a35a1dfd604b6a933bb";
+      sha256 = "0a75lxhzbwm66c1fa5b7zpsz3i7raljsbq4d3n5h8cfdv8hgcjch";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
@@ -7587,12 +7623,12 @@ final: prev:
 
   nvim-dap-python = buildVimPlugin {
     pname = "nvim-dap-python";
-    version = "2024-02-19";
+    version = "2024-04-10";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap-python";
-      rev = "66560f0ebddf96604f7037e1efad3ba6942761e6";
-      sha256 = "0yc96r53iy0iim2nkl3rz5fza148fs6wk9y9k19k90ilzhh2ay3k";
+      rev = "3dffa58541d1f52c121fe58ced046268c838d802";
+      sha256 = "0kjcv8wvh7hwr9wy2najyrxz88fa4s7djz2lnmz2gfrmqhihibjl";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap-python/";
   };
@@ -7611,12 +7647,12 @@ final: prev:
 
   nvim-dap-virtual-text = buildVimPlugin {
     pname = "nvim-dap-virtual-text";
-    version = "2024-03-10";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "nvim-dap-virtual-text";
-      rev = "baa5b0dc6663284cce32e0d00ac1f2511b13496f";
-      sha256 = "136qm88phwbyn5zdbr6xnw0hvsa7zcycxyg5anhfdc1vxdsh8lfm";
+      rev = "3e8e207513e6ef520894950acd76b79902714103";
+      sha256 = "1jsb5l4vda1qgsf8qpnz18gniw1fliia5hgap0l7xl40syvcczzm";
     };
     meta.homepage = "https://github.com/theHamsta/nvim-dap-virtual-text/";
   };
@@ -7695,36 +7731,36 @@ final: prev:
 
   nvim-highlight-colors = buildVimPlugin {
     pname = "nvim-highlight-colors";
-    version = "2024-04-01";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "brenoprata10";
       repo = "nvim-highlight-colors";
-      rev = "ca3731eab0cff414722a5c9c43a3ba06577cb250";
-      sha256 = "1z0y0xh9kyk3p2dyr5qfy7y67dawqc6d58g37ii1nxf81bi2lf3h";
+      rev = "432dc7a817a4973041f02b418169667c491f60fd";
+      sha256 = "1x2791sbifpwk3rzakggja7gr7s4icainaqyhg2x587vw26739cc";
     };
     meta.homepage = "https://github.com/brenoprata10/nvim-highlight-colors/";
   };
 
   nvim-highlite = buildVimPlugin {
     pname = "nvim-highlite";
-    version = "2024-03-21";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "Iron-E";
       repo = "nvim-highlite";
-      rev = "0962a3a5f206676d7111cd56185b28d5498a0f88";
-      sha256 = "1w75kp9dq34294k01a73pialzah875mm4xgfg9h3wdh6zdhjl1jk";
+      rev = "e1f68ff238802fdee67c3f8ac547c1832ae2b8ee";
+      sha256 = "1n1iqhn67q3fzff4kvqz2ikp5scjbb2wls267aamdqg8apq5dpq1";
     };
     meta.homepage = "https://github.com/Iron-E/nvim-highlite/";
   };
 
   nvim-hlslens = buildVimPlugin {
     pname = "nvim-hlslens";
-    version = "2024-03-22";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-hlslens";
-      rev = "c42b4526e6d83b904eb5f3d50e68d7c2fc4be4b5";
-      sha256 = "13lwshdjrqn9f827xfbnd8pdqk8ild3j2p4xbmwi2lskm17i0vhi";
+      rev = "3e8fceb2b030100857ee72741a8f48c9a1d8595e";
+      sha256 = "0j6i7rv78xxkmqgmi4w7yqhj4rng7p2skbgs8gq8jcb3k6ghcs3q";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-hlslens/";
   };
@@ -7826,12 +7862,12 @@ final: prev:
 
   nvim-lint = buildVimPlugin {
     pname = "nvim-lint";
-    version = "2024-04-01";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "6670b3ac73fa4caf720f017b91c619e9424d955e";
-      sha256 = "0pwx4l64glhx8cxrka3ms6xl9i9rf1lwsx6brzm0hdragb1lnaqr";
+      rev = "f098232d70cebe90e27404928c9bc19ca7a5a7b5";
+      sha256 = "1xnirwlnby8fr99qkcicwd1npmkx7i557jzvgxfv4m8f4b2vw923";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -7862,12 +7898,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPlugin {
     pname = "nvim-lspconfig";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "96e5711040df23583591391ce49e556b8cd248d8";
-      sha256 = "0jlqjhi6x3g8w80mqbnmybh5lmf8cw0lnyywhhdkc5plpzh43j0c";
+      rev = "ed8b8a15acc441aec669f97d75f2c1f2ac8c8aa5";
+      sha256 = "0rqjcksb0dcvvxnc0r4n499xlkviwp2sbn29r8b1bnf68d7qnapx";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -7982,12 +8018,12 @@ final: prev:
 
   nvim-nio = buildNeovimPlugin {
     pname = "nvim-nio";
-    version = "2024-04-02";
+    version = "2024-04-04";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "nvim-nio";
-      rev = "173f285eebb410199273fa178aa517fd2d7edd80";
-      sha256 = "0favgnfpsak44lzyzyhfavazr2i64l7ysk370xm4wbrb51kjsdkf";
+      rev = "5800f585def265d52f1d8848133217c800bcb25d";
+      sha256 = "0y3afl42z41ymksk29al5knasmm9wmqzby860x8zj0i0mfb1q5k5";
     };
     meta.homepage = "https://github.com/nvim-neotest/nvim-nio/";
   };
@@ -8150,12 +8186,12 @@ final: prev:
 
   nvim-spectre = buildVimPlugin {
     pname = "nvim-spectre";
-    version = "2024-03-27";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "nvim-pack";
       repo = "nvim-spectre";
-      rev = "2b012554a2536465243c0dff3605b5927c49ed23";
-      sha256 = "09v8pw7a4p0k7aib7yhzadifg9pm8amzqvql3rwx9b95d793710x";
+      rev = "9653847cf2f225648967f6e9363643e327387579";
+      sha256 = "15866wdyck6snm0iz9iqd036wqkbfwnliwd5f220r9g5v3cwg5lg";
     };
     meta.homepage = "https://github.com/nvim-pack/nvim-spectre/";
   };
@@ -8174,12 +8210,12 @@ final: prev:
 
   nvim-surround = buildVimPlugin {
     pname = "nvim-surround";
-    version = "2024-02-27";
+    version = "2024-04-11";
     src = fetchFromGitHub {
       owner = "kylechui";
       repo = "nvim-surround";
-      rev = "84a26afce16cffa7e3322cfa80a42cddf60616eb";
-      sha256 = "04sapqxwj4siwv5b0zxhv5vxmc653109bkk7yn6g5bckmwkdg2dq";
+      rev = "a4e30d33add8a9743b4f518b3a788b3c8e5def71";
+      sha256 = "09m95jd84y3b2wrair263f0csqqdx8h45fjq9jrr4f3108494xc1";
     };
     meta.homepage = "https://github.com/kylechui/nvim-surround/";
   };
@@ -8222,36 +8258,36 @@ final: prev:
 
   nvim-tree-lua = buildVimPlugin {
     pname = "nvim-tree.lua";
-    version = "2024-03-31";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-tree.lua";
-      rev = "d8d3a1590a05b2d8b5eb26e2ed1c6052b1b47a77";
-      sha256 = "1b2h5hxngzplf3gi72r07s2zrlgyk4213yqs208xrqry2svd9ih0";
+      rev = "ae8e46e8fabb32fa3ae5319383ea2c8763f14caa";
+      sha256 = "0cb4p6bndid12h2bjdj5ybksqjmwv1876jx5a2wlj6h0q50wfjs0";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-tree.lua/";
   };
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "cc0e29727a9651e27869b7444e835c44fb1e7b4c";
-      sha256 = "1lnpmbj0nz33dv5b2kf6p39bxknjfcwqc7qsj5rzsxf4ycf73jig";
+      rev = "ea4f6d5175812a3f48302d638a766bc18fcbb04a";
+      sha256 = "0smghl0nv4w1rpn7gqsq6lbarh5nzbhvi8pfysh5f7am0p42y86m";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
 
   nvim-treesitter-context = buildVimPlugin {
     pname = "nvim-treesitter-context";
-    version = "2024-03-22";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter-context";
-      rev = "f19766163c18515fb4d3c12d572bf9cba6cdb990";
-      sha256 = "1ivaaj3fq33dynrmw67l3m2hfdklyb2f269a2brra613qm84ac48";
+      rev = "ba4289ad345ececd335a9cdd7b9616fd0bb6be92";
+      sha256 = "0cfklfz2anc8021qi0q8dbrdmnndnd073azgsiwaagbh75s3sgh1";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-context/";
   };
@@ -8294,12 +8330,12 @@ final: prev:
 
   nvim-treesitter-textobjects = buildVimPlugin {
     pname = "nvim-treesitter-textobjects";
-    version = "2024-04-03";
+    version = "2024-04-15";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter-textobjects";
-      rev = "acffd3476eb340faef0ec07e48060b817386b973";
-      sha256 = "1mw5dn52dx1lmh98254hj44c4nlwxaf4j5i9fla9fg1g71rc521k";
+      rev = "23b820146956b3b681c19e10d3a8bc0cbd9a1d4c";
+      sha256 = "1jvx9nbz5sh09jnlcqm5qfyjvryibc3fpnfxim7adk5gb4160xws";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-textobjects/";
   };
@@ -8330,12 +8366,12 @@ final: prev:
 
   nvim-ts-context-commentstring = buildVimPlugin {
     pname = "nvim-ts-context-commentstring";
-    version = "2024-03-27";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "joosepalviste";
       repo = "nvim-ts-context-commentstring";
-      rev = "734ebad31c81c6198dfe102aa23280937c937c42";
-      sha256 = "114w2xkb1warjbs6r3z75pzb8k6087j3xlpi5z4nnxcjk1sj03v0";
+      rev = "a6382f744f584bbf71d0a563af789af7190aabda";
+      sha256 = "12b12ndva3ck5y18mkmhzkbmaz65kjkqsjxvq5gfniz1br7n2y9j";
     };
     meta.homepage = "https://github.com/joosepalviste/nvim-ts-context-commentstring/";
   };
@@ -8366,12 +8402,12 @@ final: prev:
 
   nvim-web-devicons = buildVimPlugin {
     pname = "nvim-web-devicons";
-    version = "2024-03-26";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-web-devicons";
-      rev = "3ee60deaa539360518eaab93a6c701fe9f4d82ef";
-      sha256 = "1a0z8canxpr5vlnmkqpys35yar8l296gdznqlvvvf1200wai3i8v";
+      rev = "beb6367ab8496c9e43f22e0252735fdadae1872d";
+      sha256 = "1qqwfzfk5w2sfaavfa2nn01caj753j272hpnhmvgwknfgvl9cv81";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-web-devicons/";
   };
@@ -8414,12 +8450,12 @@ final: prev:
 
   nvim_context_vt = buildVimPlugin {
     pname = "nvim_context_vt";
-    version = "2024-01-15";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "andersevenrud";
       repo = "nvim_context_vt";
-      rev = "8f7b6b46292e0819290b0d368abc3366b8a163fc";
-      sha256 = "06njpi7zr0m7kwcrw2pwnhhmaij49p810bsdkav0ynkcszf60402";
+      rev = "4b89241c19909f18d2f6b58777c413c027600fcc";
+      sha256 = "116j5k4nznsldiv752rhxlsjzr2cha1zclxrffiqlnbldiyr5i8i";
     };
     meta.homepage = "https://github.com/andersevenrud/nvim_context_vt/";
   };
@@ -8450,12 +8486,12 @@ final: prev:
 
   obsidian-nvim = buildVimPlugin {
     pname = "obsidian.nvim";
-    version = "2024-04-01";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "epwalsh";
       repo = "obsidian.nvim";
-      rev = "d70f3289399c25153b7f503b838afbf981124a37";
-      sha256 = "1528p9rhh5gkl726m5r367zdi4wd1yln0l0crg19n0gnif2l8gj4";
+      rev = "ec0f44e1921d2701bd99a542031d280f1e3930b5";
+      sha256 = "1b9b72yrp1xfkag41hxjk903payfrcnjdi7lr5880183mm0im04w";
     };
     meta.homepage = "https://github.com/epwalsh/obsidian.nvim/";
   };
@@ -8486,24 +8522,24 @@ final: prev:
 
   octo-nvim = buildVimPlugin {
     pname = "octo.nvim";
-    version = "2024-04-03";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "pwntester";
       repo = "octo.nvim";
-      rev = "a511b52fbf040f928a24deb72e17ec465613b442";
-      sha256 = "0jrcqxjbv24qa9k701l1bxyz20s0wj9jkr8vxx68j3z51idjygqn";
+      rev = "5646539320cd62af6ff28f48ec92aeb724c68e18";
+      sha256 = "1qknswy3hs9lkwbs4pqqbsngyvk7ibl6lhdl0df46ymzpmpkkb8h";
     };
     meta.homepage = "https://github.com/pwntester/octo.nvim/";
   };
 
   oil-nvim = buildVimPlugin {
     pname = "oil.nvim";
-    version = "2024-03-18";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "oil.nvim";
-      rev = "e462a3446505185adf063566f5007771b69027a1";
-      sha256 = "1pg1sakc1lka2j9nbdy4hqfhg4gc9csbrmpbhsyxwb8p2n4zyiiq";
+      rev = "1f05774e1c2dbc1940104b5c950d5c7b65ec6e0b";
+      sha256 = "0l6y9xnz8l7flq0jlh9xxnsp9inny9mbbqg2j2sg0rivq630bbnh";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/oil.nvim/";
@@ -8667,48 +8703,48 @@ final: prev:
 
   openscad-nvim = buildVimPlugin {
     pname = "openscad.nvim";
-    version = "2024-03-12";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "salkin-mada";
       repo = "openscad.nvim";
-      rev = "5c35ce921a63d59f2a0bb20d872c15a0d4c8aa72";
-      sha256 = "1l3xhv670apfjns12xzhf7sn3mf3gdd3xiyirydrnp7bxy7dyv1h";
+      rev = "bf99a48bff318ceb28646d27f29f925ba0b10af0";
+      sha256 = "1b90bfwwnz9iwwr89whpqn939m5bvw8cpiysc8yaq3yy46gzvkw7";
     };
     meta.homepage = "https://github.com/salkin-mada/openscad.nvim/";
   };
 
   orgmode = buildVimPlugin {
     pname = "orgmode";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "nvim-orgmode";
       repo = "orgmode";
-      rev = "207d12c8683090195d290c46b00f684ec941f20e";
-      sha256 = "1ff4sxq671iwk3c4qbsj9disdb5iaa0ynhq88slmq045ndbjz2bh";
+      rev = "389e91f6f935aa845bc0cd13dd80f75431c34751";
+      sha256 = "1fzckfi00bb4mi5l9wadhgv98z7fmlgryx24zipcr7k98pdaw36h";
     };
     meta.homepage = "https://github.com/nvim-orgmode/orgmode/";
   };
 
   other-nvim = buildVimPlugin {
     pname = "other.nvim";
-    version = "2024-02-05";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "rgroli";
       repo = "other.nvim";
-      rev = "d36a66af270b63459c080d4589126a06cf56578c";
-      sha256 = "015is3pyjn0jrmz03vsvyiiy8fgwrpd1syfq3zmspyyki7blclcl";
+      rev = "2a82971d3763474df29d5d32d0699b5bb13c551f";
+      sha256 = "1jxiyabkg3y8fcnms9rms844038hjmynbg9wykfmn7n38sxig300";
     };
     meta.homepage = "https://github.com/rgroli/other.nvim/";
   };
 
   otter-nvim = buildVimPlugin {
     pname = "otter.nvim";
-    version = "2024-03-25";
+    version = "2024-04-09";
     src = fetchFromGitHub {
       owner = "jmbuhr";
       repo = "otter.nvim";
-      rev = "145a7b0c3c40f4e62fc6c0bc9721e2cfe8f95471";
-      sha256 = "0a2rpxnvx35xafp19n163hba3p3247sqnwkgdhaka54yx4gx091q";
+      rev = "e67aa5082c65eeffd8a57b672e1353e8cf2ca7a9";
+      sha256 = "0223cmm4hg9c9ywifr0c7zk091ny5sndarkq7sa9vk5vmar5sz15";
     };
     meta.homepage = "https://github.com/jmbuhr/otter.nvim/";
   };
@@ -8727,12 +8763,12 @@ final: prev:
 
   overseer-nvim = buildVimPlugin {
     pname = "overseer.nvim";
-    version = "2024-03-24";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "overseer.nvim";
-      rev = "b04b0b105c07b4f02b3073ea3a98d6eca90bf152";
-      sha256 = "1j9ch2n1hxrc0vs48v753jg56jxcv79j96rvbag8f7z7gbl5agpy";
+      rev = "dd701ed0639ef1e10d0ca8dec039719e916c4a7b";
+      sha256 = "1xr0xzf5h1r8ax6djvq1vq936yqmvwa4l0hbjqq090mgnj60arh5";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/overseer.nvim/";
@@ -9162,12 +9198,12 @@ final: prev:
 
   qmk-nvim = buildVimPlugin {
     pname = "qmk.nvim";
-    version = "2024-02-15";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "codethread";
       repo = "qmk.nvim";
-      rev = "67c1a94b10f7266ac01b0a2431dade70693edba9";
-      sha256 = "sha256-YKp9/unDL52guKRHI50DSPV8nXyPqAHY9mEHUMHFhmc=";
+      rev = "cfa6cecae362d23778cd97317d33ab12671e157c";
+      sha256 = "0p44i25iyryrvy1sf3bp10as39mgd6da1gai332rv2ky3zgc3lbh";
     };
     meta.homepage = "https://github.com/codethread/qmk.nvim/";
   };
@@ -9246,11 +9282,11 @@ final: prev:
 
   rainbow-delimiters-nvim = buildVimPlugin {
     pname = "rainbow-delimiters.nvim";
-    version = "2024-03-23";
+    version = "2024-04-18";
     src = fetchgit {
       url = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
-      rev = "580bc045c7ab3ab3ebd267774038c0d8cc19c789";
-      sha256 = "1jqxlikp8y2qs9sd48dvwvpim4276kw3a32k85n6nfkvlwjspkqp";
+      rev = "7ef0766b5cd2f5cdf4fcb08886f0a2ebf65981fa";
+      sha256 = "0pw3dk0rnaa2llvgkqar1j5wqrh3lah2ygvxaqiy7760pyanh38c";
     };
     meta.homepage = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
   };
@@ -9389,12 +9425,12 @@ final: prev:
 
   rest-nvim = buildNeovimPlugin {
     pname = "rest.nvim";
-    version = "2024-03-27";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "rest-nvim";
       repo = "rest.nvim";
-      rev = "a1221086cfdeb58de393f4bbae11063c6c8c075c";
-      sha256 = "0agjc2jz6jh3k2hm942rdslpypsdxj2i8r1mm0dlqswbl853c9lj";
+      rev = "20c5b5259afa7f4867474cc463211d64c93ba371";
+      sha256 = "0ysmzf2lfry8abaajjanp3b3358nbgd2d2zs9qfjyrbk0fmqw0gc";
     };
     meta.homepage = "https://github.com/rest-nvim/rest.nvim/";
   };
@@ -9509,12 +9545,12 @@ final: prev:
 
   rustaceanvim = buildNeovimPlugin {
     pname = "rustaceanvim";
-    version = "2024-04-01";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "mrcjkb";
       repo = "rustaceanvim";
-      rev = "e2dbf91daed26d4dd7263affbecbf9a36e0096e5";
-      sha256 = "1mk8v1mdkxib9kaypy7kb76yga7zj5zyqka8zhnhn9h4v4kqdj8z";
+      rev = "dd4d5d8d1313f0bb343af90e2432ad2f2a9fedaf";
+      sha256 = "1zph7b9vdd96xai19g6di48r5p5px0pz8kkq5hfkriq2apygpb99";
     };
     meta.homepage = "https://github.com/mrcjkb/rustaceanvim/";
   };
@@ -9557,12 +9593,12 @@ final: prev:
 
   scnvim = buildVimPlugin {
     pname = "scnvim";
-    version = "2024-01-11";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "davidgranstrom";
       repo = "scnvim";
-      rev = "8929739543e5a4dc51d1af1d122bdbbb54e634b9";
-      sha256 = "1mm3lp5q6fvrlmq84637y7gjf04917xz8v1y0jkp2g4hi6v119nc";
+      rev = "94e49fa6c596813247549cd594f5ab6246c79973";
+      sha256 = "1axbrakr3xpmvbdslh803xam72fg6ar428bgz04h0j2ygg75bqmy";
     };
     meta.homepage = "https://github.com/davidgranstrom/scnvim/";
   };
@@ -9750,12 +9786,12 @@ final: prev:
 
   smart-splits-nvim = buildVimPlugin {
     pname = "smart-splits.nvim";
-    version = "2024-03-29";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "mrjones2014";
       repo = "smart-splits.nvim";
-      rev = "50f52146e4504a3fc0f0d5830c8560a16a95dd08";
-      sha256 = "07ca4mn1rlxy11ayfw89i2vvcndd0p4lpfqyzdzd99vnm0cxg2ml";
+      rev = "95d11bfc83263236431ead7dc017f5ab0ff992ca";
+      sha256 = "0x9s5801si869gh7jazlfd9asiwk5fkr1gv67qf7bs55pc0z9rbf";
     };
     meta.homepage = "https://github.com/mrjones2014/smart-splits.nvim/";
   };
@@ -9979,12 +10015,12 @@ final: prev:
 
   sqlite-lua = buildVimPlugin {
     pname = "sqlite.lua";
-    version = "2024-02-19";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "kkharji";
       repo = "sqlite.lua";
-      rev = "40701b6151f8883980c1548647116de39b763540";
-      sha256 = "106j1zzsr97jr0pk6ri2jxdpvqc2ci7g8rlsbb5s30lsqr4ix0ah";
+      rev = "d0ffd703b56d090d213b497ed4eb840495f14a11";
+      sha256 = "1nj0yqrr8dzjva14irp10g0c6xbnv3wm1igkl2cc7c8f3bddrfwx";
     };
     meta.homepage = "https://github.com/kkharji/sqlite.lua/";
   };
@@ -10099,12 +10135,12 @@ final: prev:
 
   statuscol-nvim = buildVimPlugin {
     pname = "statuscol.nvim";
-    version = "2024-02-23";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "luukvbaal";
       repo = "statuscol.nvim";
-      rev = "d954893262a57a92e46edd87de67e2b3fe72305e";
-      sha256 = "1i8nvhbrcsinydd1ppnrw6lr3izh1dwp860hr7axyfjgqxgx39f8";
+      rev = "483b9a596dfd63d541db1aa51ee6ee9a1441c4cc";
+      sha256 = "0dvpfbyvsalim5ml37vprh5ay9brdjfpcn08rgg77xp6pcjrk2qb";
     };
     meta.homepage = "https://github.com/luukvbaal/statuscol.nvim/";
   };
@@ -10159,12 +10195,12 @@ final: prev:
 
   suda-vim = buildVimPlugin {
     pname = "suda.vim";
-    version = "2024-03-12";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "lambdalisue";
       repo = "suda.vim";
-      rev = "66727b416837836712975e748bc8a19fb6cf4ec3";
-      sha256 = "09lbnx6mrqsrn6fvcp3mb6mkwbrkdrvr5rgzp43idj0ipm5j809h";
+      rev = "04469d855e36fffcda6be036eb7ff005f64fa0d6";
+      sha256 = "18igbn0ldh3mwf8qlnfbbidk88l1wfjx1v95dmdwd1xif642bppn";
     };
     meta.homepage = "https://github.com/lambdalisue/suda.vim/";
   };
@@ -10329,12 +10365,12 @@ final: prev:
 
   tabout-nvim = buildVimPlugin {
     pname = "tabout.nvim";
-    version = "2024-02-18";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "abecodes";
       repo = "tabout.nvim";
-      rev = "6a8f4e67a9bfc9bfc9989cc45253180598cc4339";
-      sha256 = "0j4n6f8k2054v77pm458q0qf36ipyk31lplm2m4fszxq0sq0kmwp";
+      rev = "c442ae7788c30dbd41d259c51df4046cb8269a96";
+      sha256 = "0rd451fz9i6wbyzjrdkjz4phwlq8fz1lcgmbdjrjxvax3hkpbbqx";
     };
     meta.homepage = "https://github.com/abecodes/tabout.nvim/";
   };
@@ -10449,12 +10485,12 @@ final: prev:
 
   telekasten-nvim = buildVimPlugin {
     pname = "telekasten.nvim";
-    version = "2024-02-27";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "renerocksai";
       repo = "telekasten.nvim";
-      rev = "a684d6ebe7026944b0a5323219d5f5364511e5b2";
-      sha256 = "03hsj2rfhllpxy0x8nr5sjp2krfg51ib0771bqmwycnlfg3cp1bw";
+      rev = "24fd8c1e7eb989dba9efa5d174e42870f08da8fb";
+      sha256 = "1ky0035jar8i06k8w4mkizbcyiib393zk3cwr14fnsvq94jp23bs";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/renerocksai/telekasten.nvim/";
@@ -10486,12 +10522,12 @@ final: prev:
 
   telescope-coc-nvim = buildVimPlugin {
     pname = "telescope-coc.nvim";
-    version = "2024-03-02";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "fannheyward";
       repo = "telescope-coc.nvim";
-      rev = "421f50c56d66bc8f39c5deec05532deb071b597d";
-      sha256 = "1cf6990fkrzbagwphzkyh10i30hrv8vbqgmf4znva3ms1ad7ilhf";
+      rev = "55ca0d6960eb1c32f9f7967fa71926f7bad484a8";
+      sha256 = "0yzw9k406q1ixascqw8maw9raqny6cc0cp1idmdsrp8dnvl954v8";
     };
     meta.homepage = "https://github.com/fannheyward/telescope-coc.nvim/";
   };
@@ -10522,12 +10558,12 @@ final: prev:
 
   telescope-frecency-nvim = buildVimPlugin {
     pname = "telescope-frecency.nvim";
-    version = "2024-03-25";
+    version = "2024-04-06";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-frecency.nvim";
-      rev = "2a22815b0928087a5989e2a8e836b13b46015505";
-      sha256 = "0jar21cac5q0blpfc25hyfi1kxxx18maw0mvjnpi5awygggxxwx7";
+      rev = "94a532cb9c4713db83acf5432f5aadfd096e2af9";
+      sha256 = "17243ls89kdalb0vlx84blwxan9g8xdin9fvzyk5xkb8b1wbpz5p";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-frecency.nvim/";
   };
@@ -10607,12 +10643,12 @@ final: prev:
 
   telescope-manix = buildNeovimPlugin {
     pname = "telescope-manix";
-    version = "2024-03-31";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "telescope-manix";
-      rev = "b61eaf260d02da734228e0d54c3999b9b8340d5e";
-      sha256 = "1asih4ycx4219zhidsyvlw95rv83vpvx8bdb7ivzsqjnv92s70f4";
+      rev = "bd6b110a08cc5b7c098020325ff55218a5b249da";
+      sha256 = "1dj6bdx98596l2lnjcdd2c5zm5j00cid0kdb0zd6vhv1jfw8zqsx";
     };
     meta.homepage = "https://github.com/MrcJkb/telescope-manix/";
   };
@@ -10752,12 +10788,12 @@ final: prev:
 
   telescope-nvim = buildNeovimPlugin {
     pname = "telescope.nvim";
-    version = "2024-04-02";
+    version = "2024-04-21";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope.nvim";
-      rev = "4626aaa2bcfdacf55fd6d44b430e2df81b2403ff";
-      sha256 = "0rzdasr1lavdrxk7kszi0ari3di48zfki70himrc1m2qs89pa6ph";
+      rev = "7d1698f3d88b448e0639974248cc17f49b7b8acf";
+      sha256 = "1k3fhgpakr1b8x9fk7sq699h3479k8x9yc3jbq7xq2jk7p0n4m62";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope.nvim/";
   };
@@ -10860,12 +10896,12 @@ final: prev:
 
   texpresso-vim = buildVimPlugin {
     pname = "texpresso.vim";
-    version = "2024-03-08";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "let-def";
       repo = "texpresso.vim";
-      rev = "04816dcdddc27e6c50fc2a4faff0ef1675a7ee8e";
-      sha256 = "08lzl0g1b287agscd345yg9cmxsj2vlbg83s1mgsa13qn81y6jga";
+      rev = "30f9b8277b18326e0aa6882fb96d51bc1b40a222";
+      sha256 = "1iagc7kld327mkkravk30dz2a0dq4i8718w0k1jrlj0z54981gbn";
     };
     meta.homepage = "https://github.com/let-def/texpresso.vim/";
   };
@@ -11005,12 +11041,12 @@ final: prev:
 
   toggleterm-nvim = buildVimPlugin {
     pname = "toggleterm.nvim";
-    version = "2024-02-12";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "toggleterm.nvim";
-      rev = "193786e0371e3286d3bc9aa0079da1cd41beaa62";
-      sha256 = "0cz6i3xa61mh8s5b9b2z008ay85ggaw02ak9w58wzgmn172q770l";
+      rev = "dca1c80fb8ec41c97e7c3ef308719d8143fbbb05";
+      sha256 = "11rmk7hpmf75n0lgchj7hvsw9915m493hlgqsmjkkyhs9w0bwb4n";
     };
     meta.homepage = "https://github.com/akinsho/toggleterm.nvim/";
   };
@@ -11209,12 +11245,12 @@ final: prev:
 
   typst-vim = buildVimPlugin {
     pname = "typst.vim";
-    version = "2024-03-25";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "kaarmu";
       repo = "typst.vim";
-      rev = "86e4fa8dcddd032f9fdbf04602417a8baac8fed3";
-      sha256 = "1rhiz5lbkq3d6pd0g07hj9gwk359vyk2vqsj0h4dmkvz6vlnnjv2";
+      rev = "d9a7650e76c85f8ba437e056d08dd43b01b8bfd6";
+      sha256 = "1l4mq2m8s7kav6hpq6nay4xyy2jvq6jbblyy100yfb9nrzkpggpc";
     };
     meta.homepage = "https://github.com/kaarmu/typst.vim/";
   };
@@ -11245,12 +11281,12 @@ final: prev:
 
   undotree = buildVimPlugin {
     pname = "undotree";
-    version = "2024-03-08";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "mbbill";
       repo = "undotree";
-      rev = "aa93a7e5890dbbebbc064cd22260721a6db1a196";
-      sha256 = "110w9nr24rph717w1vs3vhfq1ggsjgq91zvyp431qxpa7wzd5pyk";
+      rev = "56c684a805fe948936cda0d1b19505b84ad7e065";
+      sha256 = "1yy7y344b906z04rrnvy2hkrgsrxjm6ij399qmfw8b20rxdyi2jh";
     };
     meta.homepage = "https://github.com/mbbill/undotree/";
   };
@@ -11269,12 +11305,12 @@ final: prev:
 
   unison = buildVimPlugin {
     pname = "unison";
-    version = "2024-04-01";
+    version = "2024-04-17";
     src = fetchFromGitHub {
       owner = "unisonweb";
       repo = "unison";
-      rev = "80fc452dd8cd325436fb8da1dcd54510348c89de";
-      sha256 = "0ndmfsxy4scwahv3917ylxjn59lih9q1rha636h2xq4bcmgbcifb";
+      rev = "ac4d817f5e18a0b462b23dcd124f849633d650fe";
+      sha256 = "00dsvdqp02bf8zvnk8ljn0f38wb38h8iabsrarycl2a3v6jr8lgr";
     };
     meta.homepage = "https://github.com/unisonweb/unison/";
   };
@@ -11341,12 +11377,12 @@ final: prev:
 
   venn-nvim = buildVimPlugin {
     pname = "venn.nvim";
-    version = "2023-11-05";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "jbyuki";
       repo = "venn.nvim";
-      rev = "e4d68341a73dd56c64955058821a58295fb337b1";
-      sha256 = "181sr7p8qn67br64ahg5vhb9b7m9mldwlg27nsgs0hc33vagvr1h";
+      rev = "a5430d75875acbe93e9685cdeb78c6eb2a329ed5";
+      sha256 = "1dwl75chqbp888yp2ykyqszz0glli2vx2cbw3lsgnrzlhql53alm";
     };
     meta.homepage = "https://github.com/jbyuki/venn.nvim/";
   };
@@ -11377,12 +11413,12 @@ final: prev:
 
   vim-CtrlXA = buildVimPlugin {
     pname = "vim-CtrlXA";
-    version = "2024-03-27";
+    version = "2024-04-07";
     src = fetchFromGitHub {
       owner = "Konfekt";
       repo = "vim-CtrlXA";
-      rev = "56a7041a393f08594dc34865ddddc724bffa7684";
-      sha256 = "1gw2793hdw7m1k5837ynnzvbb1ikgyhzi6lv817cdfgxa5kkqsh0";
+      rev = "cb520cd3f9248b9ede236ff3da8ca3e0b68b6459";
+      sha256 = "1csbmjrdrlqsagz5b6hryrcglfdplwc7d26q4r20w37zx3f9qzw3";
     };
     meta.homepage = "https://github.com/Konfekt/vim-CtrlXA/";
   };
@@ -12205,12 +12241,12 @@ final: prev:
 
   vim-code-dark = buildVimPlugin {
     pname = "vim-code-dark";
-    version = "2023-11-11";
+    version = "2024-04-11";
     src = fetchFromGitHub {
       owner = "tomasiser";
       repo = "vim-code-dark";
-      rev = "8def3d890b2087ee4c42af03117d7edc7d693706";
-      sha256 = "129mrz3jxw4kgbg5lz9gc7rznsjp2fbjvi60zyrpkmv8xa6yhmpw";
+      rev = "05d7843412c4fb7d1bdafefd04462ac4db841f0f";
+      sha256 = "1ycb94cdady4x1bv957zcndrsk16ia54q5kg1k8r8x0ir0gclmac";
     };
     meta.homepage = "https://github.com/tomasiser/vim-code-dark/";
   };
@@ -12289,12 +12325,12 @@ final: prev:
 
   vim-commentary = buildVimPlugin {
     pname = "vim-commentary";
-    version = "2024-01-12";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-commentary";
-      rev = "f67e3e67ea516755005e6cccb178bc8439c6d402";
-      sha256 = "0r5jlxkxfy5gvpkmzsfkxzlgydn477qiywqlng4xbaw3pijcf04i";
+      rev = "c4b8f52cbb7142ec239494e5a2c4a512f92c4d07";
+      sha256 = "1v16mnjm8gr540w6smvwbpn1zmjimzwi74a8d165a1yacnmdm6pf";
     };
     meta.homepage = "https://github.com/tpope/vim-commentary/";
   };
@@ -12601,12 +12637,12 @@ final: prev:
 
   vim-easy-align = buildVimPlugin {
     pname = "vim-easy-align";
-    version = "2019-04-29";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "vim-easy-align";
-      rev = "12dd6316974f71ce333e360c0260b4e1f81169c3";
-      sha256 = "0gpfdla8shaf5ykgakrsf0h0w6ygvwcv3lfpnki24l790xhdi606";
+      rev = "9815a55dbcd817784458df7a18acacc6f82b1241";
+      sha256 = "028gcsvmihw3nmc4pp9zyh8na29i6h0fhihk060ka2y3rn5xc9zl";
     };
     meta.homepage = "https://github.com/junegunn/vim-easy-align/";
   };
@@ -12913,12 +12949,12 @@ final: prev:
 
   vim-floaterm = buildVimPlugin {
     pname = "vim-floaterm";
-    version = "2024-04-02";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "voldikss";
       repo = "vim-floaterm";
-      rev = "fe61226f8990bb4d36fa274fdc5f6079535cedeb";
-      sha256 = "0yy16na6ffjj4kk14ar1gy9zvd9nlz15hnn18s3g92494gipq4q2";
+      rev = "4e28c8dd0271e10a5f55142fb6fe9b1599ee6160";
+      sha256 = "0nkbp4hcpfqj2s85g03rkb3786pa4cdf80mvmbzc89kiqw2ir260";
     };
     meta.homepage = "https://github.com/voldikss/vim-floaterm/";
   };
@@ -12985,12 +13021,12 @@ final: prev:
 
   vim-fugitive = buildVimPlugin {
     pname = "vim-fugitive";
-    version = "2024-03-31";
+    version = "2024-04-08";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fugitive";
-      rev = "c0b03f1cac242d96837326d300f42a660306fc1a";
-      sha256 = "0czzasq0r4130yxjhsakk65p5yv7wcwlbzrv14dbjjsvgjs0zdlx";
+      rev = "dac8e5c2d85926df92672bf2afb4fc48656d96c7";
+      sha256 = "1m33vpkfw1dx3kxxgw8r278a5rch4sd3ngc9mbnap97f0q8karm6";
     };
     meta.homepage = "https://github.com/tpope/vim-fugitive/";
   };
@@ -13141,12 +13177,12 @@ final: prev:
 
   vim-go = buildVimPlugin {
     pname = "vim-go";
-    version = "2024-03-25";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "14eedf6135cf4253b0ed48a0b53d6834a40da1c4";
-      sha256 = "06ihf1mrynk28yv4a23khfbz16621pj3lindwd19p2sn3wbz47d1";
+      rev = "feef9b31507f8e942bcd21f9e1f22d587c83c72d";
+      sha256 = "10baiz4hklzwr53vrvivmx86c84d66k0yzbajd3p8mi19h3a96gy";
     };
     meta.homepage = "https://github.com/fatih/vim-go/";
   };
@@ -13478,12 +13514,12 @@ final: prev:
 
   vim-illuminate = buildVimPlugin {
     pname = "vim-illuminate";
-    version = "2024-02-04";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "RRethy";
       repo = "vim-illuminate";
-      rev = "305bf07b919ac526deb5193280379e2f8b599926";
-      sha256 = "1pmzh7pz23dl6jmcify9494jwgyi2jfjkg0l95cxfrbjqghjxli8";
+      rev = "e522e0dd742a83506db0a72e1ced68c9c130f185";
+      sha256 = "0l9306c3867r6dqn4272kkzql63pwfaibhdwisjlc7pcv9wzah53";
     };
     meta.homepage = "https://github.com/RRethy/vim-illuminate/";
   };
@@ -13743,12 +13779,12 @@ final: prev:
 
   vim-just = buildVimPlugin {
     pname = "vim-just";
-    version = "2024-04-03";
+    version = "2024-04-09";
     src = fetchFromGitHub {
       owner = "NoahTheDuke";
       repo = "vim-just";
-      rev = "4f6eea3d5ad64236549411bb2e2fd8f1c7926abc";
-      sha256 = "07g61mvln8sdqfacypap5fdx235bmrlbx713s4n8jpxdp6fwnydr";
+      rev = "a2777b4b113dafc639f541ad4f0f7da0adc640f4";
+      sha256 = "07dwja75dlwjmn687jbk56yz3srijjagppqn7xyl4bzd0svi4s97";
     };
     meta.homepage = "https://github.com/NoahTheDuke/vim-just/";
   };
@@ -13803,12 +13839,12 @@ final: prev:
 
   vim-lawrencium = buildVimPlugin {
     pname = "vim-lawrencium";
-    version = "2024-04-03";
+    version = "2024-04-10";
     src = fetchFromGitHub {
       owner = "ludovicchabant";
       repo = "vim-lawrencium";
-      rev = "756d7544c380a92b6f12e501a0d979cb6f53a90a";
-      sha256 = "16wzibxqz6jqh4bp43h1hh9kwlnns6zcqd6hdi25zzlfpx5m14q3";
+      rev = "a790513b278eba1279e1f053aab760cbddbc3872";
+      sha256 = "0awx42g0wak2akxmdm5whp2hcgjyqf28v3vzmb06l1fm7qs76c0v";
     };
     meta.homepage = "https://github.com/ludovicchabant/vim-lawrencium/";
   };
@@ -14007,12 +14043,12 @@ final: prev:
 
   vim-lsp-settings = buildVimPlugin {
     pname = "vim-lsp-settings";
-    version = "2024-03-19";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "mattn";
       repo = "vim-lsp-settings";
-      rev = "d0766475906b8cda4d542a2284efd170da31eff7";
-      sha256 = "0abnh5rrir62glayf8kdlq9h16ixa934z0hpw4kc7k4nsx66y91m";
+      rev = "4b3732c31b408953a1bb0fca6f003400abb5bfaa";
+      sha256 = "1p02j2k68csvcp5wshhzk29byavsc76gpj7a935smirj9d8nhcmr";
     };
     meta.homepage = "https://github.com/mattn/vim-lsp-settings/";
   };
@@ -14116,12 +14152,12 @@ final: prev:
 
   vim-markdown-toc = buildVimPlugin {
     pname = "vim-markdown-toc";
-    version = "2024-03-20";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "mzlogin";
       repo = "vim-markdown-toc";
-      rev = "483c8fbc7d63c9d381b367a9f845674456081534";
-      sha256 = "08mvz4qz2mvcyvlii4p7v5w9pc81vwh108p643dm8rzkw0g8kn50";
+      rev = "05d6538ccef1d33f2d26f2515c0eacaa93d2e061";
+      sha256 = "0x9vq6qi7m532la56i9pnp9l4q1s7iy1g7w36451w4c03lsw39is";
     };
     meta.homepage = "https://github.com/mzlogin/vim-markdown-toc/";
   };
@@ -14668,12 +14704,12 @@ final: prev:
 
   vim-paper = buildVimPlugin {
     pname = "vim-paper";
-    version = "2023-08-02";
+    version = "2024-04-16";
     src = fetchFromGitHub {
       owner = "yorickpeterse";
       repo = "vim-paper";
-      rev = "c4995be5a73a5b24d69a9ebd932a4e9be58fdb90";
-      sha256 = "11psmnapyz8qg2h6rm2wkaq8xkw8kv12nwq5m16baqvf04fp847c";
+      rev = "790c31c56ce510cc0c0f777090be4140fe130d1d";
+      sha256 = "1w958a6ga1a6518f5cr1nag6vkkxh92hqcv5k6f7410xm7fqdya6";
     };
     meta.homepage = "https://github.com/yorickpeterse/vim-paper/";
   };
@@ -15040,12 +15076,12 @@ final: prev:
 
   vim-rails = buildVimPlugin {
     pname = "vim-rails";
-    version = "2024-02-11";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-rails";
-      rev = "3a155462d1c346e291595400ca238037d02a357f";
-      sha256 = "0zz510l1ncv3abax76s99cfpc6r6vvb81hnhxzyx4nzgwqzm0qag";
+      rev = "8972461e64c7c4bf049f2f86ea1bc571e8077b55";
+      sha256 = "08lzlk2lhfcyp45sk90h3j6diwz78c8hx0dm1wb9fykmiiipsr0c";
     };
     meta.homepage = "https://github.com/tpope/vim-rails/";
   };
@@ -15280,12 +15316,12 @@ final: prev:
 
   vim-signify = buildVimPlugin {
     pname = "vim-signify";
-    version = "2023-05-10";
+    version = "2024-04-05";
     src = fetchFromGitHub {
       owner = "mhinz";
       repo = "vim-signify";
-      rev = "7d538b77a5a8806e344b057f8846f6d0c035efa9";
-      sha256 = "00ybb3l0g9bprdlj33f0n3nlf96gm40gsmnlazh9mzb3nzr2knzr";
+      rev = "8670143f9e12ed1cd3c9b2c54f345cdd9a4baac3";
+      sha256 = "0wpa5d401slgg41mknm6kiaki7frg7wkzs7ymjyn4l5jxq03x42h";
     };
     meta.homepage = "https://github.com/mhinz/vim-signify/";
   };
@@ -15725,12 +15761,12 @@ final: prev:
 
   vim-test = buildVimPlugin {
     pname = "vim-test";
-    version = "2024-04-03";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "vim-test";
       repo = "vim-test";
-      rev = "8746ef06631293d7d47a6daccd95b0ed3e135494";
-      sha256 = "04wp13zpfzvcx7lisjq489m8vh6maynv6lhz7didqr3lawicnvr2";
+      rev = "eb5bd18d58a859e7d55d732d37e4e2b94fa50275";
+      sha256 = "0v4yi5h8w06vkcl13zhl8hmb79d1g1rc4wrbwj86rxcq7yj490vk";
     };
     meta.homepage = "https://github.com/vim-test/vim-test/";
   };
@@ -15821,12 +15857,12 @@ final: prev:
 
   vim-themis = buildVimPlugin {
     pname = "vim-themis";
-    version = "2024-03-02";
+    version = "2024-04-06";
     src = fetchFromGitHub {
       owner = "thinca";
       repo = "vim-themis";
-      rev = "5c8df1b5fa495ece990df5596d8e7fa1be2c2355";
-      sha256 = "14v75zl5dgxi9pyv8vm79gd578mnq0mw4c947v8f2zhlc4xbda04";
+      rev = "c1f4d465ce7dd23735513551b5c4c918d9c1bab1";
+      sha256 = "1vzwjpn3jr3ayal2pjr2qb36mal2pa8szbf83nqzb2awa1lv1ds1";
     };
     meta.homepage = "https://github.com/thinca/vim-themis/";
   };
@@ -15869,12 +15905,12 @@ final: prev:
 
   vim-tmux-navigator = buildVimPlugin {
     pname = "vim-tmux-navigator";
-    version = "2023-12-23";
+    version = "2024-04-13";
     src = fetchFromGitHub {
       owner = "christoomey";
       repo = "vim-tmux-navigator";
-      rev = "38b1d0402c4600543281dc85b3f51884205674b6";
-      sha256 = "0wj7627bvzw2rjb97b3ddkqx966f4xjlw80lmna6kxi0vvx5hsp1";
+      rev = "a26954a585b02a2ac02f87145e204f8798a7cbc2";
+      sha256 = "01nqxcsn2w24w33d0c4k2w5xyxb0xxvwn7a3pxlzv4i1k36nyaz9";
     };
     meta.homepage = "https://github.com/christoomey/vim-tmux-navigator/";
   };
@@ -15905,12 +15941,12 @@ final: prev:
 
   vim-tpipeline = buildVimPlugin {
     pname = "vim-tpipeline";
-    version = "2024-02-18";
+    version = "2024-04-12";
     src = fetchFromGitHub {
       owner = "vimpostor";
       repo = "vim-tpipeline";
-      rev = "649f079a0bee19565978b82b672d831c6641d952";
-      sha256 = "16lyavpy8qh06l03jqs7klyja3nqs3ynjfy7y8xjmlqa4mgfcffn";
+      rev = "5dd3832bd6e239feccb11cadca583cdcf9d5bda1";
+      sha256 = "14f4fjjjjml3rbh99385xzkkcfqa7awa9bjc191qvvvycqipp0hw";
     };
     meta.homepage = "https://github.com/vimpostor/vim-tpipeline/";
   };
@@ -16145,12 +16181,12 @@ final: prev:
 
   vim-wakatime = buildVimPlugin {
     pname = "vim-wakatime";
-    version = "2024-03-15";
+    version = "2024-04-11";
     src = fetchFromGitHub {
       owner = "wakatime";
       repo = "vim-wakatime";
-      rev = "56b4d073adaf18c04c7bb5728d41c03b2f25754d";
-      sha256 = "1qcx81hgamz4v7nxhbx0kbwsx2qm0b7rsgpja16imhycvlaf28n1";
+      rev = "5d11a253dd1ecabd4612a885175216032d814300";
+      sha256 = "1kx5xid8sybwc7fmmcn6j36r8n0m3g0529q5p0mywfn337m8q3np";
     };
     meta.homepage = "https://github.com/wakatime/vim-wakatime/";
   };
@@ -16470,12 +16506,12 @@ final: prev:
 
   vimtex = buildVimPlugin {
     pname = "vimtex";
-    version = "2024-03-31";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "ac0a41b297a70c101df89bc9c8d43341ba00fd4f";
-      sha256 = "1lnakgdi5gp46v0bqivlvmjqqcagvz78h5327p4k9fxccz3gcf58";
+      rev = "268dd8d311adebb121fa0a4b31cdabcb98072403";
+      sha256 = "1nd6yafqvdx0h7mad3pwfp3fxs8kssjyd758q3f99612fhl63c61";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -16554,24 +16590,24 @@ final: prev:
 
   vista-vim = buildVimPlugin {
     pname = "vista.vim";
-    version = "2024-02-21";
+    version = "2024-04-06";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vista.vim";
-      rev = "f76cecc430003968e6174cae899c2cb2953219b7";
-      sha256 = "0hq41f91f97885vx1rcl981vhwariiwbz2hs0dzryka2ycy5lvy4";
+      rev = "04fa99afe865b16324af94fd8a8391121117d8f7";
+      sha256 = "0gjma1ba0ds0dznhqdajmhib1i49b08iv7hf0c4vjz833kcjagqj";
     };
     meta.homepage = "https://github.com/liuchengxu/vista.vim/";
   };
 
   vscode-nvim = buildVimPlugin {
     pname = "vscode.nvim";
-    version = "2024-03-24";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "Mofiqul";
       repo = "vscode.nvim";
-      rev = "4fe3e696a90f183d4dbbb432ddb79155c6d4c99b";
-      sha256 = "1dxabfrdwm5c8dnpjzgxmb9bnajnk3d4jhg5m1mvkw9vlyjvq8xg";
+      rev = "d47aab1fbe423bf14275745684205dca08366277";
+      sha256 = "0g4dh47rasd5973mjv8cpsd1c6bf5c1bv7pc05sbjkb8vck2lsl5";
     };
     meta.homepage = "https://github.com/Mofiqul/vscode.nvim/";
   };
@@ -16650,12 +16686,12 @@ final: prev:
 
   wiki-vim = buildVimPlugin {
     pname = "wiki.vim";
-    version = "2024-04-02";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "wiki.vim";
-      rev = "34c82a61963988bdf9db3ff426ff313d419f2061";
-      sha256 = "0qazdn1y0j3pb9qm3f9ydasgkcvishz2km0aw19n1fqyylal0fps";
+      rev = "0035cd000cb2a5c60ea67c176ce795852ea04448";
+      sha256 = "0xzxscvaflappikhi7l0v6i92cls6jp1y8fq2pfai9rnsyizvh7p";
     };
     meta.homepage = "https://github.com/lervag/wiki.vim/";
   };
@@ -16758,12 +16794,12 @@ final: prev:
 
   wrapping-nvim = buildVimPlugin {
     pname = "wrapping.nvim";
-    version = "2024-02-25";
+    version = "2024-04-07";
     src = fetchFromGitHub {
       owner = "andrewferrier";
       repo = "wrapping.nvim";
-      rev = "2b74a9fa326ad42e2a509f9e49543471d2d7c1ea";
-      sha256 = "1v66hgmv05w5yz9bg4h5s00j1iz41pc09prm45xdbds6kx02rg2d";
+      rev = "d1ac69c0db82ff0c7540088a0f91d74ad7378c3d";
+      sha256 = "0cmvgmynr3jkp9ikygrn773f3j8n6580ajvv29p8lzg6h5pvafdc";
     };
     meta.homepage = "https://github.com/andrewferrier/wrapping.nvim/";
   };
@@ -16951,12 +16987,12 @@ final: prev:
 
   zk-nvim = buildVimPlugin {
     pname = "zk-nvim";
-    version = "2024-01-05";
+    version = "2024-04-14";
     src = fetchFromGitHub {
       owner = "zk-org";
       repo = "zk-nvim";
-      rev = "fb0962b75a680561f94cae0588b8da92ea8d2fae";
-      sha256 = "0xbxkm6inxi09fb0zj4zrbfi8iyhcjn6lfrwqvmym8fnvi5pmz4c";
+      rev = "e2b6d62b18a88249016bf917d4e5bb0e417ac974";
+      sha256 = "16mmrl34f1bsr1dfl1drg62wwycc23n9w0qczmqz7ylpgb6k8i02";
     };
     meta.homepage = "https://github.com/zk-org/zk-nvim/";
   };
@@ -16987,12 +17023,12 @@ final: prev:
 
   catppuccin-nvim = buildVimPlugin {
     pname = "catppuccin-nvim";
-    version = "2024-03-29";
+    version = "2024-04-14";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "nvim";
-      rev = "aebe43db9cb26e1c70fc5b2fd4158169c405e720";
-      sha256 = "0921cvaa0hkm47vcih1vjsqabzgnpqj1qvg2hnlrv3shr49z220r";
+      rev = "a1439ad7c584efb3d0ce14ccb835967f030450fe";
+      sha256 = "1ngjll0khnx1nighazw64kvfdl139z8xhv0hh2r4bb40ynxnhdf9";
     };
     meta.homepage = "https://github.com/catppuccin/nvim/";
   };
@@ -17011,12 +17047,12 @@ final: prev:
 
   dracula-vim = buildVimPlugin {
     pname = "dracula-vim";
-    version = "2024-02-23";
+    version = "2024-04-14";
     src = fetchFromGitHub {
       owner = "dracula";
       repo = "vim";
-      rev = "9fa89296884e47bbadc49ad959e37b9d1c24cafb";
-      sha256 = "0911akib9ys9vyxnalbmyip7m1ahpnsn89km2hrgj0fc9s5m75ky";
+      rev = "28874a1e9d583eb0b1dfebb9191445b822812ea3";
+      sha256 = "1answqiln7pg1f0cpgknjrnnzk4cslhn19vnv2hvji9xm45lvvbv";
     };
     meta.homepage = "https://github.com/dracula/vim/";
   };
@@ -17059,12 +17095,12 @@ final: prev:
 
   harpoon2 = buildVimPlugin {
     pname = "harpoon2";
-    version = "2024-04-02";
+    version = "2024-04-09";
     src = fetchFromGitHub {
       owner = "ThePrimeagen";
       repo = "harpoon";
-      rev = "4ad05be8fe98092f0dec3bc3b47abebb59c3814a";
-      sha256 = "0ssnlid3bd6qnar1xlg2kkmlgfdabrnkwqhvvw02nr9ms901d9sh";
+      rev = "0378a6c428a0bed6a2781d459d7943843f374bce";
+      sha256 = "129d51cp89dir809yakiw0b7kkjqww7s5h437j8ppn1lq7ghg50m";
     };
     meta.homepage = "https://github.com/ThePrimeagen/harpoon/";
   };
@@ -17083,12 +17119,12 @@ final: prev:
 
   nightfly = buildVimPlugin {
     pname = "nightfly";
-    version = "2024-03-28";
+    version = "2024-04-20";
     src = fetchFromGitHub {
       owner = "bluz71";
       repo = "vim-nightfly-colors";
-      rev = "06cd078edc8d92ded2d37270649bd8ed23dec43d";
-      sha256 = "1axw4m4xw6nqbiabs7cbd8davgpgbxvyxjn73n21zh9bvjdmm90x";
+      rev = "a54ba6131c4e5feb47176efb78b1f93501df1572";
+      sha256 = "1ajnyr7lwhmpjzdwni0hzgd46x64kgdgb3x0qjmvw2q456vs1fap";
     };
     meta.homepage = "https://github.com/bluz71/vim-nightfly-colors/";
   };
@@ -17107,12 +17143,12 @@ final: prev:
 
   nvchad-ui = buildVimPlugin {
     pname = "nvchad-ui";
-    version = "2024-04-03";
+    version = "2024-04-19";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "ui";
-      rev = "e1af69426b3c4b55c88bd1c81790c1c73b30bfa8";
-      sha256 = "1rmfjmwm5zckvdyk2pdpi2zgzql9rvy0b2rpsm8z56g98skh3nma";
+      rev = "6512f7d1faa4fd86c53e9c5c8492b4bdda692613";
+      sha256 = "165yndfj0m3wib17wa15fswsfwixm1bxalprpbdwvyzd2f9p1fd0";
     };
     meta.homepage = "https://github.com/nvchad/ui/";
   };
@@ -17155,12 +17191,12 @@ final: prev:
 
   rose-pine = buildVimPlugin {
     pname = "rose-pine";
-    version = "2024-03-30";
+    version = "2024-04-18";
     src = fetchFromGitHub {
       owner = "rose-pine";
       repo = "neovim";
-      rev = "19055dfe90bfa46a1e5b0a706d13980bdffa2dee";
-      sha256 = "0h3l8dnzqvbq43zhbgm2p741ivk3zks5qi6azyg0qmjx469h4mhr";
+      rev = "17b466e79479758b332a3cac12544a3ad2be6241";
+      sha256 = "1fwwp7szzz2yp4z5hngqn8ll8765xv0nlhgcb75yj257kz7x5lq1";
     };
     meta.homepage = "https://github.com/rose-pine/neovim/";
   };
@@ -17213,17 +17249,5 @@ final: prev:
     meta.homepage = "https://github.com/jhradilek/vim-snippets/";
   };
 
-  gitignore-nvim = buildVimPlugin {
-    pname = "gitignore-nvim";
-    version = "2024-03-25";
-    src = fetchFromGitHub {
-      owner = "wintermute-cell";
-      repo = "gitignore.nvim";
-      rev = "2455191ec94da8ed222806a4fe3aa358eac1e558";
-      sha256 = "sha256-p6k0NP3Vne6Kl98YodzSruVmJwxyrXziJj8N7u79o1w=";
-    };
-    meta.homepage = "https://github.com/wintermute-cell/gitignore.nvim/";
-  };
-
 
 }
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 8c1224cbe4c96..42c846ee5ebc1 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -27,12 +27,12 @@
   };
   angular = buildGrammar {
     language = "angular";
-    version = "0.0.0+rev=62179d7";
+    version = "0.0.0+rev=b7a7167";
     src = fetchFromGitHub {
       owner = "dlvandenberg";
       repo = "tree-sitter-angular";
-      rev = "62179d7bbfb5fd8a8f7298495ac654d252a1bd52";
-      hash = "sha256-qRsBeJ01kGTKJqFubG1u9SFa1nsDH7ZHKQ0cGwfqi84=";
+      rev = "b7a7167762e3863b3d6247c708b7f9bca1ca7bea";
+      hash = "sha256-GXjjRcB0ml9MMYuJUWAlORWrOUsRxrwZ6kmg0fp3kNQ=";
     };
     meta.homepage = "https://github.com/dlvandenberg/tree-sitter-angular";
   };
@@ -50,34 +50,34 @@
   };
   arduino = buildGrammar {
     language = "arduino";
-    version = "0.0.0+rev=e3d0dea";
+    version = "0.0.0+rev=4ddf79e";
     src = fetchFromGitHub {
       owner = "ObserverOfTime";
       repo = "tree-sitter-arduino";
-      rev = "e3d0dea39dbb8032e754bafe5aec3ed5a234d986";
-      hash = "sha256-cBuFIHUZQGkj1C3S6W+yPPuICxL1cCZVoSVvMOqjDAY=";
+      rev = "4ddf79edaa87170ec12bd6a8d03a8ac528fe0ae7";
+      hash = "sha256-DbxzbbmKq0GxbKIKtoygEhbdYeEwp23Nkk15WI2AQW4=";
     };
     meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-arduino";
   };
   asm = buildGrammar {
     language = "asm";
-    version = "0.0.0+rev=62e4932";
+    version = "0.0.0+rev=afdc3d5";
     src = fetchFromGitHub {
       owner = "RubixDev";
       repo = "tree-sitter-asm";
-      rev = "62e49328113ff318128c640bf0cf6dd3d3d51553";
-      hash = "sha256-FwbHDaUqIVKYIAOCF9kv30aV2JX/tEmGUsWXFKQ6Uro=";
+      rev = "afdc3d5da18d42cbb471c0f40527dbed9cace7ad";
+      hash = "sha256-YYzJMGmizeqZxBF2YXYPLjAo54Y60z7RFhLcmOJbeGY=";
     };
     meta.homepage = "https://github.com/RubixDev/tree-sitter-asm";
   };
   astro = buildGrammar {
     language = "astro";
-    version = "0.0.0+rev=dfa0893";
+    version = "0.0.0+rev=b422ccd";
     src = fetchFromGitHub {
       owner = "virchau13";
       repo = "tree-sitter-astro";
-      rev = "dfa0893bdc4bdfada102043404758c66e3580568";
-      hash = "sha256-gToRdyLvvDaeE1b9fYRVPFt1mtdR9kSYzqFBDUYpv3k=";
+      rev = "b422ccd41f0b433260a3d28df7e39fa2ff63ef9c";
+      hash = "sha256-FrXd4dR28GP1CAP+SaGSRO8TImok9MjVw2vWyZgUijQ=";
     };
     meta.homepage = "https://github.com/virchau13/tree-sitter-astro";
   };
@@ -105,12 +105,12 @@
   };
   bash = buildGrammar {
     language = "bash";
-    version = "0.0.0+rev=f3f26f4";
+    version = "0.0.0+rev=f8fb327";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-bash";
-      rev = "f3f26f47a126797c011c311cec9d449d855c3eab";
-      hash = "sha256-6Rfxh8Y6dg2wyQ9jYnbOaXm1SVfQDQ1B1tNqgpz6sY4=";
+      rev = "f8fb3274f72a30896075585b32b0c54cad65c086";
+      hash = "sha256-sj1qYb42k0hXXcNCKg1hINYD11wDcVpnoPhZNtlYT6k=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
   };
@@ -149,12 +149,12 @@
   };
   bicep = buildGrammar {
     language = "bicep";
-    version = "0.0.0+rev=c3451d1";
+    version = "0.0.0+rev=0092c7d";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-bicep";
-      rev = "c3451d1049c80074b18078ba50007b7c00e063f8";
-      hash = "sha256-81Pt/Yyc/r8RDBCaGcXx9giIJ9+smi9Xus43NGOePgM=";
+      rev = "0092c7d1bd6bb22ce0a6f78497d50ea2b87f19c0";
+      hash = "sha256-jj1ccJQOX8oBx1XVKzI53B1sveq5kNADc2DB8bJhsf4=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-bicep";
   };
@@ -182,23 +182,23 @@
   };
   c = buildGrammar {
     language = "c";
-    version = "0.0.0+rev=72084f4";
+    version = "0.0.0+rev=1aafaff";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c";
-      rev = "72084f447c2051e01a7cd6c6e0477ec71a9297ed";
-      hash = "sha256-M0OWcUS+7G/S8S6iqlHXXcWfwqQLjshZpWniFzf3hvo=";
+      rev = "1aafaff4d26dac5a36dd3495be33e1c20161d761";
+      hash = "sha256-eix/BqsZzrJc+h1sHiG/IDtdyZvIsEdox71sPMNXs58=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c";
   };
   c_sharp = buildGrammar {
     language = "c_sharp";
-    version = "0.0.0+rev=92c0a94";
+    version = "0.0.0+rev=9de5652";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c-sharp";
-      rev = "92c0a9431400cd8b6b6ee7503f81da3ae83fc830";
-      hash = "sha256-8ffTbsAOjGZi1Bcf2mOGjTLbzwVI8K1RAYrUbhj/j94=";
+      rev = "9de565257ada70ac441c640e3b5d6850e2df5ab8";
+      hash = "sha256-QNI2V1CG1DdkMIzR+NUcM/IjtQHnJcYn9Nk3sUmkINE=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c-sharp";
   };
@@ -215,12 +215,12 @@
   };
   capnp = buildGrammar {
     language = "capnp";
-    version = "0.0.0+rev=dc28c9f";
+    version = "0.0.0+rev=7b0883c";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-capnp";
-      rev = "dc28c9f4212809eab74d10996086297853eb34e5";
-      hash = "sha256-4GcOBC5JJsfbdsIrQd33tSW2sz6ytjYGqWgFVFLH6sc=";
+      rev = "7b0883c03e5edd34ef7bcf703194204299d7099f";
+      hash = "sha256-WKrZuOMxmdGlvUI9y8JgwCNMdJ8MULucMhkmW8JCiXM=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-capnp";
   };
@@ -270,12 +270,12 @@
   };
   commonlisp = buildGrammar {
     language = "commonlisp";
-    version = "0.0.0+rev=a2a6749";
+    version = "0.0.0+rev=83ae738";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-commonlisp";
-      rev = "a2a67494c223ccf8aa419ac419d9cdf483dbb8ca";
-      hash = "sha256-6rzHgzXWZW5psOsBxW9ygRIPHc/I3wX40EDDM/nc3Qk=";
+      rev = "83ae738bed7e914cee9090c3fe4c80a32ab45905";
+      hash = "sha256-0qWcrn65vtOYz54NVi/sj+GqnGMztEpZJsl9sjbF5sw=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-commonlisp";
   };
@@ -303,23 +303,23 @@
   };
   cpon = buildGrammar {
     language = "cpon";
-    version = "0.0.0+rev=f4b3cbc";
+    version = "0.0.0+rev=594289e";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-cpon";
-      rev = "f4b3cbc8b0bd4e13035d39940fef09f1392e8739";
-      hash = "sha256-Enxc0sdQS9vSZVvIQkkHxk/1bzT2denRk0+AZdDNnJ8=";
+      rev = "594289eadfec719198e560f9d7fd243c4db678d5";
+      hash = "sha256-Nr+98yrDkOS5Yh/EFmBWV9Yhv2tPfHGb4pPlLUwc+k8=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-cpon";
   };
   cpp = buildGrammar {
     language = "cpp";
-    version = "0.0.0+rev=e0c1678";
+    version = "0.0.0+rev=72fd001";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-cpp";
-      rev = "e0c1678a78731e78655b7d953efb4daecf58be46";
-      hash = "sha256-CdNCVDMAmeJrHgPb2JLxFHj/tHnUYC8flmxj+UaVXTo=";
+      rev = "72fd00128f1c38319670cbf4bcedbba0dc849d96";
+      hash = "sha256-COlDbMi3kKb1YAjJthBO5TmLOWs1dH4VAGNYgh8iSmE=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
   };
@@ -348,12 +348,12 @@
   };
   cuda = buildGrammar {
     language = "cuda";
-    version = "0.0.0+rev=4ec5afd";
+    version = "0.0.0+rev=50a28f4";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-cuda";
-      rev = "4ec5afdf98041d137c25b555958a1f825c7c1272";
-      hash = "sha256-EA37LJeRHBFBra17UwiUASQYTRBuGKE9HNyUrn8HBNk=";
+      rev = "50a28f4600c559e3d19a1825e854dfe6dcac1d49";
+      hash = "sha256-xVf9sD5CbXDn1Kw9vkgKd+hWmerQgHf7ntUtynRXpBo=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
   };
@@ -381,12 +381,12 @@
   };
   dart = buildGrammar {
     language = "dart";
-    version = "0.0.0+rev=7861a48";
+    version = "0.0.0+rev=6da4647";
     src = fetchFromGitHub {
       owner = "UserNobody14";
       repo = "tree-sitter-dart";
-      rev = "7861a4889e7682af453afa4811ae85b1d7a6e415";
-      hash = "sha256-zJngHDZVmQtliHpgqYpLpLvSHQYwOXDDIw/U0/CBxF0=";
+      rev = "6da46473ab8accb13da48113f4634e729a71d335";
+      hash = "sha256-AT7DuOq4mZZxizB2a5UsPGSIP11Jn88O7bJeJIEmv8s=";
     };
     meta.homepage = "https://github.com/UserNobody14/tree-sitter-dart";
   };
@@ -414,12 +414,12 @@
   };
   diff = buildGrammar {
     language = "diff";
-    version = "0.0.0+rev=c165725";
+    version = "0.0.0+rev=710e881";
     src = fetchFromGitHub {
       owner = "the-mikedavis";
       repo = "tree-sitter-diff";
-      rev = "c165725c28e69b36c5799ff0e458713a844f1aaf";
-      hash = "sha256-qou5ow/Am/qyO0I1j74ojgnBonwmJriLCCeSNpTk7t8=";
+      rev = "710e881127512bda8157096e26c1f3e91702823a";
+      hash = "sha256-BdRWI/7LiUS8z5LehaQgPVcdOPcEOJSmNHowtukHAQw=";
     };
     meta.homepage = "https://github.com/the-mikedavis/tree-sitter-diff";
   };
@@ -447,12 +447,12 @@
   };
   dockerfile = buildGrammar {
     language = "dockerfile";
-    version = "0.0.0+rev=33e22c3";
+    version = "0.0.0+rev=439c3e7";
     src = fetchFromGitHub {
       owner = "camdencheek";
       repo = "tree-sitter-dockerfile";
-      rev = "33e22c33bcdbfc33d42806ee84cfd0b1248cc392";
-      hash = "sha256-uCKzTTbJL9Ans3lCQbt2zApF+ERLbbu5D1WcyWJ6Gf4=";
+      rev = "439c3e7b8a9bfdbf1f7d7c2beaae4173dc484cbf";
+      hash = "sha256-sW3fCCAXNak4JszEPgspZFfOHtUlqnW3eRxzHNfzInk=";
     };
     meta.homepage = "https://github.com/camdencheek/tree-sitter-dockerfile";
   };
@@ -480,16 +480,27 @@
   };
   dtd = buildGrammar {
     language = "dtd";
-    version = "0.0.0+rev=2282ad5";
+    version = "0.0.0+rev=96beba9";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-xml";
-      rev = "2282ad5cb8e815523e70d5c82404620bd9a1494c";
-      hash = "sha256-CZAVJdT01wXyaDnPxXz6ZhiiDxuvwKCWPGjaWe6FpWk=";
+      rev = "96beba9f3e4156aaae64bb86997503b1ceb1283d";
+      hash = "sha256-XmSU9Om1bj/PtBxr22Sf81Mx68QINtK8Gls1fRldt6Q=";
     };
     location = "dtd";
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-xml";
   };
+  earthfile = buildGrammar {
+    language = "earthfile";
+    version = "0.0.0+rev=7d5cc9e";
+    src = fetchFromGitHub {
+      owner = "glehmann";
+      repo = "tree-sitter-earthfile";
+      rev = "7d5cc9e27e3e340c8b521d11c8da84047494fe30";
+      hash = "sha256-0rjD8SJGot/KAsLVW98e7X2tbNPntScRk/oEsS1wmAg=";
+    };
+    meta.homepage = "https://github.com/glehmann/tree-sitter-earthfile";
+  };
   ebnf = buildGrammar {
     language = "ebnf";
     version = "0.0.0+rev=8e635b0";
@@ -526,12 +537,12 @@
   };
   elixir = buildGrammar {
     language = "elixir";
-    version = "0.0.0+rev=868620e";
+    version = "0.0.0+rev=de690fa";
     src = fetchFromGitHub {
       owner = "elixir-lang";
       repo = "tree-sitter-elixir";
-      rev = "868620e19f070a5e6b0b685dc6069a611a86259a";
-      hash = "sha256-r+G0321T1+RwaqcJ+E/gfzm1iSLCIVGPdus7XZFK9So=";
+      rev = "de690fa8a028f122af46d9d2685679fe5f2d7d60";
+      hash = "sha256-bvbOWF+Fy3IhOPhkW6pB/3LcLXnPzqVQb8GOCCQWzw0=";
     };
     meta.homepage = "https://github.com/elixir-lang/tree-sitter-elixir";
   };
@@ -636,12 +647,12 @@
   };
   firrtl = buildGrammar {
     language = "firrtl";
-    version = "0.0.0+rev=2b5adae";
+    version = "0.0.0+rev=8503d3a";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-firrtl";
-      rev = "2b5adae629c8cba528c7b1e4aa67a8ae28934ea5";
-      hash = "sha256-If34GymYMJpSNtzSGpcq4dMxj8djKZ3B5uMHGx9uCnM=";
+      rev = "8503d3a0fe0f9e427863cb0055699ff2d29ae5f5";
+      hash = "sha256-I2EMcm6bTMRODmxOOOiv+U0fhm6yoNhjCyuINfTUtlY=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-firrtl";
   };
@@ -779,12 +790,12 @@
   };
   gitcommit = buildGrammar {
     language = "gitcommit";
-    version = "0.0.0+rev=a427a79";
+    version = "0.0.0+rev=edd817e";
     src = fetchFromGitHub {
       owner = "gbprod";
       repo = "tree-sitter-gitcommit";
-      rev = "a427a79653b6829aa5b663b5b9a6b39e954858b7";
-      hash = "sha256-vnuSzMQeBow5A37VOmpAWUgHehVpetjJwos44mdEmP8=";
+      rev = "edd817e0532f179b7f7f371dc180629070945f0c";
+      hash = "sha256-iipzgO8vJJpxhf/ZJh6tsfRa54C6g9rAN9TVdycKiqc=";
     };
     meta.homepage = "https://github.com/gbprod/tree-sitter-gitcommit";
   };
@@ -823,12 +834,12 @@
   };
   glsl = buildGrammar {
     language = "glsl";
-    version = "0.0.0+rev=f704096";
+    version = "0.0.0+rev=e7817c9";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-glsl";
-      rev = "f7040966a97c6c5a644a230df7fe74623f963d2f";
-      hash = "sha256-HwaN4T3dpcMpR2Nch3gMh9QGhBThd4RxdW7o5KTzRtI=";
+      rev = "e7817c982e0e921c5ee89a1e0283121bb5cc5e01";
+      hash = "sha256-pkbvD+VQUtR6GiY4RP6J6tB2Cl2UyqjB7t/HE0dLr78=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-glsl";
   };
@@ -856,12 +867,12 @@
   };
   go = buildGrammar {
     language = "go";
-    version = "0.0.0+rev=fd577c4";
+    version = "0.0.0+rev=eb68645";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-go";
-      rev = "fd577c4358c28cbcb6748bbf65354cc85f1cf7a4";
-      hash = "sha256-Fz9xSyjJLbNXAXbYMoVDsRqyRrLTWHAxnQBV9EF6n78=";
+      rev = "eb68645662a3f7bf7fdd4bcb9531585f54c8570e";
+      hash = "sha256-RZx8M3QGX/+kfjbEB0+f2jeDZhGF+XGXwtb5oltxHrI=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-go";
   };
@@ -944,23 +955,23 @@
   };
   groovy = buildGrammar {
     language = "groovy";
-    version = "0.0.0+rev=b398a5a";
+    version = "0.0.0+rev=6c5c881";
     src = fetchFromGitHub {
       owner = "murtaza64";
       repo = "tree-sitter-groovy";
-      rev = "b398a5a243c67f0b4d54728c983fa586bd5cd52e";
-      hash = "sha256-5PA3of/pD8YDXyV+taKha/zKphpH4EDHRj40YA7aL9c=";
+      rev = "6c5c8813233fe326e24c5ef032858d13f8006a8d";
+      hash = "sha256-NursRJ7DBmlbA7EOzC+WwoxDkjMUZYANcdX48DyjEIY=";
     };
     meta.homepage = "https://github.com/murtaza64/tree-sitter-groovy";
   };
   gstlaunch = buildGrammar {
     language = "gstlaunch";
-    version = "0.0.0+rev=2c0d9c9";
+    version = "0.0.0+rev=549aef2";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-gstlaunch";
-      rev = "2c0d9c94d35e37aa63fa5002163c8480985b3e5b";
-      hash = "sha256-H5H1v4xJSPHW0oaTY/JczhfVmYExbrdfdugYkMJktPY=";
+      rev = "549aef253fd38a53995cda1bf55c501174372bf7";
+      hash = "sha256-zNUx/9dxEqyqTXCxEiNnYPzplnR7l9b2L4frYpPOA9M=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-gstlaunch";
   };
@@ -977,12 +988,12 @@
   };
   hare = buildGrammar {
     language = "hare";
-    version = "0.0.0+rev=3d4af17";
+    version = "0.0.0+rev=0705249";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-hare";
-      rev = "3d4af179414525a35dd069ba0208c9b71093d8b3";
-      hash = "sha256-RRi2uAE9rf0bjQrk8Asf6z+6ZDZYhEoKaX0m8hZnI9o=";
+      rev = "070524937539eb8bb4f10debd9c83b66c434f3a2";
+      hash = "sha256-NUvbkMYA1nZmS84vLNguto/Fo7wdrDmRCBnveR88ry0=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-hare";
   };
@@ -1055,23 +1066,23 @@
   };
   hlsl = buildGrammar {
     language = "hlsl";
-    version = "0.0.0+rev=ef428a3";
+    version = "0.0.0+rev=d200375";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-hlsl";
-      rev = "ef428a36b2faa20450ee979a618f802228b38318";
-      hash = "sha256-/G5c7Fr7Z23FR7n5oh90QHObicDjx8Ppslp8T6sr1wg=";
+      rev = "d200375a29b24764b78d7051df0024ed7c2f1ab0";
+      hash = "sha256-HCbH8Lyi2ziaUTxhgVPQ4hyOZhRxNFW66gAkoFT/Ubg=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
   };
   hlsplaylist = buildGrammar {
     language = "hlsplaylist";
-    version = "0.0.0+rev=5305c06";
+    version = "0.0.0+rev=3e65f65";
     src = fetchFromGitHub {
       owner = "Freed-Wu";
       repo = "tree-sitter-hlsplaylist";
-      rev = "5305c061efce2841942dbbac6f9a5b21e3e4eb35";
-      hash = "sha256-XNqkyFLqZTo5mPqbtLM8gq178fkB1YhQkjfp6bcKpcM=";
+      rev = "3e65f652b9dea8d38f9a44b5b0898a51c9247eb8";
+      hash = "sha256-IGfKnEG1b9TSPBjxb+NjgweyKp7HUyZCe2gR/xnV5CY=";
     };
     meta.homepage = "https://github.com/Freed-Wu/tree-sitter-hlsplaylist";
   };
@@ -1121,12 +1132,12 @@
   };
   http = buildGrammar {
     language = "http";
-    version = "0.0.0+rev=86ad05a";
+    version = "0.0.0+rev=8d22f33";
     src = fetchFromGitHub {
       owner = "rest-nvim";
       repo = "tree-sitter-http";
-      rev = "86ad05ac2de3c63c69f65e58f0182a76c1658d1e";
-      hash = "sha256-7iUNDri5SB9RygMcAGUo78Cbtm11fM8Wvn+KwjKC0M4=";
+      rev = "8d22f33faa5aa95c6526606fb656ada342e59e40";
+      hash = "sha256-L+9cDLTmisZmdBXocK8u7fkJIlaZId9qeQxVWwFkdJg=";
     };
     meta.homepage = "https://github.com/rest-nvim/tree-sitter-http";
   };
@@ -1187,23 +1198,23 @@
   };
   java = buildGrammar {
     language = "java";
-    version = "0.0.0+rev=2aae502";
+    version = "0.0.0+rev=953abfc";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-java";
-      rev = "2aae502017d3aed587ba85e3c7e0cbc138f3e07a";
-      hash = "sha256-UzMpDQtvbu05iu0kL/qkPaxnAOQKLJlzqWYeUurGSqo=";
+      rev = "953abfc8bb3eb2f578e1f461edba4a9885f974b8";
+      hash = "sha256-COrEPsdTI6MJeb5iIZtyNHHe6nMsD/EnHDRVDTSKFTg=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-java";
   };
   javascript = buildGrammar {
     language = "javascript";
-    version = "0.0.0+rev=de1e682";
+    version = "0.0.0+rev=fff4560";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-javascript";
-      rev = "de1e682289a417354df5b4437a3e4f92e0722a0f";
-      hash = "sha256-HhqYqU1CwPxXMHp21unRekFDzpGVedlgh/4bsplhe9c=";
+      rev = "fff4560044bdc51d9f6995f1edc797b7cd72b9dc";
+      hash = "sha256-erxZ5nYvUwrzdRnkni8WEsxB04ghI7H3DLASfCoHXYs=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-javascript";
   };
@@ -1231,12 +1242,12 @@
   };
   json = buildGrammar {
     language = "json";
-    version = "0.0.0+rev=3b12920";
+    version = "0.0.0+rev=80e623c";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-json";
-      rev = "3b129203f4b72d532f58e72c5310c0a7db3b8e6d";
-      hash = "sha256-dVErHgsUDEN42wc/Gd68vQfVc8+/r/8No9KZk2GFzmY=";
+      rev = "80e623c2165887f9829357acfa9c0a0bab34a3cd";
+      hash = "sha256-waejAbS7MjrE7w03MPqvBRpEpqTcKc6RgKCVSYaDV1Y=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-json";
   };
@@ -1275,12 +1286,12 @@
   };
   julia = buildGrammar {
     language = "julia";
-    version = "0.0.0+rev=e84f10d";
+    version = "0.0.0+rev=acd5ca1";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-julia";
-      rev = "e84f10db8eeb8b9807786bfc658808edaa1b4fa2";
-      hash = "sha256-jrQjVPLb6SfePxEJV1GgFgLslGxgdmdb8bJy6VHOEbs=";
+      rev = "acd5ca12cc278df7960629c2429a096c7ac4bbea";
+      hash = "sha256-1dOUMS4nlPaG5WxpCONXclVgq4F/Ti4JQK81KOnxvIk=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-julia";
   };
@@ -1352,12 +1363,12 @@
   };
   latex = buildGrammar {
     language = "latex";
-    version = "0.0.0+rev=eb552c7";
+    version = "0.0.0+rev=ae2134a";
     src = fetchFromGitHub {
       owner = "latex-lsp";
       repo = "tree-sitter-latex";
-      rev = "eb552c7022cbd1379138bdc1b2fe464a99d25640";
-      hash = "sha256-y+FFT9UmtVDp37hWLwHi+qlCwezHYn0blH1tt/uyKb8=";
+      rev = "ae2134af67f6c5e45587ace9ec748dd6e7b356a2";
+      hash = "sha256-hQaQBQYK0o5qRH5Mjv3pIAUHJe6BWHGzg2I4KCVG2KE=";
     };
     generate = true;
     meta.homepage = "https://github.com/latex-lsp/tree-sitter-latex";
@@ -1463,12 +1474,12 @@
   };
   luau = buildGrammar {
     language = "luau";
-    version = "0.0.0+rev=e5f7a02";
+    version = "0.0.0+rev=5b088fa";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-luau";
-      rev = "e5f7a020967407f73959592decdb147bb5fc30bb";
-      hash = "sha256-5Tnqt4PA3xX2Gk0CvlzVpWXI3OcqzsIJov4Kn0EWN+w=";
+      rev = "5b088fac748f2666a315cafd1638a214388eb23e";
+      hash = "sha256-m0xHQu9nxjyrCMza9Aw/kRK8Rlhtc2DRbtyyFtMZkJU=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-luau";
   };
@@ -1542,12 +1553,12 @@
   };
   mermaid = buildGrammar {
     language = "mermaid";
-    version = "0.0.0+rev=e8dac87";
+    version = "0.0.0+rev=49442bd";
     src = fetchFromGitHub {
       owner = "monaqa";
       repo = "tree-sitter-mermaid";
-      rev = "e8dac87a9f789b23a2c7ab8e55b485a2f5927b98";
-      hash = "sha256-1FCc8goKhFtgxSPeAzFkQhpbpruhZ+GD8VaLRJpnyS4=";
+      rev = "49442bd087901c60f019b4e34dcb6ecdc8849067";
+      hash = "sha256-KoAoEuADv6Xj/bpZV5XGW7nXugSCfk6St2xzx7x2oPA=";
     };
     meta.homepage = "https://github.com/monaqa/tree-sitter-mermaid";
   };
@@ -1564,24 +1575,24 @@
   };
   mlir = buildGrammar {
     language = "mlir";
-    version = "0.0.0+rev=a89a5f2";
+    version = "0.0.0+rev=c2845c1";
     src = fetchFromGitHub {
       owner = "artagnon";
       repo = "tree-sitter-mlir";
-      rev = "a89a5f2bbcf7e82e46b106138977c99d6a644db2";
-      hash = "sha256-FIwyHvyIJziliEd+7CBMqUjJuT9G60CZGe73Ees0CRU=";
+      rev = "c2845c1c0b23e2faf6febfa72a042e5346374ebf";
+      hash = "sha256-SQR/1lAWdvNDwa40wNI3uGSF9OBgtyjxVM5lsP4CgIU=";
     };
     generate = true;
     meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
   };
   muttrc = buildGrammar {
     language = "muttrc";
-    version = "0.0.0+rev=2f918f9";
+    version = "0.0.0+rev=1a3d3c9";
     src = fetchFromGitHub {
       owner = "neomutt";
       repo = "tree-sitter-muttrc";
-      rev = "2f918f9c887109fdf1419f98158a0cfff644af75";
-      hash = "sha256-tB0qY7p099aNulvuZVah4yuyFdp/Dh6Knw4Qi+/QC6w=";
+      rev = "1a3d3c98de86689f2bb1e59c8db8067c6784aaed";
+      hash = "sha256-9RFz8qaAapJSNxy8YH/6FZG2j1tcrhNWRhxx+fNo7z8=";
     };
     meta.homepage = "https://github.com/neomutt/tree-sitter-muttrc";
   };
@@ -1609,12 +1620,12 @@
   };
   nim = buildGrammar {
     language = "nim";
-    version = "0.0.0+rev=f5cec6a";
+    version = "0.0.0+rev=961c279";
     src = fetchFromGitHub {
       owner = "alaviss";
       repo = "tree-sitter-nim";
-      rev = "f5cec6a841b585e4e7388a120ded07e60ae19c43";
-      hash = "sha256-CL041Tjw7CH9EnpjAVl4f66zyOADfG9qwkFxeUjXH0w=";
+      rev = "961c2798cec9250c44f7d7225ddb33d47d25856a";
+      hash = "sha256-zFT316pJwJvPRLJcBk4kvPmwNgdkYG5/10VktNBQwL8=";
     };
     meta.homepage = "https://github.com/alaviss/tree-sitter-nim";
   };
@@ -1642,23 +1653,23 @@
   };
   nix = buildGrammar {
     language = "nix";
-    version = "0.0.0+rev=763168f";
+    version = "0.0.0+rev=b3cda61";
     src = fetchFromGitHub {
       owner = "cstrahan";
       repo = "tree-sitter-nix";
-      rev = "763168fa916a333a459434f1424b5d30645f015d";
-      hash = "sha256-MarXhVPVmL505c57HkbUk0kHN7jez83mcGtyM5GMw1o=";
+      rev = "b3cda619248e7dd0f216088bd152f59ce0bbe488";
+      hash = "sha256-Ib83CECi3hvm2GfeAJXIkapeN8rrpFQxCWWFFsIvB/Y=";
     };
     meta.homepage = "https://github.com/cstrahan/tree-sitter-nix";
   };
   norg = buildGrammar {
     language = "norg";
-    version = "0.0.0+rev=9766442";
+    version = "0.0.0+rev=aa1a1a7";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "tree-sitter-norg";
-      rev = "9766442985fd546e2d33f8d1c7e7619ed07860cf";
-      hash = "sha256-YMS4UDVulE9PjOTchCSkeRRVbBbDFYgY/dCla32CkwQ=";
+      rev = "aa1a1a7ded81a094cc3d5cb14bea6f34b86d8688";
+      hash = "sha256-baJdvWfwUx1U2RX0G6ECaGPGZBFbWsVUhh3kYPaYeiE=";
     };
     meta.homepage = "https://github.com/nvim-neorg/tree-sitter-norg";
   };
@@ -1733,12 +1744,12 @@
   };
   odin = buildGrammar {
     language = "odin";
-    version = "0.0.0+rev=f94c590";
+    version = "0.0.0+rev=b5f668e";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-odin";
-      rev = "f94c590ed5263e11f1e492d1b53356f8c8459b66";
-      hash = "sha256-MLSy1OU8PE2wTfV8JoJdtjoc12MD993TViaZjp3Ujgc=";
+      rev = "b5f668ef8918aab13812ce73acd89fe191fb8c5e";
+      hash = "sha256-D/+ls8a5efAy3sBaH1eGEifEwBRmz+6bYIMGNji949Q=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-odin";
   };
@@ -1755,12 +1766,12 @@
   };
   pascal = buildGrammar {
     language = "pascal";
-    version = "0.0.0+rev=9e99540";
+    version = "0.0.0+rev=a9ee969";
     src = fetchFromGitHub {
       owner = "Isopod";
       repo = "tree-sitter-pascal";
-      rev = "9e995404ddff8319631d72d4b46552e737206912";
-      hash = "sha256-y8xPnVZ15+eAnjrLSGjS5wIbLgSKbz9bipgL0o8acmA=";
+      rev = "a9ee969dec5b2e3b2ccccc5954fec04100c7619e";
+      hash = "sha256-U45RkRpE1EdX2ijGyjTKVNRcSu6E6Dh9Z7G9bp24T80=";
     };
     meta.homepage = "https://github.com/Isopod/tree-sitter-pascal.git";
   };
@@ -1845,12 +1856,12 @@
   };
   po = buildGrammar {
     language = "po";
-    version = "0.0.0+rev=d6aed22";
+    version = "0.0.0+rev=bd860a0";
     src = fetchFromGitHub {
       owner = "erasin";
       repo = "tree-sitter-po";
-      rev = "d6aed225290bc71a15ab6f06305cb11419360c56";
-      hash = "sha256-fz4DGPA+KtOvLBmVMXqwnEMeXhupFecQC1xfhMbWCJg=";
+      rev = "bd860a0f57f697162bf28e576674be9c1500db5e";
+      hash = "sha256-/St0VxDTAF872ZlBph1TukRoO0PBIOMT0D11DZ6nSLQ=";
     };
     meta.homepage = "https://github.com/erasin/tree-sitter-po";
   };
@@ -1878,12 +1889,12 @@
   };
   pony = buildGrammar {
     language = "pony";
-    version = "0.0.0+rev=16f930b";
+    version = "0.0.0+rev=73ff874";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-pony";
-      rev = "16f930b250433cfcd4fb4144df92bb98ad344c20";
-      hash = "sha256-UamgLmI1aI5e/JlGVZzFCPgDol8MnFomncrFKhQYLsk=";
+      rev = "73ff874ae4c9e9b45462673cbc0a1e350e2522a7";
+      hash = "sha256-/9bTbep2AXLoiijeft9amMeFQ6fHXzItjH+bD/w6pDo=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-pony";
   };
@@ -1978,12 +1989,12 @@
   };
   puppet = buildGrammar {
     language = "puppet";
-    version = "0.0.0+rev=5849f96";
+    version = "0.0.0+rev=584522f";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-puppet";
-      rev = "5849f9694197a6e822872945b415429c285fdd54";
-      hash = "sha256-Lwfiby7amjTIOz8QRoC4RdZyFPfFikmQ2sqta4akyH8=";
+      rev = "584522f32495d648b18a53ccb52d988e60de127d";
+      hash = "sha256-+zMgzyuGerJ8l+i5ZtWnmGr3i4fFiSLD5FssyKESsmI=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-puppet";
   };
@@ -2011,12 +2022,12 @@
   };
   python = buildGrammar {
     language = "python";
-    version = "0.0.0+rev=b8a4c64";
+    version = "0.0.0+rev=a227610";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-python";
-      rev = "b8a4c64121ba66b460cb878e934e3157ecbfb124";
-      hash = "sha256-ZTqWyr4+pOyXY4X/WnYdn9Sgp7T8FEEUy/TQPuFqb4k=";
+      rev = "a22761025cdac6c314b7e3aa48fb44fa9e594d6a";
+      hash = "sha256-L6iEej6bPqfaZdH5GNoJyNxZWdnIyn7+Cut+zYnMI88=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-python";
   };
@@ -2077,12 +2088,12 @@
   };
   racket = buildGrammar {
     language = "racket";
-    version = "0.0.0+rev=d9858a0";
+    version = "0.0.0+rev=171f52a";
     src = fetchFromGitHub {
       owner = "6cdh";
       repo = "tree-sitter-racket";
-      rev = "d9858a0f607578814f2d34662ad4bc21aa37a455";
-      hash = "sha256-UaF9/leXBlyF+3j8lTyi9tn2pVwVHlYM7zLdTpVCmgI=";
+      rev = "171f52a8c0ed635b85cd42d1e36d82f1066a03b4";
+      hash = "sha256-iuigtcakpqm5vPuxsSV5PR32pwzyPMmldYXaJmzO3d0=";
     };
     meta.homepage = "https://github.com/6cdh/tree-sitter-racket";
   };
@@ -2187,34 +2198,34 @@
   };
   roc = buildGrammar {
     language = "roc";
-    version = "0.0.0+rev=649c3b6";
+    version = "0.0.0+rev=7df2c08";
     src = fetchFromGitHub {
       owner = "nat-418";
       repo = "tree-sitter-roc";
-      rev = "649c3b68eb863f350f0aafeb68f4a8ca4f13081a";
-      hash = "sha256-oY6mQV4bJ0XCGcx/8AnlYMAIKAs54wbgZ4iNzD4rkVE=";
+      rev = "7df2c0892e62efb81a7504d9799d4e0d0443d241";
+      hash = "sha256-8HJH63NcSuqmPviVWO+UE27ydoU7vRXEIXSTjKLSYvk=";
     };
     meta.homepage = "https://github.com/nat-418/tree-sitter-roc";
   };
   ron = buildGrammar {
     language = "ron";
-    version = "0.0.0+rev=ce6086b";
+    version = "0.0.0+rev=f0ddc95";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-ron";
-      rev = "ce6086b2c9e8e71065b8129d6c2289c5f66d1879";
-      hash = "sha256-4ZKhJ3qvKWwINQIWJLqgPwfnDvQBWzeZb2dZY7imYfc=";
+      rev = "f0ddc95a4b7bb21a7308642255a80f5496e69c5b";
+      hash = "sha256-Wi81LYFfQXjZzj2OuxB64sNDEim/eZKViMeQ0h/w88k=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-ron";
   };
   rst = buildGrammar {
     language = "rst";
-    version = "0.0.0+rev=c6f7444";
+    version = "0.0.0+rev=5120f6e";
     src = fetchFromGitHub {
       owner = "stsewd";
       repo = "tree-sitter-rst";
-      rev = "c6f7444fd77271862730af49e757c60405fba991";
-      hash = "sha256-Z6kW2InTqQ+5p0WDcRjXN1dvKLoruIKdTe04SrspVzg=";
+      rev = "5120f6e59284cb8b85b450bd2db0bd352635ba9f";
+      hash = "sha256-PI1C0W8fiuIQ2fgHXDelkCa0ng1a32x/9hrA33KoefM=";
     };
     meta.homepage = "https://github.com/stsewd/tree-sitter-rst";
   };
@@ -2231,23 +2242,23 @@
   };
   rust = buildGrammar {
     language = "rust";
-    version = "0.0.0+rev=3a56481";
+    version = "0.0.0+rev=b77c0d8";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-rust";
-      rev = "3a56481f8d13b6874a28752502a58520b9139dc7";
-      hash = "sha256-6ROXeKuPehtIOtaI1OJuTtyPfQmZyLzCxv3ZS04yAIk=";
+      rev = "b77c0d8ac28a7c143224e6ed9b4f9e4bd044ff5b";
+      hash = "sha256-7SQ/gOKVIE5bmj3vscY363LTwkYX+VHn7JflSU+zKsQ=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-rust";
   };
   scala = buildGrammar {
     language = "scala";
-    version = "0.0.0+rev=70b4fe6";
+    version = "0.0.0+rev=b76db43";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-scala";
-      rev = "70b4fe63c4973b04cc7bd40c6b7646d9c2430db8";
-      hash = "sha256-ZwrsEhlZGVJMP+GRIlaxGqS1b7HtiQelg3QBwJT9Igk=";
+      rev = "b76db435a7f876cf1ede837d66054c534783c72f";
+      hash = "sha256-AZ1YIsnw3x84T2ubwWoekfy98L2GdgQP0R3tM8DEXLM=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-scala";
   };
@@ -2265,12 +2276,12 @@
   };
   scheme = buildGrammar {
     language = "scheme";
-    version = "0.0.0+rev=184e759";
+    version = "0.0.0+rev=8f9dff3";
     src = fetchFromGitHub {
       owner = "6cdh";
       repo = "tree-sitter-scheme";
-      rev = "184e7596ee0cbaef79230cae1b4ee5bb4fbad314";
-      hash = "sha256-wx/uov0kWoxwTyo9MwJR50efnRoboQUlii2MrwpnDGs=";
+      rev = "8f9dff3d038f09934db5ea113cebc59c74447743";
+      hash = "sha256-QECZQVhWntN+3wnIA+U3JesuoLZiSU7pOrsKRdVPLtk=";
     };
     meta.homepage = "https://github.com/6cdh/tree-sitter-scheme";
   };
@@ -2287,34 +2298,34 @@
   };
   slang = buildGrammar {
     language = "slang";
-    version = "0.0.0+rev=13fdd89";
+    version = "0.0.0+rev=b950ddf";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-slang";
-      rev = "13fdd899bfa62527cc39887abd74ec24cd626dec";
-      hash = "sha256-YImk9t0zrOSBornem2rTzqhl/FUWqh955bjjOWkcfHY=";
+      rev = "b950ddf54c564fec0efead602268b6e0d3e5f26e";
+      hash = "sha256-AYZ7MlAh9AEvyHsGw6stiJFSEb4/FDLfuqFPhpAorAA=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-slang";
   };
   slint = buildGrammar {
     language = "slint";
-    version = "0.0.0+rev=acc77c9";
+    version = "0.0.0+rev=d5fbeaf";
     src = fetchFromGitHub {
       owner = "slint-ui";
       repo = "tree-sitter-slint";
-      rev = "acc77c93ef4b73ba8c3a581b8c99d95b55f7178b";
-      hash = "sha256-/fvCR8h3C7aL2We8Ijzx4nQ9AN05PFKObPMCwu7Ps6o=";
+      rev = "d5fbeaf0c26683f1417d00b6a5ab1cca445031f2";
+      hash = "sha256-ECzYJue7tKx9Eg043fl5x18ySvPlkWPU21Ga2Zqunv0=";
     };
     meta.homepage = "https://github.com/slint-ui/tree-sitter-slint";
   };
   smali = buildGrammar {
     language = "smali";
-    version = "0.0.0+rev=5ae51e1";
+    version = "0.0.0+rev=3f65178";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-smali";
-      rev = "5ae51e15c4d1ac93cba6127caf3d1f0a072c140c";
-      hash = "sha256-hcqai2QKx6ZG+Sl1HOPu3wlyjKt3MJ60jNfjfcjKKiM=";
+      rev = "3f6517855898ef23023e5d64a8b175d4ee8d646e";
+      hash = "sha256-K1cRK4D0BE9FNq1tpa0L3Crc+8woXIwhRPg86+73snk=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-smali";
   };
@@ -2342,12 +2353,12 @@
   };
   solidity = buildGrammar {
     language = "solidity";
-    version = "0.0.0+rev=a8ed2f5";
+    version = "0.0.0+rev=1653da0";
     src = fetchFromGitHub {
       owner = "JoranHonig";
       repo = "tree-sitter-solidity";
-      rev = "a8ed2f5d600fed77f8ed3084d1479998c649bca1";
-      hash = "sha256-aSQnJR/r4H086Um4TV4mjnCSg+2Y7KFn2Rwo/lP2nfg=";
+      rev = "1653da09ccd183f4312fba819056a13af22a65f6";
+      hash = "sha256-1IW04F6CxTIdGHxRocM1QmfgXHHf5Jn/eaZ6M8o2EU8=";
     };
     meta.homepage = "https://github.com/JoranHonig/tree-sitter-solidity";
   };
@@ -2399,34 +2410,34 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "0.0.0+rev=cdb7cde";
+    version = "0.0.0+rev=25f94f9";
     src = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "cdb7cde9bf70b194ab8beb5069fbbc3c9640284e";
-      hash = "sha256-yxr+AbKp4pkVpjMQXL3P5VEzSo2Ii6yE7ceEBYiDHJA=";
+      rev = "25f94f998de79bae9df28add9782f9ea6ea0e2b8";
+      hash = "sha256-UmGvjtN0Pi7uH8+Sb6JbvdV60gow7KQCbDRcKo3nMYw=";
     };
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };
   squirrel = buildGrammar {
     language = "squirrel";
-    version = "0.0.0+rev=e8b5835";
+    version = "0.0.0+rev=f93fd28";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-squirrel";
-      rev = "e8b5835296f931bcaa1477d3c5a68a0c5c2ba034";
-      hash = "sha256-wKefWCqcQcg7zLT6abaDC9lWoJiJp7EbbsBOWRRsWFQ=";
+      rev = "f93fd2864dd05cc39b0490145fd86a1a93bfa3a3";
+      hash = "sha256-06cmaCyBkdwSmIHSEE0xr9V4M6pp+ApIZNopbnW3pok=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-squirrel";
   };
   ssh_config = buildGrammar {
     language = "ssh_config";
-    version = "0.0.0+rev=514695d";
+    version = "0.0.0+rev=77450e8";
     src = fetchFromGitHub {
       owner = "ObserverOfTime";
       repo = "tree-sitter-ssh-config";
-      rev = "514695df4985f56455b8f139a319453a2325cdcf";
-      hash = "sha256-LDqRP8FA5m1tnbGNTxItQlp6B6U+M6gOBlbi4zX0FHI=";
+      rev = "77450e8bce8853921512348f83c73c168c71fdfb";
+      hash = "sha256-V7JI1o30+mzGA4X1oh+pyu3rSWOfHFKfCUbYaFPLOmM=";
     };
     meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-ssh-config";
   };
@@ -2454,12 +2465,12 @@
   };
   styled = buildGrammar {
     language = "styled";
-    version = "0.0.0+rev=5e52758";
+    version = "0.0.0+rev=c68a457";
     src = fetchFromGitHub {
       owner = "mskelton";
       repo = "tree-sitter-styled";
-      rev = "5e52758b32e02adca16bb93f95b3f9c050c72b56";
-      hash = "sha256-3x/ZKVYyWuLGkgdm9HutI16m8xpJKSMOZHY48WqH9b0=";
+      rev = "c68a4572e2d6403b6e99066c9a113b43f4a07a27";
+      hash = "sha256-ZOMHyhtlKVOty+0lyUX7aJiwyP9yNN+r0eXVhpu22WQ=";
     };
     meta.homepage = "https://github.com/mskelton/tree-sitter-styled";
   };
@@ -2487,23 +2498,23 @@
   };
   svelte = buildGrammar {
     language = "svelte";
-    version = "0.0.0+rev=6909efa";
+    version = "0.0.0+rev=2c97326";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-svelte";
-      rev = "6909efa7179cd655f9b48123357d65ce8fc661fd";
-      hash = "sha256-s/aO6f91vW+XITaDkB3kyNSReLU1V125wgPcTATvgcY=";
+      rev = "2c97326cd96b7c3016c3d249e8dc244c89b4abeb";
+      hash = "sha256-rlfLelXjNLtQ2/UACwxB3QO5l+QYFLsfGnBaxTAtgTE=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-svelte";
   };
   swift = buildGrammar {
     language = "swift";
-    version = "0.0.0+rev=67ea4e9";
+    version = "0.0.0+rev=e2f0b7c";
     src = fetchFromGitHub {
       owner = "alex-pinkus";
       repo = "tree-sitter-swift";
-      rev = "67ea4e9ea7302b731d392cd8b1aad7b8e79a5547";
-      hash = "sha256-+ms6YcgcwpEuF+KWoC75KA/cQuOeqqDlfOJkWPApor4=";
+      rev = "e2f0b7cf8136b801e4743790b7a956ab29a4d6b0";
+      hash = "sha256-DFoNyZmpzSDI37Gto2DxeoRZuDgLtx9NJxyYGIG6lrY=";
     };
     generate = true;
     meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -2532,34 +2543,34 @@
   };
   t32 = buildGrammar {
     language = "t32";
-    version = "0.0.0+rev=95caba8";
+    version = "0.0.0+rev=6182836";
     src = fetchFromGitLab {
       owner = "xasc";
       repo = "tree-sitter-t32";
-      rev = "95caba87f00c51177b254e95be55b2dc46d2ac78";
-      hash = "sha256-Z02LcEzzAHVKw0lyeuo4bdeFclLUtyXU8XGevBbJJPc=";
+      rev = "6182836f4128725f1e74ce986840d7317021a015";
+      hash = "sha256-w9X/CL5X6Lwr4/GGVQcMZ1O2HfJmdNiVjRQKGZHrRqg=";
     };
     meta.homepage = "https://gitlab.com/xasc/tree-sitter-t32.git";
   };
   tablegen = buildGrammar {
     language = "tablegen";
-    version = "0.0.0+rev=300f6a4";
+    version = "0.0.0+rev=6b7eb09";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-tablegen";
-      rev = "300f6a490e71f895e644ed2deec6920860a2e107";
-      hash = "sha256-V4fEmiGPBAnZO+NAyA7FdlyjLSA0ByUfrCTbsdDOxc8=";
+      rev = "6b7eb096621443627cc5e29c8c34ff1fde482cf3";
+      hash = "sha256-kdOqHAyKAI4IgI2/GbEx13DWLB8JklURd3ndaicxUno=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-tablegen";
   };
   tcl = buildGrammar {
     language = "tcl";
-    version = "0.0.0+rev=56ad1fa";
+    version = "0.0.0+rev=8784024";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-tcl";
-      rev = "56ad1fa6a34ba800e5495d1025a9b0fda338d5b8";
-      hash = "sha256-GhK92+nbJ+M5/1ZnPbIJ3EuNub332YK+hyWiwyBqUmk=";
+      rev = "8784024358c233efd0f3a6fd9e7a3c5852e628bc";
+      hash = "sha256-/uw+Nb5A+DklN+BxMpufSCMb/VOE/zqJNnLZVFwjWtc=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-tcl";
   };
@@ -2577,12 +2588,12 @@
   };
   templ = buildGrammar {
     language = "templ";
-    version = "0.0.0+rev=db66241";
+    version = "0.0.0+rev=e2218a2";
     src = fetchFromGitHub {
       owner = "vrischmann";
       repo = "tree-sitter-templ";
-      rev = "db662414ccd6f7c78b1e834e7abe11c224b04759";
-      hash = "sha256-DPVVdzAU3xGa1TpndlwPZr11zi1ToYkvqWDJeddfDYs=";
+      rev = "e2218a2376e3ff18c9963b21aa567770baab0462";
+      hash = "sha256-lyxXb71FVfpWw4IbU5P6uDVETNSDO+r7+YgZDvaIEbc=";
     };
     meta.homepage = "https://github.com/vrischmann/tree-sitter-templ";
   };
@@ -2611,12 +2622,12 @@
   };
   thrift = buildGrammar {
     language = "thrift";
-    version = "0.0.0+rev=d4deb1b";
+    version = "0.0.0+rev=68fd0d8";
     src = fetchFromGitHub {
       owner = "duskmoon314";
       repo = "tree-sitter-thrift";
-      rev = "d4deb1bd9e848f2dbe81103a151d99e8546de480";
-      hash = "sha256-MCa7319E8bo3r2kDClBmjOvvs+yZDlE1E+52WqJqvMI=";
+      rev = "68fd0d80943a828d9e6f49c58a74be1e9ca142cf";
+      hash = "sha256-owZbs8ttjKrqTA8fQ/NmBGyIUUItSUvvW4hRv0NPV8Y=";
     };
     meta.homepage = "https://github.com/duskmoon314/tree-sitter-thrift";
   };
@@ -2633,23 +2644,23 @@
   };
   tlaplus = buildGrammar {
     language = "tlaplus";
-    version = "0.0.0+rev=439dad0";
+    version = "0.0.0+rev=410122a";
     src = fetchFromGitHub {
       owner = "tlaplus-community";
       repo = "tree-sitter-tlaplus";
-      rev = "439dad01355e4db335fe9cd12eb177b4f2563dd6";
-      hash = "sha256-d2CPUjqMOu9xc+wjw2uGk2UmkR9OzoYFchbK+IMH7YA=";
+      rev = "410122a012abb06fbacc8c0b8f288b684f8113e1";
+      hash = "sha256-vWxMaka5h8L+tJctiflEWT1/nofPYHIgpf1/3jfsgVU=";
     };
     meta.homepage = "https://github.com/tlaplus-community/tree-sitter-tlaplus";
   };
   tmux = buildGrammar {
     language = "tmux";
-    version = "0.0.0+rev=7499587";
+    version = "0.0.0+rev=1415bd8";
     src = fetchFromGitHub {
       owner = "Freed-Wu";
       repo = "tree-sitter-tmux";
-      rev = "7499587642a46ee156e1bb58851904ac750dcc7c";
-      hash = "sha256-0zeAaQtHZrOwfoSyzj37GZH4tpm+BSuJvLyilVHUW4E=";
+      rev = "1415bd8b5bb69c230947663deceb62c2a0ae4155";
+      hash = "sha256-3kF6H3tP20FUfNoIRxQCnVzvyd4MFLd9oN6rhB/ePvo=";
     };
     meta.homepage = "https://github.com/Freed-Wu/tree-sitter-tmux";
   };
@@ -2746,12 +2757,12 @@
   };
   typst = buildGrammar {
     language = "typst";
-    version = "0.0.0+rev=f457c77";
+    version = "0.0.0+rev=13863dd";
     src = fetchFromGitHub {
       owner = "uben0";
       repo = "tree-sitter-typst";
-      rev = "f457c77edffd4b93190794355ff5acf7acfb99c6";
-      hash = "sha256-f/vIpDZkQOK0GWlwvGEGucYkv4FHGpmhQDchnE6ddz8=";
+      rev = "13863ddcbaa7b68ee6221cea2e3143415e64aea4";
+      hash = "sha256-n6RTRMJS3h+g+Wawjb7I9NJbz+w/SGi+DQVj1jiyGaU=";
     };
     meta.homepage = "https://github.com/uben0/tree-sitter-typst";
   };
@@ -2779,12 +2790,12 @@
   };
   unison = buildGrammar {
     language = "unison";
-    version = "0.0.0+rev=fb49b81";
+    version = "0.0.0+rev=a1eba0f";
     src = fetchFromGitHub {
       owner = "kylegoetz";
       repo = "tree-sitter-unison";
-      rev = "fb49b8125509c079e08f345758c03a427129010e";
-      hash = "sha256-Y4Pnte9ZxXq7tzjc+cliXO8U57cnHlQxOMuX8u39ptE=";
+      rev = "a1eba0fef887800de97126e2c9ae4109c1c6a2ea";
+      hash = "sha256-p0LArEOspQvpgNponLpMakEHrwHM+UzA9SU5PdwQCTU=";
     };
     generate = true;
     meta.homepage = "https://github.com/kylegoetz/tree-sitter-unison";
@@ -2813,12 +2824,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "0.0.0+rev=95869fa";
+    version = "0.0.0+rev=7e11a6f";
     src = fetchFromGitHub {
       owner = "vlang";
       repo = "v-analyzer";
-      rev = "95869fa2058fbc9098f640b87399971c6d7552c0";
-      hash = "sha256-Y3htLfDQ6gjYReQ1z5vlCA+A5n0qFSlu7GHog/b+7/E=";
+      rev = "7e11a6f8f369df935664fadd2f0c99d90fe3226f";
+      hash = "sha256-zCXfYW8NCsdqKKEMkZUudpCEQM4bLePyCGFS0w86DY0=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/vlang/v-analyzer";
@@ -2880,12 +2891,12 @@
   };
   vimdoc = buildGrammar {
     language = "vimdoc";
-    version = "0.0.0+rev=a75a932";
+    version = "0.0.0+rev=0b36856";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "tree-sitter-vimdoc";
-      rev = "a75a932449675bbd260213a95f4cd8b3193286f0";
-      hash = "sha256-spj8h1ZDY+6sWi+FCALapBsG+ig9H1u3bjkI2+UP0ds=";
+      rev = "0b36856db88680f662cc67545c82af4ce83bf158";
+      hash = "sha256-8kq1Y+WXL6qu8CyS5zmE7pe/a0K5rmiGgZMxj5O/VHY=";
     };
     meta.homepage = "https://github.com/neovim/tree-sitter-vimdoc";
   };
@@ -2913,27 +2924,36 @@
   };
   wgsl_bevy = buildGrammar {
     language = "wgsl_bevy";
-    version = "0.0.0+rev=4d7b469";
+    version = "0.0.0+rev=f5980f5";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-wgsl-bevy";
-      rev = "4d7b4697dd2598c60a6ccbc51db8b768cd8700b8";
-      hash = "sha256-n4RkD6Q0QPYY34MlJSlzlzsUix5xnZnMEU/UCdbxGYI=";
+      rev = "f5980f534ee64256b1e64b0a42e2864d91154a5d";
+      hash = "sha256-LbysBXujWWDVtgyHte9RLOPu/LMk1TN/9DC0t0WWdcQ=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-wgsl-bevy";
   };
   wing = buildGrammar {
     language = "wing";
-    version = "0.0.0+rev=0cdff2b";
+    version = "0.0.0+rev=bd1d35c";
     src = fetchFromGitHub {
       owner = "winglang";
-      repo = "wing";
-      rev = "0cdff2bc50e3664049905e952746cadf4ac62f15";
-      hash = "sha256-ocHNpn7EKDdoBsanBf8XPhqZYM0wna9a+tDxy4gIO3o=";
+      repo = "tree-sitter-wing";
+      rev = "bd1d35cf3e013dc7e189b46a593bdc2b281b0dd7";
+      hash = "sha256-jygMTswZ8r4tUJQ0lUH8GHz56dyGd6rV1wL5i75Ni88=";
     };
-    location = "libs/tree-sitter-wing";
-    generate = true;
-    meta.homepage = "https://github.com/winglang/wing";
+    meta.homepage = "https://github.com/winglang/tree-sitter-wing";
+  };
+  wit = buildGrammar {
+    language = "wit";
+    version = "0.0.0+rev=6f511f9";
+    src = fetchFromGitHub {
+      owner = "liamwh";
+      repo = "tree-sitter-wit";
+      rev = "6f511f9c6676e597c2f0930e4d2629595319882d";
+      hash = "sha256-xvMIcbeYdr/KIz0fqnARAwEKWmm4dlWhFAS/NZFU16s=";
+    };
+    meta.homepage = "https://github.com/liamwh/tree-sitter-wit";
   };
   xcompose = buildGrammar {
     language = "xcompose";
@@ -2948,24 +2968,24 @@
   };
   xml = buildGrammar {
     language = "xml";
-    version = "0.0.0+rev=2282ad5";
+    version = "0.0.0+rev=96beba9";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-xml";
-      rev = "2282ad5cb8e815523e70d5c82404620bd9a1494c";
-      hash = "sha256-CZAVJdT01wXyaDnPxXz6ZhiiDxuvwKCWPGjaWe6FpWk=";
+      rev = "96beba9f3e4156aaae64bb86997503b1ceb1283d";
+      hash = "sha256-XmSU9Om1bj/PtBxr22Sf81Mx68QINtK8Gls1fRldt6Q=";
     };
     location = "xml";
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-xml";
   };
   yaml = buildGrammar {
     language = "yaml";
-    version = "0.0.0+rev=c9ee63b";
+    version = "0.0.0+rev=ee09311";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-yaml";
-      rev = "c9ee63b15c92656a89f7007f38a98f21c3eca81d";
-      hash = "sha256-2MWTBUoaf+F/TJU+CWJ22JAoyq63XKxy1wJPxcZFePc=";
+      rev = "ee093118211be521742b9866a8ed8ce6d87c7a94";
+      hash = "sha256-tE39KP86JYYmj8WW1l3HAIiBZr/E4IyOgdsUm6d6pQ8=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-yaml";
   };
@@ -2982,23 +3002,23 @@
   };
   yuck = buildGrammar {
     language = "yuck";
-    version = "0.0.0+rev=c348825";
+    version = "0.0.0+rev=a513732";
     src = fetchFromGitHub {
       owner = "Philipp-M";
       repo = "tree-sitter-yuck";
-      rev = "c348825d3f86dec71dee0e1223c6bd73114e3579";
-      hash = "sha256-H4tsLDo9Egp1mpZGcA5Z9C9wPFNxPEBDTugUYKeYW9I=";
+      rev = "a513732feb813426b51d1ead8397a9c285c411be";
+      hash = "sha256-XfenP9bXkskCfiq2sE8qLog0NmSecP50Ur+8HDtU4pQ=";
     };
     meta.homepage = "https://github.com/Philipp-M/tree-sitter-yuck";
   };
   zathurarc = buildGrammar {
     language = "zathurarc";
-    version = "0.0.0+rev=aad4302";
+    version = "0.0.0+rev=09b837d";
     src = fetchFromGitHub {
       owner = "Freed-Wu";
       repo = "tree-sitter-zathurarc";
-      rev = "aad4302fb5a5176004b688fcab4ae7dcf36bf49a";
-      hash = "sha256-mo/gYg6cDp38hx3HTqI4CqPHTGLQ/Je9fs1rYn10Aws=";
+      rev = "09b837dc8f7445fd86e1245c23b1a7804229edd4";
+      hash = "sha256-t7eBWDfn0nq1nGqSyCZmoSGVGgeTcGFfPrZl62OkD1I=";
     };
     meta.homepage = "https://github.com/Freed-Wu/tree-sitter-zathurarc";
   };
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 381c9e4a80d82..58524a92d1a7a 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -321,12 +321,12 @@
 
   codeium-nvim = let
     # Update according to https://github.com/Exafunction/codeium.nvim/blob/main/lua/codeium/versions.json
-    codeiumVersion = "1.6.7";
+    codeiumVersion = "1.8.25";
     codeiumHashes = {
-      x86_64-linux = "sha256-z1cZ6xmP25iPezeLpz4xRh7czgx1JLwsYwGAEUA6//I=";
-      aarch64-linux = "sha256-8cSdCiIVbqv91lUMOLV1Xld8KuIzJA5HCIDbhyyc404=";
-      x86_64-darwin = "sha256-pjW7tNyO0cIFdIm69H6I3HDBpFwnJIRmIN7WRi1OfLw=";
-      aarch64-darwin = "sha256-DgE4EVNCM9+YdTVJeVYnrDGAXOJV1VrepiVeX3ziwfg=";
+      x86_64-linux = "sha256-6sIYDI6+1/p54Af+E/GmRAFlfDYJVwxhn0qF47ZH+Zg=";
+      aarch64-linux = "sha256-1ImcjAqCZm5KZZYHWhG1eO7ipAdrP4Qjj2eBxTst++s=";
+      x86_64-darwin = "sha256-yHthItxZYFejJlwJJ7BrM2csnLsZXjy/IbzF1iaCCyI=";
+      aarch64-darwin = "sha256-GIx0yABISj/rH/yVkkx6NBs5qF0P8nhpMyvnzXJ92mA=";
     };
 
     codeium' = codeium.overrideAttrs rec {
@@ -1038,7 +1038,7 @@
         inherit (old) version src;
         sourceRoot = "${old.src.name}/spectre_oxi";
 
-        cargoHash = "sha256-tWJyVBYYQWr3ofYnbvfQZdzPQ9o//7XEbdjN5b2frPo=";
+        cargoHash = "sha256-UxOAIyVlJWlp5RUFVU3Ib539D5pm6Z+3edjHLerkIRU=";
 
 
         preCheck = ''
diff --git a/pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch b/pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch
index 82d73809ff793..c3b1368577f3f 100644
--- a/pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch
+++ b/pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch
@@ -21,7 +21,7 @@ index d6d4b4c..9853877 100644
  	else
  		call v:lua.vim.health.ok("htop is installed")
 diff --git a/lua/openscad.lua b/lua/openscad.lua
-index 7475f29..832c895 100644
+index 0a26d08..1264989 100644
 --- a/lua/openscad.lua
 +++ b/lua/openscad.lua
 @@ -101,7 +101,7 @@ end
@@ -33,12 +33,12 @@ index 7475f29..832c895 100644
  end
  
  function M.help()
-@@ -125,7 +125,7 @@ function M.exec_openscad()
- 		jobCommand = '/Applications/OpenSCAD.app/Contents/MacOS/OpenSCAD ' .. vim.fn.expand('%:p')
+@@ -126,7 +126,7 @@ function M.exec_openscad()
+ 		jobCommand = '/Applications/OpenSCAD.app/Contents/MacOS/OpenSCAD ' .. filename
  	else
  		-- TODO: What about Windows?
--		jobCommand = 'openscad ' .. vim.fn.expand('%:p')
-+		jobCommand = '@openscad@ ' .. vim.fn.expand('%:p')
+-		jobCommand = 'openscad ' .. filename
++		jobCommand = '@openscad@ ' .. filename
  	end
  
  	vim.fn.jobstart(jobCommand)
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index a9b5e4e9c69c3..25709a73a6980 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -56,6 +56,7 @@ https://github.com/pearofducks/ansible-vim/,,
 https://github.com/ckarnell/antonys-macro-repeater/,,
 https://github.com/solarnz/arcanist.vim/,,
 https://github.com/vim-scripts/argtextobj.vim/,,
+https://github.com/otavioschwanck/arrow.nvim/,,
 https://github.com/AstroNvim/astrotheme/,,
 https://github.com/prabirshrestha/async.vim/,,
 https://github.com/prabirshrestha/asyncomplete-buffer.vim/,HEAD,
@@ -361,6 +362,7 @@ https://github.com/morhetz/gruvbox/,,
 https://github.com/luisiacc/gruvbox-baby/,HEAD,
 https://github.com/eddyekofo94/gruvbox-flat.nvim/,,
 https://github.com/sainnhe/gruvbox-material/,,
+https://github.com/f4z3r/gruvbox-material.nvim/,HEAD,
 https://github.com/ellisonleao/gruvbox.nvim/,,
 https://github.com/nvimdev/guard-collection/,HEAD,
 https://github.com/nvimdev/guard.nvim/,HEAD,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 5cf2b7b53d066..24d0a32ef9cbf 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1,27 +1,29 @@
 # Before adding a new extension, read ./README.md
 
-{ config
-, lib
-, fetchurl
-, callPackage
-, vscode-utils
-, python3Packages
-, jdk
-, llvmPackages
-, llvmPackages_14
-, protobuf
-, jq
-, moreutils
-, autoPatchelfHook
-, zlib
-, stdenv
+{
+  autoPatchelfHook,
+  callPackage,
+  config,
+  fetchurl,
+  jdk,
+  jq,
+  lib,
+  llvmPackages,
+  llvmPackages_14,
+  moreutils,
+  protobuf,
+  python3Packages,
+  stdenv,
+  vscode-utils,
+  zlib,
 }:
 
 let
   inherit (vscode-utils) buildVscodeMarketplaceExtension;
 
-  baseExtensions = self: lib.mapAttrs (_n: lib.recurseIntoAttrs)
-    {
+  baseExtensions =
+    self:
+    lib.mapAttrs (_n: lib.recurseIntoAttrs) {
       "13xforever".language-x86-64-assembly = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "language-x86-64-assembly";
@@ -142,6 +144,23 @@ let
         };
       };
 
+      adzero.vscode-sievehighlight = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-sievehighlight";
+          publisher = "adzero";
+          version = "1.0.6";
+          hash = "sha256-8Ompv792eI2kIH+5+KPL9jAf88xsMGQewHEQwi8BhoQ=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/adzero.vscode-sievehighlight/changelog";
+          description = "A Visual Studio Code extension to enable syntax highlight support for Sieve mail filtering language";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=adzero.vscode-sievehighlight";
+          homepage = "https://github.com/adzero/vscode-sievehighlight";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.sebtm ];
+        };
+      };
+
       alanz.vscode-hie-server = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-hie-server";
@@ -316,8 +335,7 @@ let
         };
         meta = {
           description = "An arctic, north-bluish clean and elegant Visual Studio Code theme.";
-          downloadPage =
-            "https://marketplace.visualstudio.com/items?itemName=arcticicestudio.nord-visual-studio-code";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=arcticicestudio.nord-visual-studio-code";
           homepage = "https://github.com/arcticicestudio/nord-visual-studio-code";
           license = lib.licenses.mit;
           maintainers = [ lib.maintainers.imgabe ];
@@ -363,7 +381,7 @@ let
           homepage = "https://github.com/asdine/vscode-cue";
           changelog = "https://marketplace.visualstudio.com/items/asdine.cue/changelog";
           license = lib.licenses.mit;
-          maintainers = [lib.maintainers.matthewpi];
+          maintainers = [ lib.maintainers.matthewpi ];
         };
       };
 
@@ -735,30 +753,33 @@ let
       };
 
       charliermarsh.ruff = buildVscodeMarketplaceExtension {
-        mktplcRef = let
-          sources = {
-            "x86_64-linux" = {
-              arch = "linux-x64";
-              hash = "sha256-2c0tH/MlDOqeyffcV8ZCy4woogBTcf1GCuPPO8JXaWc=";
-            };
-            "x86_64-darwin" = {
-              arch = "darwin-x64";
-              hash = "sha256-euvGIlO7931N56R5BWKu3F9nSEoDgf+DXk7Hgl1qSUw=";
-            };
-            "aarch64-linux" = {
-              arch = "linux-arm64";
-              hash = "sha256-dGpIHChnfrQbxRZDuoAi4imgStyyPdxdvTQ3lknMYu0=";
-            };
-            "aarch64-darwin" = {
-              arch = "darwin-arm64";
-              hash = "sha256-tElX4C0I5AmpxSHMtqOsxSAUImD1tqArB5fnvhw4LFc=";
+        mktplcRef =
+          let
+            sources = {
+              "x86_64-linux" = {
+                arch = "linux-x64";
+                hash = "sha256-2c0tH/MlDOqeyffcV8ZCy4woogBTcf1GCuPPO8JXaWc=";
+              };
+              "x86_64-darwin" = {
+                arch = "darwin-x64";
+                hash = "sha256-euvGIlO7931N56R5BWKu3F9nSEoDgf+DXk7Hgl1qSUw=";
+              };
+              "aarch64-linux" = {
+                arch = "linux-arm64";
+                hash = "sha256-dGpIHChnfrQbxRZDuoAi4imgStyyPdxdvTQ3lknMYu0=";
+              };
+              "aarch64-darwin" = {
+                arch = "darwin-arm64";
+                hash = "sha256-tElX4C0I5AmpxSHMtqOsxSAUImD1tqArB5fnvhw4LFc=";
+              };
             };
-          };
-        in {
-          name = "ruff";
-          publisher = "charliermarsh";
-          version = "2024.4.0";
-        } // sources.${stdenv.system} or (throw "Unsupported system ${stdenv.system}");
+          in
+          {
+            name = "ruff";
+            publisher = "charliermarsh";
+            version = "2024.4.0";
+          }
+          // sources.${stdenv.system} or (throw "Unsupported system ${stdenv.system}");
         meta = {
           license = lib.licenses.mit;
           changelog = "https://marketplace.visualstudio.com/items/charliermarsh.ruff/changelog";
@@ -917,7 +938,9 @@ let
         };
       };
 
-      contextmapper.context-mapper-vscode-extension = callPackage ./contextmapper.context-mapper-vscode-extension { };
+      contextmapper.context-mapper-vscode-extension =
+        callPackage ./contextmapper.context-mapper-vscode-extension
+          { };
 
       continue.continue = buildVscodeMarketplaceExtension {
         mktplcRef =
@@ -945,13 +968,10 @@ let
             name = "continue";
             publisher = "Continue";
             version = "0.8.22";
-          } // sources.${stdenv.system};
-        nativeBuildInputs = [
-          autoPatchelfHook
-        ];
-        buildInputs = [
-          stdenv.cc.cc.lib
-        ];
+          }
+          // sources.${stdenv.system};
+        nativeBuildInputs = [ autoPatchelfHook ];
+        buildInputs = [ stdenv.cc.cc.lib ];
         postInstall = ''
           cd "$out/$installPrefix"
           substituteInPlace "out/extension.js" \
@@ -963,7 +983,12 @@ let
           homepage = "https://github.com/continuedev/continue";
           license = lib.licenses.asl20;
           maintainers = [ lib.maintainers.raroh73 ];
-          platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ];
+          platforms = [
+            "x86_64-linux"
+            "x86_64-darwin"
+            "aarch64-darwin"
+            "aarch64-linux"
+          ];
         };
       };
 
@@ -1130,34 +1155,35 @@ let
       };
 
       devsense.phptools-vscode = buildVscodeMarketplaceExtension {
-        mktplcRef = let
-          sources = {
-            "x86_64-linux" = {
-              arch = "linux-x64";
-              hash = "sha256-8i5nRlzd+LnpEh9trWECxfiC1W4S0ekBab5vo18OlsA=";
-            };
-            "x86_64-darwin" = {
-              arch = "darwin-x64";
-              sha256 = "14crw56277rdwhigabb3nsndkfcs3yzzf7gw85jvryxviq32chgy";
-            };
-            "aarch64-linux" = {
-              arch = "linux-arm64";
-              sha256 = "1j1xlvbg3nrfmdd9zm6kywwicdwdkrq0si86lcndaii8m7sj5pfp";
-            };
-            "aarch64-darwin" = {
-              arch = "darwin-arm64";
-              sha256 = "0nlks6iqxkx1xlicsa8lrb1319rgznlxkv2gg7wkwgzph97ik8bi";
+        mktplcRef =
+          let
+            sources = {
+              "x86_64-linux" = {
+                arch = "linux-x64";
+                hash = "sha256-8i5nRlzd+LnpEh9trWECxfiC1W4S0ekBab5vo18OlsA=";
+              };
+              "x86_64-darwin" = {
+                arch = "darwin-x64";
+                sha256 = "14crw56277rdwhigabb3nsndkfcs3yzzf7gw85jvryxviq32chgy";
+              };
+              "aarch64-linux" = {
+                arch = "linux-arm64";
+                sha256 = "1j1xlvbg3nrfmdd9zm6kywwicdwdkrq0si86lcndaii8m7sj5pfp";
+              };
+              "aarch64-darwin" = {
+                arch = "darwin-arm64";
+                sha256 = "0nlks6iqxkx1xlicsa8lrb1319rgznlxkv2gg7wkwgzph97ik8bi";
+              };
             };
-          };
-        in {
-          name = "phptools-vscode";
-          publisher = "devsense";
-          version = "1.41.14332";
-        } // sources.${stdenv.system};
+          in
+          {
+            name = "phptools-vscode";
+            publisher = "devsense";
+            version = "1.41.14332";
+          }
+          // sources.${stdenv.system};
 
-        nativeBuildInputs = [
-          autoPatchelfHook
-        ];
+        nativeBuildInputs = [ autoPatchelfHook ];
 
         buildInputs = [
           zlib
@@ -1175,7 +1201,12 @@ let
           homepage = "https://github.com/DEVSENSE/phptools-docs";
           license = lib.licenses.unfree;
           maintainers = [ lib.maintainers.drupol ];
-          platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ];
+          platforms = [
+            "x86_64-linux"
+            "x86_64-darwin"
+            "aarch64-darwin"
+            "aarch64-linux"
+          ];
         };
       };
 
@@ -1203,7 +1234,9 @@ let
           version = "0.0.4";
           sha256 = "0sa04srhqmngmw71slnrapi2xay0arj42j4gkan8i11n7bfi1xpf";
         };
-        meta = { license = lib.licenses.mit; };
+        meta = {
+          license = lib.licenses.mit;
+        };
       };
 
       dhall.vscode-dhall-lsp-server = buildVscodeMarketplaceExtension {
@@ -1213,7 +1246,9 @@ let
           version = "0.0.4";
           sha256 = "1zin7s827bpf9yvzpxpr5n6mv0b5rhh3civsqzmj52mdq365d2js";
         };
-        meta = { license = lib.licenses.mit; };
+        meta = {
+          license = lib.licenses.mit;
+        };
       };
 
       dhedgecock.radical-vscode = buildVscodeMarketplaceExtension {
@@ -1240,7 +1275,9 @@ let
           version = "0.0.8";
           hash = "sha256-BQPiSxiPPjdNPtIJI8L+558DVKxngPAI9sscpcJSJUI=";
         };
-        meta = { license = lib.licenses.asl20; };
+        meta = {
+          license = lib.licenses.asl20;
+        };
       };
 
       divyanshuagrawal.competitive-programming-helper = buildVscodeMarketplaceExtension {
@@ -1794,8 +1831,7 @@ let
         };
         meta = {
           description = "GitHub theme for VS Code";
-          downloadPage =
-            "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
           homepage = "https://github.com/primer/github-vscode-theme";
           license = lib.licenses.mit;
           maintainers = [ lib.maintainers.hugolgst ];
@@ -1830,7 +1866,9 @@ let
           version = "0.78.1";
           hash = "sha256-T9oW6o4ItZfR8E1qrcH3nhMvVB6ihi4kpiDz7YGHOcI=";
         };
-        meta = { license = lib.licenses.mit; };
+        meta = {
+          license = lib.licenses.mit;
+        };
       };
 
       gitlab.gitlab-workflow = buildVscodeMarketplaceExtension {
@@ -2439,9 +2477,15 @@ let
             hash = "sha256-IueXiN+077tiecAsVCzgYksWYTs00mZv6XJVMtRJ/PQ=";
           };
 
-          nativeBuildInputs = [ jq moreutils ];
+          nativeBuildInputs = [
+            jq
+            moreutils
+          ];
 
-          buildInputs = [ cfn-lint pydot ];
+          buildInputs = [
+            cfn-lint
+            pydot
+          ];
 
           postInstall = ''
             cd "$out/$installPrefix"
@@ -3321,13 +3365,18 @@ let
         mktplcRef = {
           name = "java";
           publisher = "redhat";
-          version = "1.17.2023032504";
-          hash = "sha256-ni1jzCPjwtcdJTEORn0vYzLRbQ/wseTZmrETJ8QPW58=";
+          version = "1.30.2024041908";
+          hash = "sha256-2VaB7duzDmoQYxLHIuC9yghJvmVnWJIBfH75xq5ljPg=";
         };
         buildInputs = [ jdk ];
         meta = {
+          description = "Java language support for VS Code via the Eclipse JDT Language Server";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=redhat.java";
+          homepage = "https://github.com/redhat-developer/vscode-java";
+          changelog = "https://marketplace.visualstudio.com/items/redhat.java/changelog";
           license = lib.licenses.epl20;
-          broken = lib.versionOlder jdk.version "11";
+          maintainers = [ lib.maintainers.wackbyte ];
+          broken = lib.versionOlder jdk.version "17";
         };
       };
 
@@ -4019,8 +4068,8 @@ let
         mktplcRef = {
           name = "vscode-nushell-lang";
           publisher = "thenuprojectcontributors";
-          version = "1.1.0";
-          hash = "sha256-7v4q0OEqv7q2ejHp4lph2Dsqg0GWE65pxyz9goQEm8g=";
+          version = "1.9.0";
+          hash = "sha256-E9CK/GChd/yZT+P3ttROjL2jHtKPJ0KZzc32/nbuE4w=";
         };
         meta.license = lib.licenses.mit;
       };
@@ -4179,7 +4228,11 @@ let
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=uiua-lang.uiua-vscode";
           homepage = "https://github.com/uiua-lang/uiua-vscode";
           license = lib.licenses.mit;
-          maintainers = with lib.maintainers; [ tomasajt wackbyte defelo ];
+          maintainers = with lib.maintainers; [
+            tomasajt
+            wackbyte
+            defelo
+          ];
         };
       };
 
@@ -4249,7 +4302,10 @@ let
           sha256 = "1nlrijjwc35n1xgb5lgnr4yvlgfcxd0vdj93ip8lv2xi8x1ni5f6";
         };
 
-        nativeBuildInputs = [ jq moreutils ];
+        nativeBuildInputs = [
+          jq
+          moreutils
+        ];
 
         buildInputs = [ jdk ];
 
@@ -4693,7 +4749,10 @@ let
           version = "0.5.4";
           sha256 = "08dfl5h1k6s542qw5qx2czm1wb37ck9w2vpjz44kp2az352nmksb";
         };
-        nativeBuildInputs = [ jq moreutils ];
+        nativeBuildInputs = [
+          jq
+          moreutils
+        ];
         postInstall = ''
           cd "$out/$installPrefix"
           jq '.contributes.configuration.properties.protoc.properties.path.default = "${protobuf}/bin/protoc"' package.json | sponge package.json
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index 5e7c3f59f1982..9dbf71b8b1016 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -12,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
     publisher = "myriad-dreamin";
     # Please update the corresponding binary (tinymist) when updating
     # this extension.
-    version = "0.11.4";
-    hash = "sha256-VR+vl6mctwq9oSIgnfutvPFwfGUdEco8fCOjzMvPtII=";
+    version = "0.11.5";
+    hash = "sha256-p97RREGKhTeXO5s4jP8qUsLtYxOj91ddQhsk6Q+50jc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/emulators/cemu/default.nix b/pkgs/applications/emulators/cemu/default.nix
index 2b3f5e28a8cf8..a51982a19cd4c 100644
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@@ -46,13 +46,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "cemu";
-  version = "2.0-74";
+  version = "2.0-79";
 
   src = fetchFromGitHub {
     owner = "cemu-project";
     repo = "Cemu";
     rev = "v${version}";
-    hash = "sha256-taV2HEKRUQ7k5BpgA3nwVzX8qkTN02O9kqswjdCHod0=";
+    hash = "sha256-vSZLiRzOOJJMgycjI5xpgJcUAj5WCz241mAABgNuECw=";
   };
 
   patches = [
diff --git a/pkgs/applications/emulators/dolphin-emu/default.nix b/pkgs/applications/emulators/dolphin-emu/default.nix
index b2a9bbb7bbc40..3f77dcd105f91 100644
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@@ -204,7 +204,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [
       MP2E
       ashkitten
-      xfix
       ivar
     ];
   };
diff --git a/pkgs/applications/emulators/lambda-delta/default.nix b/pkgs/applications/emulators/lambda-delta/default.nix
index a17a0eadfd5b9..cf2001caff32f 100644
--- a/pkgs/applications/emulators/lambda-delta/default.nix
+++ b/pkgs/applications/emulators/lambda-delta/default.nix
@@ -13,6 +13,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ SDL2 ];
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-std=c89";
+  };
+
 
   configureFlags = [ "--without-SDL1" ];
 
diff --git a/pkgs/applications/emulators/mednafen/server.nix b/pkgs/applications/emulators/mednafen/server.nix
deleted file mode 100644
index 3e11ff41d48d5..0000000000000
--- a/pkgs/applications/emulators/mednafen/server.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  pname = "mednafen-server";
-  version = "0.5.2";
-
-  src = fetchurl {
-    url = "https://mednafen.github.io/releases/files/mednafen-server-${version}.tar.xz";
-    sha256 = "0xm7dj5nwnrsv69r72rcnlw03jm0l8rmrg3s05gjfvxyqmlb36dq";
-  };
-
-  postInstall = "install -m 644 -Dt $out/share/mednafen-server standard.conf";
-
-  meta = with lib; {
-    description = "Netplay server for Mednafen";
-    mainProgram = "mednafen-server";
-    homepage = "https://mednafen.github.io/";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/applications/emulators/mednaffe/default.nix b/pkgs/applications/emulators/mednaffe/default.nix
deleted file mode 100644
index 75a25a4bec3b0..0000000000000
--- a/pkgs/applications/emulators/mednaffe/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, autoreconfHook
-, pkg-config
-, mednafen
-, gtk3
-, wrapGAppsHook
-}:
-
-stdenv.mkDerivation rec {
-  pname = "mednaffe";
-  version = "0.9.2";
-
-  src = fetchFromGitHub {
-    owner = "AmatCoder";
-    repo = "mednaffe";
-    rev = version;
-    sha256 = "sha256-zvSAt6CMcgdoPpTTA5sPlQaWUw9LUMsR2Xg9jM2UaWY=";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
-
-  buildInputs = [ gtk3 mednafen ];
-
-  enableParallelBuilding = true;
-
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --prefix PATH ':' "${mednafen}/bin"
-    )
-   '';
-
-  meta = with lib; {
-    description = "GTK-based frontend for mednafen emulator";
-    mainProgram = "mednaffe";
-    homepage = "https://github.com/AmatCoder/mednaffe";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ sheenobu yana AndersonTorres ];
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/applications/emulators/melonDS/default.nix b/pkgs/applications/emulators/melonDS/default.nix
index 0603373dfedd5..bb0499f97277d 100644
--- a/pkgs/applications/emulators/melonDS/default.nix
+++ b/pkgs/applications/emulators/melonDS/default.nix
@@ -65,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
       artemist
       benley
       shamilton
-      xfix
     ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/applications/emulators/retroarch/hashes.json b/pkgs/applications/emulators/retroarch/hashes.json
index 3f07ec28fb003..1be9814b5e179 100644
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -85,10 +85,10 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-psx-libretro",
-            "rev": "9c9b44a7b9b373f2d8f9a3f16bc8373d6469cf98",
-            "hash": "sha256-XQ7EVPj0Eprs94yjqaUGCphHteRdbcv2nqp3gojYjzc="
+            "rev": "ab39d37f868ba8ff3982ce52c4ec22c162888dd7",
+            "hash": "sha256-Ay3wI9WToSsJNjkNFnHXTt9JUQ6nt+S9jI378E/kK8U="
         },
-        "version": "unstable-2024-04-12"
+        "version": "unstable-2024-04-19"
     },
     "beetle-saturn": {
         "fetcher": "fetchFromGitHub",
@@ -226,10 +226,10 @@
         "src": {
             "owner": "libretro",
             "repo": "dolphin",
-            "rev": "2f4b0f7902257d40a054f60b2c670d6e314f2a04",
-            "hash": "sha256-9WYWbLehExYbPmGJpguhVFXqFJ9aR6VxzFVChd4QOEg="
+            "rev": "89a4df725d4eb24537728f7d655cddb1add25c18",
+            "hash": "sha256-f9O3//EuoCSPQC7GWmf0EzAEpjoKof30kIDBCDw0dbs="
         },
-        "version": "unstable-2022-12-17"
+        "version": "unstable-2024-04-19"
     },
     "dosbox": {
         "fetcher": "fetchFromGitHub",
@@ -287,10 +287,10 @@
         "src": {
             "owner": "libretro",
             "repo": "fbneo",
-            "rev": "97f01ed6075b6034aeb16829a2a259bbe8a254f9",
-            "hash": "sha256-qXym7CzAXfOSK+hmq6JfCIrq9w11uA2UQ2Ps+lFHrfI="
+            "rev": "c821b1008e31d40b6d0464f67a3bc0b1a3da4cce",
+            "hash": "sha256-yZimJ1eH5Oi+6+4eMtXppj75awCrPXMiWhalsR+Bfik="
         },
-        "version": "unstable-2024-04-15"
+        "version": "unstable-2024-04-20"
     },
     "fceumm": {
         "fetcher": "fetchFromGitHub",
@@ -307,11 +307,11 @@
         "src": {
             "owner": "flyinghead",
             "repo": "flycast",
-            "rev": "7438094d7cdf191e6eb2a39e73cb0f512ea2a714",
-            "hash": "sha256-T19GJbN/MKC03Q/yS1C6qL5Rv++OlaBol4UYf9//l3s=",
+            "rev": "3c38fc1f16cc6518db46a5ad350e8b3738eefb48",
+            "hash": "sha256-NfJJcu7noefSgFlCFCgovnrb6FSzIXu3MGQHu6TCJWo=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-04-12"
+        "version": "unstable-2024-04-19"
     },
     "fmsx": {
         "fetcher": "fetchFromGitHub",
@@ -358,10 +358,10 @@
         "src": {
             "owner": "libretro",
             "repo": "Genesis-Plus-GX",
-            "rev": "b063aa81b90682ca89ae6fd1e958bc589b4ce34d",
-            "hash": "sha256-Tz6if6NfbwvZVDb5Ggr/tXuLNymOjcMkghKwZq6tl6I="
+            "rev": "cbacea723690e88e0b11a4b1d0e5b88b1b7eb9d4",
+            "hash": "sha256-7qFBzATlhf89ILHsEoF+SWwD4Pwd5+08VnK5xU1EDuI="
         },
-        "version": "unstable-2024-04-05"
+        "version": "unstable-2024-04-20"
     },
     "gpsp": {
         "fetcher": "fetchFromGitHub",
@@ -438,10 +438,10 @@
         "src": {
             "owner": "libretro",
             "repo": "mame2003-plus-libretro",
-            "rev": "7ca870c4168e69819923f73ae0289c38d57b01dc",
-            "hash": "sha256-eoLzRNsZtIo6Pc9SovQGh9sHxdXhBSQj71RDcQqjji0="
+            "rev": "bb864ca20b40908b8fbc49a350939160d6af29f6",
+            "hash": "sha256-3AvjOpgBh/p0p9xq4rD8xSKqZWzulw7AKUGQ1o9B2Ck="
         },
-        "version": "unstable-2024-04-13"
+        "version": "unstable-2024-04-19"
     },
     "mame2010": {
         "fetcher": "fetchFromGitHub",
@@ -630,10 +630,10 @@
         "src": {
             "owner": "libretro",
             "repo": "pcsx_rearmed",
-            "rev": "2f326fa15ff26df057ef10da232ebc07a410803a",
-            "hash": "sha256-mnJJ1NzxZoA3kwfPOyvpP65SKI0I/9FCPNW8TR8NY8k="
+            "rev": "e5cb0939ab32d3c3b90b39e2d49a1652a7cf0db1",
+            "hash": "sha256-K96w3NGXpsnVAmORPdwwhwIJ6PcvaDOEUtLkF4ftX3s="
         },
-        "version": "unstable-2024-04-14"
+        "version": "unstable-2024-04-18"
     },
     "picodrive": {
         "fetcher": "fetchFromGitHub",
@@ -651,22 +651,22 @@
         "src": {
             "owner": "jpd002",
             "repo": "Play-",
-            "rev": "5c8f4a818be5c1e4df568abfec169c2b08df6674",
-            "hash": "sha256-IyxqH0ZAAiJ8V9kaVSwhf1zJnVlxhJWghr51AXcvQvs=",
+            "rev": "57f8a1389f7f2987ab2ad99fdc846663994603ad",
+            "hash": "sha256-MwqLSTDL6C823grCMRYZrwjhIhbVipAR+4vF5k8UhyE=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-04-10"
+        "version": "unstable-2024-04-15"
     },
     "ppsspp": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "hrydgard",
             "repo": "ppsspp",
-            "rev": "efe2302548fcbd2dc68c9b5b1fb39dc7976532fd",
-            "hash": "sha256-zwC3HniJO11/6ApBo0UNn6WMu4Jmj099XaUY4QuKaZI=",
+            "rev": "1786a4ddb097f7df1c75b55b4c4b163032614371",
+            "hash": "sha256-nAyGfgSfcJ4dF5oF3FHy+aqzabf9wUOiP0w+GIY1svg=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-04-14"
+        "version": "unstable-2024-04-20"
     },
     "prboom": {
         "fetcher": "fetchFromGitHub",
@@ -693,10 +693,10 @@
         "src": {
             "owner": "libretro",
             "repo": "libretro-uae",
-            "rev": "3c4f02622bd9ab4bbfc5e90cea9c7e60cf410073",
-            "hash": "sha256-UMbD1RcgQmilBwwzvakUIWWWwg78sl1YT9EOE3Rhyao="
+            "rev": "4806716da70cf1f030788b43190d71aae61e2041",
+            "hash": "sha256-MNqk8ItSC//82HsRfXVYCH+Xd2GV8OA/2heZprx89PY="
         },
-        "version": "unstable-2024-04-12"
+        "version": "unstable-2024-04-19"
     },
     "quicknes": {
         "fetcher": "fetchFromGitHub",
@@ -753,10 +753,10 @@
         "src": {
             "owner": "snes9xgit",
             "repo": "snes9x",
-            "rev": "9d22dbb8d866f10042fe564db7dc7b41078a580b",
-            "hash": "sha256-y2kPj1BugXVZGzyxs0Ph/qM5SMe82kjxnQA25DIpzac="
+            "rev": "8077396d399424de89d0a6cc15134523965658e0",
+            "hash": "sha256-p6apk/8bRKSM3H3hGPr/fYGsDFgMv7syVmTHV0zgmOg="
         },
-        "version": "unstable-2024-04-13"
+        "version": "unstable-2024-04-20"
     },
     "snes9x2002": {
         "fetcher": "fetchFromGitHub",
@@ -813,10 +813,10 @@
         "src": {
             "owner": "libretro",
             "repo": "swanstation",
-            "rev": "77aeeea58a45cccae7a8be37645f8f5a27ff101b",
-            "hash": "sha256-z+9Y9hoQ832caip5U+siQXh9GFxLMnX0HcmLa93B/lc="
+            "rev": "c7fefb5bfdec2569c2528f8daa6e75b7a3de0880",
+            "hash": "sha256-dE8F/NXGIEMrdmBWUTzanCSlT0ddkwG8RLZFmy1XvzQ="
         },
-        "version": "unstable-2024-01-26"
+        "version": "unstable-2024-04-18"
     },
     "tgbdual": {
         "fetcher": "fetchFromGitHub",
diff --git a/pkgs/applications/emulators/retroarch/retroarch-assets.nix b/pkgs/applications/emulators/retroarch/retroarch-assets.nix
index fe9669836624a..eba4a71021969 100644
--- a/pkgs/applications/emulators/retroarch/retroarch-assets.nix
+++ b/pkgs/applications/emulators/retroarch/retroarch-assets.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "retroarch-assets";
-  version = "unstable-2024-01-02";
+  version = "unstable-2024-04-18";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "retroarch-assets";
-    rev = "923b711dc6772a168d83dc8915e9260730fcf3a1";
-    hash = "sha256-Hwgga2hCJEdf/j2mU+hLGAsWdYcfuzjCycxSF37I4qk=";
+    rev = "912f652740986549f41967d615d9da27c325c2b9";
+    hash = "sha256-HpmRnbj6CQp7+rmZY46MyT8Ga6832COm1it2z9rKUEU=";
   };
 
   makeFlags = [
diff --git a/pkgs/applications/emulators/snes9x/default.nix b/pkgs/applications/emulators/snes9x/default.nix
index 34c2f72c7dd4a..8f374b7e18183 100644
--- a/pkgs/applications/emulators/snes9x/default.nix
+++ b/pkgs/applications/emulators/snes9x/default.nix
@@ -120,7 +120,7 @@ stdenv.mkDerivation rec {
       license = licenses.unfreeRedistributable // {
         url = "https://github.com/snes9xgit/snes9x/blob/${version}/LICENSE";
       };
-      maintainers = with maintainers; [ qknight xfix thiagokokada ];
+      maintainers = with maintainers; [ qknight thiagokokada ];
       platforms = platforms.unix;
       broken = (withGtk && stdenv.isDarwin);
       mainProgram = "snes9x";
diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index 4a5e06c2e5e64..3476816b1c230 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -77,14 +77,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.34.5";
+  version = "3.34.6";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-TRSS1YclGUfBjNz+Lo8U8YlN4kdJ9JLcwd7qpgwRbG0=";
+    hash = "sha256-eWd8oIINWVN5Dt6s4bc1RtQbytFd0foPgIcd/N2hsMw=";
   };
 
   passthru = {
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index 61e08ef561632..d112ed50a0d52 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -78,14 +78,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.36.1";
+  version = "3.36.2";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-/0wVPcQoliJFgY8Kn506gUHfY+kDTdLgzbp/0KLSAkI=";
+    hash = "sha256-/8mpzl/6UpjrMVjae2nqpS2DBRCq86rE+B3INzoRz8g=";
   };
 
   passthru = {
diff --git a/pkgs/applications/graphics/gscan2pdf/default.nix b/pkgs/applications/graphics/gscan2pdf/default.nix
index bbf52e105a284..d7ebb0a747ea3 100644
--- a/pkgs/applications/graphics/gscan2pdf/default.nix
+++ b/pkgs/applications/graphics/gscan2pdf/default.nix
@@ -2,7 +2,7 @@
   # libs
   librsvg, sane-backends, sane-frontends,
   # runtime dependencies
-  imagemagick, libtiff_4_5, djvulibre, poppler_utils, ghostscript, unpaper, pdftk,
+  imagemagick, libtiff, djvulibre, poppler_utils, ghostscript, unpaper, pdftk,
   # test dependencies
   xvfb-run, liberation_ttf, file, tesseract }:
 
@@ -82,7 +82,7 @@ perlPackages.buildPerlPackage rec {
     wrapProgram "$out/bin/gscan2pdf" \
       --prefix PATH : "${sane-backends}/bin" \
       --prefix PATH : "${imagemagick}/bin" \
-      --prefix PATH : "${libtiff_4_5}/bin" \
+      --prefix PATH : "${libtiff}/bin" \
       --prefix PATH : "${djvulibre}/bin" \
       --prefix PATH : "${poppler_utils}/bin" \
       --prefix PATH : "${ghostscript}/bin" \
@@ -98,10 +98,7 @@ perlPackages.buildPerlPackage rec {
 
   nativeCheckInputs = [
     imagemagick
-    # Needs older libtiff version, because it stopped packageing tools like
-    # tiff2pdf and others in version 4.6. These tools are necessary for gscan2pdf.
-    # See commit f57a4b0ac1b954eec0c8def2a99e2a464ac6ff7a for in-depth explanation.
-    libtiff_4_5
+    libtiff
     djvulibre
     poppler_utils
     ghostscript
diff --git a/pkgs/applications/graphics/meshlab/default.nix b/pkgs/applications/graphics/meshlab/default.nix
index 32d5288315395..a77a39445c045 100644
--- a/pkgs/applications/graphics/meshlab/default.nix
+++ b/pkgs/applications/graphics/meshlab/default.nix
@@ -15,21 +15,27 @@
 , qhull
 , cmake
 , cgal
-, boost179
+, boost
 , mpfr
 , xercesc
+, tbb
+, embree
+, vcg
+, libigl
+, corto
+, openctm
+, structuresynth
 }:
 
 mkDerivation rec {
   pname = "meshlab";
-  version = "2022.02";
+  version = "2023.12";
 
   src = fetchFromGitHub {
     owner = "cnr-isti-vclab";
     repo = "meshlab";
     rev = "MeshLab-${version}";
-    sha256 = "sha256-jcc3PfsiIeYyipteZgzd0NwZgFFgR/mMBiaInzhOcDY=";
-    fetchSubmodules = true; # for vcglib
+    sha256 = "sha256-AdUAWS741RQclYaSE3Tz1/I0YSinNAnfSaqef+Tib8Y=";
   };
 
   buildInputs = [
@@ -46,38 +52,38 @@ mkDerivation rec {
     levmar
     qhull
     cgal
-    boost179
+    boost
     mpfr
     xercesc
+    tbb
+    embree
+    vcg
+    libigl
+    corto
+    openctm
+    structuresynth
   ];
 
   nativeBuildInputs = [ cmake ];
 
   preConfigure = ''
-    substituteAll ${./meshlab.desktop} scripts/Linux/resources/meshlab.desktop
-    cmakeDir=$PWD/src
-    mkdir ../build
-    cd ../build
+    substituteAll ${./meshlab.desktop} resources/linux/meshlab.desktop
+    substituteInPlace src/external/libigl.cmake \
+      --replace-fail '$'{MESHLAB_EXTERNAL_DOWNLOAD_DIR}/libigl-2.4.0 ${libigl}
+    substituteInPlace src/external/nexus.cmake \
+      --replace-fail '$'{NEXUS_DIR}/src/corto ${corto.src}
+    substituteInPlace src/external/levmar.cmake \
+      --replace-fail '$'{LEVMAR_LINK} ${levmar.src} \
+      --replace-warn "MD5 ''${LEVMAR_MD5}" ""
+    substituteInPlace src/external/ssynth.cmake \
+      --replace-fail '$'{SSYNTH_LINK} ${structuresynth.src} \
+      --replace-warn "MD5 ''${SSYNTH_MD5}" ""
+    substituteInPlace src/common_gui/CMakeLists.txt \
+      --replace-warn "MESHLAB_LIB_INSTALL_DIR" "CMAKE_INSTALL_LIBDIR"
   '';
 
   cmakeFlags = [
-    "-DALLOW_BUNDLED_EIGEN=OFF"
-    "-DALLOW_BUNDLED_GLEW=OFF"
-    "-DALLOW_BUNDLED_LIB3DS=OFF"
-    "-DALLOW_BUNDLED_MUPARSER=OFF"
-    "-DALLOW_BUNDLED_QHULL=OFF"
-    # disable when available in nixpkgs
-    "-DALLOW_BUNDLED_OPENCTM=ON"
-    "-DALLOW_BUNDLED_SSYNTH=ON"
-    "-DALLOW_BUNDLED_BOOST=OFF"
-    # some plugins are disabled unless these are on
-    "-DALLOW_BUNDLED_NEWUOA=ON"
-    "-DALLOW_BUNDLED_LEVMAR=ON"
-  ];
-
-  CXXFLAGS = [
-    # GCC 13: error: 'int16_t' has not been declared in 'std'
-    "-include cstdint"
+    "-DVCGDIR=${vcg.src}"
   ];
 
   postFixup = ''
diff --git a/pkgs/applications/graphics/pymeshlab/default.nix b/pkgs/applications/graphics/pymeshlab/default.nix
new file mode 100644
index 0000000000000..5bf8339797b42
--- /dev/null
+++ b/pkgs/applications/graphics/pymeshlab/default.nix
@@ -0,0 +1,107 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, libGLU
+, qtbase
+, qtscript
+, qtxmlpatterns
+, lib3ds
+, bzip2
+, muparser
+, eigen
+, glew
+, gmp
+, levmar
+, qhull
+, cmake
+, cgal
+, boost
+, mpfr
+, xercesc
+, tbb
+, embree
+, vcg
+, libigl
+, corto
+, openctm
+, structuresynth
+, wrapQtAppsHook
+, python3Packages
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pymeshlab";
+  version = "2023.12";
+
+  src = fetchFromGitHub {
+    owner = "cnr-isti-vclab";
+    repo = "pymeshlab";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-IOlRdXoUPOJt67g3HqsLchV5aL+JUEks2y1Sy+wpwsg=";
+    fetchSubmodules = true;
+  };
+
+  buildInputs = [
+    libGLU
+    qtbase
+    qtscript
+    qtxmlpatterns
+    lib3ds
+    bzip2
+    muparser
+    eigen
+    glew
+    gmp
+    levmar
+    qhull
+    cgal
+    boost
+    mpfr
+    xercesc
+    tbb
+    embree
+    vcg
+    libigl
+    corto
+    structuresynth
+    openctm
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+    python3Packages.pybind11
+  ];
+
+  propagatedBuildInputs = [
+    python3Packages.numpy
+  ];
+
+  preConfigure = ''
+    substituteInPlace src/meshlab/src/external/libigl.cmake \
+      --replace-fail '$'{MESHLAB_EXTERNAL_DOWNLOAD_DIR}/libigl-2.4.0 ${libigl}
+    substituteInPlace src/meshlab/src/external/nexus.cmake \
+      --replace-fail '$'{NEXUS_DIR}/src/corto ${corto.src}
+    substituteInPlace src/meshlab/src/external/levmar.cmake \
+      --replace-fail '$'{LEVMAR_LINK} ${levmar.src} \
+      --replace-warn "MD5 ''${LEVMAR_MD5}" ""
+    substituteInPlace src/meshlab/src/external/ssynth.cmake \
+      --replace-fail '$'{SSYNTH_LINK} ${structuresynth.src} \
+      --replace-warn "MD5 ''${SSYNTH_MD5}" ""
+    export cmakeFlags="cmakeFlags
+      -DCMAKE_INSTALL_PREFIX=$out/${python3Packages.python.sitePackages}/pymeshlab
+    "
+  '';
+
+  cmakeFlags = [
+    "-DVCGDIR=${vcg.src}"
+  ];
+
+  meta = {
+    description = "The open source mesh processing python library";
+    homepage = "https://github.com/cnr-isti-vclab/PyMeshLab";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ nim65s ];
+    platforms = with lib.platforms; linux;
+  };
+})
diff --git a/pkgs/applications/graphics/sane/backends/brscan5/default.nix b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
index 7bce5301f938a..c15599ec66bbb 100644
--- a/pkgs/applications/graphics/sane/backends/brscan5/default.nix
+++ b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
@@ -10,15 +10,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "brscan5";
-  version = "1.3.0-0";
+  version = "1.3.1-0";
   src = {
     "i686-linux" = fetchurl {
       url = "https://download.brother.com/welcome/dlf104034/${pname}-${version}.i386.deb";
-      sha256 = "sha256-LpbPUo8iD5CcwUoIOa1UYHQXMrZZJ7PjZpcuyXhXjzk=";
+      hash = "sha256-BgS64vwsKESJBDz9H2MDwcGiresROSNFP1b+7+zlE5c=";
     };
     "x86_64-linux" = fetchurl {
       url = "https://download.brother.com/welcome/dlf104033/${pname}-${version}.amd64.deb";
-      sha256 = "sha256-ntVe/e6/cdz3+LSpGilMFZecxfv74pd7ksh85SzEdKc=";
+      hash = "sha256-0UMbXMBlyiZI90WG5FWEP2mIZEBsxXd11dtgtyuSDnY=";
     };
   }."${system}" or (throw "Unsupported system: ${system}");
 
@@ -33,9 +33,12 @@ stdenv.mkDerivation rec {
 
   postPatch =
     let
+      # Download .deb for both amd64 and i386, then unpack like unpackPhase
+      # to get the offset, run:
+      # strings -n 10 --radix=d opt/brother/scanner/brscan5/libsane-brother5.so.1.0.7 | grep "/opt/brother/scanner/brscan5/models"
       patchOffsetBytes =
-        if system == "x86_64-linux" then 86528
-        else if system == "i686-linux" then 79140
+        if system == "x86_64-linux" then 86592
+        else if system == "i686-linux" then 79236
         else throw "Unsupported system: ${system}";
     in
     ''
diff --git a/pkgs/applications/misc/albert/default.nix b/pkgs/applications/misc/albert/default.nix
index f9533663daa4b..8fe269ddab230 100644
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@@ -75,7 +75,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://albertlauncher.github.io";
     changelog = "https://github.com/albertlauncher/albert/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    license = licenses.gpl3Plus;
+    # See: https://github.com/NixOS/nixpkgs/issues/279226
+    license = licenses.unfree;
     maintainers = with maintainers; [ ericsagnes synthetica ];
     mainProgram = "albert";
     platforms = platforms.linux;
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 8266f4bfd067f..8cc7d4dd01f61 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -99,11 +99,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "blender";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchurl {
     url = "https://download.blender.org/source/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3AAtguPDQMk4VcZoRzDQGAG2aaKbHMa3XuuZC6aecj8=";
+    hash = "sha256-T7s69k0/hN9ccQN0hFQibBiFwawu1Tc9DOoegOgsCEg=";
   };
 
   patches = [ ./draco.patch ] ++ lib.optional stdenv.isDarwin ./darwin.patch;
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index 3f57531e099d1..ce72458f3a0f6 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -32,11 +32,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "7.8.0";
+  version = "7.9.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FxYuQzzuaWZihSsmeJc6ssG3VBr2YNEi3TkXyyymLUQ=";
+    hash = "sha256-Ilzv4HXW6ZmEVNUWQm04cHZ71FEgjfWVX9IvrfYCHIk=";
   };
 
   patches = [
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     (fetchpatch {
       name = "0001-only-plugin-update.patch";
       url = "https://raw.githubusercontent.com/debian-calibre/calibre/debian/${finalAttrs.version}+ds-1/debian/patches/0001-only-plugin-update.patch";
-      hash = "sha256-uL1mSjgCl5ZRLbSuKxJM6XTfvVwog70F7vgKtQzQNEQ=";
+      hash = "sha256-mHZkUoVcoVi9XBOSvM5jyvpOTCcM91g9+Pa/lY6L5p8=";
     })
     (fetchpatch {
       name = "0007-Hardening-Qt-code.patch";
diff --git a/pkgs/applications/misc/faircamp/Cargo.lock b/pkgs/applications/misc/faircamp/Cargo.lock
index 3c9a2765b2a26..deeaca6b86be1 100644
--- a/pkgs/applications/misc/faircamp/Cargo.lock
+++ b/pkgs/applications/misc/faircamp/Cargo.lock
@@ -53,7 +53,7 @@ dependencies = [
  "actix-service",
  "actix-utils",
  "ahash",
- "base64",
+ "base64 0.21.7",
  "bitflags 2.4.1",
  "brotli",
  "bytes",
@@ -262,6 +262,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "aligned-vec"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aa90d7ce82d4be67b64039a3d588d38dbcc6736577de4a847025ce5b0c468d1"
+
+[[package]]
 name = "alloc-no-stdlib"
 version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -346,12 +352,35 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
 
 [[package]]
+name = "arbitrary"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5a26814d8dcb93b0e5a0ff3c6d80a8843bafb21b39e8e18a6f05471870e110"
+
+[[package]]
 name = "arbitrary-int"
 version = "1.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe8e2a586ecd6eb29477a0c25b19742acca4fa5e39c92e127656616810c20579"
 
 [[package]]
+name = "arg_enum_proc_macro"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ae92a5119aa49cdbcf6b9f893fe4e1d98b04ccbf82ee0584ad948a44a734dea"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+
+[[package]]
 name = "atomic-polyfill"
 version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -378,6 +407,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
+name = "av1-grain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6678909d8c5d46a42abcf571271e15fdbc0a225e3646cf23762cd415046c78bf"
+dependencies = [
+ "anyhow",
+ "arrayvec",
+ "log",
+ "nom",
+ "num-rational",
+ "v_frame",
+]
+
+[[package]]
+name = "avif-serialize"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "876c75a42f6364451a033496a14c44bffe41f5f4a8236f697391f11024e596d2"
+dependencies = [
+ "arrayvec",
+]
+
+[[package]]
 name = "az"
 version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -405,6 +457,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
+name = "base64"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+
+[[package]]
 name = "base64ct"
 version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -447,6 +505,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "bitstream-io"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06c9989a51171e2e81038ab168b6ae22886fe9ded214430dbb4f41c28cf176da"
+
+[[package]]
 name = "block-buffer"
 version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -477,6 +541,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "built"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38d17f4d6e4dc36d1a02fbedc2753a096848e7c1b0772f7654eab8e2c927dd53"
+
+[[package]]
 name = "bumpalo"
 version = "3.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -547,6 +617,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
 
 [[package]]
+name = "cfg-expr"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa50868b64a9a6fda9d593ce778849ea8715cd2a3d2cc17ffdb4a2f2f2f1961d"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
+[[package]]
 name = "cfg-if"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -554,9 +634,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.33"
+version = "0.4.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f13690e35a5e4ace198e7beea2895d29f3a9cc55015fcebe6336bd2010af9eb"
+checksum = "8a0d04d43504c61aa6c7531f1871dd0d418d91130162063b789da00fd7057a5e"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -579,9 +659,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.4.18"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e578d6ec4194633722ccf9544794b71b1385c3c027efe0c55db226fc880865c"
+checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -589,9 +669,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.18"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4df4df40ec50c46000231c914968278b1eb05098cf8f1b3a518a95030e71d1c7"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
 dependencies = [
  "anstream",
  "anstyle",
@@ -601,9 +681,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.4.7"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
+checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -613,9 +693,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
+checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
 
 [[package]]
 name = "claxon"
@@ -822,8 +902,8 @@ dependencies = [
 
 [[package]]
 name = "enolib"
-version = "0.4.1"
-source = "git+https://codeberg.org/simonrepp/enolib-rs?tag=0.4.1#1ca85dc8af9f74f65b199b2ab6c5c94f5b119b93"
+version = "0.4.2"
+source = "git+https://codeberg.org/simonrepp/enolib-rs?tag=0.4.2#b97102e1890d91f184469f9c778d07df7d117adc"
 
 [[package]]
 name = "equivalent"
@@ -849,12 +929,12 @@ dependencies = [
 
 [[package]]
 name = "faircamp"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "actix-files",
  "actix-web",
  "alac",
- "base64",
+ "base64 0.22.0",
  "bincode",
  "chrono",
  "clap",
@@ -1010,9 +1090,9 @@ dependencies = [
 
 [[package]]
 name = "gif"
-version = "0.12.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80792593675e051cf94a4b111980da2ba60d4a83e43e0048c5693baab3977045"
+checksum = "3fb2d69b19215e18bb912fa30f7ce15846e301408695e44e0ef719f1da9e19f2"
 dependencies = [
  "color_quant",
  "weezl",
@@ -1092,9 +1172,9 @@ dependencies = [
 
 [[package]]
 name = "heck"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
@@ -1186,9 +1266,9 @@ dependencies = [
 
 [[package]]
 name = "id3"
-version = "1.12.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ba0a11a3cf6f08d58a5629531bdb4e7c3b8b595e9812a31a7058b1176c4631e"
+checksum = "79f41f7e5ad125c63d55b112a98afb753742fa7f97692bfbbc52544b89e1ff1f"
 dependencies = [
  "bitflags 2.4.1",
  "byteorder",
@@ -1207,23 +1287,44 @@ dependencies = [
 
 [[package]]
 name = "image"
-version = "0.24.8"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "034bbe799d1909622a74d1193aa50147769440040ff36cb2baa947609b0a4e23"
+checksum = "fd54d660e773627692c524beaad361aca785a4f9f5730ce91f42aabe5bce3d11"
 dependencies = [
  "bytemuck",
  "byteorder",
  "color_quant",
  "exr",
  "gif",
- "jpeg-decoder",
+ "image-webp",
  "num-traits",
  "png",
  "qoi",
+ "ravif",
+ "rayon",
+ "rgb",
  "tiff",
+ "zune-core",
+ "zune-jpeg",
 ]
 
 [[package]]
+name = "image-webp"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a84a25dcae3ac487bc24ef280f9e20c79c9b1a3e5e32cbed3041d1c514aa87c"
+dependencies = [
+ "byteorder",
+ "thiserror",
+]
+
+[[package]]
+name = "imgref"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44feda355f4159a7c757171a77de25daf6411e217b4cabd03bd6650690468126"
+
+[[package]]
 name = "indexmap"
 version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1235,9 +1336,9 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "2.0.4"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e186cfbae8084e513daff4240b4797e342f988cecda4fb6c939150f96315fd8"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
 name = "inout"
@@ -1249,6 +1350,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "interpolate_name"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c34819042dc3d3971c46c2190835914dfbe0c3c13f61449b2997f4e9722dfa60"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
+[[package]]
 name = "iso_country"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1267,6 +1379,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "itertools"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+dependencies = [
+ "either",
+]
+
+[[package]]
 name = "itoa"
 version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1308,9 +1429,6 @@ name = "jpeg-decoder"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bc0000e42512c92e31c2252315bda326620a4e034105e900c98ec492fa077b3e"
-dependencies = [
- "rayon",
-]
 
 [[package]]
 name = "js-sys"
@@ -1357,12 +1475,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
 
 [[package]]
+name = "libfuzzer-sys"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a96cfd5557eb82f2b83fed4955246c988d331975a002961b07c81584d107e7f7"
+dependencies = [
+ "arbitrary",
+ "cc",
+ "once_cell",
+]
+
+[[package]]
 name = "libvips"
 version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bfedc1cd1634c8bc74e91653646f4be7ec7630fcd828ae35a35272a0bbfd9e8d"
 dependencies = [
- "num-derive",
+ "num-derive 0.3.3",
  "num-traits",
 ]
 
@@ -1400,6 +1529,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
+name = "loop9"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fae87c125b03c1d2c0150c90365d7d6bcc53fb73a9acaef207d2d065860f062"
+dependencies = [
+ "imgref",
+]
+
+[[package]]
 name = "malloc_buf"
 version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1409,6 +1547,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "maybe-rayon"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ea1f30cedd69f0a2954655f7188c6a834246d2bcf1e315e2ac40c4b24dc9519"
+dependencies = [
+ "cfg-if",
+ "rayon",
+]
+
+[[package]]
 name = "memchr"
 version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1529,6 +1677,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
 
 [[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
 name = "nom"
 version = "7.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1539,6 +1693,23 @@ dependencies = [
 ]
 
 [[package]]
+name = "noop_proc_macro"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0676bb32a98c1a483ce53e500a81ad9c3d5b3f7c920c28c24e9cb0980d0b5bc8"
+
+[[package]]
+name = "num-bigint"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
 name = "num-derive"
 version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1550,6 +1721,38 @@ dependencies = [
 ]
 
 [[package]]
+name = "num-derive"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+dependencies = [
+ "autocfg",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
 name = "num-traits"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1606,9 +1809,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "opus"
@@ -1770,6 +1973,25 @@ dependencies = [
 ]
 
 [[package]]
+name = "profiling"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d84d1d7a6ac92673717f9f6d1518374ef257669c24ebc5ac25d5033828be58"
+dependencies = [
+ "profiling-procmacros",
+]
+
+[[package]]
+name = "profiling-procmacros"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8021cf59c8ec9c432cfc2526ac6b8aa508ecaf29cd415f271b8406c1b851c3fd"
+dependencies = [
+ "quote",
+ "syn 2.0.48",
+]
+
+[[package]]
 name = "pulldown-cmark"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1797,6 +2019,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "quick-error"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
+
+[[package]]
 name = "quote"
 version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1836,6 +2064,56 @@ dependencies = [
 ]
 
 [[package]]
+name = "rav1e"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd87ce80a7665b1cce111f8a16c1f3929f6547ce91ade6addf4ec86a8dda5ce9"
+dependencies = [
+ "arbitrary",
+ "arg_enum_proc_macro",
+ "arrayvec",
+ "av1-grain",
+ "bitstream-io",
+ "built",
+ "cfg-if",
+ "interpolate_name",
+ "itertools",
+ "libc",
+ "libfuzzer-sys",
+ "log",
+ "maybe-rayon",
+ "new_debug_unreachable",
+ "noop_proc_macro",
+ "num-derive 0.4.2",
+ "num-traits",
+ "once_cell",
+ "paste",
+ "profiling",
+ "rand",
+ "rand_chacha",
+ "simd_helpers",
+ "system-deps",
+ "thiserror",
+ "v_frame",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "ravif"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc13288f5ab39e6d7c9d501759712e6969fcc9734220846fc9ed26cae2cc4234"
+dependencies = [
+ "avif-serialize",
+ "imgref",
+ "loop9",
+ "quick-error",
+ "rav1e",
+ "rayon",
+ "rgb",
+]
+
+[[package]]
 name = "raw-window-handle"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1900,6 +2178,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
+name = "rgb"
+version = "0.8.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05aaa8004b64fd573fc9d002f4e632d51ad4f026c2b5ba95fcb6c2f32c2c47d8"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
 name = "rmp3"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1963,18 +2250,18 @@ checksum = "836fa6a3e1e547f9a2c4040802ec865b5d85f4014efe00555d7090a3dcaa1090"
 
 [[package]]
 name = "serde"
-version = "1.0.196"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "870026e60fa08c69f064aa766c10f10b1d62db9ccd4d0abb206472bee0ce3b32"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.196"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33c85360c95e7d137454dc81d9a4ed2b8efd8fbe19cee57357b32b9771fccb67"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1993,6 +2280,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "serde_spanned"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2042,6 +2338,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
 
 [[package]]
+name = "simd_helpers"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95890f873bec569a0362c235787f3aca6e1e887302ba4840839bcc6459c42da6"
+dependencies = [
+ "quote",
+]
+
+[[package]]
 name = "slab"
 version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2099,9 +2404,9 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
 name = "strsim"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
 
 [[package]]
 name = "subtle"
@@ -2132,6 +2437,25 @@ dependencies = [
 ]
 
 [[package]]
+name = "system-deps"
+version = "6.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3e535eb8dded36d55ec13eddacd30dec501792ff23a0b1682c38601b8cf2349"
+dependencies = [
+ "cfg-expr",
+ "heck",
+ "pkg-config",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
+
+[[package]]
 name = "thiserror"
 version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2208,9 +2532,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.36.0"
+version = "1.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
+checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2251,6 +2575,40 @@ dependencies = [
 ]
 
 [[package]]
+name = "toml"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9dd1545e8208b4a5af1aa9bbd0b4cf7e9ea08fabc5d0a5c67fcaafa17433aa3"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e40bb779c5187258fd7aad0eb68cb8706a0a81fa712fbea808ab43c4b8374c4"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow",
+]
+
+[[package]]
 name = "tracing"
 version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2330,12 +2688,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
+name = "v_frame"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f32aaa24bacd11e488aa9ba66369c7cd514885742c9fe08cfe85884db3e92b"
+dependencies = [
+ "aligned-vec",
+ "num-traits",
+ "wasm-bindgen",
+]
+
+[[package]]
 name = "v_htmlescape"
 version = "0.15.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4e8257fbc510f0a46eb602c10215901938b5c2a7d5e70fc11483b1d3c9b5b18c"
 
 [[package]]
+name = "version-compare"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "852e951cb7832cb45cb1169900d19760cfa39b82bc0ea9c0e5a14ae88411c98b"
+
+[[package]]
 name = "version_check"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2423,9 +2798,9 @@ dependencies = [
 
 [[package]]
 name = "webbrowser"
-version = "0.8.12"
+version = "0.8.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b2391658b02c27719fc5a0a73d6e696285138e8b12fba9d4baa70451023c71"
+checksum = "d1b04c569c83a9bb971dd47ec6fd48753315f4bf989b9b04a2e7ca4d7f0dc950"
 dependencies = [
  "core-foundation",
  "home",
@@ -2440,9 +2815,9 @@ dependencies = [
 
 [[package]]
 name = "weezl"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9193164d4de03a926d909d3bc7c30543cecb35400c02114792c2cae20d5e2dbb"
+checksum = "53a85b86a771b1c87058196170769dd264f66c0782acf1ae6cc51bfd64b39082"
 
 [[package]]
 name = "winapi"
@@ -2674,6 +3049,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
 
 [[package]]
+name = "winnow"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dffa400e67ed5a4dd237983829e66475f0a4a26938c4b04c21baede6262215b8"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
 name = "zerocopy"
 version = "0.7.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2761,6 +3145,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "zune-core"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f423a2c17029964870cfaabb1f13dfab7d092a62a29a89264f4d36990ca414a"
+
+[[package]]
 name = "zune-inflate"
 version = "0.2.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2768,3 +3158,12 @@ checksum = "73ab332fe2f6680068f3582b16a24f90ad7096d5d39b974d1c0aff0125116f02"
 dependencies = [
  "simd-adler32",
 ]
+
+[[package]]
+name = "zune-jpeg"
+version = "0.4.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec866b44a2a1fd6133d363f073ca1b179f438f99e7e5bfb1e33f7181facfe448"
+dependencies = [
+ "zune-core",
+]
diff --git a/pkgs/applications/misc/faircamp/default.nix b/pkgs/applications/misc/faircamp/default.nix
index 9aa92101a1cce..3b1cdf51321b8 100644
--- a/pkgs/applications/misc/faircamp/default.nix
+++ b/pkgs/applications/misc/faircamp/default.nix
@@ -16,20 +16,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "faircamp";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "simonrepp";
     repo = "faircamp";
     rev = version;
-    hash = "sha256-Q0jsqOWeXEfekegxYvq3oIIuVMGyeKL1no2Jh4JByD0=";
+    hash = "sha256-gHlm5ZQ5u+gOSBERlg6iYJxGTfs/+L4y2TY+ZOsVYh8=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "enolib-0.4.1" = "sha256-Uz9AXksD3YO6PjSr29RZCQjdoPiFBTXecbE0fluA0LU=";
+      "enolib-0.4.2" = "sha256-FJuWKcwjoi/wKfTzxghobNWblhnKRdUvHOejhpCF7kY=";
     };
   };
 
diff --git a/pkgs/applications/misc/freemind/default.nix b/pkgs/applications/misc/freemind/default.nix
index 0bdf8df306a83..5e5d205c8ae99 100644
--- a/pkgs/applications/misc/freemind/default.nix
+++ b/pkgs/applications/misc/freemind/default.nix
@@ -1,43 +1,76 @@
-{ lib, stdenv, fetchurl, jdk, jre, ant }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  ant,
+  jdk,
+  jre,
+  makeWrapper,
+  stripJavaArchivesHook,
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "freemind";
   version = "1.0.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/freemind/freemind-src-${version}.tar.gz";
-    sha256 = "06c6pm7hpwh9hbmyah3lj2wp1g957x8znfwc5cwygsi7dc98b0h1";
+    url = "mirror://sourceforge/freemind/freemind-src-${finalAttrs.version}.tar.gz";
+    hash = "sha256-AYKFEmsn6uc5K4w7+1E/Jb1wuZB0QOXrggnyC0+9hhk=";
   };
 
-  buildInputs = [ jdk ant ];
+  nativeBuildInputs = [
+    ant
+    jdk
+    makeWrapper
+    stripJavaArchivesHook
+  ];
 
-  preConfigure = ''
-    chmod +x check_for_duplicate_resources.sh
-    sed 's,/bin/bash,${stdenv.shell},' -i check_for_duplicate_resources.sh
+  postPatch = ''
+    # disable the <buildnumer> task because it would edit version.properties
+    # and add a "last edited" header to it, which is non-deterministic
+    sed -i  '/<buildnumber/d' build.xml
 
-    ## work around javac encoding errors
-    export JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8"
+    # replace dependency on `which`
+    substituteInPlace freemind.sh \
+        --replace-fail "which" "type -p"
   '';
 
-  buildPhase = "ant dist";
+  preConfigure = ''
+    chmod +x *.sh
+    patchShebangs *.sh
+  '';
+
+  # Workaround for javac encoding errors
+  # Note: not sure if this is still needed
+  env.JAVA_TOOL_OPTIONS = "-Dfile.encoding=UTF8";
+
+  buildPhase = ''
+    runHook preBuild
+    ant build
+    runHook postBuild
+  '';
 
   installPhase = ''
-    mkdir -p $out/{bin,nix-support}
-    cp -r ../bin/dist $out/nix-support
-    sed -i 's/which/type -p/' $out/nix-support/dist/freemind.sh
-
-    cat >$out/bin/freemind <<EOF
-    #! ${stdenv.shell}
-    JAVA_HOME=${jre} $out/nix-support/dist/freemind.sh
-    EOF
-    chmod +x $out/{bin/freemind,nix-support/dist/freemind.sh}
+    runHook preInstall
+    ant dist -Ddist=$out/share/freemind
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper $out/share/freemind/freemind.sh $out/bin/freemind \
+        --set JAVA_HOME ${jre}
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Mind-mapping software";
-    mainProgram = "freemind";
     homepage = "https://freemind.sourceforge.net/wiki/index.php/Main_Page";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    mainProgram = "freemind";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode # source bundles dependencies as jars
+    ];
   };
-}
+})
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index 7fb177d482892..c4dd51951bd2b 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonApplication, fetchPypi, requests, yt-dlp, pytestCheckHook }:
+{ lib, buildPythonApplication, fetchPypi, fetchpatch, requests, yt-dlp, pytestCheckHook }:
 
 buildPythonApplication rec {
   pname = "gallery-dl";
@@ -11,6 +11,14 @@ buildPythonApplication rec {
     sha256 = "sha256-PgbfppyJCpgFupBQng8MUPihbDmit4C+xWnSzCJyu5k=";
   };
 
+  patches = [
+    # catch general Exceptions. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/mikf/gallery-dl/commit/5227bb6b1d62ecef5b281592b0d001e7f9c101e3.patch";
+      hash = "sha256-rVsd764siP/07XBPVDnpxMm/4kLiH3fp9+NtpHHH23U=";
+    })
+  ];
+
   propagatedBuildInputs = [
     requests
     yt-dlp
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index 882481ace1e07..eacd64b06b557 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -60,8 +60,7 @@ in {
     makeWrapper ${electron_27}/bin/electron $out/bin/${pname} \
       --set "LOCAL_GIT_DIRECTORY" ${git} \
       --add-flags $out/share/${pname}/resources/app \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/applications/misc/orca/default.nix b/pkgs/applications/misc/orca/default.nix
index 283970a6e75ef..dcb578dd56789 100644
--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/applications/misc/orca/default.nix
@@ -96,7 +96,7 @@ buildPythonApplication rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Projects/Orca";
+    homepage = "https://orca.gnome.org/";
     description = "Screen reader";
     mainProgram = "orca";
     longDescription = ''
diff --git a/pkgs/applications/misc/rtfm/default.nix b/pkgs/applications/misc/rtfm/default.nix
index 9eb97113c37b5..256ed98f9a8cd 100644
--- a/pkgs/applications/misc/rtfm/default.nix
+++ b/pkgs/applications/misc/rtfm/default.nix
@@ -7,10 +7,10 @@
 , desktopToDarwinBundle
 , webkitgtk_6_0
 , sqlite
-, gi-crystal
 , libadwaita
 , gtk4
 , pango
+, substituteAll
 }:
 let
   gtk4' = gtk4.override { x11Support = true; };
@@ -18,42 +18,40 @@ let
 in
 crystal.buildCrystalPackage rec {
   pname = "rtfm";
-  version = "0.2.4";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "hugopl";
     repo = "rtfm";
     rev = "v${version}";
     name = "rtfm";
-    hash = "sha256-IfI7jYM1bsrCq2NiANv/SWkCjPyT/HYUofJMUYy0Sbk=";
+    hash = "sha256-cloaGlHjtwrjuPGzAG55B58w307R+TO+MixAWTw2ags=";
   };
 
   patches = [
     # 1) fixed gi-crystal binding generator command
-    # 2) removed `-v` arg to `cp` command to prevent build failure due to stdout buffer overflow
+    # 2) fixed docset generator command
     # 3) added commands to build gschemas and update icon-cache
-    ./patches/make.patch
-
-    # fixed docset path and gi libs directory names
-    ./patches/friendly-docs-path.patch
-
+    (substituteAll {
+      src = ./make.patch;
+      inherit crystal;
+    })
     # added chmod +w for copied docs to prevent error:
     # `Error opening file with mode 'wb': '.../style.css': Permission denied`
-    ./patches/enable-write-permissions.patch
+    ./enable-write-permissions.patch
   ];
 
   postPatch = ''
-    substituteInPlace Makefile \
-      --replace "crystal run src/create_crystal_docset.cr" "crystal src/create_crystal_docset.cr ${crystal}/share/doc/crystal/api/" \
-      --replace "crystal run src/create_gtk_docset.cr" "crystal src/create_gtk_docset.cr gtk-doc/"
+    substituteInPlace src/doc2dash/create_gtk_docset.cr \
+      --replace-fail 'basedir = Path.new("/usr/share/doc")' 'basedir = Path.new(ARGV[0]? || "gtk-docs")'
   '';
 
   shardsFile = ./shards.nix;
+  copyShardDeps = true;
 
   nativeBuildInputs = [
     wrapGAppsHook4
     gobject-introspection
-    gi-crystal
   ] ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
 
   buildInputs = [
@@ -86,6 +84,7 @@ crystal.buildCrystalPackage rec {
     description = "Dash/docset reader with built in documentation for Crystal and GTK APIs";
     homepage = "https://github.com/hugopl/rtfm/";
     license = licenses.mit;
+    mainProgram = "rtfm";
     maintainers = with maintainers; [ sund3RRR ];
   };
 }
diff --git a/pkgs/applications/misc/rtfm/patches/enable-write-permissions.patch b/pkgs/applications/misc/rtfm/enable-write-permissions.patch
index efdabce083519..8023d647f782a 100644
--- a/pkgs/applications/misc/rtfm/patches/enable-write-permissions.patch
+++ b/pkgs/applications/misc/rtfm/enable-write-permissions.patch
@@ -1,5 +1,5 @@
---- a/src/doc2dash/doc_set_builder.cr	2023-07-19 14:00:06.864770147 +0300
-+++ b/src/doc2dash/doc_set_builder.cr	2023-07-19 13:59:35.440707740 +0300
+--- a/src/doc2dash/docset_builder.cr	2024-04-20 10:45:32.000673168 +0300
++++ b/src/doc2dash/docset_builder.cr	2024-04-20 10:45:56.072895349 +0300
 @@ -44,6 +44,7 @@
        real_dest = @html_dest.join(dest || source)
        Dir.mkdir_p(Path.new(real_dest).dirname)
diff --git a/pkgs/applications/misc/rtfm/make.patch b/pkgs/applications/misc/rtfm/make.patch
new file mode 100644
index 0000000000000..40f327193debf
--- /dev/null
+++ b/pkgs/applications/misc/rtfm/make.patch
@@ -0,0 +1,39 @@
+--- a/Makefile	2024-04-20 10:28:36.697545022 +0300
++++ b/Makefile	2024-04-20 10:37:55.591657540 +0300
+@@ -7,8 +7,10 @@
+ 	shards build --debug -Dpreview_mt
+ 
+ configure:
+-	shards install
+-	./bin/gi-crystal
++	mkdir bin/
++	cd lib/gi-crystal && shards build -Dpreview_mt --release --no-debug
++	cd ../..
++	cp lib/gi-crystal/bin/gi-crystal bin/ && ./bin/gi-crystal
+ 
+ rtfm:
+ 	shards build --release -Dpreview_mt rtfm
+@@ -16,10 +18,10 @@
+ docsets: crystal-docset gtk-docset
+ 
+ crystal-docset:
+-	crystal run src/doc2dash/create_crystal_docset.cr
++	crystal src/doc2dash/create_crystal_docset.cr "@crystal@/share/doc/crystal/api"
+ 
+ gtk-docset:
+-	crystal run src/doc2dash/create_gtk_docset.cr
++	crystal src/doc2dash/create_gtk_docset.cr "gtk-doc/"
+ 
+ test: crystal-docset gtk-docset
+ 	crystal spec
+@@ -28,8 +30,10 @@
+ 	install -D -m 0755 bin/rtfm $(DESTDIR)$(PREFIX)/bin/rtfm
+ 	install -D -m 0644 data/io.github.hugopl.rtfm.desktop $(DESTDIR)$(PREFIX)/share/applications/io.github.hugopl.rtfm.desktop
+ 	install -D -m 0644 data/icons/hicolor/scalable/apps/io.github.hugopl.rtfm.svg $(DESTDIR)$(PREFIX)/share/icons/hicolor/scalable/apps/io.github.hugopl.rtfm.svg
++	gtk4-update-icon-cache --ignore-theme-index $(PREFIX)/share/icons/hicolor
+ 	# Settings schema
+ 	install -D -m644 data/io.github.hugopl.rtfm.gschema.xml $(DESTDIR)$(PREFIX)/share/glib-2.0/schemas/io.github.hugopl.rtfm.gschema.xml
++	glib-compile-schemas $(DESTDIR)$(PREFIX)/share/glib-2.0/schemas
+ 	# docsets
+ 	mkdir -p $(DESTDIR)$(PREFIX)/share/rtfm/docsets/
+ 	cp -r data/Crystal.docset $(DESTDIR)$(PREFIX)/share/rtfm/docsets/
diff --git a/pkgs/applications/misc/rtfm/patches/friendly-docs-path.patch b/pkgs/applications/misc/rtfm/patches/friendly-docs-path.patch
deleted file mode 100644
index cecbeb750b300..0000000000000
--- a/pkgs/applications/misc/rtfm/patches/friendly-docs-path.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/create_gtk_docset.cr	2023-07-17 14:28:04.882620660 +0300
-+++ b/src/create_gtk_docset.cr	2023-07-17 14:27:09.660643747 +0300
-@@ -136,7 +136,7 @@
- end
- 
- def find_modules : Array(Path)
--  basedir = Path.new("/usr/share/doc")
-+  basedir = Path.new(ARGV[0]? || "gtk-docs")
-   MODULES.compact_map do |mod|
-     print "#{mod.ljust(20, '.')}"
-     mod_dir = basedir.join(mod)
diff --git a/pkgs/applications/misc/rtfm/patches/make.patch b/pkgs/applications/misc/rtfm/patches/make.patch
deleted file mode 100644
index 51b95575cd0d6..0000000000000
--- a/pkgs/applications/misc/rtfm/patches/make.patch
+++ /dev/null
@@ -1,21 +0,0 @@
---- a/Makefile	2023-12-07 23:37:38.984501858 +0300
-+++ b/Makefile	2023-12-07 23:47:52.884456064 +0300
-@@ -4,8 +4,7 @@
- all: configure .WAIT rtfm docsets
- 
- configure:
--	shards install
--	./bin/gi-crystal
-+	gi-crystal
- 
- rtfm:
- 	shards build --release -s rtfm
-@@ -36,6 +35,8 @@
- 	# Changelog
- 	install -D -m0644 CHANGELOG.md $(DESTDIR)$(PREFIX)/share/doc/rtfm/CHANGELOG.md
- 	gzip -9fn $(DESTDIR)$(PREFIX)/share/doc/rtfm/CHANGELOG.md
-+	gtk4-update-icon-cache --ignore-theme-index $(PREFIX)/share/icons/hicolor
-+	glib-compile-schemas $(DESTDIR)$(PREFIX)/share/glib-2.0/schemas
- 
- uninstall:
- 	rm -f $(DESTDIR)$(PREFIX)/bin/rtfm
diff --git a/pkgs/applications/misc/rtfm/shards.nix b/pkgs/applications/misc/rtfm/shards.nix
index 0a7ce34cda62e..79a2eeb2f0db3 100644
--- a/pkgs/applications/misc/rtfm/shards.nix
+++ b/pkgs/applications/misc/rtfm/shards.nix
@@ -6,18 +6,18 @@
   };
   fzy = {
     url = "https://github.com/hugopl/fzy.git";
-    rev = "v0.5.5";
-    sha256 = "1zk95m43ymx9ilwr6iw9l44nkmp4sas28ib0dkr07hkhgrkw68sv";
+    rev = "6c2395bcdea1889969d0d08c16163c276fe4e473";
+    sha256 = "0vpradafkwckfsq7wqrgkpsli7bfmgc27d38q06l1jzq0z0j92rw";
   };
-  gio = {
-    url = "https://github.com/hugopl/gio.cr.git";
-    rev = "v0.2.1";
-    sha256 = "0vl5lpvhhdi9pvyl12smag0i3dwj1jjz1zzilc8ai0wjrnbnwlxs";
+  gi-crystal = {
+    url = "https://github.com/hugopl/gi-crystal.git";
+    rev = "v0.22.2";
+    sha256 = "0bpa1f8iaf97z2kbgjc7nc8km7nd7bppiwna319lm2hvm8m5pw15";
   };
   gtk4 = {
     url = "https://github.com/hugopl/gtk4.cr.git";
-    rev = "v0.16.0";
-    sha256 = "1bnnfy07246vwbjfwhziv2yw1g52pzhhrr25660fp3qcnw8q513w";
+    rev = "v0.16.1";
+    sha256 = "1cqkbh072y70l8g0p040vf50k920p32ry1larnwn9mqabd74jwaj";
   };
   harfbuzz = {
     url = "https://github.com/hugopl/harfbuzz.cr.git";
@@ -31,8 +31,8 @@
   };
   pango = {
     url = "https://github.com/hugopl/pango.cr.git";
-    rev = "v0.3.0";
-    sha256 = "1dg5bcbq11zww4xh68dq4ivnsz89yqsnxz81ggp4j9c9d6dhx0m4";
+    rev = "v0.3.1";
+    sha256 = "0xlf127flimnll875mcq92q7xsi975rrgdpcpmnrwllhdhfx9qmv";
   };
   sqlite3 = {
     url = "https://github.com/crystal-lang/crystal-sqlite3.git";
diff --git a/pkgs/applications/misc/shell-genie/default.nix b/pkgs/applications/misc/shell-genie/default.nix
index 63294e4048210..728a4aabed381 100644
--- a/pkgs/applications/misc/shell-genie/default.nix
+++ b/pkgs/applications/misc/shell-genie/default.nix
@@ -21,12 +21,15 @@ buildPythonPackage rec {
     "typer"
   ];
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
+  ];
+
+  nativeBuildInputs = [
     pythonRelaxDepsHook
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     colorama
     openai
     pyperclip
@@ -44,9 +47,9 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Describe your shell commands in natural language";
-    mainProgram = "shell-genie";
     homepage = "https://github.com/dylanjcastillo/shell-genie";
     license = licenses.mit;
     maintainers = with maintainers; [ onny ];
+    mainProgram = "shell-genie";
   };
 }
diff --git a/pkgs/applications/misc/skytemple/default.nix b/pkgs/applications/misc/skytemple/default.nix
index 98e41bf73e763..116c5096cb599 100644
--- a/pkgs/applications/misc/skytemple/default.nix
+++ b/pkgs/applications/misc/skytemple/default.nix
@@ -67,6 +67,6 @@ python3Packages.buildPythonApplication rec {
     description = "ROM hacking tool for Pokémon Mystery Dungeon Explorers of Sky";
     mainProgram = "skytemple";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ xfix marius851000 ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/applications/misc/terminal-stocks/default.nix b/pkgs/applications/misc/terminal-stocks/default.nix
index 9d1ee035d81a3..275e9627372fe 100644
--- a/pkgs/applications/misc/terminal-stocks/default.nix
+++ b/pkgs/applications/misc/terminal-stocks/default.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "terminal-stocks";
-  version = "1.0.16";
+  version = "1.0.17";
 
   src = fetchFromGitHub {
     owner = "shweshi";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tu6SKeTVEqIqDJXimoSkMK9+l0uGqWSrlIO0KHoROSQ=";
+    hash = "sha256-hCKUUISn/TIr2o3ZtG2kSTgmUCut4NVzIzfIrg84PYI=";
   };
 
-  npmDepsHash = "sha256-13RiEBLhmKW04Tesg1s7c9rCYtRGOd/prnVARb6jpGQ=";
+  npmDepsHash = "sha256-t71SfoPYVFLWcrjv2ErWazDeaVTO4W46g4lFler86Sc=";
   dontNpmBuild = true;
 
   passthru.updateScript = nix-update-script {};
diff --git a/pkgs/applications/misc/ttyper/default.nix b/pkgs/applications/misc/ttyper/default.nix
index de72638d19ffe..180b09771ce3e 100644
--- a/pkgs/applications/misc/ttyper/default.nix
+++ b/pkgs/applications/misc/ttyper/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ttyper";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "max-niederman";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IvAx65b2rGsMdDUhRxTx8cyqnG7oxC+MseCFIJil1e0=";
+    hash = "sha256-L6xdJ659ZWKNg9CGQs+5TQIKoIAZ5KHdFSk7NCp9a2Q=";
   };
 
-  cargoHash = "sha256-o3J2bEAV5NnWKFadJdSGTqUS8K2qpBKPQz6xAbfLtg4=";
+  cargoHash = "sha256-iOeyn4oXk6y/NqZeBwkStBjt3hVVw4s2L5Lm58tq1BY=";
 
   meta = with lib; {
     description = "Terminal-based typing test";
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index daed65d0c21d7..3061d4ea37d52 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -6,17 +6,17 @@ callPackage ./make-brave.nix (removeAttrs args [ "callPackage" ])
     if stdenv.isAarch64 then
       {
         pname = "brave";
-        version = "1.64.122";
-        url = "https://github.com/brave/brave-browser/releases/download/v1.64.122/brave-browser_1.64.122_arm64.deb";
-        hash = "sha256-PBYiCTy/QaPfxvWAzUnXLEzBELISNSKX0kG/mYTDDEA=";
+        version = "1.65.114";
+        url = "https://github.com/brave/brave-browser/releases/download/v1.65.114/brave-browser_1.65.114_arm64.deb";
+        hash = "sha256-E5IqMmkgnwn1eyKcPQ3SZX4QpGor2W8JH+rmERuUonA=";
         platform = "aarch64-linux";
       }
     else if stdenv.isx86_64 then
       {
         pname = "brave";
-        version = "1.64.122";
-        url = "https://github.com/brave/brave-browser/releases/download/v1.64.122/brave-browser_1.64.122_amd64.deb";
-        hash = "sha256-9tSoOn9XGbX/b8n9vD9Hmpi26jzmUVJomoCFdSJoaoU=";
+        version = "1.65.114";
+        url = "https://github.com/brave/brave-browser/releases/download/v1.65.114/brave-browser_1.65.114_amd64.deb";
+        hash = "sha256-Dn6havSLcf6KCxI1hd8Ad4FsLIOYBH2KO2oCJJQHJm8=";
         platform = "x86_64-linux";
       }
     else
diff --git a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
index af1fe9694bcf8..60be29607787b 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
@@ -1,1025 +1,1025 @@
 {
-  version = "125.0.1";
+  version = "125.0.2";
   sources = [
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ach/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ach/firefox-125.0.2.tar.bz2";
       locale = "ach";
       arch = "linux-x86_64";
-      sha256 = "3eff17d5692dd680eee87770b2213b9172f9db352632e8a5239548f56b90cfd8";
+      sha256 = "c1e0c0a2c0d8604408c1a6deef3619afdee63e3ec6ed2a372b620eaf69becae8";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/af/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/af/firefox-125.0.2.tar.bz2";
       locale = "af";
       arch = "linux-x86_64";
-      sha256 = "6dffbfa2dc131ddda51c0c1f3f611590af6e4dc74463c749878f637994cb5ce3";
+      sha256 = "eb3a8dda25571e621e8b4b44e521f514bf9dc42341d6658212c05b35854d311e";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/an/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/an/firefox-125.0.2.tar.bz2";
       locale = "an";
       arch = "linux-x86_64";
-      sha256 = "e4f047571a7efdfe0e63d7b3eb56b2dd1b5b2aa15869043510eead9c2ef1b1a2";
+      sha256 = "592d708dcfff3902a3a07d20d43927f43126a82ee8fb17e15841454aee490b48";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ar/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ar/firefox-125.0.2.tar.bz2";
       locale = "ar";
       arch = "linux-x86_64";
-      sha256 = "761426bf5e97a8d9bced76ef3adb29a084a02b0018f84d3bc48427ddf5016cf2";
+      sha256 = "f9111fb9b0fcfd44e8dac53e714f44512a4738077eece31c542b9013e1d05e96";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ast/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ast/firefox-125.0.2.tar.bz2";
       locale = "ast";
       arch = "linux-x86_64";
-      sha256 = "5e7c584dec51fae02722386653822d5e023fd1e82069965d40b6781c4989889b";
+      sha256 = "f7eb76354add218b6fe8c30cd3a61c30ffbe4fb9a80d27c5d16420c0e61e79d8";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/az/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/az/firefox-125.0.2.tar.bz2";
       locale = "az";
       arch = "linux-x86_64";
-      sha256 = "daada2f24cfd93113dd755931306a34002bce7bfba4a1b7e4bf60172049601af";
+      sha256 = "8745fb82e0807bf888a6cce399cbb7700d7b720123ce4a6972caff5ccb677c67";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/be/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/be/firefox-125.0.2.tar.bz2";
       locale = "be";
       arch = "linux-x86_64";
-      sha256 = "463b1912034a0d682d18be5d60f543d0ee9e05e133af712959232a8ba6bfb288";
+      sha256 = "d6725d8fe67b309058dfcf33951619e0f0b57b05e8dcdbf3d5f9462e3c903684";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/bg/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/bg/firefox-125.0.2.tar.bz2";
       locale = "bg";
       arch = "linux-x86_64";
-      sha256 = "ba3248f9c02f0d989ee69664c779f590a488c94b8713282b7fa7d658c0039704";
+      sha256 = "c66ec00ce77d7c0743c0ac98029b064b4cf21d70ff3b1f07b7611e60a4e9b575";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/bn/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/bn/firefox-125.0.2.tar.bz2";
       locale = "bn";
       arch = "linux-x86_64";
-      sha256 = "7624b5985028574d55957156b485873a0d5458716c6ee3f2c80b53945d299f7e";
+      sha256 = "9cf7401bf5fc8be7cf30e3dbcd97fc51c8a8948f3ab31d9d311fc5dccd2628d2";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/br/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/br/firefox-125.0.2.tar.bz2";
       locale = "br";
       arch = "linux-x86_64";
-      sha256 = "e02aa070554301849a9b8ce21ace8d02afa92f4525b33c8d8e6fc54cd1e8e754";
+      sha256 = "6648ecdfc1e7931caff9e3cb2fec9984d83a1f1b5298f3ea0f72b0bbfdb2abcb";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/bs/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/bs/firefox-125.0.2.tar.bz2";
       locale = "bs";
       arch = "linux-x86_64";
-      sha256 = "568caa5b4731fb55d6e460f999f003d75ae92b417aeb5b82f4d2b5365bc3d06a";
+      sha256 = "f2892526f0fa826666549bbf7412c0ad42a4bc74841a3c3c53f1965c24246f54";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ca-valencia/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ca-valencia/firefox-125.0.2.tar.bz2";
       locale = "ca-valencia";
       arch = "linux-x86_64";
-      sha256 = "8dc814a81c260f245b2233f1910feb015064ba8c1876d2528c984a8f021b8976";
+      sha256 = "0ba73ee9bb67921fa1ab4ede7c8803a50e1f9991de703a0b0340d6d95e62b906";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ca/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ca/firefox-125.0.2.tar.bz2";
       locale = "ca";
       arch = "linux-x86_64";
-      sha256 = "f92b82c81132772848d53e0827561b218704ba5a47a12c61635a16a54c41f2fb";
+      sha256 = "445306c9e98bdf82942560d91b367fa623641c860531531e47062956bb12d944";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/cak/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/cak/firefox-125.0.2.tar.bz2";
       locale = "cak";
       arch = "linux-x86_64";
-      sha256 = "affbaf0c513b34d34b4cdeca35de1af1e337d2dfc2fb360e043586815094295b";
+      sha256 = "b008e29144aaea98bb7617903df3d99af922482d03ff45d0079daf68977b44f8";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/cs/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/cs/firefox-125.0.2.tar.bz2";
       locale = "cs";
       arch = "linux-x86_64";
-      sha256 = "c1baacdd60987568b720f95bff2fc87080be11f03be24b65aa70ea6f77eabc5b";
+      sha256 = "60eddd9dd435f828416c8612d42b64cde2d095a29dd0e38112a1467aae211797";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/cy/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/cy/firefox-125.0.2.tar.bz2";
       locale = "cy";
       arch = "linux-x86_64";
-      sha256 = "1ddb7725eb94d31cbc2b1b5b636b5cdd37bd96d2ad7864be17b14b8b78043816";
+      sha256 = "b01de57e45b6d6c887a7c0caed9681a59799bf8864d6a30d999622c64758518e";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/da/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/da/firefox-125.0.2.tar.bz2";
       locale = "da";
       arch = "linux-x86_64";
-      sha256 = "c5b9cd2ee09bcda66225fd80acb13525c94ab1d9e10ffe87d02f54e9c6099dad";
+      sha256 = "1d855f06c7967a4ffbace2f65b14290a4cb9cfd59bd57660c6f98697d897a982";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/de/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/de/firefox-125.0.2.tar.bz2";
       locale = "de";
       arch = "linux-x86_64";
-      sha256 = "f776f031ac76a06f99588e10cd4189eb6797a5fbc758842899578537bc74733c";
+      sha256 = "88bf1866dcb4afd25cfa55f67e316f09d75ddda0012ba8d2188183c72e55f83f";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/dsb/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/dsb/firefox-125.0.2.tar.bz2";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha256 = "d01e0599410c98e85ccb8063c377ca711b8a90adbb05f6dc2fd41b3353de74e9";
+      sha256 = "0637ff08956b7c76f36f8f3e7f3811acb3f8dc36a3948b9d318dd3330ba75148";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/el/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/el/firefox-125.0.2.tar.bz2";
       locale = "el";
       arch = "linux-x86_64";
-      sha256 = "58bfefce3489820dd5a25e835eb5e58e47f60cac15bc8826d5a84a9815431a20";
+      sha256 = "805d626a871401ae319f98f0cd0809ce4718d6c5511d521e8d15479a5bcf2469";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/en-CA/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/en-CA/firefox-125.0.2.tar.bz2";
       locale = "en-CA";
       arch = "linux-x86_64";
-      sha256 = "edf44edb67dd84118abc6faee78fbb10cb207c6107b8f5636ec9bc86b58a2798";
+      sha256 = "f0f564282dfd392ee25fef3fe0e6a2057cc3d1490a0c63834cb9e066bc4324ce";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/en-GB/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/en-GB/firefox-125.0.2.tar.bz2";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha256 = "f717bc337bc5bd778976c7bb2362f59b965ab1014b36b236c1f0024575960e09";
+      sha256 = "c869f6573e388c13650b1103f0d445be8e96c9b1cec4723d53e544669138af1e";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/en-US/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/en-US/firefox-125.0.2.tar.bz2";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha256 = "0f702f7690b02953e336fac27874276d9d471c9d264dc0feb7fcc6693d63bd4b";
+      sha256 = "ecd3d99be21bc2c3afb6f1a89fc587adb3dcd2a4ef22f95350d461f86251ae7b";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/eo/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/eo/firefox-125.0.2.tar.bz2";
       locale = "eo";
       arch = "linux-x86_64";
-      sha256 = "bcee9457010f934ac6f2de8f695ec1ee968704b2fe7f3b98f132ae79774d19c4";
+      sha256 = "9aa8fd5f10d5464f7d3fd15aab706848dcc8885dacb5c3de9401c8ff23d7ba46";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/es-AR/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/es-AR/firefox-125.0.2.tar.bz2";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha256 = "39df6c4a78468016fdead6a62fa0ad91a5ba504885470c39c9f82748df156984";
+      sha256 = "ae54789a38235c25f7147b61b661f552f109afbb2f21027392bbf14bc30d3790";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/es-CL/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/es-CL/firefox-125.0.2.tar.bz2";
       locale = "es-CL";
       arch = "linux-x86_64";
-      sha256 = "2f5882afb43007833b3991b115c9d8fa58235a9fbf2f830f3c9679277cb4c519";
+      sha256 = "7624f5b01d859f6017f57b2913681b7c0ad92fecedb86a5a5282e172ee108afc";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/es-ES/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/es-ES/firefox-125.0.2.tar.bz2";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha256 = "bfdc7194d20804b5b9345212d38bdc08703560b5808518ec93cd81a64e0b6fec";
+      sha256 = "af56a3bda1dcc4be8dd16418be567c47625ae1880026d5e3bb35550352e50b45";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/es-MX/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/es-MX/firefox-125.0.2.tar.bz2";
       locale = "es-MX";
       arch = "linux-x86_64";
-      sha256 = "493f3072aa9aeeedfcd2b09b3bd0487565878e3d15f463851730462a90b12426";
+      sha256 = "e488a67b04e315f8e924b423e5a0f6779952737a057ed8f8e3cdd3b29bce02d9";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/et/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/et/firefox-125.0.2.tar.bz2";
       locale = "et";
       arch = "linux-x86_64";
-      sha256 = "534253a06a8d7100c7891bd4d647e4a66715f80303f2b72875e973aa755a99c9";
+      sha256 = "3083bd8c49fae0155b7dc607bf176263998fe9926e4a3c2bc2d8a380190b37a7";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/eu/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/eu/firefox-125.0.2.tar.bz2";
       locale = "eu";
       arch = "linux-x86_64";
-      sha256 = "1bed9db2d2890bc951fecdd3e774cb496fbe7928d6766b8f5a65719e6e0a97d6";
+      sha256 = "cdf4f8928fd7c9a8ae55ef5fb0bf90667f19a77ebdd04d9cf1a15a70b07b67b5";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/fa/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/fa/firefox-125.0.2.tar.bz2";
       locale = "fa";
       arch = "linux-x86_64";
-      sha256 = "790b694d3471b61a53b0362e4dd9d2b0378004b417c3a2374c6a059fad24c7a7";
+      sha256 = "bb77300367b2a59defc1ca8cdd2754398f5d5a669cf77dbe4b6ba96656d221ab";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ff/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ff/firefox-125.0.2.tar.bz2";
       locale = "ff";
       arch = "linux-x86_64";
-      sha256 = "cb31483e98b05888845bcab9bb9243cf9670783b41371d76c6df10d71fa32f01";
+      sha256 = "526daa29ae65ba57fefe639c5b18d140fad7bd04093071e4b7513937bc39486d";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/fi/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/fi/firefox-125.0.2.tar.bz2";
       locale = "fi";
       arch = "linux-x86_64";
-      sha256 = "d2e85a2719d62a69e01bdc54720b4c1847d8eb39931b78252c6468ead96d80f9";
+      sha256 = "c642f7803b2f9aace0ecc500c3664ba7209c1ab4fc7f7c3bf62a4f368f5097bb";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/fr/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/fr/firefox-125.0.2.tar.bz2";
       locale = "fr";
       arch = "linux-x86_64";
-      sha256 = "824326a2d42caa9571597e6750f307d0fb164c14a50aea4f7517c765bb7c912b";
+      sha256 = "32345e02fb215813bab7c689d95138e6a93f4937345e75b4cc01bdbb9c607de2";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/fur/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/fur/firefox-125.0.2.tar.bz2";
       locale = "fur";
       arch = "linux-x86_64";
-      sha256 = "6d815d210ff533a8cdd35bf66ac780bb756cb9934145abe2f2f8ddc1cdc6d6c8";
+      sha256 = "24ad3d7a2877aff268ff03c6ac08e0d0005accc1c22dc50d48fe7740f083f3d5";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/fy-NL/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/fy-NL/firefox-125.0.2.tar.bz2";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha256 = "eac5be3269ae26ee8057fa93fc586432e531dcfedb7ab2202c5d5911f82b8a71";
+      sha256 = "4b11a2d6372e4ad66375681491abc94075ef05a8009f4adbe7a81762029ab5ae";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ga-IE/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ga-IE/firefox-125.0.2.tar.bz2";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha256 = "5ccb6e5fdeb2001fe15ad7ffe3f9e3d77ca1c35b15839b502aa03659a37bb645";
+      sha256 = "7bc49b1edb7300b362264c212076d7f75e7fd3feed8ab12dc5bc4b4ec3022c78";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/gd/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/gd/firefox-125.0.2.tar.bz2";
       locale = "gd";
       arch = "linux-x86_64";
-      sha256 = "7f879a849f1fb13bf7a45f40a55ea1b06827070b21f34f4cb0cebe216af4072a";
+      sha256 = "4d2ae49ae50da5e093426220dcb5ff8e6e007503fd5526f4acd498b31c9770b2";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/gl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/gl/firefox-125.0.2.tar.bz2";
       locale = "gl";
       arch = "linux-x86_64";
-      sha256 = "e41f9b2b24133a57d90b4fd390076083a1f04bb1faee6b6dfd551c506f455996";
+      sha256 = "1a349bb943eea8eada319a3fd42ebb258664fbcf410dd7ee3bb3552200043b80";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/gn/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/gn/firefox-125.0.2.tar.bz2";
       locale = "gn";
       arch = "linux-x86_64";
-      sha256 = "06acdbc7257e68bf4dd0d84b126ad78688bbfd967506a267d77cf1bc3803bca3";
+      sha256 = "4683096c6963ae79480829f2bcfc24346cfb0ff89554b1de2237c2926f2f6402";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/gu-IN/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/gu-IN/firefox-125.0.2.tar.bz2";
       locale = "gu-IN";
       arch = "linux-x86_64";
-      sha256 = "a08cf0ff8c58dc58801180c20f030a7d88dbe940e638ff58d82923328853417d";
+      sha256 = "ce3ccfeccc8626d78b6ca5119d907960d7b415a4f6eb0cb1e8b1ce697234c9f4";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/he/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/he/firefox-125.0.2.tar.bz2";
       locale = "he";
       arch = "linux-x86_64";
-      sha256 = "8b2d5d1ca76fa3bb538f72af15a4af7180145e0c2f3f03b845965a2a6144b35d";
+      sha256 = "6319f2446945e15aa2918b45236d57690e3b4ceed65a847915d92f228eef4f10";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/hi-IN/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/hi-IN/firefox-125.0.2.tar.bz2";
       locale = "hi-IN";
       arch = "linux-x86_64";
-      sha256 = "478dee761374f2f156b6ec0f33e3f9d8b7e09113186b8a0945555bd919582007";
+      sha256 = "fb6848985b5c27d80eca2c8c6b877ca287c095d3b9319bee5ba4b72dbf5e00ca";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/hr/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/hr/firefox-125.0.2.tar.bz2";
       locale = "hr";
       arch = "linux-x86_64";
-      sha256 = "a7601810c17465b7d730b9c8bede5f0cb69f00e2c5f30dc645a1a97fe636759d";
+      sha256 = "defb3c3e05b58525dde6bc5d8c2b0ffa096d6e86f320882234acd3564f394c4d";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/hsb/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/hsb/firefox-125.0.2.tar.bz2";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha256 = "aad2350a6848585062c2cc5ff5947821898f8e783dc81b3ac2a87283d24e8389";
+      sha256 = "a4fe13dc42bc37262e34c0f9a63e63e79b0e91614cfda5c84cbeed928e9c8800";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/hu/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/hu/firefox-125.0.2.tar.bz2";
       locale = "hu";
       arch = "linux-x86_64";
-      sha256 = "b4dce9a17840c641de84005892e60e1271a5a59570f85cc9f5179622d81a7c84";
+      sha256 = "f50c9778a1c83c30e31926f15bc00caa405041eb9f686a10463b64178159f0dd";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/hy-AM/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/hy-AM/firefox-125.0.2.tar.bz2";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha256 = "c1f60aa1dfb9966fd9e21f25bc54169b1866f0550c5fbacdea633c1cf6a4a31b";
+      sha256 = "39684d30a43a314aef722ae757d6e2fd58af76c9861a708455b9df8eacbf2d5b";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ia/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ia/firefox-125.0.2.tar.bz2";
       locale = "ia";
       arch = "linux-x86_64";
-      sha256 = "bf8f8dfe6f8a27bbad18683f07c499212560c19399bf42a6f7833a97a86005fd";
+      sha256 = "8e99811b2ee15adaf78eaecebb59c506e45b0402a052353d6007f5da7ba6461a";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/id/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/id/firefox-125.0.2.tar.bz2";
       locale = "id";
       arch = "linux-x86_64";
-      sha256 = "118153305412549d6152caa1a4d9d34ffd371d460ae03d35021e8bb65cbde136";
+      sha256 = "a53d77bcb75cfe8c0c7951711f9b11681fa5aaf20a2bb8ec6cf2198572624980";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/is/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/is/firefox-125.0.2.tar.bz2";
       locale = "is";
       arch = "linux-x86_64";
-      sha256 = "bc85c4fd022ea6907603ef3654b5bed73875b0603ac0ab4ff49a6e0c8b5980bd";
+      sha256 = "c5b85b3e16e2d6300ed4f1196325630b53eb9edbc4688ee8187d6a77b641a339";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/it/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/it/firefox-125.0.2.tar.bz2";
       locale = "it";
       arch = "linux-x86_64";
-      sha256 = "ff43d05336aeb2a77a9c1f5bddf1e5bf02570c18f21b5f91a97a8ebf69e54e72";
+      sha256 = "3a70bc2b11b133b170482c88981b726cb734b9f5eaf0115bc4e65734f7862ce8";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ja/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ja/firefox-125.0.2.tar.bz2";
       locale = "ja";
       arch = "linux-x86_64";
-      sha256 = "1f610ca7a4433d7d8cbd2fe250bece840340e4e4cc87df84e3e8b9014d32c579";
+      sha256 = "a490ced3f87b4b89d717365b196b8c0a311da50ad0392a056190466ac399e178";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ka/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ka/firefox-125.0.2.tar.bz2";
       locale = "ka";
       arch = "linux-x86_64";
-      sha256 = "4092cb63ec87a1bac05228db400a3f121224228bfa3e70e9401b3f6c8b2747d4";
+      sha256 = "02749be6732a88fa5593d4c1dae76a2626bb5ce516cee98c205900aa4b785ec4";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/kab/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/kab/firefox-125.0.2.tar.bz2";
       locale = "kab";
       arch = "linux-x86_64";
-      sha256 = "56eaf3565e87db99738630bf2d08afb4f70abde00ef8bc0b1db0b6a531e9cded";
+      sha256 = "3a26d92fabc60ad584c98d8b21eb46cad94a4d69dd3a5a1c30b73d72a73dc507";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/kk/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/kk/firefox-125.0.2.tar.bz2";
       locale = "kk";
       arch = "linux-x86_64";
-      sha256 = "1de385e239c692e91eb6611958b59141bf11be9ec89131419c650c8c82f5ec6c";
+      sha256 = "0c68d4db9fec3dbfd240c211179fcc72a18fe44f6f4526f1520b9f77eca497e6";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/km/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/km/firefox-125.0.2.tar.bz2";
       locale = "km";
       arch = "linux-x86_64";
-      sha256 = "16eb03b53450aace3eec14b96ca6b3e5a814cb5b6988643d2cea6f202f906af9";
+      sha256 = "a823adbc5ed6d00c6611cef7278766ab67095d05df28f4feea74ac36bb35159d";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/kn/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/kn/firefox-125.0.2.tar.bz2";
       locale = "kn";
       arch = "linux-x86_64";
-      sha256 = "3b93bd087ed6a0f81e8e8670f3b578552a9d17aa34622da67780b3e1970c5aec";
+      sha256 = "4acfaf770e803a9f95d6538169864af173efdca5979b5e53e255e246b5bdfddc";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ko/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ko/firefox-125.0.2.tar.bz2";
       locale = "ko";
       arch = "linux-x86_64";
-      sha256 = "a32868e5dfe44ec42cd9e317a60e744c82dad7bf3547330a06ddf317a337b601";
+      sha256 = "d7f9f882a33f3024173243960dd65165062a3e5fb72b76b413ba0225f0e82171";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/lij/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/lij/firefox-125.0.2.tar.bz2";
       locale = "lij";
       arch = "linux-x86_64";
-      sha256 = "6f99eab1a99d24554eb1ee8c6194ecee9973d087ae181fc062650d3c444ae221";
+      sha256 = "a6991f8be2d09111a545e39a1114ade9b51f1a4667f62267719b4d99f8312ab3";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/lt/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/lt/firefox-125.0.2.tar.bz2";
       locale = "lt";
       arch = "linux-x86_64";
-      sha256 = "542aa0fe483ad89ef920b1285241678fbed1b9e9f47c8392a1fbc7c2bb8996ad";
+      sha256 = "952de896927ede1f4650ee45e1fcb3bb5ea28f81b9ae711ec8d72e6a15a37649";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/lv/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/lv/firefox-125.0.2.tar.bz2";
       locale = "lv";
       arch = "linux-x86_64";
-      sha256 = "eb231d0acf68ff4ace85aec28a5554b562a30b6b51886323eeb0d6eed1580f6d";
+      sha256 = "1beaef01e6dc993450d0f787f80ad5a50c8d5288e816775d1c0ced012cea81ba";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/mk/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/mk/firefox-125.0.2.tar.bz2";
       locale = "mk";
       arch = "linux-x86_64";
-      sha256 = "f8d58941da72efb58b3d9429a048ab90d51ad08d27ecb7add4b30c2d3bace096";
+      sha256 = "38ab05672f75133480c02c69e89364ea75c7fddc5cce4b38e26d2bbc49720f52";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/mr/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/mr/firefox-125.0.2.tar.bz2";
       locale = "mr";
       arch = "linux-x86_64";
-      sha256 = "9d5010f7bef77c1f01d06eb5c9ddda74aaf38060c1efbd96670d02324cb0608d";
+      sha256 = "e4bccdf8b86959ae7037468886bf1b8bd0ce2e72b78fd284c2a9d01d7594b488";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ms/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ms/firefox-125.0.2.tar.bz2";
       locale = "ms";
       arch = "linux-x86_64";
-      sha256 = "39647010c62be696785a8c17fd9b32c91bb6c698d3117560da02a0c5ee5c4835";
+      sha256 = "781b8993cb31223f01eef9e1c1736fd65f88def01d5163015496c57c80a952d7";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/my/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/my/firefox-125.0.2.tar.bz2";
       locale = "my";
       arch = "linux-x86_64";
-      sha256 = "4339fc0c35ab6ce4f118defa3d5f4acee5965331a825d6b1c6aa2e5c0a778858";
+      sha256 = "4de4a0f5c23f2ecf715da6d53a5db187f0f3a24ec96da65f3c3326fafc90f4cd";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/nb-NO/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/nb-NO/firefox-125.0.2.tar.bz2";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha256 = "540f57e75798b9dacb26578824e5ba92dad5f56ab30289e88a1af607b6a0d469";
+      sha256 = "c3d5174d3b9bc06832f1db0ec52597ded859b10c93a8393f326798b9ca9a9092";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ne-NP/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ne-NP/firefox-125.0.2.tar.bz2";
       locale = "ne-NP";
       arch = "linux-x86_64";
-      sha256 = "cd2494580e1d76f813b90a2c056c6aa57ebd904b0adc76cd822f47559cd397a0";
+      sha256 = "74e4887923e23e564c8c9760f9000febea221a1a1719923fb35b5e8a274bc537";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/nl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/nl/firefox-125.0.2.tar.bz2";
       locale = "nl";
       arch = "linux-x86_64";
-      sha256 = "faecf7f18fd7c564c4108ca96395cf72032fb2321bf60527211c5251ced5d5d2";
+      sha256 = "06e98ab97d45d4f76ebd5f16059a87591de279b189dada428eaa31be5edb9e58";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/nn-NO/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/nn-NO/firefox-125.0.2.tar.bz2";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha256 = "f53b5e8b126e6f972d81902d5cbbddd1dc028971720904993e1f62df3468d15c";
+      sha256 = "d4dd1f483f9f4a74efcfe70fd25473ae1162a6fbd30bd2dabc7da38d49dafd32";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/oc/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/oc/firefox-125.0.2.tar.bz2";
       locale = "oc";
       arch = "linux-x86_64";
-      sha256 = "ca9fbeb0a9f2960f8024dd5e5bc5f86b08b05df321582180619e2a240ae7e64b";
+      sha256 = "2d2b7e612cd3c10fa390f08fcd5bfe7808c4563e79dec1391f4d88e103bcecde";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/pa-IN/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/pa-IN/firefox-125.0.2.tar.bz2";
       locale = "pa-IN";
       arch = "linux-x86_64";
-      sha256 = "b824cb8e8f3d30d921abb892a1b93ca7dd2279437cd4aadd0f2bae8e65fc3fea";
+      sha256 = "287d1f46526bc07d74a3317f7bbc7b781622cab1929f9265a439cf724d275cbd";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/pl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/pl/firefox-125.0.2.tar.bz2";
       locale = "pl";
       arch = "linux-x86_64";
-      sha256 = "768193553fe105602522b0ce9f6d63d4f726a939612595ac9ef64be9c8a5e785";
+      sha256 = "61a04f0b259841d6855f27ce1272b8a5cb5bb63171d6b59185760f91ba55f228";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/pt-BR/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/pt-BR/firefox-125.0.2.tar.bz2";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha256 = "d3895aedffa937e5cc1ad745bd52fafe2269a5b49cd3af618e4dbb314a29b2a5";
+      sha256 = "bd7981044c90498ed6b69058c526378edac609456ee5bd17a27e2d5ab8aeea2c";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/pt-PT/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/pt-PT/firefox-125.0.2.tar.bz2";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha256 = "86e4a9ff8ef82e76fc5a5aa3b76f3587897a7b1b9132de9585c41f5bae11f8e1";
+      sha256 = "845063d62e92923afdfce5f8cdaf830fc861e3e80d0f0a9e87944054c3af078c";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/rm/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/rm/firefox-125.0.2.tar.bz2";
       locale = "rm";
       arch = "linux-x86_64";
-      sha256 = "68433ba1c01075484f14ab905f2737a7c05cc466073ed8cbd8903b5b3ac5feee";
+      sha256 = "11729b87358cdd32d374bb7097625d94d49c0f491085e0a338170da2fd5ff78e";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ro/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ro/firefox-125.0.2.tar.bz2";
       locale = "ro";
       arch = "linux-x86_64";
-      sha256 = "c34aefea9bfba08bc3657597138eb3d4b3dbae1138527b59981750b8811e8958";
+      sha256 = "5480b2d8bc4a3d820104c3faee11240ac8c1ff002ed5b784ed2ae3a39e813deb";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ru/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ru/firefox-125.0.2.tar.bz2";
       locale = "ru";
       arch = "linux-x86_64";
-      sha256 = "3766761278a43e13570542d57ede9a66a26388faca72368dc889a4ae1ad637ea";
+      sha256 = "be35c75aaaeeb2b8dc07a807ea906b82032e01e800e91b044a7c559039883e3a";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/sat/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/sat/firefox-125.0.2.tar.bz2";
       locale = "sat";
       arch = "linux-x86_64";
-      sha256 = "566eb5ed634157490e3adb57b04d0f93a6662e2afe98055c4686bdabf93d8497";
+      sha256 = "2b63b616bfba962a9c2382c59182bd4acb0ca44c693ccfde911449db2730820c";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/sc/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/sc/firefox-125.0.2.tar.bz2";
       locale = "sc";
       arch = "linux-x86_64";
-      sha256 = "ea73e0afa3f5cf896618486542911731230265788be3d4cc9a94ccce16be2453";
+      sha256 = "478c94327cb3d4e51981a0a3adddd0b7f00ce8b54fd21e0b233277f0131941ea";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/sco/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/sco/firefox-125.0.2.tar.bz2";
       locale = "sco";
       arch = "linux-x86_64";
-      sha256 = "07bbe26242497c5cef48916438b9755b754a79e377be368565c5b240ebcaeb2c";
+      sha256 = "84721bbb09ac8036013d2ebd7d053b20531c1873004c67e8723bb7986fa18641";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/si/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/si/firefox-125.0.2.tar.bz2";
       locale = "si";
       arch = "linux-x86_64";
-      sha256 = "26555216a11d4e1d1ec93ea5b7d1aceb2b63fc0548139be980667061465e5d43";
+      sha256 = "fce4cdd335e52207980f1329ba3190ef224188679a9c2cd0c81b87b663953874";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/sk/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/sk/firefox-125.0.2.tar.bz2";
       locale = "sk";
       arch = "linux-x86_64";
-      sha256 = "82a4aab4cd824eedb2e0812358ae8145e1a8e9de181527355702021d9c93334b";
+      sha256 = "9ebc5c03aed1b417efaf40103bcf41ef59d06bef081a37c40fe6f9ea55e625c2";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/sl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/sl/firefox-125.0.2.tar.bz2";
       locale = "sl";
       arch = "linux-x86_64";
-      sha256 = "32ca73ae69c1b6745084afe178bba8f73513ccd1452bc257cbec843e7e3f5ca0";
+      sha256 = "f13472ed1ba867350e5255e3d70f83e0925116575e02a6846d814c59ab071837";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/son/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/son/firefox-125.0.2.tar.bz2";
       locale = "son";
       arch = "linux-x86_64";
-      sha256 = "05c1c7a426dd0e51c64023fdb42024cb963637028a7f1accea0c91b4cea224a4";
+      sha256 = "6cbf423f1f464835d4f076f0cdb0910e7c152271884d686d988db048dd06992c";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/sq/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/sq/firefox-125.0.2.tar.bz2";
       locale = "sq";
       arch = "linux-x86_64";
-      sha256 = "7b14364475e55a995577e111570d2a83aadf1c1f1351e41cf192dfa4b9f99ff3";
+      sha256 = "4bfa8c3be90651e0ecbac820fa1acc38ae5dd0916fe18250c2b2cf2c8f6d401e";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/sr/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/sr/firefox-125.0.2.tar.bz2";
       locale = "sr";
       arch = "linux-x86_64";
-      sha256 = "43c6ba007493881fa4719578b801bd0ffef4efffee5b4633ca123bbc9961bd7c";
+      sha256 = "b2405bdf08213345271a52e80270e45298ef66776e04947a5a38985a048b93a6";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/sv-SE/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/sv-SE/firefox-125.0.2.tar.bz2";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha256 = "3c16cda4f7b56773d81ffcc36480d3c8793fe74a91d6ce59d34b1474c7579f48";
+      sha256 = "c45ab928dae8b4ead94cf977fb441df786aa6b80aa63a27ca6cabc66e8853b91";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/szl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/szl/firefox-125.0.2.tar.bz2";
       locale = "szl";
       arch = "linux-x86_64";
-      sha256 = "2ff545d757937629cd317eb453c6e7c8d5ba52c50697f81d608b2274501bc192";
+      sha256 = "3a7c420f68614ec9b2a2d60aa9027b43ad38b67f9317de24bda551a8d1af261d";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ta/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ta/firefox-125.0.2.tar.bz2";
       locale = "ta";
       arch = "linux-x86_64";
-      sha256 = "d49331a87e9b94eb1ca3232207b5af867a9001ef71f6a2735224e7583fc860f0";
+      sha256 = "1847f9234956a76365207d7b9ecacd594f67896a1beeeb3792038ef24b51a2fd";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/te/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/te/firefox-125.0.2.tar.bz2";
       locale = "te";
       arch = "linux-x86_64";
-      sha256 = "2ca9b4c38220bbdffab7f92bb696eaa31882d5c14078ba2e27216fa1fc87b07d";
+      sha256 = "13411399d0cb4993cec0cb5bd1d1dc2c24073620b9cb36d390a3606f4a251047";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/tg/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/tg/firefox-125.0.2.tar.bz2";
       locale = "tg";
       arch = "linux-x86_64";
-      sha256 = "ea3b284000e62e13620a010749e9b60534ecd2eeec31f2df3cf85df6bcb12f96";
+      sha256 = "7c477ad4e273bfd23a91e018cee8955e7b7605dccdbc8585285902b7f0cfdd6e";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/th/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/th/firefox-125.0.2.tar.bz2";
       locale = "th";
       arch = "linux-x86_64";
-      sha256 = "b9e46851dc8c9518ace17b1313fa61af5fe7beb696bf5bfe07875e7661fc736f";
+      sha256 = "dc66bbd288067fb256c16cd83025f3c5dda45a2e8bbbccc3deda72a62bed56f0";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/tl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/tl/firefox-125.0.2.tar.bz2";
       locale = "tl";
       arch = "linux-x86_64";
-      sha256 = "a686195e0ed3677c77b043bc4488c985c075373156cad6f05086dae31994e02c";
+      sha256 = "d198857dace1d8798a2ef09cfbb80e80dd5dfd5d6cf2d4427260b72726972ba5";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/tr/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/tr/firefox-125.0.2.tar.bz2";
       locale = "tr";
       arch = "linux-x86_64";
-      sha256 = "92b4600fb6d2cf244abd8941d383806da8cf27397c1f04dae892b9d224ff04f9";
+      sha256 = "ffb9b7ffef7385bbfe53f2b18c8fff5c6ba1bc44c89a52e4db21d46b9bd4b87d";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/trs/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/trs/firefox-125.0.2.tar.bz2";
       locale = "trs";
       arch = "linux-x86_64";
-      sha256 = "a655b722886e276fd8ed444eb3d359f7a1398486e697e1a7c60607857c97ac94";
+      sha256 = "21078973238b093474fbc34c1b411f3a0ec4293da44215f99eb65e70d09585f4";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/uk/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/uk/firefox-125.0.2.tar.bz2";
       locale = "uk";
       arch = "linux-x86_64";
-      sha256 = "4446466118ff2dbd8d2cf9fd115b30128e626df25fa8efb799fbf58ec86be3c3";
+      sha256 = "625e545c4daed88fb87173bed12ac2d1927e0d38b2623b6e4a9ea1e170af3d8f";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/ur/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/ur/firefox-125.0.2.tar.bz2";
       locale = "ur";
       arch = "linux-x86_64";
-      sha256 = "8954d1812cdc7e7fd6671a0368d1eb9f12af04ae654427310a1b1031fe65a0b4";
+      sha256 = "f507fc9d121691404f427394736cde58fc57223c1fc2e49628560beb2834c3c4";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/uz/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/uz/firefox-125.0.2.tar.bz2";
       locale = "uz";
       arch = "linux-x86_64";
-      sha256 = "1e481c989b7ca17770ad1e3fecf948a32125989a8d8460609b22be87d89fa95f";
+      sha256 = "0a4a7ab783abf28c72d8dc05fb89d1c595e9cb6c4230162ffa61e56f9cd4a900";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/vi/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/vi/firefox-125.0.2.tar.bz2";
       locale = "vi";
       arch = "linux-x86_64";
-      sha256 = "261d944075b7df8f306b0d32a19e640e896d6b37b7911aed66affa88dfdaeeea";
+      sha256 = "c11b780a90868ad2a352c724eed2308e8f8348ed854773370dab467dfae1a037";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/xh/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/xh/firefox-125.0.2.tar.bz2";
       locale = "xh";
       arch = "linux-x86_64";
-      sha256 = "7cb327501663e7fe772a40723275b3d8c34391687dcce8165ca3aaef9122bbc5";
+      sha256 = "196ba78639720766d7f199ebd0cfcaf7dd47ca81c15e19fece45a7c90ba41659";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/zh-CN/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/zh-CN/firefox-125.0.2.tar.bz2";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha256 = "7d0cbdadbf0e7d772d70cc228597fdd6cb71943e757eeead166c14630d0436a9";
+      sha256 = "861c2b6a384976ab9b134ff62518e7bd9d52298c2020f7e8e93298f306bbb2d6";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-x86_64/zh-TW/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-x86_64/zh-TW/firefox-125.0.2.tar.bz2";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha256 = "11dcac1e5a53885fcb07d370ad68e74244fd379927c9330ffff1827972cbc172";
+      sha256 = "a1994e5d0fab6cd4ec2e7ceb7406955bcbf3aae240cb8c5dcf2c10325a50d1d9";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ach/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ach/firefox-125.0.2.tar.bz2";
       locale = "ach";
       arch = "linux-i686";
-      sha256 = "b82f69643300bac35f5c25f14f95e2ddf237aadb5ef0430520a543f0a0ecc6f1";
+      sha256 = "c5fd729c3397225d4c34dcc3980ce7db50c4983e2d6b03480f1ba8c34bbfdccb";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/af/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/af/firefox-125.0.2.tar.bz2";
       locale = "af";
       arch = "linux-i686";
-      sha256 = "4adfee36050e96d7a148656415df9cef4958331e31707f4372ddf43eceb5ef46";
+      sha256 = "2dd3e6ed95ed3ee56acbb8798b6d4ad0a4609b1e8cc711a778942b1f2ef91161";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/an/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/an/firefox-125.0.2.tar.bz2";
       locale = "an";
       arch = "linux-i686";
-      sha256 = "ed3f933caaade24d236c93f4fda10f4d0ed302af1c058698d7b1b36380356b13";
+      sha256 = "15be5f74f58a8e6b34adec1554e0be02ddd115cc4f44d1935cb9bdf187b90e2c";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ar/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ar/firefox-125.0.2.tar.bz2";
       locale = "ar";
       arch = "linux-i686";
-      sha256 = "dff115619f895d491d47b0f2d2c028c77f7c5764098a218974ba861d1124f352";
+      sha256 = "d225f582cc7f4805815c5207961992019196b6c044a9c9722abae0e7f1a75810";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ast/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ast/firefox-125.0.2.tar.bz2";
       locale = "ast";
       arch = "linux-i686";
-      sha256 = "5ee98c5325bfae6d27e27c1c7d5a5dd8d52c5892efca98d8559ed76bbc431628";
+      sha256 = "6e94ecae9a7567f997f885c9e4d332b97c4f1cbc7df2f3c7cdeb61231aca5f80";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/az/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/az/firefox-125.0.2.tar.bz2";
       locale = "az";
       arch = "linux-i686";
-      sha256 = "3df15bec53ad5b5cfb265321bde6bad22c37886a2b526b2ba3d8ef00e7619d62";
+      sha256 = "decbc3404707ebdef7f231adf6f4185f38fbef581b8def1ff4bb587e8973f0a1";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/be/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/be/firefox-125.0.2.tar.bz2";
       locale = "be";
       arch = "linux-i686";
-      sha256 = "24a5d62a81d00761c0cb14bc6c1264000cc8a1ad26b63c68f79505946021e3ac";
+      sha256 = "8422388e348bdff5dd6af1656a2e6270697b1427da851e09dd5a62e45eb14b50";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/bg/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/bg/firefox-125.0.2.tar.bz2";
       locale = "bg";
       arch = "linux-i686";
-      sha256 = "049eb23c4c9790fed8588da0896fc14ddf54f9a6ba30095aa18d34d1a3f33a31";
+      sha256 = "b14c60a8ff41875d183608fc9763e9dd24975f078e08797c7589f6ed1769d1e5";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/bn/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/bn/firefox-125.0.2.tar.bz2";
       locale = "bn";
       arch = "linux-i686";
-      sha256 = "be00b429dfc0555e2a10edbcd25fd4617bde75779f135656452940e687783191";
+      sha256 = "941a7fc7677cb3488608c81c727ce5799a651bf1b76727977af81c31bd3f3e95";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/br/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/br/firefox-125.0.2.tar.bz2";
       locale = "br";
       arch = "linux-i686";
-      sha256 = "0b9d68cf7da38352718b70d6c14ff2fb8acec2fe22b4d7bd4d74269f1b90c518";
+      sha256 = "1e19bd29b6361aafdaf09fe6a9299434db0b240a68f3ad934cde2c8c4c03c790";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/bs/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/bs/firefox-125.0.2.tar.bz2";
       locale = "bs";
       arch = "linux-i686";
-      sha256 = "0c1337cb4c9af4a6196c8fefd273174ab28ec99a25a2c64fe920d2f692b16575";
+      sha256 = "7432eed3e1a2c8480d7610e209f7b55ab8c9084dfcae453adfba40e0d43a6fda";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ca-valencia/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ca-valencia/firefox-125.0.2.tar.bz2";
       locale = "ca-valencia";
       arch = "linux-i686";
-      sha256 = "60a2fa1d387dc21aa1d923347e2b51f76d63a263015009d8cd6960a7bc1efeb4";
+      sha256 = "68fa72fa1145aeba1c40b8d1971f985814161ae63a502f68183dea627b36e3bd";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ca/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ca/firefox-125.0.2.tar.bz2";
       locale = "ca";
       arch = "linux-i686";
-      sha256 = "dfd409f0a4d17329080b58061be53b57d3c95a8a11579e47f17bcac90cd476da";
+      sha256 = "9f57ea19e727b409aee9783cdf0992918d9b586c87e59ba2d88b7b4cb8de182f";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/cak/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/cak/firefox-125.0.2.tar.bz2";
       locale = "cak";
       arch = "linux-i686";
-      sha256 = "a4177252b2ada2676eaf8d119c89f1abc8afddbe1d9d4241b7643d8e9699f34f";
+      sha256 = "a35a688ab4192a3b14c08c2a0ba70a36a98c9228ac74b8782be835761c84a930";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/cs/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/cs/firefox-125.0.2.tar.bz2";
       locale = "cs";
       arch = "linux-i686";
-      sha256 = "664bcdec576573e44d5c6970290f1cf376da95ee3c04c6d239a35c8836709f2f";
+      sha256 = "b52f8d472fbdc98c571e1915da8ece00f6b66b2d4f2fb3cfc9a0a87f96ec32fa";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/cy/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/cy/firefox-125.0.2.tar.bz2";
       locale = "cy";
       arch = "linux-i686";
-      sha256 = "661c4626fcea77bfcbb5efe188e40a2da2a42f8ac534ab8a9e75b201d8ae11a3";
+      sha256 = "6f10274a2ecd6358eba51cd9ca0d2548a30c1a9af074c92e00c8702385f2e2db";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/da/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/da/firefox-125.0.2.tar.bz2";
       locale = "da";
       arch = "linux-i686";
-      sha256 = "ef8b706eea86538b4cc0f987244fabc05ff96f70a0a41155f6f8e73d15c35500";
+      sha256 = "6ffc7d1e7ba3549fd68eb225a870b84807cf4c8277490a9ff5efa8118b629daf";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/de/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/de/firefox-125.0.2.tar.bz2";
       locale = "de";
       arch = "linux-i686";
-      sha256 = "010fdd5d96a8575a3547bcb5b6cd1f8f38fb152a3ae014f0bb4e375b48f63f72";
+      sha256 = "2530ca9be98f115521c34f6dbf2c7d8cf1e4b4a65ce087f702f390fd091ea27e";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/dsb/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/dsb/firefox-125.0.2.tar.bz2";
       locale = "dsb";
       arch = "linux-i686";
-      sha256 = "1325a8fcadf3484a0ef9364fb6ff7187507a74780e35abf18fe93334d75c6928";
+      sha256 = "1f6d8d87a4c0504fe2c076eaba0683dfd145df33101dd66bf422dcc1b08ec600";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/el/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/el/firefox-125.0.2.tar.bz2";
       locale = "el";
       arch = "linux-i686";
-      sha256 = "cee3565afa0d1bea1eecacba264552fe1cd1485ad442d0f9335ffdc6a830c54b";
+      sha256 = "8d428453a25947a39236766e8896c84e264e5e0e79636eca5ad66de24dc4dacd";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/en-CA/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/en-CA/firefox-125.0.2.tar.bz2";
       locale = "en-CA";
       arch = "linux-i686";
-      sha256 = "f5133ff41df3c00efba7d9bd645b293a35b2b1b167a49fae715f2d5db14f6322";
+      sha256 = "518d40beac437ef3974884572b504ecef611927f471bbd2673bac3ae79b524f6";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/en-GB/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/en-GB/firefox-125.0.2.tar.bz2";
       locale = "en-GB";
       arch = "linux-i686";
-      sha256 = "3d27e3074c55cf0932dbee424ba3769b8aea0e718604162657443b91edddd53c";
+      sha256 = "2f306743cb4d570058cd25adb6cc674ec21b98459a4127523d4748c694428481";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/en-US/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/en-US/firefox-125.0.2.tar.bz2";
       locale = "en-US";
       arch = "linux-i686";
-      sha256 = "2c60d84d168c48ff571dd0313101f8ff772d34c4c4a6afdde570109002a5ce70";
+      sha256 = "08ccf11fbd664b80f2f5f71da98e486b1bfed34e1fc5f85027810b0cdbde8962";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/eo/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/eo/firefox-125.0.2.tar.bz2";
       locale = "eo";
       arch = "linux-i686";
-      sha256 = "42cd56d238a0697f469fb7948ab93905a4ded7d6e54203c9ddf8cc10f5399636";
+      sha256 = "6f3c5a5c92e19c8ee9371296604d354d1725ee52546d5d627c7b0039b72c77ff";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/es-AR/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/es-AR/firefox-125.0.2.tar.bz2";
       locale = "es-AR";
       arch = "linux-i686";
-      sha256 = "6820f8831f155706ef16381e56671267504e86cf6edd8c6713ac29b2973a9441";
+      sha256 = "e75e034b2e797eed918474f0ec6aad44a4b562f367ac4d3ae953676b4c58d1ef";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/es-CL/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/es-CL/firefox-125.0.2.tar.bz2";
       locale = "es-CL";
       arch = "linux-i686";
-      sha256 = "8fde139c51d2f78e603f6efb54add63a5d81ef307a1ab934ca20ffa77853a773";
+      sha256 = "113e48f98b738dccca3f11ef7eeccbe740c3a6019d91c8cb0505f3c2faf6682c";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/es-ES/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/es-ES/firefox-125.0.2.tar.bz2";
       locale = "es-ES";
       arch = "linux-i686";
-      sha256 = "76a1df6e67653ac056e822ab6a682aa57dfe8aac991b8fcb91d4388fef19f247";
+      sha256 = "a8beea1049c77a48b098fe8fe2121d0b0eb83edb471b53733dd1183effdc0bcd";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/es-MX/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/es-MX/firefox-125.0.2.tar.bz2";
       locale = "es-MX";
       arch = "linux-i686";
-      sha256 = "265a1f1799e1ede04bcf460dbe676398d36a15d7c81f4a9bcd67ce3cf6355654";
+      sha256 = "796759fd53e134559142d88d2a0d242feca6120660345468665f0a9b08e49999";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/et/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/et/firefox-125.0.2.tar.bz2";
       locale = "et";
       arch = "linux-i686";
-      sha256 = "b88bc9d688eb6eb232cac3599de3d56a7e0da65166da863592a353561e0e7b92";
+      sha256 = "3bea5fc06a710e69c23998f729463c767200bd0e0528d4ed89dadb55f20ab53d";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/eu/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/eu/firefox-125.0.2.tar.bz2";
       locale = "eu";
       arch = "linux-i686";
-      sha256 = "3fe098b6ab3d811edcda82019b200859f51e3ad0e2ae8193b163005b98d0386a";
+      sha256 = "57e0087f574ab13a3aac00c732dfaaf5aa768fba8a56d086c56e19dcdc24de33";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/fa/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/fa/firefox-125.0.2.tar.bz2";
       locale = "fa";
       arch = "linux-i686";
-      sha256 = "e51723ab10c6833e75c1fac5f435a544590237e2bc2ce826ec8083c035cc2c2d";
+      sha256 = "af7cad609b5a4b155b19c227c8664f6b9136655c804b44e7fa3c9100fe371baa";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ff/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ff/firefox-125.0.2.tar.bz2";
       locale = "ff";
       arch = "linux-i686";
-      sha256 = "82f3a145131b6c6b1f29a094815e60df081d3521d726704f098a3278326cdc1a";
+      sha256 = "3148f266c40bc08bdac8fe3ea0f458c4a01b1bca60f5c2101d00901e0de4775d";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/fi/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/fi/firefox-125.0.2.tar.bz2";
       locale = "fi";
       arch = "linux-i686";
-      sha256 = "fc8be841682da29fd98f336fcaec222c3c8bb911f8effe490301da0340879ea9";
+      sha256 = "423be151b922259c88d36c92e54a60dea2f6328bfd086d32dc74cd1a6d0eedd6";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/fr/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/fr/firefox-125.0.2.tar.bz2";
       locale = "fr";
       arch = "linux-i686";
-      sha256 = "6ec50a746151d57eaa56dfd4aa7ca0b8ee75e6fa31681da416e8a57301d4049d";
+      sha256 = "946fa92a4e746e6755a6af0ca404135b8ba0388f57c8abb1f69963f3cf606811";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/fur/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/fur/firefox-125.0.2.tar.bz2";
       locale = "fur";
       arch = "linux-i686";
-      sha256 = "1beae941315a6d00826433fc59949f62df76b09ae713211a5c0f455dcf77e545";
+      sha256 = "931b5d7bfc87228770624e7ce6c437337fec17e54d4f3dfd03bead3692844d43";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/fy-NL/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/fy-NL/firefox-125.0.2.tar.bz2";
       locale = "fy-NL";
       arch = "linux-i686";
-      sha256 = "43dbc9af218c1a33c5bc7d27f7a3389aa3f89aa1dd3a91e2f5552e4457f937c9";
+      sha256 = "8c0745e61f0465ce452a13ec02c13bf1fdf497e2abc66d357b3c5aaf5a8b9ac2";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ga-IE/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ga-IE/firefox-125.0.2.tar.bz2";
       locale = "ga-IE";
       arch = "linux-i686";
-      sha256 = "173325d041c4044c3055f787bd7372dc600ac6e847cc1d2294c5ea43aec0de5b";
+      sha256 = "b2c1b6dd41a56fab2f7aaf049ed4afa4af80d1458ca3b3a56f630a9f39174edc";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/gd/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/gd/firefox-125.0.2.tar.bz2";
       locale = "gd";
       arch = "linux-i686";
-      sha256 = "49560b641ba9375780d346eaf64e79228192bd3deec171858227a7889e060765";
+      sha256 = "8701d32ecd572560bf26609857a0d7af6b5946774bbb820e49a54c55e175bc83";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/gl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/gl/firefox-125.0.2.tar.bz2";
       locale = "gl";
       arch = "linux-i686";
-      sha256 = "6119b6f4befef9537ccf32a82bd968358cc7e41d975b387b350c7b04417a262d";
+      sha256 = "a85edef215b2f9beaba5b3c396cfc248157dd7819eedde7fa420b8cd306ba816";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/gn/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/gn/firefox-125.0.2.tar.bz2";
       locale = "gn";
       arch = "linux-i686";
-      sha256 = "adbbccc3b675c9dec331f9e3ac3682f78e71ed081a70d2141e28a6f4f997982c";
+      sha256 = "49a3b8909d29f5609a1da6477a43f719fe20ac178ac7d69299f8f21126f7f739";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/gu-IN/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/gu-IN/firefox-125.0.2.tar.bz2";
       locale = "gu-IN";
       arch = "linux-i686";
-      sha256 = "f74fd4955f1a53229f75a03a910a46b03ac23856de5e5dcbc24bb75941d4464d";
+      sha256 = "44ea127c78193c5dc83f5bf8e5f2adca93d91e2ccc0266ca68b9d17c8f8cbc74";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/he/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/he/firefox-125.0.2.tar.bz2";
       locale = "he";
       arch = "linux-i686";
-      sha256 = "21ea8a68afb63d58c976fa7a272fd39eaefadb20e1b15b291eca49de9b8f77b0";
+      sha256 = "2df30f0cdeed80e2d2dc1113db666b7340893fa52337d913ac6255e9823a6a2f";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/hi-IN/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/hi-IN/firefox-125.0.2.tar.bz2";
       locale = "hi-IN";
       arch = "linux-i686";
-      sha256 = "22a538fbf6445f4a02f4705098b0293ef92898d45a6bc414c4734a44d8a0fe48";
+      sha256 = "051e5df71df66353f8fe940efcffb8ec9b1586057d9118685387b713dea255d0";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/hr/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/hr/firefox-125.0.2.tar.bz2";
       locale = "hr";
       arch = "linux-i686";
-      sha256 = "ff5b46a0097a8ee17c3eda0168264b5fefdf50307d6247d36b6f141cba7a8261";
+      sha256 = "0525bb2435c8e829534886e405f4e5802641a6659ad5276980d1bf5378903436";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/hsb/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/hsb/firefox-125.0.2.tar.bz2";
       locale = "hsb";
       arch = "linux-i686";
-      sha256 = "5b7f41a5b8e1d8d6b04a14a37b7fd5cf217ba5a76cb049290a140d1f0db687c4";
+      sha256 = "902793e7d135940797a44a4285cbae3f1b3a579740f386b1de463065d566d603";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/hu/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/hu/firefox-125.0.2.tar.bz2";
       locale = "hu";
       arch = "linux-i686";
-      sha256 = "3e59352bc5ec6465d1427fd0df2e72600f690ca00674f0c9f9985f6f3f15c669";
+      sha256 = "127db71d94fd41770ffc4715d16fa2e7e9f9aed77db8ff21c566e74a3fa67931";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/hy-AM/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/hy-AM/firefox-125.0.2.tar.bz2";
       locale = "hy-AM";
       arch = "linux-i686";
-      sha256 = "223920f8993e7cf9f4c297669b7f5e953f71901ffb36b0834050b993758690a4";
+      sha256 = "6479e62315e8402655a06f6e58765c8d8b71a1635af582f32e75a06d98603ebd";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ia/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ia/firefox-125.0.2.tar.bz2";
       locale = "ia";
       arch = "linux-i686";
-      sha256 = "d6287fff698044a26cef07521208894980fa59e3a9bb11090efd44071c5ad029";
+      sha256 = "5cb8656e668d2efc8c35228640a99696afd72f23d1a3702da25b3a5e8fe9d1ec";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/id/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/id/firefox-125.0.2.tar.bz2";
       locale = "id";
       arch = "linux-i686";
-      sha256 = "c826bf9fae736c0237faa33bf07182706e0cfa9d6b0857451b0b413fd5bc921d";
+      sha256 = "acf5464fe544b9b72ac650830bb4337acc851f037f9937e0d2932e2056fe06f9";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/is/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/is/firefox-125.0.2.tar.bz2";
       locale = "is";
       arch = "linux-i686";
-      sha256 = "f512956810704495d3d5c9633f1e44e22c472d5d6bcbbae23498d00bafe96151";
+      sha256 = "28475ce33fbf59db4cb84775a2a7c39b641b3bea67dd1e7e49d5ace1878f306a";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/it/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/it/firefox-125.0.2.tar.bz2";
       locale = "it";
       arch = "linux-i686";
-      sha256 = "1db9991a709984d9e6305dd8e5e479c3b3ff2b2a272d2e4bf30b3674fd558511";
+      sha256 = "0b79a518da5b28aa74d22d3df117310c39521114b0e627d3d42bd694e06e6d90";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ja/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ja/firefox-125.0.2.tar.bz2";
       locale = "ja";
       arch = "linux-i686";
-      sha256 = "45eea70af05d2db4b7e5671bbb3ee8aa04d4121b13758848c05f810de02114e6";
+      sha256 = "e99dee56181843e5c1b1af336f1fb68c2c2eb7eeebed885c067bb57a5a62d56d";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ka/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ka/firefox-125.0.2.tar.bz2";
       locale = "ka";
       arch = "linux-i686";
-      sha256 = "6ca7b33f9c45431f5954e165afbeafb53aebb806f867a5be0598f01985187de7";
+      sha256 = "a4657d7a0f8e2c445837cb42171780fa221ea528eddb7d17d23ba3afbd7592c5";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/kab/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/kab/firefox-125.0.2.tar.bz2";
       locale = "kab";
       arch = "linux-i686";
-      sha256 = "284be383240c84325812f4c5342559093af20d0f77f4e833381b285f6af71860";
+      sha256 = "b36b00e250f6b1f1abbd816f7e0038f711b75e5a017bee285c3fa2995ac1ebc4";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/kk/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/kk/firefox-125.0.2.tar.bz2";
       locale = "kk";
       arch = "linux-i686";
-      sha256 = "b1347910af157cb22a5227cd3d32cce6bf658b8a540c220e66b6b2cf77853907";
+      sha256 = "f66c2b7364f0b2742efe8e532dca7884b72a2811b72e3b0de0d8260ae007ec92";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/km/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/km/firefox-125.0.2.tar.bz2";
       locale = "km";
       arch = "linux-i686";
-      sha256 = "1c5c7b371eec2d2f5cf40278bbbd259b3d0577c9c159b56bd5a7dc62f6c9fa4e";
+      sha256 = "d137d33268cb376423d4395be1193af2bb73bee0e0b7726abe7e70d7b6d96ed5";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/kn/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/kn/firefox-125.0.2.tar.bz2";
       locale = "kn";
       arch = "linux-i686";
-      sha256 = "d7c74aa01bf368cae66f0751dc2efd2572ced0fef672a54e0ec509640084a7fb";
+      sha256 = "ac3aff36240512506a51543a9766bd85a796a2fb137666207fe221a0e17152e1";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ko/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ko/firefox-125.0.2.tar.bz2";
       locale = "ko";
       arch = "linux-i686";
-      sha256 = "6e479b43e1c7f77084ed8f34f934a5a551ffba7156f2898186acd8d78bfe8b51";
+      sha256 = "2af68d3e380de18efc36937193dfaadd8c438be39b45a297edf3fd9c73fff7be";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/lij/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/lij/firefox-125.0.2.tar.bz2";
       locale = "lij";
       arch = "linux-i686";
-      sha256 = "2fa2fcf25b2e309e46f1f5c14ba2aa311151d8b4c69570a7fd1b60b21728d249";
+      sha256 = "5c708d6c2c1b55b90c0728c7567132c61b6ceb64ed0c7be71c26218653e143bf";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/lt/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/lt/firefox-125.0.2.tar.bz2";
       locale = "lt";
       arch = "linux-i686";
-      sha256 = "cc1cc039ea23c4a43443436941e077d621a428f532f81be4983517993ebd37b4";
+      sha256 = "7f2e33013772b3bf042415c45c1d75d407fe007167f628dcd14aaecc6855f088";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/lv/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/lv/firefox-125.0.2.tar.bz2";
       locale = "lv";
       arch = "linux-i686";
-      sha256 = "ebb199a86117fefe8541411e7696adb7bb49c4b3a26d20d2a2977f6ba8b2cc57";
+      sha256 = "1a736f61f8ca876ea12221fb23c54d3166f9c4d0edbe90839300ed1fef7d4c92";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/mk/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/mk/firefox-125.0.2.tar.bz2";
       locale = "mk";
       arch = "linux-i686";
-      sha256 = "e22008d118358c56aabbe8ef2ac9843a38a7ed8088bbd042045271b9a065881a";
+      sha256 = "c688a25f9113b2c688da4f4e9290f30a1fd2d2a23b54dadefb219f5d95d30bc2";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/mr/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/mr/firefox-125.0.2.tar.bz2";
       locale = "mr";
       arch = "linux-i686";
-      sha256 = "aaf53f2983d192b7985daa596b6e99ddc7b382bdcb30149eb66c56c7c7f02188";
+      sha256 = "b46aabecf664d093a1928f6004d21dc81b2ffc195926652f6af276661900abd4";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ms/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ms/firefox-125.0.2.tar.bz2";
       locale = "ms";
       arch = "linux-i686";
-      sha256 = "426441bda00b7079cc8a0c1373e3eeb487b686888a4b61c1752db8b6dc472af0";
+      sha256 = "22efdbdc9ea35b8d9fe3f26f08a971361c4931abec59758f077a6d12e6f6f4fa";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/my/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/my/firefox-125.0.2.tar.bz2";
       locale = "my";
       arch = "linux-i686";
-      sha256 = "77b809bf0a100312882793e4308a5edfe82944b934574b136119af6e8333b111";
+      sha256 = "c4577d22565386ce731612103ee797d8a01df494cab95442d412cb2163a012ca";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/nb-NO/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/nb-NO/firefox-125.0.2.tar.bz2";
       locale = "nb-NO";
       arch = "linux-i686";
-      sha256 = "129a28f32f3b9b9b01d24e62fb08629f1dc44e98b98741074d11eb6dfa4f8d0a";
+      sha256 = "dfe7b1164522e0d16444efec1f59269fef971d0362cbfe9f612f7fa5cad7c88f";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ne-NP/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ne-NP/firefox-125.0.2.tar.bz2";
       locale = "ne-NP";
       arch = "linux-i686";
-      sha256 = "c56002de914665040ec4c737bc6432ca8537b369a00125fd6496511a2cad6bd8";
+      sha256 = "6686fdc0c953696a0d33dd52d30ade52bd8c9eb3f0ece2c2c0c05aacba0e5e6b";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/nl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/nl/firefox-125.0.2.tar.bz2";
       locale = "nl";
       arch = "linux-i686";
-      sha256 = "c3061e5cfd0ceb7b4080ad9feb8ce7abb24511a1e0acfc658bcc89f06b2115b5";
+      sha256 = "122d6f234ae9b8459117e64658ca322e98d19a2c52df92d6152baf9b36aea82a";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/nn-NO/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/nn-NO/firefox-125.0.2.tar.bz2";
       locale = "nn-NO";
       arch = "linux-i686";
-      sha256 = "e9885e43e143208f22f43d21aeb562860765565e6d30709d75b9e207d7cf82ae";
+      sha256 = "d1db5f3b8433275b521e3f51afdd62180ae255446f199bd5a474a59a30fa432c";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/oc/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/oc/firefox-125.0.2.tar.bz2";
       locale = "oc";
       arch = "linux-i686";
-      sha256 = "6595d4b9adbbc97c4a712d22aa86260fa186fcf32b86c6f8e1b90d2e26181dbc";
+      sha256 = "9175fb84d455f5f3b31d3dc646451644c12df19f930420e7e408e89ed86e595c";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/pa-IN/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/pa-IN/firefox-125.0.2.tar.bz2";
       locale = "pa-IN";
       arch = "linux-i686";
-      sha256 = "4d75bcf2e127ed624df0a3eef9430210d5206f9029f7265038e2560a5e1a855e";
+      sha256 = "bdf66cc8ecd0f924f0dafba2e242f696fe9be86a7e69d67d44aba4e4868da951";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/pl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/pl/firefox-125.0.2.tar.bz2";
       locale = "pl";
       arch = "linux-i686";
-      sha256 = "29f243936df126b1be089827e03354eab81a70d1d1d324bcf01d68a2406f514f";
+      sha256 = "3595e0cc555c55f28f5bec95959517ac6687421319aeb549c15bf50faa38b43d";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/pt-BR/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/pt-BR/firefox-125.0.2.tar.bz2";
       locale = "pt-BR";
       arch = "linux-i686";
-      sha256 = "bd3795069fbcf3d945dcb9c2c9c2ab2dc6a263367e9fcc8261af2a77d6eb5da2";
+      sha256 = "bf5ea226f5bf1c4113ef0d6885a1b74af83f38591972ee4d2c6d1063869a934d";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/pt-PT/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/pt-PT/firefox-125.0.2.tar.bz2";
       locale = "pt-PT";
       arch = "linux-i686";
-      sha256 = "005b2667bbc30560d63f8c832651063016b8b166b8f40f777d459a3b255887de";
+      sha256 = "54e2d124625715c63c224b8914f53a1e06052ad7bd9c06acaaaa0b61a996f018";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/rm/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/rm/firefox-125.0.2.tar.bz2";
       locale = "rm";
       arch = "linux-i686";
-      sha256 = "78e5cff6bd1a34082413f6e716220ecae38f6eb06f2bbf61e653504bc3e91034";
+      sha256 = "24371d9664b00363d02e3881b89e86732f53e9bd989b5fca2a2a70c9d998b836";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ro/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ro/firefox-125.0.2.tar.bz2";
       locale = "ro";
       arch = "linux-i686";
-      sha256 = "1f545495f57236c10358755ee7a51accbb9e2a9b8e5d5c1d1801db8d040194d2";
+      sha256 = "7a47f911a297375cd3bcf407f876c56c6cb88ca5020d218cf4077c780c1732e7";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ru/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ru/firefox-125.0.2.tar.bz2";
       locale = "ru";
       arch = "linux-i686";
-      sha256 = "0edddacf79110ebeac3b1894b049deb6b7b0d2e3705c09d181b1a43a5362c3ef";
+      sha256 = "fc5ad6b89224b862b586692bf3536205786c90230c595cda8e8b37c64839aa27";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/sat/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/sat/firefox-125.0.2.tar.bz2";
       locale = "sat";
       arch = "linux-i686";
-      sha256 = "e0523ca21774ffb3a9e5f2bc39b42f1b8c76370f55ff9220365ad825bc360481";
+      sha256 = "bbfd0aaee2266aae2a0b30f2b35770eb2fb51e46dba75d737aadbb31da243d39";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/sc/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/sc/firefox-125.0.2.tar.bz2";
       locale = "sc";
       arch = "linux-i686";
-      sha256 = "e2aadb90aec3e60caedf38513437ab6cb66a91ecdf7da3a90f3849f9949f22f2";
+      sha256 = "c09414e2609fbbe64157c2ed19a8f4b079a35847a4b418d84451a813b5b8dd63";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/sco/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/sco/firefox-125.0.2.tar.bz2";
       locale = "sco";
       arch = "linux-i686";
-      sha256 = "2bbca54be46a4ac85a8d0622b6a8acd74df8812ed089320797ed3a7aa43c9ac3";
+      sha256 = "c2a8ba393c85956e7e9b4f778b7a6d15bb6ccfd3784e3e0f25d8ab0cbea53dec";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/si/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/si/firefox-125.0.2.tar.bz2";
       locale = "si";
       arch = "linux-i686";
-      sha256 = "dcd127679d6104a58f91602034b4d963fe78344ec2183ac06f384b106c3dc8ec";
+      sha256 = "431670b3f074ad1cfb91033cd115b7d7dc0145a138fa7ec258afa8ea9de8759a";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/sk/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/sk/firefox-125.0.2.tar.bz2";
       locale = "sk";
       arch = "linux-i686";
-      sha256 = "05dbc0c1f3a93f06441ba662d0a926ea5bff4571bb2f5609f226de1fbd83b8b4";
+      sha256 = "0022b74c8688325113aff06ddcad2a008195c093a86b26c0344a6c5377a990f9";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/sl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/sl/firefox-125.0.2.tar.bz2";
       locale = "sl";
       arch = "linux-i686";
-      sha256 = "c6f8414ed1945d7c5be50d8129b9218ad9ca64b0d614861f222603ee1be55331";
+      sha256 = "ee6eb7ece377119e362c2ffc85ea6ac9f7a03ded3ae44b148f73e708600ccf40";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/son/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/son/firefox-125.0.2.tar.bz2";
       locale = "son";
       arch = "linux-i686";
-      sha256 = "fc81b41ded7bd0fe499f8027cdd4326f6d92e273e438ac4ba903f3aa92a137ef";
+      sha256 = "17075b61d96ce5bf6e9d5131c00c4cee84a3bf97e81a0672ca292c8c24318006";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/sq/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/sq/firefox-125.0.2.tar.bz2";
       locale = "sq";
       arch = "linux-i686";
-      sha256 = "d57fc39e623000134c8aa00b393825c3ff4453df1ea07d5f8d7bb644dafc60cb";
+      sha256 = "758b50ad050464f67afe3615826b2e8c36ef852f911abb3f85dba198b452e9f9";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/sr/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/sr/firefox-125.0.2.tar.bz2";
       locale = "sr";
       arch = "linux-i686";
-      sha256 = "3935f39340fdda61fd0626479ff176aad5921edca685d199e2ce2a5342784b39";
+      sha256 = "b63320cdac54d79d9c192df4732f63795718bd72a8d69a7b08d03a444d913d44";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/sv-SE/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/sv-SE/firefox-125.0.2.tar.bz2";
       locale = "sv-SE";
       arch = "linux-i686";
-      sha256 = "38e52f809689661c454fc70ae65a9ea354f73131b6ac1eb7ab9e94cc44b96ff0";
+      sha256 = "bfc3854d763a26231884c31e938ab699fc267eaada2fba59825ae4978addb6ea";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/szl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/szl/firefox-125.0.2.tar.bz2";
       locale = "szl";
       arch = "linux-i686";
-      sha256 = "1ab9988991e8553db48df8bba87646ca3ae9254914207758899143e772729bc5";
+      sha256 = "59142a86da4d79a9045e3402f5dc08ad1bb4fd0da19c38678e23ec28fe0d17e9";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ta/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ta/firefox-125.0.2.tar.bz2";
       locale = "ta";
       arch = "linux-i686";
-      sha256 = "120428f8e2827d3283dcb0b2886e05a0ef84797656075ed160386c4aae5d9e53";
+      sha256 = "10f81b53ab382c3d886cccdcbc358d88913047c2d3b46f3b5ede8e6e37e49f4b";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/te/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/te/firefox-125.0.2.tar.bz2";
       locale = "te";
       arch = "linux-i686";
-      sha256 = "9f8272b1dbc34d7861130e76f5e72398e8038009eb3937e332a7b7b739a2892c";
+      sha256 = "cfc670b083d0833f12009fb7a5900005b587f8810703fe1524eff4a8d7324924";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/tg/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/tg/firefox-125.0.2.tar.bz2";
       locale = "tg";
       arch = "linux-i686";
-      sha256 = "1a13f73a74d2c42d602ca0b88275c6b49b7b98cc56f363bc460a108e7cc9a33f";
+      sha256 = "85639be530c9646f3585da1e016baaa5da94ea5f013fb000e9701f24ef0f1a6f";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/th/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/th/firefox-125.0.2.tar.bz2";
       locale = "th";
       arch = "linux-i686";
-      sha256 = "e07e9bd213ec0357c90c400e336b040987814c4105afd111235464695fed1101";
+      sha256 = "fad792259e305d54f79a96cb7531a1715e005550a38f1270c8c7c87bfafde1f6";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/tl/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/tl/firefox-125.0.2.tar.bz2";
       locale = "tl";
       arch = "linux-i686";
-      sha256 = "a14daf411cde7285c8f488f8c185171bf3b2efc3cc8adbba801c09a3b3765320";
+      sha256 = "3e99c9479f4b3cf56b50c42b8795a6b33fbbc691fa590a37154e7cce060e4a86";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/tr/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/tr/firefox-125.0.2.tar.bz2";
       locale = "tr";
       arch = "linux-i686";
-      sha256 = "2163257dd10892967378152ba2c6fe8165d09a219a897bd04a30bca7711bd030";
+      sha256 = "ed87d470ba9002b8dad1602903a7e09ffbfc060f07a18c0add678b598734c375";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/trs/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/trs/firefox-125.0.2.tar.bz2";
       locale = "trs";
       arch = "linux-i686";
-      sha256 = "a16e68ce428af8d6f87923ce2ce6b5c71b3d82e8b78faf2fdb00fec57b77798d";
+      sha256 = "06828e917ef4af7d21e9f029089786c83e8fd68566791fe7e4c3864e86c3e6f5";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/uk/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/uk/firefox-125.0.2.tar.bz2";
       locale = "uk";
       arch = "linux-i686";
-      sha256 = "ea8fea7dbc06fbaecb6ec9a195c5b7f77a8f724bd66affcaea62ff41a9c390e9";
+      sha256 = "b25acede364fe39902fa28246598f98f84a7dc3165360aa9c64cf1561fa15ef6";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/ur/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/ur/firefox-125.0.2.tar.bz2";
       locale = "ur";
       arch = "linux-i686";
-      sha256 = "a12d6f1533431c63acc0e5cdd18d0d3a220f43be15d821acb1fa846d1103031b";
+      sha256 = "a4cea15d11709f4d6dcbded2dc4148a0fb898714ccc25a04cbcbbcd95ee71cc5";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/uz/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/uz/firefox-125.0.2.tar.bz2";
       locale = "uz";
       arch = "linux-i686";
-      sha256 = "b456de99139122e04e1f0c08978517353fbdc984cf4b9fdd733a02f6011a060f";
+      sha256 = "0391b07c6610249fdb6b9d97f7740be9eef58e17839226aec92824288c470f27";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/vi/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/vi/firefox-125.0.2.tar.bz2";
       locale = "vi";
       arch = "linux-i686";
-      sha256 = "11b6b4ae3b754ba5b11156f61fa60380edb6ce921359007c1fd51f20f7713415";
+      sha256 = "a5ae2a1f2742cccddee2b5f38410420c70819bc50690036f70751cd167652148";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/xh/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/xh/firefox-125.0.2.tar.bz2";
       locale = "xh";
       arch = "linux-i686";
-      sha256 = "f3e63830176c6525145a609429c352ec385a3a9a3d9822d6f12fe72ac43ea04c";
+      sha256 = "ecfb3185448cb3f41dc1cf0ac21cdb44bfb01c26a84630376090749c8148af5a";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/zh-CN/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/zh-CN/firefox-125.0.2.tar.bz2";
       locale = "zh-CN";
       arch = "linux-i686";
-      sha256 = "3e8e26fb66b7907717dc4fcc38200dc3816b2b7fad72dd9d3d56fc768eb76f32";
+      sha256 = "4b4fdcf285ac82083c4b1ca18d91884bceaf9fdbf407266a6aade2ecf7f3c6ba";
     }
-    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.1/linux-i686/zh-TW/firefox-125.0.1.tar.bz2";
+    { url = "https://archive.mozilla.org/pub/firefox/releases/125.0.2/linux-i686/zh-TW/firefox-125.0.2.tar.bz2";
       locale = "zh-TW";
       arch = "linux-i686";
-      sha256 = "d35306938344fec0b926b9bb732534e9afa72798fe4d63da2e878bd50f0900c0";
+      sha256 = "8f3be757fb5212e849a31a98f7b1ec874a19d14e8d9af186d36c070759005e23";
     }
     ];
 }
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index bcf14cd15a5d8..bf342444c99b3 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -3,10 +3,10 @@
 {
   firefox = buildMozillaMach rec {
     pname = "firefox";
-    version = "125.0.1";
+    version = "125.0.2";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "6f2f336de8b0ec9cb19ba20c909407b7b88c0319ee3b2f1f3429133516b0c45b4c7846f287985a0cdb9f34acc7d5378ed14fb48e26bef113c8ac360501a30c4d";
+      sha512 = "f6d5fff7c5c532d2e41a246d0403bdd746981cfcb7c43f9d3d8ec85a7acc3310a52043d1e18848475cef1b63c24769e81b2b06d68ae007b68016ee51436032f1";
     };
 
     extraPatches = [
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 81beb044083ac..593f70afe4218 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,15 +1,15 @@
 {
-  "packageVersion": "124.0.2-1",
+  "packageVersion": "125.0.1-1",
   "source": {
-    "rev": "124.0.2-1",
-    "sha256": "0qh40l1pif0b6n1amiw18pr13gvmi7rjd89q6n1qz8y14yf9w5xp"
+    "rev": "125.0.1-1",
+    "sha256": "1h2x08gdpw3bldmfkws5qafp73r4w11a7ad3xc6flyg96b8a6h4f"
   },
   "settings": {
-    "rev": "8a499ecdab8a5136faee50aae1fdd48997711de6",
-    "sha256": "1c12y7b09rrz8zlpar8nnd9k2nvldjqq3cicbc57g6s1npnf8rz6"
+    "rev": "6b2b6a89fc15a705388955e4d1375f453d8cdc89",
+    "sha256": "0yginhc8pn00k1gh8h7bzvrl4vi2wimbmrrgnmvvblv28bxhwnh0"
   },
   "firefox": {
-    "version": "124.0.2",
-    "sha512": "8cf340de6e34812f8ae3363265859a263330af770d981c3dd1ca1e7e0cfe513604d3e68184d4aa1446569aefbdf359d561fbc200faf19a5ed020a1709d9ef10e"
+    "version": "125.0.1",
+    "sha512": "6f2f336de8b0ec9cb19ba20c909407b7b88c0319ee3b2f1f3429133516b0c45b4c7846f287985a0cdb9f34acc7d5378ed14fb48e26bef113c8ac360501a30c4d"
   }
 }
diff --git a/pkgs/applications/networking/cluster/hubble/default.nix b/pkgs/applications/networking/cluster/hubble/default.nix
index 49d1b10bf3fdf..76b53453dac9f 100644
--- a/pkgs/applications/networking/cluster/hubble/default.nix
+++ b/pkgs/applications/networking/cluster/hubble/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hubble";
-  version = "0.13.2";
+  version = "0.13.3";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0SCuQzRwluowF48lzyLxY+0rvTOyDbpkMI7Iwb6GHJo=";
+    sha256 = "sha256-tHkLUoccOUcUjODecy1QyeuDb/aXv67sK8JHJ1IspC8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/k3s/README.md b/pkgs/applications/networking/cluster/k3s/README.md
index 9e3c32623ac3f..c01a9ceab817f 100644
--- a/pkgs/applications/networking/cluster/k3s/README.md
+++ b/pkgs/applications/networking/cluster/k3s/README.md
@@ -75,11 +75,11 @@ This would allow someone to upgrade between those NixOS releases in a supported
 
 ## K3s upkeep for nixpkgs maintainers
 
-* A `nixos-stable` release triggers the need of re-setting K3s versions in `nixos-unstable` branch to a single K3s version. After every `nixos-stable` release, K3s maintainers should remove all K3s versions in `nixos-unstable` branch but the latest. While `nixos-stable` keeps the multiple K3s versions necessary for a smooth upgrade to `nixos-unstable`.
+* After every nixos release, K3s maintainers should remove from `nixos-unstable` all K3s versions that exist in `nixos-stable` except the latest version (to allow decoupling system upgrade from k3s upgrade).
 
 * Whenever adding a new major/minor K3s version to nixpkgs:
   - update `k3s` alias to the latest version.
-  - add a NixOS release note scheduling the removal of all K3s packages but the latest
+  - add a NixOS release note scheduling the removal of deprecated K3s packages
   - include migration information from both Kubernetes and K3s projects
 
 * For version patch upgrades, use the K3s update script.
@@ -111,4 +111,4 @@ This would allow someone to upgrade between those NixOS releases in a supported
 
   - Read the nix build logs to check for anything unusual. (Obvious but underrated.)
 
-* Thank you for reading the documentation and your continued contribution.
+* Thanks for reading the documentation and your continued contribution.
diff --git a/pkgs/applications/networking/cluster/kubectl-klock/default.nix b/pkgs/applications/networking/cluster/kubectl-klock/default.nix
index 044e12837c9d2..06ede90ffb67c 100644
--- a/pkgs/applications/networking/cluster/kubectl-klock/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-klock/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "kubectl-klock";
-  version = "0.5.1";
+  version = "0.6.1";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "applejag";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-q7Wq1mTjOB7tT66+LWIwwqltQcQSHD/VHLO7nCTZTQ0=";
+    hash = "sha256-QzleoHRQ/A5ImMl43kze5ppUdiLa4n/VT02lMnaXVkg=";
   };
 
-  vendorHash = "sha256-3CJ/tmFFkmq6wHxbqk8u+GxxbSrUpB/JD5s/S7hegB8=";
+  vendorHash = "sha256-smE8mdyZ8xJOevgHs4+ozS6VOlko+Whhs/37B+hIbxo=";
 
   postInstall = ''
     makeWrapper $out/bin/kubectl-klock $out/bin/kubectl_complete-klock --add-flags __complete
diff --git a/pkgs/applications/networking/cluster/kubefirst/default.nix b/pkgs/applications/networking/cluster/kubefirst/default.nix
index 01f05ba65ac94..e4d704d6ff27d 100644
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "kubefirst";
-  version = "2.4.3";
+  version = "2.4.5";
 
   src = fetchFromGitHub {
     owner = "kubefirst";
     repo = "kubefirst";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wxIXXCB7+s3RfDjSxwlp0BBTZMb/9GFZ7cYm7L471U8=";
+    hash = "sha256-CkssgMr/4VGNQHyvaPnXBOf6HdExnhB7MjpJ3yQ9kfI=";
   };
 
   vendorHash = "sha256-ZcZl4knlyKAwTsiyZvlkN5e2ox30B5aNzutI/2UEE9U=";
diff --git a/pkgs/applications/networking/cluster/kubelogin/default.nix b/pkgs/applications/networking/cluster/kubelogin/default.nix
index b2fa146b0bc30..b52a4887824cb 100644
--- a/pkgs/applications/networking/cluster/kubelogin/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JBP2lE1/46VB/oKgDlNTQ8RFpgIlQE0If5vND7dzo7A=";
+    sha256 = "sha256-mQSQrcLzEZqNpXNuZFCVk3FRcfkrtvN19VhwqyrmwIU=";
   };
 
-  vendorHash = "sha256-EwL/aiq2jyojM1r7wNZkA07TswHy6MLUUPQJFnaDG4A=";
+  vendorHash = "sha256-Xh4htBknBW59xdJVYw7A7BT2GB5WW8SnV05is7dWAS8=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/applications/networking/cluster/kubevpn/default.nix b/pkgs/applications/networking/cluster/kubevpn/default.nix
index 13b45f748ab73..14df6fa5c47d0 100644
--- a/pkgs/applications/networking/cluster/kubevpn/default.nix
+++ b/pkgs/applications/networking/cluster/kubevpn/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubevpn";
-  version = "2.2.5";
+  version = "2.2.6";
 
   src = fetchFromGitHub {
     owner  = "KubeNetworks";
     repo   = "kubevpn";
     rev    = "v${version}";
-    hash = "sha256-I4szQNRBW3M+QNwsfkJZlrZL3jJXcXmD2KnFF/E+jaE=";
+    hash = "sha256-Z+IXSmN1V0xRnhE/PpWv9dQIwfTztJRYaftY9KCIucc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/linkerd/edge.nix b/pkgs/applications/networking/cluster/linkerd/edge.nix
index e268dadd262dd..f40dc62474764 100644
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "edge";
-  version = "24.4.2";
-  sha256 = "0apwhbcnghy7b9kwalbhcgvgcrwv6s55gzlgax55qaa5lxm6r6yz";
+  version = "24.4.4";
+  sha256 = "07p4cgl4myv7kv9pxvxrvsqnl3vkd9ay5hngx5g6xds2sc8va306";
   vendorHash = "sha256-bLTummNoDfGMYvtfSLxICgCFZEymPJcRWkQyWOSzKR8=";
 }
diff --git a/pkgs/applications/networking/cluster/pachyderm/default.nix b/pkgs/applications/networking/cluster/pachyderm/default.nix
index 4d5736724aad0..451e209a7b36f 100644
--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pachyderm";
-  version = "2.9.3";
+  version = "2.9.4";
 
   src = fetchFromGitHub {
     owner = "pachyderm";
     repo = "pachyderm";
     rev = "v${version}";
-    hash = "sha256-4ER0kjp3H5B2TrR4pI3XMvmtGrUv5ZuSM8dbDeufm2s=";
+    hash = "sha256-RF8JEmZpvUf8w89wRa+d3ItMFnInEoxxQzLJvrx1mZE=";
   };
 
-  vendorHash = "sha256-+0Df3pelty9mE1E8V+4L99/SrGK5msWn68LeB0nmAIA=";
+  vendorHash = "sha256-bAB2vMPHIcJaMobPukQyKiCq0Af0n4b5mjImTswGFTo=";
 
   subPackages = [ "src/server/cmd/pachctl" ];
 
diff --git a/pkgs/applications/networking/cluster/pv-migrate/default.nix b/pkgs/applications/networking/cluster/pv-migrate/default.nix
index b55510e7e4cfa..c2d38e2a7c893 100644
--- a/pkgs/applications/networking/cluster/pv-migrate/default.nix
+++ b/pkgs/applications/networking/cluster/pv-migrate/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "pv-migrate";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "utkuozdemir";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xbg32ckxAUQkkN/yumHz4v1U4FvUcmx5ftd3+4zc3/c=";
+    sha256 = "sha256-HeK8/IZTqkrJxfmNIYOm8/jY3Fbof8t7/emdHONvMZo=";
   };
 
   subPackages = [ "cmd/pv-migrate" ];
 
-  vendorHash = "sha256-AqR9Gy8sAX4wrKGPnQUj33juBOfhUn0BR8OyJPiDrO0=";
+  vendorHash = "sha256-q8/Rb26ZY/Rn3FnESnAvPr+LrIvFFlSJnN6c0k8+sHg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/velero/default.nix b/pkgs/applications/networking/cluster/velero/default.nix
index 4cb8bc0ad40df..8a39c31f11d9e 100644
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "velero";
-  version = "1.13.1";
+  version = "1.13.2";
 
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "velero";
     rev = "v${version}";
-    sha256 = "sha256-Fz3FqNj2NbqU9CvtdjM8cjkZh5xLCA+AAIF/QgLJ7UA=";
+    sha256 = "sha256-Dqz8UFoGb5uG5f8mrIUIRWJUYH/ZuFavhRy2wie75/Q=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
   ];
 
-  vendorHash = "sha256-Fu4T2VEW5s/KCdgJLk3bf0wIUhKULK6QuNEmL99MUCI=";
+  vendorHash = "sha256-L1QTqw0L/aE4bFlLWg4/mmdHL7Sb5EsT3eL0jZIpBsA=";
 
   excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix b/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
index 9777dca11c59f..841df5a4cd610 100644
--- a/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
@@ -1,6 +1,10 @@
 { lib
+, stdenv
+, darwin
 , fetchFromGitHub
+, rust
 , rustPlatform
+, cargo-tauri
 , cinny
 , copyDesktopItems
 , wrapGAppsHook
@@ -16,6 +20,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cinny-desktop";
+  # We have to be using the same version as cinny-web or this isn't going to work.
   version = "3.1.0";
 
   src = fetchFromGitHub {
@@ -37,33 +42,48 @@ rustPlatform.buildRustPackage rec {
   in ''
     substituteInPlace tauri.conf.json \
       --replace '"distDir": "../cinny/dist",' '"distDir": "${cinny'}",'
-
+    substituteInPlace tauri.conf.json \
+      --replace '"cd cinny && npm run build"' '""'
+  '' + lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
       --replace "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
   '';
 
-  postInstall = ''
+  postBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    cargo tauri build --bundles app --target "${rust.envVars.rustHostPlatform}"
+  '';
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     install -DT icons/128x128@2x.png $out/share/icons/hicolor/256x256@2/apps/cinny.png
     install -DT icons/128x128.png $out/share/icons/hicolor/128x128/apps/cinny.png
     install -DT icons/32x32.png $out/share/icons/hicolor/32x32/apps/cinny.png
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications/"
+    cp -r "target/${rust.envVars.rustHostPlatform}/release/bundle/macos/Cinny.app" "$out/Applications/"
+    ln -sf "$out/Applications/Cinny.app/Contents/MacOS/Cinny" "$out/bin/cinny"
   '';
 
   nativeBuildInputs = [
     copyDesktopItems
     wrapGAppsHook
     pkg-config
+    cargo-tauri
   ];
 
   buildInputs = [
     openssl
     dbus
     glib
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
     glib-networking
     libayatana-appindicator
     webkitgtk
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.DarwinTools
+    darwin.apple_sdk.frameworks.WebKit
   ];
 
-  desktopItems = [
+  desktopItems = lib.optionals stdenv.hostPlatform.isLinux [
     (makeDesktopItem {
       name = "cinny";
       exec = "cinny";
@@ -77,9 +97,9 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Yet another matrix client for desktop";
     homepage = "https://github.com/cinnyapp/cinny-desktop";
-    maintainers = [ ];
+    maintainers = with maintainers; [ qyriad ];
     license = licenses.agpl3Only;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     mainProgram = "cinny";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index f2d0e55e18716..7211d540896b4 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,14 +2,14 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.49";
-      ptb = "0.0.78";
-      canary = "0.0.346";
+      stable = "0.0.50";
+      ptb = "0.0.80";
+      canary = "0.0.357";
       development = "0.0.17";
     } else {
-      stable = "0.0.300";
-      ptb = "0.0.107";
-      canary = "0.0.468";
+      stable = "0.0.301";
+      ptb = "0.0.109";
+      canary = "0.0.477";
       development = "0.0.39";
     };
   version = versions.${branch};
@@ -17,15 +17,15 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-rVSYAkTZTlurnbUeYJFCgsPcsCqjJ1bJneQQiyhmvwQ=";
+        hash = "sha256-6VXdVLk7Z8NGQMiSdgBRd8NIueUktkId6BXYKNABb+4=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-Fp94BsR6Fzy4tV+c5ToP9GKg6GC/TryGvHWLupew4Z8=";
+        hash = "sha256-y/ntnHIYcY35Jszh0PrFy395eJ5dBWwLNpzHMoSZuNA=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-/FBVo3ptZk2YQPoq+VpyxMlSWYlVb8ChpKW5YH/BM7U=";
+        hash = "sha256-sDwC5kPzAfvQmsrq6M/GPFtUaT9pNAEB4uGI5Mn3oXs=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -35,15 +35,15 @@ let
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-f9YIlzRESzzxtD9/us1DY5acu2HYo+UrwS7GWk9RwCk=";
+        hash = "sha256-h7C1wCKtUGcMFUhoKVdD7Vq9TGUaXfmjlVhwmRdhqYw=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-etxXrO9Ksacbdes3DT1Tm4kKD/t40jGUeSAegdexRqc=";
+        hash = "sha256-xxLnzELuI0X2r/weP1K2Bb51uRh1JjR72p7cXzy12Kc=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-UOoXDwAa5pFukqTCmUfM89QVK5jB13id8ek/gwWajMM=";
+        hash = "sha256-xEDtEtZNhOTtz+zRLLQBSeLbntlVAVQsocAGyAaVePM=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index 3fcbfcbf4649c..db8a8be7a8718 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -16,7 +16,6 @@
 , AppKit
 , CoreServices
 , desktopToDarwinBundle
-, libnotify
 , useKeytar ? true
 }:
 
@@ -79,11 +78,6 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
   '';
 
   installPhase =
-    let
-      libPath = lib.makeLibraryPath [
-        libnotify
-      ];
-    in
   ''
     runHook preInstall
 
@@ -111,7 +105,6 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
     # LD_PRELOAD workaround for sqlcipher not found: https://github.com/matrix-org/seshat/issues/102
     makeWrapper '${electron}/bin/electron' "$out/bin/${executableName}" \
       --set LD_PRELOAD ${sqlcipher}/lib/libsqlcipher.so \
-      --set LD_LIBRARY_PATH "${libPath}" \
       --add-flags "$out/share/element/electron" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
 
diff --git a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
index 318f7a11c54bf..83a3b78e1d4bd 100644
--- a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
@@ -10,7 +10,6 @@
 , libXtst
 , zlib
 , electron
-, pipewire
 }:
 
 buildNpmPackage rec {
@@ -72,7 +71,6 @@ buildNpmPackage rec {
 
     makeWrapper ${lib.getExe electron} $out/bin/jitsi-meet-electron \
         --add-flags $out/share/jitsi-meet-electron/resources/app.asar \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ pipewire ]} \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
         --inherit-argv0
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
index 2e13a66377358..62b6e1c9a4847 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop-beta";
   dir = "Signal Beta";
-  version = "7.4.0-beta.2";
+  version = "7.6.0-beta.3";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-oBkZ9BaKbmosTkC/OZFjt6PmU/9XqclyzbllwYPj3Q4=";
+  hash = "sha256-BbXogNB2BxFQTpvHw0JVOaCV2PQHEQbafSavVcBd/Fg=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
index 0d4d46be06b4a..130508f95e30b 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "7.4.0";
+  version = "7.5.1";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-9a8Y8ncatynKspC/q0YxUWJj+nENr1ArwCZA9Ng8Mxk=";
+  hash = "sha256-afKR+P2YPkv4OMIr8LzWeAMZWr0zaJ1R0BQD87gQuSk=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index 6c976fdd0a433..f59b9c3774bc6 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -9,9 +9,6 @@
 , fetchYarnDeps
 , fixup-yarn-lock
 , electron
-, libnotify
-, libpulseaudio
-, pipewire
 , alsa-utils
 , which
 , testers
@@ -72,11 +69,10 @@ stdenv.mkDerivation (finalAttrs: {
     done
     popd
 
-    # Linux needs 'aplay' for notification sounds, 'libpulse' for meeting sound, 'libpipewire' for screen sharing and 'libnotify' for notifications
+    # Linux needs 'aplay' for notification sounds
     makeWrapper '${electron}/bin/electron' "$out/bin/teams-for-linux" \
       ${lib.optionalString stdenv.isLinux ''
         --prefix PATH : ${lib.makeBinPath [ alsa-utils which ]} \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio pipewire libnotify ]} \
       ''} \
       --add-flags "$out/share/teams-for-linux/app.asar" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
diff --git a/pkgs/applications/networking/instant-messengers/webcord/default.nix b/pkgs/applications/networking/instant-messengers/webcord/default.nix
index d2796142e8f7d..aebe2998bd277 100644
--- a/pkgs/applications/networking/instant-messengers/webcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webcord/default.nix
@@ -3,9 +3,6 @@
 , fetchFromGitHub
 , copyDesktopItems
 , python3
-, pipewire
-, libpulseaudio
-, libnotify
 , xdg-utils
 , electron_29
 , makeDesktopItem
@@ -42,11 +39,6 @@ buildNpmPackage rec {
   # override installPhase so we can copy the only folders that matter
   installPhase =
     let
-      libPath = lib.makeLibraryPath [
-        libpulseaudio
-        pipewire
-        libnotify
-      ];
       binPath = lib.makeBinPath [ xdg-utils ];
     in
   ''
@@ -62,7 +54,6 @@ buildNpmPackage rec {
 
     # Add xdg-utils to path via suffix, per PR #181171
     makeWrapper '${lib.getExe electron_29}' $out/bin/webcord \
-      --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/webcord \
       --suffix PATH : "${binPath}" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
       --add-flags $out/lib/node_modules/webcord/
diff --git a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
index 9aaba98710e30..4109c5f04cf27 100644
--- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
@@ -26,19 +26,19 @@ let
   pname = "wire-desktop";
 
   version = let
-    x86_64-darwin = "3.32.4589";
+    x86_64-darwin = "3.35.4861";
   in {
     inherit x86_64-darwin;
     aarch64-darwin = x86_64-darwin;
-    x86_64-linux = "3.32.3079";
+    x86_64-linux = "3.35.3348";
   }.${system} or throwSystem;
 
   hash = let
-    x86_64-darwin = "sha256-PDAZCnkgzlausdtwycK+PHfp+zmL33VnX6RzCsgBTZ4=";
+    x86_64-darwin = "sha256-QPxslMEz1jOH2LceFOdCyVDtpya1SfJ8GWMIAIhie4U=";
   in {
     inherit x86_64-darwin;
     aarch64-darwin = x86_64-darwin;
-    x86_64-linux = "sha256-+4aRis141ctI50BtBwipoVtPoMGRs82ENqZ+y2ZlL58=";
+    x86_64-linux = "sha256-KtDUuAzD53mFJ0+yywp0Q2/hx9MGsOhFjRLWsZAd+h0=";
   }.${system} or throwSystem;
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/maestral-qt/default.nix b/pkgs/applications/networking/maestral-qt/default.nix
index 51fde794a1c8b..195fdc8556420 100644
--- a/pkgs/applications/networking/maestral-qt/default.nix
+++ b/pkgs/applications/networking/maestral-qt/default.nix
@@ -10,14 +10,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "maestral-qt";
-  version = "1.8.0";
+  version = "1.9.2";
   disabled = python3.pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "SamSchott";
     repo = "maestral-qt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ys7XrvV4qzq4Q9llua2WgU013Ui0+x+uMwLNIv6xxCw=";
+    hash = "sha256-dgiVSwCTNDncbPJ+f0grjtq822TvtG0PhC9gDOKhwRI=";
   };
 
   format = "pyproject";
diff --git a/pkgs/applications/networking/protonvpn-gui/default.nix b/pkgs/applications/networking/protonvpn-gui/default.nix
index e273a3242739d..2930ef450ea25 100644
--- a/pkgs/applications/networking/protonvpn-gui/default.nix
+++ b/pkgs/applications/networking/protonvpn-gui/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonApplication rec {
   pname = "protonvpn-gui";
-  version = "4.1.10";
+  version = "4.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-gtk-app";
     rev = "refs/tags/v${version}";
-    hash = "sha256-D06dMMjzFE7gIGFpIH/+0xmVCckqAWLkb3lc2ZmxNZs=";
+    hash = "sha256-H4m4u9zksab47W5aIsQZPQTPEYiXbmrVCnT67b+A5Tc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/synology-drive-client/default.nix b/pkgs/applications/networking/synology-drive-client/default.nix
index 84ca42cec167a..172e5bfb669a4 100644
--- a/pkgs/applications/networking/synology-drive-client/default.nix
+++ b/pkgs/applications/networking/synology-drive-client/default.nix
@@ -2,7 +2,7 @@
 let
   pname = "synology-drive-client";
   baseUrl = "https://global.synologydownload.com/download/Utility/SynologyDriveClient";
-  version = "3.4.0-15724";
+  version = "3.5.0-16084";
   buildNumber = with lib; last (splitString "-" version);
   meta = with lib; {
     description = "Desktop application to synchronize files and folders between the computer and the Synology Drive server.";
@@ -10,7 +10,7 @@ let
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ jcouyang MoritzBoehme ];
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
     mainProgram = "synology-drive";
   };
   passthru.updateScript = writeScript "update-synology-drive-client" ''
@@ -30,7 +30,7 @@ let
 
     src = fetchurl {
       url = "${baseUrl}/${version}/Ubuntu/Installer/synology-drive-client-${buildNumber}.x86_64.deb";
-      sha256 = "sha256-Zf6JMghXy8ODbR4MhVSPmD4QDu003MTc7YNfbiRVRoY=";
+      sha256 = "sha256-Spl6DC+wf+JaXjwH2ecraySo1VtA+EiI3/TWw9UOSA8=";
     };
 
     nativeBuildInputs = [ autoPatchelfHook dpkg ];
@@ -60,7 +60,7 @@ let
 
     src = fetchurl {
       url = "${baseUrl}/${version}/Mac/Installer/synology-drive-client-${buildNumber}.dmg";
-      sha256 = "sha256-65mZeRYHGl+n9TeTx7bxRrGPjcZiV9UlyfcCZ3GwOhE=";
+      sha256 = "sha256-NDYxUhWtAVUtpCf1WemqShZCFHGgLGwrkX6HldxOlH0=";
     };
 
     nativeBuildInputs = [ cpio xar undmg ];
diff --git a/pkgs/applications/office/super-productivity/default.nix b/pkgs/applications/office/super-productivity/default.nix
index 5a5ff9fc959ed..9b32967159275 100644
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@@ -38,8 +38,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ]}"
+      --add-flags $out/share/${pname}/resources/app.asar
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/science/biology/nest/default.nix b/pkgs/applications/science/biology/nest/default.nix
index 2e5eac7881392..807af7ce488ac 100644
--- a/pkgs/applications/science/biology/nest/default.nix
+++ b/pkgs/applications/science/biology/nest/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "nest";
     repo = "nest-simulator";
     rev = "v${version}";
-    hash = "sha256-KoeehD0HNG6Uafv6ICf8d4gjggJ7+/8RBJCpttf7AGk=";
+    hash = "sha256-EwhpsfRmBLJnPiH6hXQXgG9jSNoC2oqq5lZ6t038VpI=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/science/engineering/brmodelo/default.nix b/pkgs/applications/science/engineering/brmodelo/default.nix
index c484260d25f37..09225fcd5948c 100644
--- a/pkgs/applications/science/engineering/brmodelo/default.nix
+++ b/pkgs/applications/science/engineering/brmodelo/default.nix
@@ -2,27 +2,34 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
-, openjdk8
 , ant
+, jdk8
 , makeWrapper
 , makeDesktopItem
 , copyDesktopItems
+, strip-nondeterminism
+, stripJavaArchivesHook
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "brmodelo";
   version = "3.31";
 
   src = fetchFromGitHub {
     owner = "chcandido";
-    repo = pname;
-    rev = version;
-    sha256 = "09qrhqhv264x8phnf3pnb0cwq75l7xdsj9xkwlvhry81nxz0d5v0";
+    repo = "brmodelo";
+    rev = finalAttrs.version;
+    hash = "sha256-YJcGfrcB+Qw35bMnqVs/tBzMGVj2DmfhRZ0YsSGGGSc=";
   };
 
-  nativeBuildInputs = [ ant makeWrapper copyDesktopItems ];
-
-  buildInputs = [ openjdk8 ];
+  nativeBuildInputs = [
+    ant
+    jdk8
+    makeWrapper
+    copyDesktopItems
+    strip-nondeterminism
+    stripJavaArchivesHook
+  ];
 
   patches = [
     # Fixes for building with Ant.
@@ -30,22 +37,22 @@ stdenv.mkDerivation rec {
     (fetchpatch {
       name = "fix-self-closing-element-not-allowed.patch";
       url = "https://github.com/yuuyins/brModelo/commit/0d712b74fd5d29d67be07480ed196da28a77893b.patch";
-      sha256 = "sha256-yy03arE6xetotzyvpToi9o9crg3KnMRn1J70jDUvSXE=";
+      hash = "sha256-yy03arE6xetotzyvpToi9o9crg3KnMRn1J70jDUvSXE=";
     })
     (fetchpatch {
       name = "fix-tag-closing.patch";
       url = "https://github.com/yuuyins/brModelo/commit/e8530ff75f024cf6effe0408ed69985405e9709c.patch";
-      sha256 = "sha256-MNuh/ORbaAkB5qDSlA/nPrXN+tqzz4oOglVyEtSangI=";
+      hash = "sha256-MNuh/ORbaAkB5qDSlA/nPrXN+tqzz4oOglVyEtSangI=";
     })
     (fetchpatch {
       name = "fix-bad-use-greater-than.patch";
       url = "https://github.com/yuuyins/brModelo/commit/498a6ef8129daff5a472b318f93c8f7f2897fc7f.patch";
-      sha256 = "sha256-MmAwYUmx38DGRsiSxCWCObtpqxk0ykUQiDSC76bCpFc=";
+      hash = "sha256-MmAwYUmx38DGRsiSxCWCObtpqxk0ykUQiDSC76bCpFc=";
     })
     (fetchpatch {
       name = "fix-param-errors.patch";
       url = "https://github.com/yuuyins/brModelo/commit/8a508aaba0bcffe13a3f95cff495230beea36bc4.patch";
-      sha256 = "sha256-qME9gZChSMzu1vs9HaosD+snb+jlOrQLY97meNoA8oU=";
+      hash = "sha256-qME9gZChSMzu1vs9HaosD+snb+jlOrQLY97meNoA8oU=";
     })
 
     # Add SVG icons.
@@ -53,12 +60,14 @@ stdenv.mkDerivation rec {
     (fetchpatch {
       name = "add-brmodelo-logo-icons-svg.patch";
       url = "https://github.com/yuuyins/brModelo/commit/f260b82b664fad3325bbf3ebd7a15488d496946b.patch";
-      sha256 = "sha256-UhgcWxsHkNFS1GgaRnmlZohjDR8JwHof2cIb3SBetYs=";
+      hash = "sha256-UhgcWxsHkNFS1GgaRnmlZohjDR8JwHof2cIb3SBetYs=";
     })
   ];
 
   buildPhase = ''
+    runHook postBuild
     ant
+    runHook preBuild
   '';
 
   desktopItems = [
@@ -68,15 +77,16 @@ stdenv.mkDerivation rec {
       genericName = "Entity-relationship diagramming tool";
       exec = "brmodelo";
       icon = "brmodelo";
-      comment = meta.description;
+      comment = finalAttrs.meta.description;
       categories = [ "Development" "Education" "Database" "2DGraphics" "ComputerScience" "DataVisualization" "Engineering" "Java" ];
     })
   ];
 
   installPhase = ''
-    install -d $out/bin $out/share/doc/${pname} $out/share/java
+    runHook preInstall
 
-    cp -rv ./dist/javadoc $out/share/doc/${pname}/
+    mkdir -p $out/share/doc/brmodelo
+    cp -rv ./dist/javadoc $out/share/doc/brmodelo/
 
     install -Dm755 ./dist/brModelo.jar -t $out/share/java/
     # NOTE: The standard Java GUI toolkit has a
@@ -85,26 +95,28 @@ stdenv.mkDerivation rec {
     # in WMs that are not in that list (e.g. XMonad).
     # Solution/Workaround: set the environment variable
     # _JAVA_AWT_WM_NONREPARENTING=1.
-    makeWrapper ${openjdk8}/bin/java $out/bin/brmodelo \
+    makeWrapper ${jdk8}/bin/java $out/bin/brmodelo \
        --prefix _JAVA_AWT_WM_NONREPARENTING : 1 \
        --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on" \
        --add-flags "-jar $out/share/java/brModelo.jar"
 
-    runHook postInstall
-  '';
-
-  postInstall = ''
     for size in 16 24 32 48 64 128 256; do
       install -Dm644 ./src/imagens/icone_"$size"x"$size".svg \
         $out/share/icons/hicolor/"$size"x"$size"/apps/brmodelo.svg
     done
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    find $out/share/doc/brmodelo/javadoc -name "*.html" -exec strip-nondeterminism --type javadoc {} +
   '';
 
   meta = with lib; {
     description = "Entity-relationship diagram tool for making conceptual and logical database models";
-    mainProgram = "brmodelo";
     homepage = "https://github.com/chcandido/brModelo";
     license = licenses.gpl3;
+    mainProgram = "brmodelo";
     maintainers = with maintainers; [ yuu ];
   };
-}
+})
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index d355412e54f0a..e543c10d4bcbf 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "snakemake";
-  version = "8.10.6";
+  version = "8.10.7";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-THp8sqAFZVA5V2k0ruv9qwmPNjSVi2uVx8tla0Y3awE=";
+    hash = "sha256-tRjyv7pTTTDj3LrcIP3OWOX+9FldHV6rtbPdOYr70E4=";
     # https://github.com/python-versioneer/python-versioneer/issues/217
     postFetch = ''
       sed -i "$out"/snakemake/_version.py -e 's#git_refnames = ".*"#git_refnames = " (tag: v${version})"#'
diff --git a/pkgs/applications/version-management/delta/default.nix b/pkgs/applications/version-management/delta/default.nix
index 3065d56721939..b343e473e3c8b 100644
--- a/pkgs/applications/version-management/delta/default.nix
+++ b/pkgs/applications/version-management/delta/default.nix
@@ -44,6 +44,11 @@ rustPlatform.buildRustPackage rec {
       etc/completion/completion.{bash,fish,zsh}
   '';
 
+  # test_env_parsing_with_pager_set_to_bat sets environment variables,
+  # which can be flaky with multiple threads:
+  # https://github.com/dandavison/delta/issues/1660
+  dontUseCargoParallelTests = true;
+
   checkFlags = lib.optionals stdenv.isDarwin [
     "--skip=test_diff_same_non_empty_file"
   ];
diff --git a/pkgs/applications/version-management/forgejo/default.nix b/pkgs/applications/version-management/forgejo/default.nix
index 85613530ba394..65c683ddbe763 100644
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
   pname = "forgejo";
-  version = "1.21.11-0";
+  version = "1.21.11-1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "forgejo";
     rev = "v${version}";
-    hash = "sha256-Cp+dN4nTIboin42NJR/YUkVXbBC7uufH8EE7NgIVFzY=";
+    hash = "sha256-7oYsoZpZcNIUw3iXSi1Q5So2yYgKnT5U7GHQ4NVqVdc=";
     # Forgejo has multiple different version strings that need to be provided
     # via ldflags.  main.ForgejoVersion for example is a combination of a
     # hardcoded gitea compatibility version string (in the Makefile) and
diff --git a/pkgs/applications/version-management/git-interactive-rebase-tool/default.nix b/pkgs/applications/version-management/git-interactive-rebase-tool/default.nix
index 176e271475368..f450b17535dd8 100644
--- a/pkgs/applications/version-management/git-interactive-rebase-tool/default.nix
+++ b/pkgs/applications/version-management/git-interactive-rebase-tool/default.nix
@@ -12,10 +12,9 @@ rustPlatform.buildRustPackage rec {
   };
 
   postPatch = ''
-    # unknown lint: `ffi_unwind_calls`
-    # note: the `ffi_unwind_calls` lint is unstable
-    substituteInPlace src/main.rs src/{config,core,display,input,git,runtime,todo_file,testutils,view}/src/lib.rs \
-      --replace "ffi_unwind_calls," ""
+    # error: lint `unused_tuple_struct_fields` has been renamed to `dead_code`
+    substituteInPlace scripts/data/lints.rs src/main.rs src/{config,core,display,git,input,runtime,testutils,todo_file,view}/src/lib.rs \
+      --replace-fail "unused_tuple_struct_fields," ""
   '';
 
   cargoLock = {
diff --git a/pkgs/applications/version-management/git-town/default.nix b/pkgs/applications/version-management/git-town/default.nix
index 379aa21ef3f18..1efcf23600be1 100644
--- a/pkgs/applications/version-management/git-town/default.nix
+++ b/pkgs/applications/version-management/git-town/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-town";
-  version = "14.0.0";
+  version = "14.1.0";
 
   src = fetchFromGitHub {
     owner = "git-town";
     repo = "git-town";
     rev = "v${version}";
-    hash = "sha256-GF1nNb/poFDXKwpqYZvQrTZ7CkNgO39KrrDuc94o/tw=";
+    hash = "sha256-BhtKl052P3PGxGXb5lSOIsncJLiNlevzBMEF2kCuFpM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/video/kodi/addons/jellyfin/default.nix b/pkgs/applications/video/kodi/addons/jellyfin/default.nix
index 63cac3e7261cf..7623a3c4db136 100644
--- a/pkgs/applications/video/kodi/addons/jellyfin/default.nix
+++ b/pkgs/applications/video/kodi/addons/jellyfin/default.nix
@@ -5,13 +5,13 @@ in
 buildKodiAddon rec {
   pname = "jellyfin";
   namespace = "plugin.video.jellyfin";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-kodi";
     rev = "v${version}";
-    sha256 = "sha256-i9lRPMHniUmKTeNSzgp6dF11uYOcjH3PgJEa+Jasx68=";
+    sha256 = "sha256-yCgsQnzmlmyYAjp1q0J9QxGDRg5JCd23H9xgVozHiGM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
index 96209f3f94062..ea379e6ffc51f 100644
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "advanced-scene-switcher";
-  version = "1.25.4";
+  version = "1.25.5";
 
   src = fetchFromGitHub {
     owner = "WarmUpTill";
     repo = "SceneSwitcher";
     rev = version;
-    hash = "sha256-d/utejwSazepkIMzd1tRrJSrKRFhFRZsQBGiOkt5pYk=";
+    hash = "sha256-ROR+R1Zak8XkhFk1+Pyi0lB+JZI4SVtKGin4vem7NEE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/subtitleedit/default.nix b/pkgs/applications/video/subtitleedit/default.nix
index d47889857ed08..924f0fc44e0eb 100644
--- a/pkgs/applications/video/subtitleedit/default.nix
+++ b/pkgs/applications/video/subtitleedit/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "subtitleedit";
-  version = "4.0.4";
+  version = "4.0.5";
 
   src = fetchzip {
     url = "https://github.com/SubtitleEdit/subtitleedit/releases/download/${version}/SE${lib.replaceStrings [ "." ] [ "" ] version}.zip";
-    hash = "sha256-9z9igHU/23KHOd1TM3Wd7y5kl19cg3D9AQ2MjH5av20=";
+    hash = "sha256-qYDLUqC5adzpmlQIq/EKmrkN8D8/EHZmP8QUGAaYf+s=";
     stripRoot = false;
   };
 
diff --git a/pkgs/applications/virtualization/podman-compose/default.nix b/pkgs/applications/virtualization/podman-compose/default.nix
index 8671617a40431..29bfbfa781898 100644
--- a/pkgs/applications/virtualization/podman-compose/default.nix
+++ b/pkgs/applications/virtualization/podman-compose/default.nix
@@ -1,17 +1,24 @@
-{ lib, buildPythonApplication, fetchFromGitHub, python-dotenv, pyyaml }:
+{ lib, buildPythonApplication, fetchFromGitHub, python-dotenv, pyyaml, setuptools, pipBuildHook, pypaBuildHook }:
 
 buildPythonApplication rec {
-  version = "1.0.6";
+  version = "1.1.0";
   pname = "podman-compose";
+  pyproject = true;
 
   src = fetchFromGitHub {
     repo = "podman-compose";
     owner = "containers";
     rev = "v${version}";
-    sha256 = "sha256-TsNM5xORqwWge+UCijKptwbAcIz1uZFN9BuIOl28vIU=";
+    sha256 = "sha256-uNgzdLrnDIABtt0L2pvsil14esRzl0XcWohgf7Oksr8=";
   };
 
-  propagatedBuildInputs = [ pyyaml python-dotenv ];
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [ python-dotenv pyyaml ];
+  propagatedBuildInputs = [ pypaBuildHook ];
 
   meta = {
     description = "An implementation of docker-compose with podman backend";
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index dca7b9bc4af0c..92935ed129d8a 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -74,13 +74,13 @@ buildGoModule rec {
   };
 
   patches = [
+    # we intentionally don't build and install the helper so we shouldn't display messages to users about it
+    ./rm-podman-mac-helper-msg.patch
+  ] ++ lib.optionals stdenv.isLinux [
     (substituteAll {
       src = ./hardcode-paths.patch;
       inherit crun runc gvisor youki conmon;
     })
-
-    # we intentionally don't build and install the helper so we shouldn't display messages to users about it
-    ./rm-podman-mac-helper-msg.patch
   ];
 
   vendorHash = null;
diff --git a/pkgs/applications/window-managers/miriway/default.nix b/pkgs/applications/window-managers/miriway/default.nix
index cd43a1be4765f..7e59995126fad 100644
--- a/pkgs/applications/window-managers/miriway/default.nix
+++ b/pkgs/applications/window-managers/miriway/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "miriway";
-  version = "unstable-2024-04-04";
+  version = "unstable-2024-04-16";
 
   src = fetchFromGitHub {
     owner = "Miriway";
     repo = "Miriway";
-    rev = "add1e0cd695985020328b0d76c91f85cc88207ff";
-    hash = "sha256-Vp9ZbN5lY26t3LhkflapsG84XEy0YQE4Kvxia0VlQyg=";
+    rev = "d7f43ac201e6f1aa7aeee668f5d16683f48917f1";
+    hash = "sha256-hUTK7kd7gTvms4HMF7BgYWomRYZyRkqUfjhVtEF+YRE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix b/pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix
index 64ccff89f6e33..0635d7a5e407e 100644
--- a/pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix
+++ b/pkgs/applications/window-managers/phosh/phosh-mobile-settings.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, nixosTests
 , directoryListingUpdater
 , meson
 , ninja
@@ -59,7 +60,10 @@ stdenv.mkDerivation rec {
     ln -s '${phosh}/lib/phosh' "$out/lib/phosh"
   '';
 
-  passthru.updateScript = directoryListingUpdater { };
+  passthru = {
+    tests.phosh = nixosTests.phosh;
+    updateScript = directoryListingUpdater { };
+  };
 
   meta = with lib; {
     description = "A settings app for mobile specific things";
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index a7e697c552154..e192c650a4ddb 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -315,6 +315,7 @@
   # D DUB
   dub = [
     "https://code.dlang.org/packages/"
+    "https://codemirror.dlang.org/packages/"
   ];
 
   # Haskell Hackage
diff --git a/pkgs/build-support/node/fetch-npm-deps/Cargo.lock b/pkgs/build-support/node/fetch-npm-deps/Cargo.lock
index 8ba72a7b76c49..dcabca0aeafda 100644
--- a/pkgs/build-support/node/fetch-npm-deps/Cargo.lock
+++ b/pkgs/build-support/node/fetch-npm-deps/Cargo.lock
@@ -4,18 +4,66 @@ version = 3
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
+name = "anstream"
+version = "0.6.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
+dependencies = [
+ "anstyle",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
 name = "anyhow"
-version = "1.0.75"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
+checksum = "f538837af36e6f6a9be0faa67f9a314f8119e4e4b5867c6ab40ed60360142519"
 
 [[package]]
 name = "async-channel"
@@ -30,9 +78,9 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
 
 [[package]]
 name = "backoff"
@@ -46,12 +94,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "base64"
-version = "0.21.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35636a1494ede3b646cc98f74f8e62c773a38a659ebc777a2cf26b9b74171df9"
-
-[[package]]
 name = "bitflags"
 version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -59,9 +101,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "block-buffer"
@@ -74,9 +116,15 @@ dependencies = [
 
 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
+
+[[package]]
+name = "camino"
+version = "1.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "c59e92b5a388f549b863a7bea62612c09f24c8393560709a54558a9abdfb3b9c"
 
 [[package]]
 name = "castaway"
@@ -86,12 +134,9 @@ checksum = "a2698f953def977c68f935bb0dfa959375ad4638570e969e2f1e9f433cbf1af6"
 
 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
-dependencies = [
- "libc",
-]
+checksum = "17f6e324229dc011159fcc089755d1e2e216a90d43a7dea6853ca740b84f35e7"
 
 [[package]]
 name = "cfg-if"
@@ -100,55 +145,53 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
+name = "colorchoice"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+
+[[package]]
 name = "concurrent-queue"
-version = "2.3.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f057a694a54f12365049b0958a1685bb52d567f5593b355fbf685838e873d400"
+checksum = "d16048cd947b08fa32c24458a22f5dc5e835264f689f4f5653210c69fd107363"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce420fe07aecd3e67c5f910618fe65e94158f6dcc0adf44e00d69ce2bdfe0fd0"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 dependencies = [
- "cfg-if",
  "crossbeam-epoch",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.15"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
- "autocfg",
- "cfg-if",
  "crossbeam-utils",
- "memoffset",
- "scopeguard",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.16"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
-dependencies = [
- "cfg-if",
-]
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
 [[package]]
 name = "crypto-common"
@@ -162,9 +205,9 @@ dependencies = [
 
 [[package]]
 name = "curl"
-version = "0.4.44"
+version = "0.4.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "509bd11746c7ac09ebd19f0b17782eae80aadee26237658a6b4808afb5c11a22"
+checksum = "1e2161dd6eba090ff1594084e95fd67aeccf04382ffea77999ea94ed42ec67b6"
 dependencies = [
  "curl-sys",
  "libc",
@@ -172,14 +215,14 @@ dependencies = [
  "openssl-sys",
  "schannel",
  "socket2",
- "winapi",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "curl-sys"
-version = "0.4.68+curl-8.4.0"
+version = "0.4.72+curl-8.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4a0d18d88360e374b16b2273c832b5e57258ffc1d4aa4f96b108e0738d5752f"
+checksum = "29cbdc8314c447d11e8fd156dcdd031d9e02a7a976163e396b548c03153bc9ea"
 dependencies = [
  "cc",
  "libc",
@@ -187,10 +230,16 @@ dependencies = [
  "openssl-sys",
  "pkg-config",
  "vcpkg",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
+name = "data-encoding"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e962a19be5cfc3f3bf6dd8f61eb50107f356ad6270fbb3ed41476571db78be5"
+
+[[package]]
 name = "digest"
 version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -202,31 +251,41 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.9.0"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
+
+[[package]]
+name = "env_filter"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+checksum = "a009aa4810eb158359dda09d0c87378e4bbb89b5a801f016885a4707ba24f7ea"
+dependencies = [
+ "log",
+ "regex",
+]
 
 [[package]]
 name = "env_logger"
-version = "0.10.1"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95b3f3e67048839cb0d0781f445682a35113da7121f7c949db0e2be96a4fbece"
+checksum = "38b35839ba51819680ba087cd351788c9a3c476841207e0b8cee0b04722343b9"
 dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
  "humantime",
- "is-terminal",
  "log",
- "regex",
- "termcolor",
 ]
 
 [[package]]
 name = "errno"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f258a7194e7f7c2a7837a8913aeab7fd8c383457034fa20ce4dd3dcb813e8eb8"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
 dependencies = [
  "libc",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -246,9 +305,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.0.1"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
+checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984"
 
 [[package]]
 name = "fnv"
@@ -258,24 +317,24 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
 dependencies = [
  "percent-encoding",
 ]
 
 [[package]]
 name = "futures-core"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb1d22c66e66d9d72e1758f0bd7d4fd0bee04cad842ee34587d68c07e45d088c"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
 
 [[package]]
 name = "futures-io"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bf34a163b5c4c52d0478a4d757da8fb65cabef42ba90515efee0f6f9fa45aaa"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
 
 [[package]]
 name = "futures-lite"
@@ -304,9 +363,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.11"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "libc",
@@ -314,16 +373,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "hermit-abi"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
-
-[[package]]
 name = "http"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
 dependencies = [
  "bytes",
  "fnv",
@@ -338,9 +391,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "idna"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
 dependencies = [
  "unicode-bidi",
  "unicode-normalization",
@@ -356,14 +409,12 @@ dependencies = [
 ]
 
 [[package]]
-name = "is-terminal"
-version = "0.4.9"
+name = "is_executable"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
+checksum = "fa9acdc6d67b75e626ad644734e8bc6df893d9cd2a834129065d3dd6158ea9c8"
 dependencies = [
- "hermit-abi",
- "rustix",
- "windows-sys",
+ "winapi",
 ]
 
 [[package]]
@@ -393,21 +444,21 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.9"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "libc"
-version = "0.2.150"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "libz-sys"
-version = "1.1.12"
+version = "1.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d97137b25e321a73eef1418d1d5d2eda4d77e12813f8e6dead84bc52c5870a7b"
+checksum = "5e143b5e666b2695d28f6bca6497720813f699c9602dd7f5cac91008b8ada7f9"
 dependencies = [
  "cc",
  "libc",
@@ -417,36 +468,39 @@ dependencies = [
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.11"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "memchr"
-version = "2.6.4"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
-name = "memoffset"
-version = "0.9.0"
+name = "nix-nar"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+checksum = "d5549158a8b179c4fcd06a19f4bcc557db60c9cbd6771add9563f46c8d0325b5"
 dependencies = [
- "autocfg",
+ "camino",
+ "is_executable",
+ "symlink",
+ "thiserror",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "openssl-probe"
@@ -456,9 +510,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.95"
+version = "0.9.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40a4130519a360279579c2053038317e40eff64d13fd3f004f9e1b72b8a6aaf9"
+checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
 dependencies = [
  "cc",
  "libc",
@@ -474,24 +528,24 @@ checksum = "bb813b8af86854136c6922af0598d719255ecb2179515e6e7730d468f05c9cae"
 
 [[package]]
 name = "percent-encoding"
-version = "2.3.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pin-project"
-version = "1.1.3"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fda4ed1c6c173e3fc7a83629421152e01d7b1f9b7f65fb301e490e8cfc656422"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.3"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -500,15 +554,15 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.27"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
 
 [[package]]
 name = "polling"
@@ -523,7 +577,7 @@ dependencies = [
  "libc",
  "log",
  "pin-project-lite",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -538,11 +592,12 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "backoff",
- "base64",
+ "data-encoding",
  "digest",
  "env_logger",
  "isahc",
  "log",
+ "nix-nar",
  "rayon",
  "serde",
  "serde_json",
@@ -555,18 +610,18 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.69"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -603,9 +658,9 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.8.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
 dependencies = [
  "either",
  "rayon-core",
@@ -613,28 +668,19 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
 dependencies = [
  "crossbeam-deque",
  "crossbeam-utils",
 ]
 
 [[package]]
-name = "redox_syscall"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
 name = "regex"
-version = "1.10.2"
+version = "1.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
+checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -644,9 +690,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.3"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -655,28 +701,28 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "rustix"
-version = "0.38.25"
+version = "0.38.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc99bc2d4f1fed22595588a013687477aedf3cdcfb26558c559edb67b4d9b22e"
+checksum = "65e04861e65f21776e67888bfbea442b3642beaa0138fdb1dd7a84a52dffdb89"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "ryu"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 
 [[package]]
 name = "same-file"
@@ -689,33 +735,27 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c3733bf4cf7ea0880754e19cb5a462007c4a8c1914bff372ccc95b464f1df88"
+checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
 dependencies = [
- "windows-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
 name = "serde"
-version = "1.0.193"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25dd9975e68d0cb5aa1120c288333fc98731bd1dd12f561e468ea4728c042b89"
+checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.193"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43576ca501357b9b071ac53cdc7da8ef0cbd9493d8df094cd821777ea6e894d3"
+checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -724,9 +764,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.108"
+version = "1.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
+checksum = "3e17db7126d17feb94eb3fad46bf1a96b034e8aacbc2e775fe81505f8b0b2813"
 dependencies = [
  "itoa",
  "ryu",
@@ -777,19 +817,25 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.4.10"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d"
+checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
 dependencies = [
  "libc",
- "winapi",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
+name = "symlink"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7973cce6668464ea31f176d85b13c7ab3bba2cb3b77a2ed26abd7801688010a"
+
+[[package]]
 name = "syn"
-version = "2.0.39"
+version = "2.0.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
+checksum = "4a6531ffc7b071655e4ce2e04bd464c4830bb585a61cabb96cf808f05172615a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -798,24 +844,34 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.8.1"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
+checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
 dependencies = [
  "cfg-if",
- "fastrand 2.0.1",
- "redox_syscall",
+ "fastrand 2.0.2",
  "rustix",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
-name = "termcolor"
-version = "1.4.0"
+name = "thiserror"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff1bc3d3f05aff0403e8ac0d92ced918ec05b666a43f83297ccef5bea8a3d449"
+checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
 dependencies = [
- "winapi-util",
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -883,9 +939,9 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "unicode-bidi"
-version = "0.3.13"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
 
 [[package]]
 name = "unicode-ident"
@@ -895,18 +951,18 @@ checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
 dependencies = [
  "tinyvec",
 ]
 
 [[package]]
 name = "url"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
+checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -915,6 +971,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "utf8parse"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
+
+[[package]]
 name = "vcpkg"
 version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -934,9 +996,9 @@ checksum = "f3c4517f54858c779bbcbf228f4fca63d121bf85fbecb2dc578cdf4a39395690"
 
 [[package]]
 name = "walkdir"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
 dependencies = [
  "same-file",
  "winapi-util",
@@ -985,7 +1047,16 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -994,13 +1065,29 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]
 
 [[package]]
@@ -1010,37 +1097,85 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
+
+[[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
+
+[[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
+name = "windows_i686_gnu"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
+
+[[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
+name = "windows_i686_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
+
+[[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
+
+[[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
+
+[[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
diff --git a/pkgs/build-support/node/fetch-npm-deps/Cargo.toml b/pkgs/build-support/node/fetch-npm-deps/Cargo.toml
index ea121c510c95b..dcb7e28a49dd7 100644
--- a/pkgs/build-support/node/fetch-npm-deps/Cargo.toml
+++ b/pkgs/build-support/node/fetch-npm-deps/Cargo.toml
@@ -6,18 +6,19 @@ edition = "2021"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-anyhow = "1.0.75"
+anyhow = "1.0.82"
 backoff = "0.4.0"
-base64 = "0.21.5"
+data-encoding = "2.5.0"
 digest = "0.10.7"
-env_logger = "0.10.1"
+env_logger = "0.11.3"
 isahc = { version = "1.7.2", default_features = false }
-log = "0.4.20"
-rayon = "1.8.0"
-serde = { version = "1.0.193", features = ["derive"] }
-serde_json = "1.0.108"
+log = "0.4.21"
+nix-nar = "0.3.0"
+rayon = "1.10.0"
+serde = { version = "1.0.198", features = ["derive"] }
+serde_json = "1.0.116"
 sha1 = "0.10.6"
 sha2 = "0.10.8"
-tempfile = "3.8.1"
-url = { version = "2.4.1", features = ["serde"] }
-walkdir = "2.4.0"
+tempfile = "3.10.1"
+url = { version = "2.5.0", features = ["serde"] }
+walkdir = "2.5.0"
diff --git a/pkgs/build-support/node/fetch-npm-deps/default.nix b/pkgs/build-support/node/fetch-npm-deps/default.nix
index 373d63cc59b8f..d86fc90c6c7d1 100644
--- a/pkgs/build-support/node/fetch-npm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-npm-deps/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenvNoCC, rustPlatform, makeWrapper, pkg-config, curl, gnutar, gzip, nix, testers, fetchurl, cacert, prefetch-npm-deps, fetchNpmDeps }:
+{ lib, stdenvNoCC, rustPlatform, makeWrapper, pkg-config, curl, gnutar, gzip, testers, fetchurl, cacert, prefetch-npm-deps, fetchNpmDeps }:
 
 {
   prefetch-npm-deps = rustPlatform.buildRustPackage {
@@ -20,7 +20,7 @@
     buildInputs = [ curl ];
 
     postInstall = ''
-      wrapProgram "$out/bin/prefetch-npm-deps" --prefix PATH : ${lib.makeBinPath [ gnutar gzip nix ]}
+      wrapProgram "$out/bin/prefetch-npm-deps" --prefix PATH : ${lib.makeBinPath [ gnutar gzip ]}
     '';
 
     passthru.tests =
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs b/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
index c49c094b85c68..403c909dee115 100644
--- a/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
@@ -1,4 +1,4 @@
-use base64::prelude::{Engine, BASE64_STANDARD};
+use data_encoding::BASE64;
 use digest::{Digest, Update};
 use serde::{Deserialize, Serialize};
 use sha1::Sha1;
@@ -11,6 +11,7 @@ use std::{
 };
 use url::Url;
 
+#[allow(clippy::struct_field_names)]
 #[derive(Serialize, Deserialize)]
 pub(super) struct Key {
     pub(super) key: String,
@@ -59,16 +60,18 @@ impl Cache {
         integrity: Option<String>,
     ) -> anyhow::Result<()> {
         let (algo, hash, integrity) = if let Some(integrity) = integrity {
-            let (algo, hash) = integrity.split_once('-').unwrap();
+            let (algo, hash) = integrity
+                .split_once('-')
+                .expect("hash should be SRI format");
 
-            (algo.to_string(), BASE64_STANDARD.decode(hash)?, integrity)
+            (algo.to_string(), BASE64.decode(hash.as_bytes())?, integrity)
         } else {
             let hash = Sha512::new().chain(data).finalize();
 
             (
                 String::from("sha512"),
                 hash.to_vec(),
-                format!("sha512-{}", BASE64_STANDARD.encode(hash)),
+                format!("sha512-{}", BASE64.encode(&hash)),
             )
         };
 
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/main.rs b/pkgs/build-support/node/fetch-npm-deps/src/main.rs
index dc20c72970491..cb06d32600e8c 100644
--- a/pkgs/build-support/node/fetch-npm-deps/src/main.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/main.rs
@@ -8,7 +8,7 @@ use std::{
     collections::HashMap,
     env, fs,
     path::{Path, PathBuf},
-    process::{self, Command},
+    process,
 };
 use tempfile::tempdir;
 use url::Url;
@@ -266,10 +266,7 @@ fn main() -> anyhow::Result<()> {
     fs::write(out.join("package-lock.json"), lock_content)?;
 
     if print_hash {
-        Command::new("nix")
-            .args(["--experimental-features", "nix-command", "hash", "path"])
-            .arg(out.as_os_str())
-            .status()?;
+        println!("{}", util::make_sri_hash(out)?);
     }
 
     Ok(())
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs b/pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs
index c6e77153a0b80..49bba8780c979 100644
--- a/pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs
@@ -179,7 +179,7 @@ impl fmt::Display for Hash {
     }
 }
 
-#[allow(clippy::incorrect_partial_ord_impl_on_ord_type)]
+#[allow(clippy::non_canonical_partial_ord_impl)]
 impl PartialOrd for Hash {
     fn partial_cmp(&self, other: &Hash) -> Option<Ordering> {
         let lhs = self.0.split_once('-')?.0;
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/util.rs b/pkgs/build-support/node/fetch-npm-deps/src/util.rs
index 7dd928fdc43fa..023ba56793b90 100644
--- a/pkgs/build-support/node/fetch-npm-deps/src/util.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/util.rs
@@ -1,10 +1,18 @@
 use backoff::{retry, ExponentialBackoff};
+use data_encoding::BASE64;
+use digest::Digest;
 use isahc::{
     config::{CaCertificate, Configurable, RedirectPolicy, SslOption},
     Body, Request, RequestExt,
 };
+use nix_nar::{Encoder, NarError};
 use serde_json::{Map, Value};
-use std::{env, io::Read, path::Path};
+use sha2::Sha256;
+use std::{
+    env,
+    io::{self, Read},
+    path::Path,
+};
 use url::Url;
 
 pub fn get_url(url: &Url) -> Result<Body, isahc::Error> {
@@ -64,3 +72,12 @@ pub fn get_url_body_with_retry(url: &Url) -> Result<Vec<u8>, isahc::Error> {
         } => err,
     })
 }
+
+pub fn make_sri_hash(path: &Path) -> Result<String, NarError> {
+    let mut encoder = Encoder::new(path)?;
+    let mut hasher = Sha256::new();
+
+    io::copy(&mut encoder, &mut hasher)?;
+
+    Ok(format!("sha256-{}", BASE64.encode(&hasher.finalize())))
+}
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index d7438923a54b8..1625b0c96719c 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -234,6 +234,12 @@ rec {
        */
       excludeShellChecks ? [ ],
       /*
+         Extra command-line flags to pass to ShellCheck.
+
+         Type: [String]
+       */
+      extraShellCheckFlags ? [ ],
+      /*
          Bash options to activate with `set -o` at the start of the script.
 
          Defaults to `[ "errexit" "nounset" "pipefail" ]`.
@@ -282,11 +288,11 @@ rec {
         # but we still want to use writeShellApplication on those platforms
         let
           shellcheckSupported = lib.meta.availableOn stdenv.buildPlatform shellcheck-minimal.compiler;
-          excludeOption = lib.optionalString (excludeShellChecks != [ ]) "--exclude '${lib.concatStringsSep "," excludeShellChecks}'";
+          excludeFlags = lib.optionals (excludeShellChecks != [ ]) [ "--exclude" (lib.concatStringsSep "," excludeShellChecks) ];
           shellcheckCommand = lib.optionalString shellcheckSupported ''
             # use shellcheck which does not include docs
             # pandoc takes long to build and documentation isn't needed for just running the cli
-            ${lib.getExe shellcheck-minimal} ${excludeOption} "$target"
+            ${lib.getExe shellcheck-minimal} ${lib.escapeShellArgs (excludeFlags ++ extraShellCheckFlags)} "$target"
           '';
         in
         if checkPhase == null then ''
diff --git a/pkgs/by-name/_6/_64gram/package.nix b/pkgs/by-name/_6/_64gram/package.nix
index 959a2ad5d17e1..8db36cf9abf50 100644
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@@ -7,7 +7,7 @@
 
 telegram-desktop.overrideAttrs (old: rec {
   pname = "64gram";
-  version = "1.1.17";
+  version = "1.1.19";
 
   src = fetchFromGitHub {
     owner = "TDesktop-x64";
@@ -15,7 +15,7 @@ telegram-desktop.overrideAttrs (old: rec {
     rev = "v${version}";
 
     fetchSubmodules = true;
-    hash = "sha256-QWHC1NAAKpH9zU7cplCW2rNYckY87bpU7MEZ1ytSi58=";
+    hash = "sha256-9QCh7/eNPWqsOF+cjO61EnqqhAdy6+4UxZhWjfJc5gQ=";
   };
 
   passthru.updateScript = nix-update-script {};
diff --git a/pkgs/by-name/ab/ab-av1/package.nix b/pkgs/by-name/ab/ab-av1/package.nix
new file mode 100644
index 0000000000000..a92e021f67e3a
--- /dev/null
+++ b/pkgs/by-name/ab/ab-av1/package.nix
@@ -0,0 +1,33 @@
+{ lib, rustPlatform, fetchFromGitHub, installShellFiles }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ab-av1";
+  version = "0.7.14";
+
+  src = fetchFromGitHub {
+    owner = "alexheretic";
+    repo = "ab-av1";
+    rev = "v${version}";
+    hash = "sha256-cDabGXNzusVnp4exINqUitEL1HnzSgpcRtYXU5pSRhY=";
+  };
+
+  cargoHash = "sha256-sW/673orvK+mIUqTijpNh4YGd9ZrgSveGT6F1O5OYfI=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd ab-av1 \
+      --bash <($out/bin/ab-av1 print-completions bash) \
+      --fish <($out/bin/ab-av1 print-completions fish) \
+      --zsh <($out/bin/ab-av1 print-completions zsh)
+  '';
+
+  meta = with lib; {
+    description = "AV1 re-encoding using ffmpeg, svt-av1 & vmaf";
+    homepage = "https://github.com/alexheretic/ab-av1";
+    changelog = "https://github.com/alexheretic/ab-av1/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+    mainProgram = "ab-av1";
+  };
+}
diff --git a/pkgs/by-name/ad/adminerevo/index.php b/pkgs/by-name/ad/adminerevo/index.php
new file mode 100644
index 0000000000000..838b5948ae4d3
--- /dev/null
+++ b/pkgs/by-name/ad/adminerevo/index.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace nixos {
+	function adminer_object() {
+		require_once(__DIR__ . '/plugins/plugin.php');
+
+		$plugins = [];
+		if (file_exists(__DIR__ . '/plugins.json')) {
+			$names = json_decode(file_get_contents(__DIR__ . '/plugins.json'), true);
+
+			foreach ($names as $name) {
+				$plugin = __DIR__ . '/plugins/' . $name . '.php';
+				if (is_readable($plugin)) {
+					require($plugin);
+
+					preg_match_all('/(\w+)/', $name, $matches);
+
+					$className = 'Adminer'. implode('', array_map('ucfirst', $matches[1]));
+
+					$plugins[] = new $className;
+				}
+			}
+		}
+
+		return new \AdminerPlugin($plugins);
+	}
+}
+
+namespace {
+	function adminer_object() {
+		return \nixos\adminer_object();
+	}
+
+	require(__DIR__ . '/adminer.php');
+}
diff --git a/pkgs/by-name/ad/adminerevo/package.nix b/pkgs/by-name/ad/adminerevo/package.nix
new file mode 100644
index 0000000000000..398d007671002
--- /dev/null
+++ b/pkgs/by-name/ad/adminerevo/package.nix
@@ -0,0 +1,73 @@
+{ lib
+, pkgs
+, stdenvNoCC
+, fetchFromGitHub
+, php
+, nix-update-script
+, theme ? null
+, plugins ? []
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  version = "4.8.4";
+  pname = "adminerevo";
+
+  src = fetchFromGitHub {
+    owner = "adminerevo";
+    repo = "adminerevo";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-cyKSwzoVbS/0Fiv02kFIF4MTOqzpKSEFwwUwS4yqL6Q=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    php
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    php compile.php
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp adminer-${finalAttrs.version}.php $out/adminer.php
+    cp ${./index.php} $out/index.php
+
+    ${lib.optionalString (theme != null) ''
+      cp designs/${theme}/adminer.css $out/adminer.css
+    ''}
+
+    # Copy base plugin
+    mkdir -p $out/plugins
+    cp plugins/plugin.php $out/plugins/plugin.php
+
+    ${lib.optionalString (plugins != []) ''
+      cp plugins/*.php $out/plugins/
+      cp ${pkgs.writeText "$out/plugins.json" ''
+        ${toString (builtins.toJSON plugins)}
+      ''} $out/plugins.json
+    ''}
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    description = "Database management in a single PHP file";
+    homepage = "https://docs.adminerevo.org";
+    license = with licenses; [ asl20 gpl2Only ];
+    maintainers = with maintainers; [
+      shyim
+    ];
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ae/aeron-cpp/package.nix b/pkgs/by-name/ae/aeron-cpp/package.nix
index 14d71aafe6811..630a94d9b4919 100644
--- a/pkgs/by-name/ae/aeron-cpp/package.nix
+++ b/pkgs/by-name/ae/aeron-cpp/package.nix
@@ -17,14 +17,14 @@
 let
   version = aeron.version;
 
-  sbeAll_1_30_0 = fetchMavenArtifact {
+  sbeAll_1_31_1 = fetchMavenArtifact {
     groupId = "uk.co.real-logic";
-    version = "1.30.0";
+    version = "1.31.1";
     artifactId = "sbe-all";
-    hash = "sha512-K/LMP6zNBHl2Wpvli/sH+ZsYwlTPJHHCKee7riOH6dR8nxTJgucnF7AsbVOpowR6xaV3wPjFh0iqWp/oerHKBg==";
+    hash = "sha512-Ypsk8PbShFOxm49u1L+TTuApaW6ECTSee+hHEhmY/jNi5AymHXBWwDMBMkzC25aowiHLJS5EnzLk6hu9Lea93Q==";
   };
 
-  sbeAll = sbeAll_1_30_0;
+  sbeAll = sbeAll_1_31_1;
 
 in
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     owner = "real-logic";
     repo = "aeron";
     rev = version;
-    hash = "sha256-MY7I8Cw1izVLW3/JWav9zPIBJTGInZHwAZT2e7tI9F0=";
+    hash = "sha256-sROEZVOfScrlqMLbfrPtw3LQCQ5TfMcrLiP6j/Z9rSM=";
   };
 
   patches = [
@@ -98,7 +98,7 @@ stdenv.mkDerivation {
         aeron_driver_static \
         aeronmd
 
-      make -j $NIX_BUILD_CORES install
+      make install
     )
 
     runHook postBuild
diff --git a/pkgs/by-name/ap/aphorme/package.nix b/pkgs/by-name/ap/aphorme/package.nix
new file mode 100644
index 0000000000000..b46dceef65062
--- /dev/null
+++ b/pkgs/by-name/ap/aphorme/package.nix
@@ -0,0 +1,52 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, wayland
+, libxkbcommon
+, libGL
+, stdenv
+, testers
+, aphorme
+, autoPatchelfHook
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "aphorme";
+  version = "0.1.19";
+
+  src = fetchFromGitHub {
+    owner = "Iaphetes";
+    repo = "aphorme_launcher";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-p1ZIMMDyQWVzoeyHb3sbeV6XQwbIDoQwJU8ynI8hGUI=";
+  };
+
+  cargoHash = "sha256-aFoy5KTapx+5aIzvDwMfjxZQ6WKQtvX3h7rNX4LBeN8=";
+
+  # No tests exist
+  doCheck = false;
+
+  buildInputs = [ stdenv.cc.cc.lib ];
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  runtimeDependencies = [
+    wayland
+    libGL
+    libxkbcommon
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = aphorme;
+    command = "aphorme --version";
+    version = "aphorme ${version}";
+  };
+
+  meta = {
+    description = "A program launcher for window managers, written in Rust";
+    mainProgram = "aphorme";
+    homepage = "https://github.com/Iaphetes/aphorme_launcher";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ anytimetraveler ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/be/betula/package.nix b/pkgs/by-name/be/betula/package.nix
index 1e27400950235..c29e6e850e75c 100644
--- a/pkgs/by-name/be/betula/package.nix
+++ b/pkgs/by-name/be/betula/package.nix
@@ -3,15 +3,15 @@
 , buildGoModule
 }: buildGoModule rec {
   pname = "betula";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromSourcehut {
     owner = "~bouncepaw";
     repo = "betula";
     rev = "v${version}";
-    hash = "sha256-MH6YeWG94YVBgx5Es3oMJ9A/hAPPBXpAcIdCJV3HX78=";
+    hash = "sha256-oxwOGpf305VDlY3Mwl0dRJRRhe0yolaMMlpNspZdKQk=";
   };
-  vendorHash = "sha256-wiMIhoSO7nignNWY16OpDYZCguRbcEwwO/HggKSC5jM=";
+  vendorHash = "sha256-DjL2h6YKCJOWgmR/Gb0Eja38yJ4DymqW/SzmPG3+q9w=";
 
   CGO_ENABLED = 1;
   # These tests use internet, so are failing in Nix build.
diff --git a/pkgs/by-name/bi/biglybt/package.nix b/pkgs/by-name/bi/biglybt/package.nix
new file mode 100644
index 0000000000000..ad365c14377a3
--- /dev/null
+++ b/pkgs/by-name/bi/biglybt/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jre,
+  wrapGAppsHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "biglybt";
+  version = "3.5.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/BiglySoftware/BiglyBT/releases/download/v${version}/GitHub_BiglyBT_unix.tar.gz";
+    hash = "sha256-ToTCIjunj/ABi3wVSmeddLGBdQlv+CfK2jGRjixJd0w=";
+  };
+
+  nativeBuildInputs = [ wrapGAppsHook ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    sed -e 's/AUTOUPDATE_SCRIPT=1/AUTOUPDATE_SCRIPT=0/g' \
+      -i biglybt || die
+
+    runHook postConfigure
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -d $out/{share/{biglybt,applications,icons/hicolor/scalable/apps},bin}
+
+    cp -r ./* $out/share/biglybt/
+
+    ln -s $out/share/biglybt/biglybt.desktop $out/share/applications/
+
+    ln -s $out/share/biglybt/biglybt.svg $out/share/icons/hicolor/scalable/apps/
+
+    wrapProgram $out/share/biglybt/biglybt \
+      --prefix PATH : ${lib.makeBinPath [ jre ]}
+
+    ln -s $out/share/biglybt/biglybt $out/bin/
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^(v[0-9.]+)$"
+    ];
+  };
+
+  meta = {
+    changelog = "https://github.com/BiglySoftware/BiglyBT/releases/tag/v${version}";
+    description = "A BitTorrent client based on the Azureus that supports I2P darknet for privacy";
+    downloadPage = "https://github.com/BiglySoftware/BiglyBT";
+    homepage = "https://www.biglybt.com/";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    mainProgram = "biglybt";
+    maintainers = with lib.maintainers; [ raspher ];
+  };
+}
diff --git a/pkgs/by-name/ca/cargo-expand/package.nix b/pkgs/by-name/ca/cargo-expand/package.nix
index 922fe9d939425..1ee53112cff12 100644
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.84";
+  version = "1.0.85";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    hash = "sha256-b98OVx7vkA3sgxp8yPzdV7jAjsTqqTeffibCtK3hoMM=";
+    hash = "sha256-2i9FAWF9b1tNdDbTwCzQY8Mh/h85uigR5IT9kzPft00=";
   };
 
-  cargoHash = "sha256-BH01DgwOdP9f0KFIbbF8RRhl/oivBET2ujxdzZ56lC0=";
+  cargoHash = "sha256-Vl0zC9TPhiFv2SiZtzIUV7GftB1y9K1gLy1ajisP8Y0=";
 
   meta = with lib; {
     description = "Cargo subcommand to show result of macro expansion";
diff --git a/pkgs/by-name/cl/clatd/package.nix b/pkgs/by-name/cl/clatd/package.nix
new file mode 100644
index 0000000000000..dff8ce4261a93
--- /dev/null
+++ b/pkgs/by-name/cl/clatd/package.nix
@@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, perl
+, perlPackages
+, tayga
+, iproute2
+, iptables
+}:
+
+stdenv.mkDerivation rec {
+  pname = "clatd";
+  version = "1.6";
+
+  src = fetchFromGitHub {
+    owner = "toreanderson";
+    repo = "clatd";
+    rev = "v${version}";
+    hash = "sha256-ZUGWQTXXgATy539NQxkZSvQA7HIWkIPsw1NJrz0xKEg=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    perl # for pod2man
+  ];
+
+  buildInputs = with perlPackages; [
+    perl
+    NetIP
+    NetDNS
+  ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  preBuild = ''
+    mkdir -p $out/{sbin,share/man/man8}
+  '';
+
+  postFixup = ''
+    patchShebangs $out/bin/clatd
+    wrapProgram $out/bin/clatd \
+      --set PERL5LIB $PERL5LIB \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          tayga
+          iproute2
+          iptables
+        ]
+      }
+  '';
+
+  meta = with lib; {
+    description = "A 464XLAT CLAT implementation for Linux";
+    homepage = "https://github.com/toreanderson/clatd";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jmbaur ];
+    mainProgram = "clatd";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/cl/clipcat/package.nix b/pkgs/by-name/cl/clipcat/package.nix
index fdf91c96f8d99..68e6744bd1752 100644
--- a/pkgs/by-name/cl/clipcat/package.nix
+++ b/pkgs/by-name/cl/clipcat/package.nix
@@ -1,25 +1,34 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , rustPlatform
 , protobuf
 , installShellFiles
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "clipcat";
-  version = "0.16.6";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "xrelkd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FSgBTQGl8LSLdv+SOAgQWLWiqFY+PRQBFYYdbmCttcY=";
+    hash = "sha256-e95h8YBVLcy9vubdJpfmeystT2Qw0Y8kap9IbTJW+s8=";
   };
 
-  cargoHash = "sha256-TrzHmWUDAe4gbwm+VoTOuC50CWWnFsF99zscM85ammo=";
+  cargoHash = "sha256-+73vnGcdCDRMrav/Pi4Z37IlbArJ/SlYishz9KhF4x0=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Cocoa
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
 
   nativeBuildInputs = [
     protobuf
+
     installShellFiles
   ];
 
@@ -42,7 +51,7 @@ rustPlatform.buildRustPackage rec {
     description = "Clipboard Manager written in Rust Programming Language";
     homepage = "https://github.com/xrelkd/clipcat";
     license = licenses.gpl3Only;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ xrelkd ];
     mainProgram = "clipcatd";
   };
diff --git a/pkgs/by-name/co/corto/package.nix b/pkgs/by-name/co/corto/package.nix
new file mode 100644
index 0000000000000..acf0517e0c10a
--- /dev/null
+++ b/pkgs/by-name/co/corto/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation {
+  pname = "corto";
+  version = "0-unstable-2024-04-05";
+
+  src = fetchFromGitHub {
+    owner = "cnr-isti-vclab";
+    repo = "corto";
+    rev = "d880519c490c88a39d12c31a914b6a687a7019c3";
+    hash = "sha256-0OUijrf+0ZNv3oYko2r8Kp9zgtg8b9RPL7DXHf15Ryc=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Mesh compression library, designed for rendering and speed";
+    homepage = "https://github.com/cnr-isti-vclab/corto";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nim65s ];
+  };
+}
diff --git a/pkgs/by-name/cr/crunchy-cli/Cargo.lock b/pkgs/by-name/cr/crunchy-cli/Cargo.lock
index 682b85db2fbe0..3e16a615852a1 100644
--- a/pkgs/by-name/cr/crunchy-cli/Cargo.lock
+++ b/pkgs/by-name/cr/crunchy-cli/Cargo.lock
@@ -217,9 +217,9 @@ checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
 
 [[package]]
 name = "chrono"
-version = "0.4.37"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0d04d43504c61aa6c7531f1871dd0d418d91130162063b789da00fd7057a5e"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -354,7 +354,7 @@ checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "crunchy-cli"
-version = "3.4.3"
+version = "3.5.0"
 dependencies = [
  "chrono",
  "clap",
@@ -367,7 +367,7 @@ dependencies = [
 
 [[package]]
 name = "crunchy-cli-core"
-version = "3.4.3"
+version = "3.5.0"
 dependencies = [
  "anyhow",
  "async-speed-limit",
@@ -404,9 +404,9 @@ dependencies = [
 
 [[package]]
 name = "crunchyroll-rs"
-version = "0.10.7"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf93641a3697ba4cd6845b3a741089f4b4c692a91ed40dece6d7376c419ef9"
+checksum = "ccd0a624f3f8ec3fb7af8d83b907142aaee1858579ab697f24f05d00736e5bb2"
 dependencies = [
  "async-trait",
  "chrono",
@@ -430,9 +430,9 @@ dependencies = [
 
 [[package]]
 name = "crunchyroll-rs-internal"
-version = "0.10.7"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48daba6fe0296c2b400cd6545cf2e8ee23870f1a5a35291fa2d61987098a5692"
+checksum = "85c3614a871ec25ab17425405b08aea3c5869597e2348302b922c2a077aa9c3a"
 dependencies = [
  "darling",
  "quote",
@@ -486,9 +486,9 @@ dependencies = [
 
 [[package]]
 name = "dash-mpd"
-version = "0.16.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cafa2c33eff2857e1a14c38aa9a432aa565a01e77804a541fce7aec3affb8f8"
+checksum = "79b4bdd5f1c0c7493d780c645f0bff5b9361e6408210fa88910adb181efca64c"
 dependencies = [
  "base64 0.22.0",
  "base64-serde",
@@ -831,9 +831,9 @@ checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
 
 [[package]]
 name = "hyper"
-version = "1.2.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "186548d73ac615b32a73aafe38fb4f56c0d340e110e5a200bcadbaf2e199263a"
+checksum = "fe575dd17d0862a9a33781c8c4696a55c320909004a67a00fb286ba8b1bc496d"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -1375,9 +1375,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.79"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
  "unicode-ident",
 ]
@@ -1459,9 +1459,9 @@ checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "reqwest"
-version = "0.12.3"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e6cc1e89e689536eb5aeede61520e874df5a4707df811cd5da4aa5fbb2aae19"
+checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
 dependencies = [
  "base64 0.22.0",
  "bytes",
@@ -1576,9 +1576,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.22.3"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99008d7ad0bbbea527ec27bddbc0e432c5b87d8175178cee68d2eec9c4a1813c"
+checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
 dependencies = [
  "log",
  "ring",
@@ -1668,18 +1668,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.197"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.197"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1688,9 +1688,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.115"
+version = "1.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12dc5c46daa8e9fdf4f5e71b6cf9a53f2487da0e86e55808e2d35539666497dd"
+checksum = "3e17db7126d17feb94eb3fad46bf1a96b034e8aacbc2e775fe81505f8b0b2813"
 dependencies = [
  "itoa",
  "ryu",
@@ -1838,9 +1838,9 @@ checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
 
 [[package]]
 name = "syn"
-version = "2.0.58"
+version = "2.0.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44cfb93f38070beee36b3fef7d4f5a16f27751d94b187b666a5cc5e9b0d30687"
+checksum = "909518bc7b1c9b779f1bbf07f2929d35af9f0f37e47c6e9ef7f9dddc1e1821f3"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/pkgs/by-name/cr/crunchy-cli/package.nix b/pkgs/by-name/cr/crunchy-cli/package.nix
index a07cdeb9fa996..1573090d58d69 100644
--- a/pkgs/by-name/cr/crunchy-cli/package.nix
+++ b/pkgs/by-name/cr/crunchy-cli/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "crunchy-cli";
-  version = "3.4.3";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "crunchy-labs";
     repo = "crunchy-cli";
     rev = "v${version}";
-    hash = "sha256-/7zJbmMPoHEpcsDPe1eVenxGenPCU6CcHE8nTBTHil8=";
+    hash = "sha256-ykE4TqsBv6VEOgwKixo8IvgJt8CwCSTl5DcKfNGycdI=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/do/dogedns/package.nix b/pkgs/by-name/do/dogedns/package.nix
new file mode 100644
index 0000000000000..0c94a9506d2c0
--- /dev/null
+++ b/pkgs/by-name/do/dogedns/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, installShellFiles
+, stdenv
+, pkg-config
+, openssl
+, pandoc
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "dogedns";
+  version = "0.2.6";
+
+  src = fetchFromGitHub {
+    owner = "Dj-Codeman";
+    repo = "doge";
+    rev = "6dd0383f31c096bfe2b6918c36b6e2c48414e753";
+    hash = "sha256-cvqDSTHFf/le2jItGTSkAGURj64WRvOmMRI+vFH0/50=";
+  };
+
+  cargoHash = "sha256-v9AuX7FZfy18yu4P9ovHsL5AQIYhPa8NEsMziEeHCJ8=";
+
+  patches = [
+    # remove date info to make the build reproducible
+    # remove commit hash to avoid dependency on git and the need to keep `.git`
+    ./remove-date-info.patch
+  ];
+
+  nativeBuildInputs = [ installShellFiles pandoc ]
+    ++ lib.optionals stdenv.isLinux [ pkg-config ];
+  buildInputs = lib.optionals stdenv.isLinux [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+
+ postInstall = ''
+    installShellCompletion completions/doge.{bash,fish,zsh}
+    installManPage ./target/man/*.1
+  '';
+
+  meta = with lib; {
+    description = "Reviving A command-line DNS client";
+    homepage = "https://github.com/Dj-Codeman/doge";
+    license = licenses.eupl12;
+    mainProgram = "doge";
+    maintainers = with maintainers; [ aktaboot ];
+  };
+}
diff --git a/pkgs/by-name/do/dogedns/remove-date-info.patch b/pkgs/by-name/do/dogedns/remove-date-info.patch
new file mode 100644
index 0000000000000..0495ec4db4611
--- /dev/null
+++ b/pkgs/by-name/do/dogedns/remove-date-info.patch
@@ -0,0 +1,11 @@
+--- a/build.rs
++++ b/build.rs
+@@ -34,7 +34,7 @@ fn main() -> io::Result<()> {
+             format!("{}\nv{} \\1;31m(beta debug build!)\\0m\n\\1;4;34m{}\\0m", tagline, version_string(), url)
+         }
+         else if is_development_version() {
+-            format!("{}\nv{} [{}] built on {} \\1;31m(beta-release!)\\0m\n\\1;4;34m{}\\0m", tagline, version_string(), git_hash(), build_date(), url)
++            format!("{}\nv{} [nixpkgs] \\1;31m(beta-release!)\\0m\n\\1;4;34m{}\\0m", tagline, version_string(),  url)
+         }
+         else {
+             format!("{}\nv{}\n\\1;4;34m{}\\0m", tagline, version_string(), url)
diff --git a/pkgs/by-name/do/dorion/package.nix b/pkgs/by-name/do/dorion/package.nix
index 9e77085ac9e26..32529e8fcf2ef 100644
--- a/pkgs/by-name/do/dorion/package.nix
+++ b/pkgs/by-name/do/dorion/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   name = "dorion";
-  version = "4.1.3";
+  version = "4.2.0";
 
   src = fetchurl {
     url = "https://github.com/SpikeHD/Dorion/releases/download/v${finalAttrs.version }/Dorion_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-O6KXOouutrNla5dkHRQeT0kp8DQO9MLoJrIMuqam/60=";
+    hash = "sha256-QqjRxAx2hDd8atpXuof8AVWtK3o8K77Se2b2CyOBMOw=";
   };
 
   unpackCmd = ''
diff --git a/pkgs/by-name/do/doublecmd/package.nix b/pkgs/by-name/do/doublecmd/package.nix
index 35746a409c77c..eb4de12dfd2f8 100644
--- a/pkgs/by-name/do/doublecmd/package.nix
+++ b/pkgs/by-name/do/doublecmd/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doublecmd";
-  version = "1.1.12";
+  version = "1.1.13";
 
   src = fetchFromGitHub {
     owner = "doublecmd";
     repo = "doublecmd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8wwYyZ9Uq65jEmgA1yO001YSZuDLnXLrFjK6WIsppwU=";
+    hash = "sha256-QJPLDqdXttUSeCm1QpQ7oFgvDmzStz9maW0c5xhOLtg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/du/dublin-traceroute/package.nix b/pkgs/by-name/du/dublin-traceroute/package.nix
index 5f559c4d97c49..5e797cf97b57f 100644
--- a/pkgs/by-name/du/dublin-traceroute/package.nix
+++ b/pkgs/by-name/du/dublin-traceroute/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "dublin-traceroute";
-  version = "0.4.2-unstable-2024-01-09";
+  version = "0.4.2-unstable-2024-04-11";
 
   src = fetchFromGitHub {
     owner = "insomniacslk";
     repo = "dublin-traceroute";
-    rev = "b136db81cfbb30d5fd324dfccc97fca49a5ecee1";
-    hash = "sha256-FsolpeQGaLDjDE5Yk58t2hFQJgM58zafIx6s5ejYKnY=";
+    rev = "a92118d93fd1fa7bdb827e741dd848b7f7083a1e";
+    hash = "sha256-UJeFPVi3423Jh72fVk8QbLX1tTNAQ504xYs9HwVCkZc=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -37,5 +37,6 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ baloo ];
     platforms = platforms.unix;
     mainProgram = "dublin-traceroute";
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch b/pkgs/by-name/ea/earlyoom/0000-fix-dbus-path.patch
index e1c10cf82f96e..e1c10cf82f96e 100644
--- a/pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch
+++ b/pkgs/by-name/ea/earlyoom/0000-fix-dbus-path.patch
diff --git a/pkgs/by-name/ea/earlyoom/package.nix b/pkgs/by-name/ea/earlyoom/package.nix
new file mode 100644
index 0000000000000..ba69b72b3babf
--- /dev/null
+++ b/pkgs/by-name/ea/earlyoom/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  fetchFromGitHub,
+  installShellFiles,
+  pandoc,
+  stdenv,
+  nixosTests,
+  # Boolean flags
+  withManpage ? true,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "earlyoom";
+  version = "1.8";
+
+  src = fetchFromGitHub {
+    owner = "rfjakob";
+    repo = "earlyoom";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-jgNoYOGor2i3ngDuU3It238n5ky+AppzlRKdkwXb2AI=";
+  };
+
+  outputs = [ "out" ] ++ lib.optionals withManpage [ "man" ];
+
+  patches = [ ./0000-fix-dbus-path.patch ];
+
+  nativeBuildInputs = lib.optionals withManpage [
+    installShellFiles
+    pandoc
+  ];
+
+  makeFlags = [
+    "VERSION=${finalAttrs.version}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D earlyoom $out/bin/earlyoom
+  '' + lib.optionalString withManpage ''
+    installManPage earlyoom.1
+  '' + ''
+    runHook postInstall
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) earlyoom;
+  };
+
+  meta = {
+    homepage = "https://github.com/rfjakob/earlyoom";
+    description = "Early OOM Daemon for Linux";
+    longDescription = ''
+      earlyoom checks the amount of available memory and free swap up to 10
+      times a second (less often if there is a lot of free memory). By default
+      if both are below 10%, it will kill the largest process (highest
+      oom_score). The percentage value is configurable via command line
+      arguments.
+    '';
+    license = lib.licenses.mit;
+    mainProgram = "earlyoom";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/ei/eigenlayer/package.nix b/pkgs/by-name/ei/eigenlayer/package.nix
index 6f24e3169e355..484d1007f25a4 100644
--- a/pkgs/by-name/ei/eigenlayer/package.nix
+++ b/pkgs/by-name/ei/eigenlayer/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "eigenlayer";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "Layr-Labs";
     repo = "eigenlayer-cli";
     rev = "v${version}";
-    hash = "sha256-vGXu6xQUeXLUkmLqJEXaVNXhxXZSmVlnQicBZAfj768=";
+    hash = "sha256-HsDuDe2ANxL+cTJ3mm1enLoKRewZ9Ey/YajpsLO66JA=";
   };
 
-  vendorHash = "sha256-9DbyfUKJjzqbZcX7j/df6fdtgZt3RY1kq2H2RK+5Vfk=";
+  vendorHash = "sha256-aclRbQtGg6yQMJtaO1WjtHLXU7cE1HX1ZDckRIEtw6o=";
 
   ldflags = ["-s" "-w"];
   subPackages = ["cmd/eigenlayer"];
diff --git a/pkgs/by-name/et/etlegacy-unwrapped/package.nix b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
index 84526ae11ada5..906ffa86c2183 100644
--- a/pkgs/by-name/et/etlegacy-unwrapped/package.nix
+++ b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
@@ -22,7 +22,7 @@
 , zlib
 }:
 let
-  version = "2.82.0";
+  version = "2.82.1";
   fakeGit = writeShellApplication {
     name = "git";
 
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
     owner = "etlegacy";
     repo = "etlegacy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yNVVEa+3+Swm3hgwm9cSLV0K88E37TgVVjh1uUl8O2o=";
+    hash = "sha256-DA5tudbehXIU+4hX3ggcxWZ7AAOa8LUkIvUHbgMgDY8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/et/etlegacy/package.nix b/pkgs/by-name/et/etlegacy/package.nix
index 446659c0148fb..245291d1e99fa 100644
--- a/pkgs/by-name/et/etlegacy/package.nix
+++ b/pkgs/by-name/et/etlegacy/package.nix
@@ -7,7 +7,7 @@
 
 symlinkJoin {
   name = "etlegacy";
-  version = "2.82.0";
+  version = "2.82.1";
   paths = [
     etlegacy-assets
     etlegacy-unwrapped
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index b9696d263117d..80aa328d289ec 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.18.10";
+  version = "0.18.11";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-qXyuibsgEF/wv2736r3EMpoXjyDFI3QFjVRsg9cI0u0=";
+    hash = "sha256-jh1YmY3G3oL8HfgojGtrJLvgLT+gyTX0fsv/11UDIJ0=";
   };
 
-  cargoHash = "sha256-9xtJJDP3f4aRPTgnpor0nSp5ehbX7Qt9U3LN9kkDWrI=";
+  cargoHash = "sha256-4ziEG7P7igCkN6UnVqaWXgqfW+XssUP4Rn867ELXYmU=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/fe/feather/package.nix b/pkgs/by-name/fe/feather/package.nix
index 99e7cf6e2166b..659f7ad1872f0 100644
--- a/pkgs/by-name/fe/feather/package.nix
+++ b/pkgs/by-name/fe/feather/package.nix
@@ -9,6 +9,7 @@
 , openssl
 , pkg-config
 , protobuf
+, python3
 , qrencode
 , qt6
 , readline
@@ -34,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     pkg-config
+    python3
     qt6.wrapQtAppsHook
   ];
 
diff --git a/pkgs/by-name/fi/files-cli/package.nix b/pkgs/by-name/fi/files-cli/package.nix
index 4694a57c688f8..834efb9d85e94 100644
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.13.2";
+  version = "2.13.7";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-xlsM3WVnhZlEwnPNpUaB8IIwsoqt1C0XVsbqm9G1vuU=";
+    hash = "sha256-ozHHoPIpT0kpUUWnnaAbYeW7knZDN4kFB3edQ4NKpes=";
   };
 
-  vendorHash = "sha256-7KL73P7oKrK2Sfgk/74D3cmQGXoDau+3gBThn+37pb8=";
+  vendorHash = "sha256-K3Dabeh3RcfTgBJ33k3/Ox6zcthFj5qK3fWBN2Jivz8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fi/find-billy/package.nix b/pkgs/by-name/fi/find-billy/package.nix
new file mode 100644
index 0000000000000..89d89dd104f3a
--- /dev/null
+++ b/pkgs/by-name/fi/find-billy/package.nix
@@ -0,0 +1,70 @@
+{ stdenv
+, lib
+, fetchFromGitea
+, godot3-headless
+, godot3-export-templates
+, godot3
+, makeWrapper
+, just
+, inkscape
+, imagemagick
+}:
+
+stdenv.mkDerivation rec {
+  pname = "find-billy";
+  version = "0.37.3";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "annaaurora";
+    repo = "Find-Billy";
+    rev = "v${version}";
+    hash = "sha256-z1GR5W67LJb5z+u/qeFZreMK4B6PjB18coecLCYFHy8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ godot3-headless makeWrapper just inkscape imagemagick ];
+
+  postPatch = ''
+    substituteInPlace export_presets.cfg --replace 'res://build/icons/usr/share/icons/hicolor' $out/share/icons/hicolor
+    substituteInPlace project.godot --replace 'res://build/icons/usr/share/icons/hicolor' $out/share/icons/hicolor
+
+    substituteInPlace justfile --replace '{{build_icons_dir}}/usr' $out
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # Cannot create file `/homeless-shelter/.config/godot/projects/...`
+    export HOME=$TMPDIR
+    # Link the export-templates to the expected location. The `--export` option expects the templates in the home directory.
+    mkdir -p $HOME/.local/share/godot
+    ln -s ${godot3-export-templates}/share/godot/templates $HOME/.local/share/godot
+
+    mkdir -p $out/share/find-billy
+    godot3-headless --export-pack 'Linux/X11' $out/share/${pname}/${pname}.pck
+    makeWrapper ${godot3}/bin/godot3 $out/bin/${pname} \
+      --add-flags "--main-pack" \
+      --add-flags "$out/share/${pname}/${pname}.pck"
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    just build-icons
+    install -D ${pname}.desktop -t $out/share/applications
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A 2 dimensional Pixel Art Jump & Run";
+    homepage = "https://codeberg.org/annaaurora/Find-Billy";
+    license = licenses.gpl3Plus;
+    platforms = [ "x86_64-linux" ];
+    maintainers = [ maintainers.annaaurora ];
+  };
+}
diff --git a/pkgs/by-name/fi/firefly-iii/package.nix b/pkgs/by-name/fi/firefly-iii/package.nix
new file mode 100644
index 0000000000000..850bb85755d65
--- /dev/null
+++ b/pkgs/by-name/fi/firefly-iii/package.nix
@@ -0,0 +1,60 @@
+{ lib
+, fetchFromGitHub
+, buildNpmPackage
+, php83
+, nixosTests
+, dataDir ? "/var/lib/firefly-iii"
+}:
+
+let
+  pname = "firefly-iii";
+  version = "6.1.13";
+  phpPackage = php83;
+
+  src = fetchFromGitHub {
+    owner = "firefly-iii";
+    repo = "firefly-iii";
+    rev = "v${version}";
+    hash = "sha256-85zI8uCyyoCflzxDkvba6FWa9B3kh179DJfQ2Um6MGM=";
+  };
+
+  assets = buildNpmPackage {
+    pname = "${pname}-assets";
+    inherit version src;
+    npmDepsHash = "sha256-wuPUE6XuzzgKjpxZVgwh2wGut15M61WSBFG+YIZwOFM=";
+    dontNpmBuild = true;
+    installPhase = ''
+      runHook preInstall
+      npm run build
+      cp -r ./public $out/
+      runHook postInstall
+    '';
+  };
+in
+
+phpPackage.buildComposerProject (finalAttrs: {
+  inherit pname src version;
+
+  vendorHash = "sha256-CVGKyyLp5hjjpEulDNEYfljU4OgPBaFcYQQAUf6GeGs=";
+
+  passthru = {
+    inherit phpPackage;
+    tests = nixosTests.firefly-iii;
+  };
+
+  postInstall = ''
+    mv $out/share/php/${pname}/* $out/
+    rm -R $out/share $out/storage $out/bootstrap/cache $out/public
+    cp -a ${assets} $out/public
+    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/cache $out/bootstrap/cache
+  '';
+
+  meta = {
+    changelog = "https://github.com/firefly-iii/firefly-iii/releases/tag/v${version}";
+    description = "Firefly III: a personal finances manager";
+    homepage = "https://github.com/firefly-iii/firefly-iii";
+    license = lib.licenses.agpl3Only;
+    maintainers = [ lib.maintainers.savyajha ];
+  };
+})
diff --git a/pkgs/by-name/fi/firefoxpwa/package.nix b/pkgs/by-name/fi/firefoxpwa/package.nix
index 971d5ac16fdea..b75d6694c19df 100644
--- a/pkgs/by-name/fi/firefoxpwa/package.nix
+++ b/pkgs/by-name/fi/firefoxpwa/package.nix
@@ -1,22 +1,26 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, makeWrapper
-, pkg-config
-, installShellFiles
-, firefox-unwrapped
-, openssl
-, stdenv
-, udev
-, libva
-, mesa
-, libnotify
-, xorg
-, cups
-, pciutils
-, libcanberra-gtk3
-, extraLibs ? [ ]
-, nixosTests
+{
+  extraLibs ? [ ],
+
+  lib,
+  fetchFromGitHub,
+  installShellFiles,
+  makeWrapper,
+  rustPlatform,
+
+  cups,
+  firefox-unwrapped,
+  libcanberra-gtk3,
+  libglvnd,
+  libnotify,
+  libva,
+  mesa,
+  nixosTests,
+  openssl,
+  pciutils,
+  pkg-config,
+  stdenv,
+  udev,
+  xorg,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -47,7 +51,11 @@ rustPlatform.buildRustPackage rec {
     sed -i $'s;DISTRIBUTION_VERSION = \'0.0.0\';DISTRIBUTION_VERSION = \'${version}\';' userchrome/profile/chrome/pwa/chrome.jsm
   '';
 
-  nativeBuildInputs = [ makeWrapper pkg-config installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+    pkg-config
+  ];
   buildInputs = [ openssl ];
 
   FFPWA_EXECUTABLES = ""; # .desktop entries generated without any store path references
@@ -55,7 +63,23 @@ rustPlatform.buildRustPackage rec {
   completions = "target/${stdenv.targetPlatform.config}/release/completions";
 
   gtk_modules = map (x: x + x.gtkModule) [ libcanberra-gtk3 ];
-  libs = let libs = lib.optionals stdenv.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver cups pciutils ] ++ gtk_modules ++ extraLibs; in lib.makeLibraryPath libs + ":" + lib.makeSearchPathOutput "lib" "lib64" libs;
+  libs =
+    let
+      libs =
+        lib.optionals stdenv.isLinux [
+          cups
+          libglvnd
+          libnotify
+          libva
+          mesa
+          pciutils
+          udev
+          xorg.libXScrnSaver
+        ]
+        ++ gtk_modules
+        ++ extraLibs;
+    in
+    lib.makeLibraryPath libs + ":" + lib.makeSearchPathOutput "lib" "lib64" libs;
 
   postInstall = ''
     # Runtime
@@ -127,7 +151,11 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/filips123/PWAsForFirefox/releases/tag/v${version}";
     license = licenses.mpl20;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ camillemndn pasqui23 ];
+    maintainers = with maintainers; [
+      adamcstephens
+      camillemndn
+      pasqui23
+    ];
     mainProgram = "firefoxpwa";
   };
 }
diff --git a/pkgs/by-name/fo/fork-cleaner/package.nix b/pkgs/by-name/fo/fork-cleaner/package.nix
new file mode 100644
index 0000000000000..30a670ab189bc
--- /dev/null
+++ b/pkgs/by-name/fo/fork-cleaner/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+let
+  version = "2.3.1";
+in
+buildGoModule {
+  name = "fork-cleaner";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "caarlos0";
+    repo = "fork-cleaner";
+    rev = "v${version}";
+    sha256 = "sha256-JNmpcDwmxR+s4regOWz8FAJllBNRfOCmVwkDs7tlChA=";
+  };
+
+  vendorHash = "sha256-QuIaXXkch5PCpX8P755X8j7MeNnbewWo7NB+Vue1/Pk=";
+
+  # allowGoRefence adds the flag `-trimpath` which is also denoted by, fork-cleaner goreleaser config
+  #  <https://github.com/caarlos0/fork-cleaner/blob/645345bf97d751614270de4ade698ddbc53509c1/goreleaser.yml#L38>
+  allowGoReference = true;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+    "-X main.builtBy=nixpkgs"
+  ];
+
+  meta = {
+    description = "Quickly clean up unused forks on your GitHub account";
+    homepage = "https://github.com/caarlos0/fork-cleaner";
+    changelog = "https://github.com/caarlos0/fork-cleaner/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ isabelroses ];
+    mainProgram = "fork-cleaner";
+  };
+}
diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix
index 96102fe2258c1..dcd00d290599a 100644
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -43,14 +43,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.14.3";
+  version = "3.14.4";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     rev = "refs/tags/${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-+6RyrdHRDk9aeM52wcgLo966jP70EAiXSMR3sffNeZM=";
+    hash = "sha256-kmi+3EH5h5kQeyTB3RnnndPn+akHFAF0N7Gt/aCOdcs=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ga/gatus/package.nix b/pkgs/by-name/ga/gatus/package.nix
index ef7df35bdaed5..1e10ce2db4759 100644
--- a/pkgs/by-name/ga/gatus/package.nix
+++ b/pkgs/by-name/ga/gatus/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gatus";
-  version = "5.9.0";
+  version = "5.10.0";
 
   src = fetchFromGitHub {
     owner = "TwiN";
     repo = "gatus";
     rev = "v${version}";
-    hash = "sha256-obrdEnNxLdWtbGL57D/nTClaOdzJlLDU3+K9VdR8XI4=";
+    hash = "sha256-gZSK3ebBBJGHRdylCl18AYifGknYbOz7+xaCJjU9ZlY=";
   };
 
-  vendorHash = "sha256-VICVo7XYeHs/43knHA4CMSgHloyYSjOFe1TUb4u+egE=";
+  vendorHash = "sha256-sZ6IPYitNnnw7+UQVAWFEe9/ObDhAiou1GzDDqnGXb8=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/gi/gitu/package.nix b/pkgs/by-name/gi/gitu/package.nix
index 4fc148542604f..8754c3bb7ed78 100644
--- a/pkgs/by-name/gi/gitu/package.nix
+++ b/pkgs/by-name/gi/gitu/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitu";
-  version = "0.16.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "altsem";
     repo = "gitu";
     rev = "v${version}";
-    hash = "sha256-ePyMyKCI8fHKfoNCMYyYeCPkyYF5KyMYaPrB1NtovCs=";
+    hash = "sha256-9OY6zBW7UA4lTH+NI61xuil5p2ChQESXrG2zTxdJblE=";
   };
 
-  cargoHash = "sha256-1komuFSucXYdgeAFWeeuMmZYxb6Mzku7hdltDwKAa7A=";
+  cargoHash = "sha256-gVmoKneAtC5dJh5Z+3aXwxCixrPZTRcxQRpoSh4S1e4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/gl/glider/package.nix b/pkgs/by-name/gl/glider/package.nix
new file mode 100644
index 0000000000000..55304ada4c985
--- /dev/null
+++ b/pkgs/by-name/gl/glider/package.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+buildGoModule rec {
+  pname = "glider";
+  version = "0.16.3";
+
+  src = fetchFromGitHub {
+    owner = "nadoo";
+    repo = "glider";
+    rev = "v${version}";
+    hash = "sha256-nM6jKFqyaxZbn0wyEt0xy9uTu9JyLRfGTNsGPTQOXQw=";
+  };
+
+  vendorHash = "sha256-PGIBBop/waZDeQvW7iSi/AzLye/4t7nNXjX8zJsS2eo=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  postInstall = ''
+    substituteInPlace systemd/glider@.service \
+      --replace-fail "/usr/bin/glider" "$out/bin/glider"
+    install -Dm444 -t "$out/lib/systemd/system/" systemd/glider@.service
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/nadoo/glider";
+    description = "Forward proxy with multiple protocols support";
+    license = licenses.gpl3Only;
+    mainProgram = "glider";
+    maintainers = with maintainers; [ oluceps ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/go/go-camo/package.nix b/pkgs/by-name/go/go-camo/package.nix
index 42cc8b7ba5daa..e90fa676cbd4d 100644
--- a/pkgs/by-name/go/go-camo/package.nix
+++ b/pkgs/by-name/go/go-camo/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-camo";
-  version = "2.4.11";
+  version = "2.4.12";
 
   src = fetchFromGitHub {
     owner = "cactus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wgneDCBiHg9M1PtLHFxEXRhK9fBNKPWQwV0fwUFxEgQ=";
+    sha256 = "sha256-rlzAx6xjV4JR3RDL+Kr2ghN3qpfIRqVZ5z/SyDBBaIc=";
   };
 
-  vendorHash = "sha256-duTW42UL8EtnxUvPr2GXHKcaGQ3d0u2maMzSIOHIxxI=";
+  vendorHash = "sha256-iyZNOooPH1jvT+S9/ETRoXsTwXUIUi1UKmDzhB7NRuE=";
 
   ldflags = [ "-s" "-w" "-X=main.ServerVersion=${version}" ];
 
diff --git a/pkgs/by-name/gv/gvisor/package.nix b/pkgs/by-name/gv/gvisor/package.nix
index ceb122a2c08db..0a83adc5953c3 100644
--- a/pkgs/by-name/gv/gvisor/package.nix
+++ b/pkgs/by-name/gv/gvisor/package.nix
@@ -47,6 +47,6 @@ buildGoModule {
     homepage = "https://github.com/google/gvisor";
     license = licenses.asl20;
     maintainers = with maintainers; [ andrew-d gpl ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 }
diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index 391bc8b9680f2..6aea05d15a2c2 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -16,14 +16,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "unstable-2024-04-10";
+  version = "unstable-2024-04-16";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "31357486b0ef6f4e161e002b6893eeb4fafc3ca9";
-    hash = "sha256-2APpO3ZW4idlgtlb8hB04u/rmIcKA8O7pYqxF66xbNY=";
+    rev = "fa8c16e2452bf092ac76f09ee1fb1e9f7d0796e7";
+    hash = "sha256-LmaabaQZdx52MPGKPRt9Opoc9Gd9RbwvCdysUUYQoXI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/in/incus/client.nix b/pkgs/by-name/in/incus/client.nix
index ecad050f042a9..c2b8020936e07 100644
--- a/pkgs/by-name/in/incus/client.nix
+++ b/pkgs/by-name/in/incus/client.nix
@@ -16,7 +16,6 @@ in
 
 buildGoModule {
   inherit
-    meta
     patches
     pname
     src
@@ -39,4 +38,8 @@ buildGoModule {
 
   # don't run the full incus test suite
   doCheck = false;
+
+  meta = meta // {
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
 }
diff --git a/pkgs/by-name/in/inshellisense/package.nix b/pkgs/by-name/in/inshellisense/package.nix
index 20fa220039111..0b685022ffa84 100644
--- a/pkgs/by-name/in/inshellisense/package.nix
+++ b/pkgs/by-name/in/inshellisense/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "inshellisense";
-  version = "0.0.1-rc.12";
+  version = "0.0.1-rc.14";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-dDjIKVV1dSCIa2Y2d1AQQAw9Rcflh0AnKlwsQSblIhs=";
+    hash = "sha256-ZsEAE9EDJLREpKjHLbvqAUNM/y9eCH44g3D8NHYHiT4=";
   };
 
-  npmDepsHash = "sha256-uBsPaUvEiR5oCl8rZvpyNPXSB/Vlcx937lT4WqgekHI=";
+  npmDepsHash = "sha256-p0/GnAdWNM/wjB/w+rXbOrh3Hr/smIW0IVQga7uCKYY=";
 
   # Needed for dependency `@homebridge/node-pty-prebuilt-multiarch`
   # On Darwin systems the build fails with,
diff --git a/pkgs/by-name/js/jsoncons/package.nix b/pkgs/by-name/js/jsoncons/package.nix
index 57908ded4a16c..0a4efe6d827f3 100644
--- a/pkgs/by-name/js/jsoncons/package.nix
+++ b/pkgs/by-name/js/jsoncons/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jsoncons";
-  version = "0.173.4";
+  version = "0.174.0";
 
   src = fetchFromGitHub {
     owner = "danielaparker";
     repo = "jsoncons";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Mf3kvfYAcwNrwbvGyMP6PQmk5e5Mz7b0qCZ6yi95ksk=";
+    hash = "sha256-VL64oWmaLz4zJm8eCF03tcAkeL+j1BRAQJ5/kUA7L90=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/kc/kcl-cli/package.nix b/pkgs/by-name/kc/kcl-cli/package.nix
index 1065bde95de2e..5a8dfc9e4d02b 100644
--- a/pkgs/by-name/kc/kcl-cli/package.nix
+++ b/pkgs/by-name/kc/kcl-cli/package.nix
@@ -5,14 +5,14 @@
 
 buildGoModule rec {
   pname = "kcl-cli";
-  version = "0.8.5";
+  version = "0.8.6";
   src = fetchFromGitHub {
     owner = "kcl-lang";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-ZjEMgQukhBGY3LWqsGmLj3lKfLtNNaQugQs0cSLMb80=";
+    hash = "sha256-A98Y5ktXFwn1XrFTwL8l04VW5zPNcMLtZCUf+niXx6c=";
   };
-  vendorHash = "sha256-jmqKMB85HxAlwH7FVjHrLCZQYuAJrguRfzIz1yMypjw=";
+  vendorHash = "sha256-zFTcwyK5HT1cwfHJB3n5Eh2JE3xuXqAluU3McA+FurQ=";
   ldflags = [
     "-X=kcl-lang.io/cli/pkg/version.version=${version}"
   ];
diff --git a/pkgs/by-name/ko/koodo-reader/fix-isdev.patch b/pkgs/by-name/ko/koodo-reader/fix-isdev.patch
new file mode 100644
index 0000000000000..956cb2042f0b8
--- /dev/null
+++ b/pkgs/by-name/ko/koodo-reader/fix-isdev.patch
@@ -0,0 +1,13 @@
+diff --git a/main.js b/main.js
+index a4b5c8ef..743d63ca 100644
+--- a/main.js
++++ b/main.js
+@@ -8,7 +8,7 @@ const {
+   nativeTheme,
+ } = require("electron");
+ const path = require("path");
+-const isDev = require("electron-is-dev");
++const isDev = false;
+ const Store = require("electron-store");
+ const store = new Store();
+ const fs = require("fs");
diff --git a/pkgs/by-name/ko/koodo-reader/mime-types.xml b/pkgs/by-name/ko/koodo-reader/mime-types.xml
new file mode 100644
index 0000000000000..46b70db743666
--- /dev/null
+++ b/pkgs/by-name/ko/koodo-reader/mime-types.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="utf-8"?>
+<mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info">
+<mime-type type="application/epub+zip">
+  <glob pattern="*.epub"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/pdf">
+  <glob pattern="*.pdf"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="image/vnd.djvu">
+  <glob pattern="*.djvu"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-mobipocket-ebook">
+  <glob pattern="*.mobi"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/vnd.amazon.ebook">
+  <glob pattern="*.azw3"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/vnd.amazon.ebook">
+  <glob pattern="*.azw"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-cbz">
+  <glob pattern="*.cbz"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-cbr">
+  <glob pattern="*.cbr"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-cbt">
+  <glob pattern="*.cbt"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-cb7">
+  <glob pattern="*.cb7"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-fictionbook+xml">
+  <glob pattern="*.fb2"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+</mime-info>
diff --git a/pkgs/by-name/ko/koodo-reader/package.json b/pkgs/by-name/ko/koodo-reader/package.json
new file mode 100644
index 0000000000000..5c8f5140d1ba5
--- /dev/null
+++ b/pkgs/by-name/ko/koodo-reader/package.json
@@ -0,0 +1,312 @@
+{
+  "name": "koodo-reader",
+  "main": "main.js",
+  "version": "1.6.6",
+  "description": "A cross-platform ebook reader",
+  "author": {
+    "name": "App by Troye",
+    "email": "support@960960.xyz"
+  },
+  "engines": {
+    "node": ">=18.0.0",
+    "npm": ">=6.0.0"
+  },
+  "repository": "https://github.com/koodo-reader/koodo-reader",
+  "private": false,
+  "resolutions": {
+    "//": "See https://github.com/facebook/create-react-app/issues/11773",
+    "react-error-overlay": "6.0.9"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.485.0",
+    "adm-zip": "^0.5.2",
+    "axios": "^0.19.2",
+    "buffer": "^6.0.3",
+    "copy-text-to-clipboard": "^2.2.0",
+    "dompurify": "^3.0.1",
+    "electron-is-dev": "^1.1.0",
+    "electron-store": "^8.0.1",
+    "font-list": "^1.4.5",
+    "fs-extra": "^9.1.0",
+    "ftp": "^0.3.10",
+    "howler": "^2.2.3",
+    "iconv-lite": "^0.6.3",
+    "qs": "^6.11.2",
+    "react-hot-toast": "^2.1.1",
+    "react-tooltip": "^5.26.3",
+    "ssh2-sftp-client": "^9.1.0",
+    "webdav": "^3.6.2",
+    "wink-lemmatizer": "^3.0.4",
+    "ws": "^8.13.0",
+    "zip-a-folder": "^0.0.12"
+  },
+  "devDependencies": {
+    "@types/i18next": "^13.0.0",
+    "@types/iconv-lite": "^0.0.1",
+    "@types/node": "^13.13.2",
+    "@types/react": "17.0.2",
+    "@types/react-dom": "17.0.2",
+    "@types/react-i18next": "^8.1.0",
+    "@types/react-lottie": "^1.2.5",
+    "@types/react-redux": "^7.1.7",
+    "@types/react-router-dom": "^5.1.6",
+    "@types/spark-md5": "^3.0.2",
+    "@types/ws": "^8.5.5",
+    "classnames": "^2.2.6",
+    "concurrently": "^5.0.1",
+    "cross-env": "^6.0.3",
+    "electron": "14.1.1",
+    "electron-builder": "^23.6.0",
+    "hard-source-webpack-plugin": "^0.13.1",
+    "html-react-parser": "^0.13.0",
+    "i18next": "^20.2.4",
+    "node-sass": "^9.0.0",
+    "nodemon": "^2.0.6",
+    "rc-color-picker": "^1.2.6",
+    "react": "^17.0.2",
+    "react-device-detect": "^1.12.1",
+    "react-dom": "^17.0.2",
+    "react-dropzone": "^11.3.0",
+    "react-i18next": "^13.2.2",
+    "react-lottie": "^1.2.3",
+    "react-redux": "^7.2.0",
+    "react-router-dom": "^5.2.0",
+    "react-scripts": "^5.0.1",
+    "redux": "^4.0.5",
+    "redux-thunk": "^2.3.0",
+    "sass-loader": "^13.3.2",
+    "source-map-explorer": "^2.5.2",
+    "spark-md5": "^3.0.1",
+    "typescript": "3.8.3",
+    "wait-on": "^7.0.1"
+  },
+  "scripts": {
+    "analyze": "source-map-explorer 'build/static/js/*.js'",
+    "start": "react-scripts start",
+    "build": "react-scripts build",
+    "test": "react-scripts test",
+    "eject": "react-scripts eject",
+    "ele": "electron .",
+    "dev": "concurrently \"cross-env BROWSER=none npm start\" \"wait-on http://127.0.0.1:3000/ && nodemon --watch main.js --exec electron .\"",
+    "release": "electron-builder",
+    "prerelease": "react-scripts build"
+  },
+  "homepage": "./",
+  "build": {
+    "appId": "xyz.960960.koodo",
+    "productName": "Koodo Reader",
+    "copyright": "Copyright (c) 2021-2022 ${author}",
+    "files": [
+      "build/**/*",
+      "node_modules/**/*",
+      "package.json",
+      "main.js",
+      "edge-tts.js"
+    ],
+    "directories": {
+      "buildResources": "assets"
+    },
+    "publish": {
+      "provider": "github",
+      "repo": "koodo-reader",
+      "owner": "koodo-reader"
+    },
+    "buildDependenciesFromSource": false,
+    "nodeGypRebuild": false,
+    "fileAssociations": [
+      {
+        "ext": "epub",
+        "icon": "assets/icons/epub",
+        "role": "Viewer",
+        "mimeType": "application/epub+zip"
+      },
+      {
+        "ext": "pdf",
+        "icon": "assets/icons/pdf",
+        "role": "Viewer",
+        "mimeType": "application/pdf"
+      },
+      {
+        "ext": "mobi",
+        "icon": "assets/icons/mobi",
+        "role": "Viewer",
+        "mimeType": "application/x-mobipocket-ebook"
+      },
+      {
+        "ext": "azw3",
+        "icon": "assets/icons/azw3",
+        "role": "Viewer",
+        "mimeType": "application/vnd.amazon.ebook"
+      },
+      {
+        "ext": "azw",
+        "icon": "assets/icons/azw3",
+        "role": "Viewer",
+        "mimeType": "application/vnd.amazon.ebook"
+      },
+      {
+        "ext": "cbz",
+        "icon": "assets/icons/comic",
+        "role": "Viewer",
+        "mimeType": "application/x-cbz"
+      },
+      {
+        "ext": "cbr",
+        "icon": "assets/icons/comic",
+        "role": "Viewer",
+        "mimeType": "application/x-cbr"
+      },
+      {
+        "ext": "cbt",
+        "icon": "assets/icons/comic",
+        "role": "Viewer",
+        "mimeType": "application/x-cbt"
+      },
+      {
+        "ext": "cb7",
+        "icon": "assets/icons/comic",
+        "role": "Viewer",
+        "mimeType": "application/x-cb7"
+      },
+      {
+        "ext": "fb2",
+        "icon": "assets/icons/fb2",
+        "role": "Viewer",
+        "mimeType": "application/x-fictionbook+xml"
+      }
+    ],
+    "extends": null,
+    "dmg": {
+      "contents": [
+        {
+          "x": 410,
+          "y": 150,
+          "type": "link",
+          "path": "/Applications"
+        },
+        {
+          "x": 130,
+          "y": 150,
+          "type": "file"
+        }
+      ]
+    },
+    "mac": {
+      "target": [
+        {
+          "target": "dmg",
+          "arch": [
+            "x64",
+            "arm64"
+          ]
+        }
+      ],
+      "icon": "assets/icons/icon.icns",
+      "category": "public.app-category.productivity",
+      "artifactName": "${productName}-${version}-${arch}.${ext}"
+    },
+    "win": {
+      "target": [
+        {
+          "target": "nsis",
+          "arch": [
+            "x64"
+          ]
+        },
+        {
+          "target": "zip",
+          "arch": [
+            "x64",
+            "ia32",
+            "arm64"
+          ]
+        },
+        {
+          "target": "portable",
+          "arch": [
+            "x64"
+          ]
+        }
+      ],
+      "icon": "assets/icons/icon.ico",
+      "artifactName": "${productName}-${version}-${arch}-Win.${ext}",
+      "publisherName": "App by Troye"
+    },
+    "linux": {
+      "icon": "assets/icons",
+      "category": "Office",
+      "target": [
+        {
+          "target": "snap",
+          "arch": [
+            "x64"
+          ]
+        },
+        {
+          "target": "deb",
+          "arch": [
+            "arm64",
+            "ia32",
+            "x64"
+          ]
+        },
+        {
+          "target": "rpm",
+          "arch": [
+            "x64"
+          ]
+        },
+        {
+          "target": "AppImage",
+          "arch": [
+            "arm64",
+            "ia32",
+            "x64"
+          ]
+        }
+      ],
+      "artifactName": "${productName}-${version}-${arch}.${ext}"
+    },
+    "portable": {
+      "artifactName": "${productName}-${version}-Portable.${ext}"
+    },
+    "nsis": {
+      "artifactName": "${productName}-${version}.${ext}",
+      "oneClick": false,
+      "allowToChangeInstallationDirectory": true,
+      "include": "assets/windows/installer.nsh"
+    },
+    "snap": {
+      "publish": [
+        {
+          "provider": "github"
+        }
+      ]
+    }
+  },
+  "eslintConfig": {
+    "extends": "react-app"
+  },
+  "browserslist": {
+    "production": [
+      ">0.2%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 1 chrome version",
+      "last 1 firefox version",
+      "last 1 safari version"
+    ]
+  },
+  "babel": {
+    "presets": [
+      "react-app"
+    ],
+    "plugins": [
+      [
+        "react-hot-loader/babel"
+      ]
+    ]
+  }
+}
diff --git a/pkgs/by-name/ko/koodo-reader/package.nix b/pkgs/by-name/ko/koodo-reader/package.nix
new file mode 100644
index 0000000000000..84da01165fea6
--- /dev/null
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@@ -0,0 +1,130 @@
+{
+  lib,
+  stdenv,
+  mkYarnPackage,
+  fetchFromGitHub,
+  applyPatches,
+  fetchYarnDeps,
+  makeDesktopItem,
+  copyDesktopItems,
+  wrapGAppsHook,
+  electron,
+}:
+
+mkYarnPackage rec {
+  pname = "koodo-reader";
+  version = "1.6.6";
+
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "troyeguo";
+      repo = "koodo-reader";
+      rev = "v${version}";
+      hash = "sha256-g2bVm8LFeEIPaWlaxzMI0SrpM+79zQFzJ7Vs5CbWBT4=";
+    };
+    patches = [ ./update-react-i18next.patch ]; # Could be upstreamed
+  };
+
+  # should be copied from `koodo-reader.src`
+  packageJSON = ./package.json;
+
+  patches = [ ./fix-isdev.patch ];
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/yarn.lock";
+    hash = "sha256-VvYkotVb74zR9+/IWiQwOX/6RJf+xukpi7okRovfVzc=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    wrapGAppsHook
+  ];
+
+  dontWrapGApps = true;
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  configurePhase = ''
+    runHook preConfigure
+
+    cp -r $node_modules node_modules
+    chmod +w node_modules
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    export HOME=$(mktemp -d)
+    yarn --offline build
+    yarn --offline run electron-builder --dir \
+      -c.electronDist=${electron}/libexec/electron \
+      -c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 assets/icons/256x256.png $out/share/icons/hicolor/256x256/apps/koodo-reader.png
+    install -Dm644 ${./mime-types.xml} $out/share/mime/packages/koodo-reader.xml
+
+    mkdir -p $out/share/lib/koodo-reader
+    cp -r dist/*-unpacked/{locales,resources{,.pak}} $out/share/lib/koodo-reader
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${electron}/bin/electron $out/bin/koodo-reader \
+      --add-flags $out/share/lib/koodo-reader/resources/app.asar \
+      "''${gappsWrapperArgs[@]}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --inherit-argv0
+  '';
+
+  doDist = false;
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "koodo-reader";
+      desktopName = "Koodo Reader";
+      exec = "koodo-reader %U";
+      icon = "koodo-reader";
+      comment = meta.description;
+      categories = [ "Office" ];
+      mimeTypes = [
+        "application/epub+zip"
+        "application/pdf"
+        "image/vnd.djvu"
+        "application/x-mobipocket-ebook"
+        "application/vnd.amazon.ebook"
+        "application/vnd.amazon.ebook"
+        "application/x-cbz"
+        "application/x-cbr"
+        "application/x-cbt"
+        "application/x-cb7"
+        "application/x-fictionbook+xml"
+      ];
+      startupWMClass = "Koodo Reader";
+      terminal = false;
+    })
+  ];
+
+  meta = {
+    broken = stdenv.isDarwin;
+    changelog = "https://github.com/troyeguo/koodo-reader/releases/tag/v${version}";
+    description = "A cross-platform ebook reader";
+    longDescription = ''
+      A modern ebook manager and reader with sync and backup capacities
+      for Windows, macOS, Linux and Web
+    '';
+    homepage = "https://github.com/troyeguo/koodo-reader";
+    license = lib.licenses.agpl3Only;
+    mainProgram = "koodo-reader";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    platforms = electron.meta.platforms;
+  };
+}
diff --git a/pkgs/by-name/ko/koodo-reader/update-react-i18next.patch b/pkgs/by-name/ko/koodo-reader/update-react-i18next.patch
new file mode 100644
index 0000000000000..6d71460ee38d3
--- /dev/null
+++ b/pkgs/by-name/ko/koodo-reader/update-react-i18next.patch
@@ -0,0 +1,58 @@
+diff --git a/package.json b/package.json
+index c71b04a1..a4b4b3ef 100644
+--- a/package.json
++++ b/package.json
+@@ -67,7 +67,7 @@
+     "react-device-detect": "^1.12.1",
+     "react-dom": "^17.0.2",
+     "react-dropzone": "^11.3.0",
+-    "react-i18next": "^11.8.15",
++    "react-i18next": "^13.2.2",
+     "react-lottie": "^1.2.3",
+     "react-redux": "^7.2.0",
+     "react-router-dom": "^5.2.0",
+diff --git a/yarn.lock b/yarn.lock
+index 881db5b2..2df4d362 100644
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -1828,7 +1828,7 @@
+   resolved "https://registry.yarnpkg.com/@babel/regjsgen/-/regjsgen-0.8.0.tgz#f0ba69b075e1f05fb2825b7fad991e7adbb18310"
+   integrity sha512-x/rqGMdzj+fWZvCOYForTghzbtqPDZ5gPwaoNGHdgDfF2QA/XZbCBp4Moo5scrkAMPhB7z26XM/AaHuIJdgauA==
+ 
+-"@babel/runtime@^7.1.2", "@babel/runtime@^7.12.0", "@babel/runtime@^7.12.13", "@babel/runtime@^7.12.5", "@babel/runtime@^7.14.5", "@babel/runtime@^7.15.4", "@babel/runtime@^7.16.3", "@babel/runtime@^7.20.6", "@babel/runtime@^7.20.7", "@babel/runtime@^7.8.4", "@babel/runtime@^7.9.2":
++"@babel/runtime@^7.1.2", "@babel/runtime@^7.12.0", "@babel/runtime@^7.12.13", "@babel/runtime@^7.12.5", "@babel/runtime@^7.15.4", "@babel/runtime@^7.16.3", "@babel/runtime@^7.20.6", "@babel/runtime@^7.20.7", "@babel/runtime@^7.8.4", "@babel/runtime@^7.9.2":
+   version "7.21.0"
+   resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.21.0.tgz#5b55c9d394e5fcf304909a8b00c07dc217b56673"
+   integrity sha512-xwII0//EObnq89Ji5AKYQaRYiW/nZ3llSv29d49IuxPhKbtJoLP+9QUUZ4nVragQVtaVGeZrpB+ZtG/Pdy/POw==
+@@ -1842,6 +1842,13 @@
+   dependencies:
+     regenerator-runtime "^0.14.0"
+ 
++"@babel/runtime@^7.22.5":
++  version "7.23.1"
++  resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.23.1.tgz#72741dc4d413338a91dcb044a86f3c0bc402646d"
++  integrity sha512-hC2v6p8ZSI/W0HUzh3V8C5g+NwSKzKPtJwSpTjwl0o297GP9+ZLQSkdvHz46CM3LqyoXxq+5G9komY+eSqSO0g==
++  dependencies:
++    regenerator-runtime "^0.14.0"
++
+ "@babel/template@^7.18.10", "@babel/template@^7.20.7", "@babel/template@^7.3.3":
+   version "7.20.7"
+   resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.20.7.tgz#a15090c2839a83b02aa996c0b4994005841fd5a8"
+@@ -10951,12 +10958,12 @@ react-i18next@*:
+     "@babel/runtime" "^7.20.6"
+     html-parse-stringify "^3.0.1"
+ 
+-react-i18next@^11.8.15:
+-  version "11.18.6"
+-  resolved "https://registry.yarnpkg.com/react-i18next/-/react-i18next-11.18.6.tgz#e159c2960c718c1314f1e8fcaa282d1c8b167887"
+-  integrity sha512-yHb2F9BiT0lqoQDt8loZ5gWP331GwctHz9tYQ8A2EIEUu+CcEdjBLQWli1USG3RdWQt3W+jqQLg/d4rrQR96LA==
++react-i18next@^13.2.2:
++  version "13.2.2"
++  resolved "https://registry.yarnpkg.com/react-i18next/-/react-i18next-13.2.2.tgz#b1e78ed66a54f4bc819616f68b98221e1b1a1936"
++  integrity sha512-+nFUkbRByFwnrfDcYqvzBuaeZb+nACHx+fAWN/pZMddWOCJH5hoc21+Sa/N/Lqi6ne6/9wC/qRGOoQhJa6IkEQ==
+   dependencies:
+-    "@babel/runtime" "^7.14.5"
++    "@babel/runtime" "^7.22.5"
+     html-parse-stringify "^3.0.1"
+ 
+ react-is@^16.12.0, react-is@^16.13.1, react-is@^16.6.0, react-is@^16.7.0:
diff --git a/pkgs/by-name/kt/ktfmt/package.nix b/pkgs/by-name/kt/ktfmt/package.nix
index 49546fd411018..99d5b03f9a53d 100644
--- a/pkgs/by-name/kt/ktfmt/package.nix
+++ b/pkgs/by-name/kt/ktfmt/package.nix
@@ -11,14 +11,17 @@ maven.buildMavenPackage rec {
     hash = "sha256-vdvKHTTD84OAQacv/VE/5BxYdW4n3bxPUHF2MdH+sQQ=";
   };
 
-  mvnHash = "sha256-Cl7P2i4VFJ/yk7700u62YPcacfKkhBztFvcDkYBfZEA=";
+  patches = [ ./pin-default-maven-plugin-versions.patch ];
+
+  mvnHash = "sha256-iw28HS0WMFC9BKQKr0v33D77rMQeIMKjXduqPcYU1XA=";
+
+  mvnParameters = "-Dproject.build.outputTimestamp=1980-01-01T00:00:02Z";
 
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin
     install -Dm644 core/target/ktfmt-*-jar-with-dependencies.jar $out/share/ktfmt/ktfmt.jar
 
     makeWrapper ${jre_headless}/bin/java $out/bin/ktfmt \
diff --git a/pkgs/by-name/kt/ktfmt/pin-default-maven-plugin-versions.patch b/pkgs/by-name/kt/ktfmt/pin-default-maven-plugin-versions.patch
new file mode 100644
index 0000000000000..d3425669da0f9
--- /dev/null
+++ b/pkgs/by-name/kt/ktfmt/pin-default-maven-plugin-versions.patch
@@ -0,0 +1,60 @@
+diff --git a/core/pom.xml b/core/pom.xml
+index 267689e..6b6e04d 100644
+--- a/core/pom.xml
++++ b/core/pom.xml
+@@ -34,6 +34,55 @@
+         <sourceDirectory>${project.basedir}/src/main/java</sourceDirectory>
+         <testSourceDirectory>${project.basedir}/src/test/java</testSourceDirectory>
+         <plugins>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-enforcer-plugin</artifactId>
++                <version>3.4.1</version>
++                <executions>
++                    <execution>
++                        <id>require-all-plugin-versions-to-be-set</id>
++                        <phase>validate</phase>
++                        <goals>
++                            <goal>enforce</goal>
++                        </goals>
++                        <configuration>
++                            <rules>
++                                <requirePluginVersions />
++                            </rules>
++                        </configuration>
++                    </execution>
++                </executions>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-surefire-plugin</artifactId>
++                <version>3.2.5</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-clean-plugin</artifactId>
++                <version>3.3.2</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-install-plugin</artifactId>
++                <version>3.1.1</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-site-plugin</artifactId>
++                <version>4.0.0-M13</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-resources-plugin</artifactId>
++                <version>3.3.1</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-deploy-plugin</artifactId>
++                <version>3.1.1</version>
++            </plugin>
+             <plugin>
+                 <groupId>org.jetbrains.kotlin</groupId>
+                 <artifactId>kotlin-maven-plugin</artifactId>
diff --git a/pkgs/by-name/lb/lbd/package.nix b/pkgs/by-name/lb/lbd/package.nix
new file mode 100644
index 0000000000000..f84ed553ad25b
--- /dev/null
+++ b/pkgs/by-name/lb/lbd/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, makeWrapper
+, bash
+, coreutils
+, diffutils
+, gawk
+, gnugrep
+, gnused
+, host
+, netcat-openbsd
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "lbd";
+  version = "0-unstable-2024-02-17";
+
+  src = fetchFromGitHub {
+    owner = "D3vil0p3r";
+    repo = "lbd";
+    rev = "73baaaecddcd834d43d79f50f0808b779c9a97c3";
+    hash = "sha256-NHY3NoPigsmfRjOx9Lt3/fGsyeq1/bzKHIXMDBJiI6c=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{bin,share/lbd}
+    cp lbd $out/share/lbd/
+    makeWrapper ${lib.getExe bash} $out/bin/lbd \
+      --prefix PATH : "${lib.makeBinPath [ coreutils diffutils gawk gnugrep gnused host netcat-openbsd ]}" \
+      --add-flags "$out/share/lbd/lbd"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Detect if a domain uses DNS and/or HTTP Load-Balancing";
+    mainProgram = "lbd";
+    homepage = "https://github.com/D3vil0p3r/lbd";
+    maintainers = with maintainers; [ d3vil0p3r ];
+    platforms = platforms.unix;
+    license = licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/by-name/li/libigl/package.nix b/pkgs/by-name/li/libigl/package.nix
new file mode 100644
index 0000000000000..085915ea352f3
--- /dev/null
+++ b/pkgs/by-name/li/libigl/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "libigl";
+  version = "2.5.0";
+
+  src = fetchFromGitHub {
+    owner = "libigl";
+    repo = "libigl";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-OpjkQGRiuc7kNlwgCeM4dcotTb5J+6LUn4IOe9bFbW4=";
+  };
+
+  # We could also properly use CMake, but we would have to heavily patch it
+  # to avoid configure-time downloads of many things.
+  installPhase = ''
+    mkdir -p $out/include
+    cp -r include/igl $out/include
+  '';
+
+  meta = with lib; {
+    description = "Simple C++ geometry processing library";
+    homepage = "https://github.com/libigl/libigl";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 52a6ba51c2f49..aa1c7afa3470c 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -12,7 +12,7 @@
 }:
 
 let
-  version = "7.3.1";
+  version = "7.4.0";
 in
 # The output of the derivation is a tool to create bootable images using Limine
 # as bootloader for various platforms and corresponding binary and helper files.
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/limine-bootloader/limine/releases/download/v${version}/limine-${version}.tar.gz";
-    sha256 = "sha256-xlOBBb281W9QT5Fv2Hgw/eyh7K3oyaNY1yU6WktbFro=";
+    sha256 = "sha256-lPesgQENZkMbxl/4sh+wTR21QfPJg57CDmqTwcy4b2k=";
   };
 
   nativeBuildInputs = [
@@ -58,6 +58,7 @@ stdenv.mkDerivation {
     # The platforms on that the Liminine binary and helper tools can run, not
     # necessarily the platforms for that bootable images can be created.
     platforms = platforms.unix;
+    badPlatforms = platforms.darwin;
     maintainers = [
       maintainers._48cf
       maintainers.phip1611
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index ed37e7d4482f4..920f6aa10e16d 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -72,13 +72,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "2674";
+  version = "2700";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "llama.cpp";
     rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-5Vc9DkXD83X22xRxZ2laCxrAZe2RdsL6FwR2tC/YGU0=";
+    hash = "sha256-gR50T++TE9/tlIjSQDp2FR+wiUSpyA+Fh7Nzg/y3zPE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/lu/luneta/dub-lock.json b/pkgs/by-name/lu/luneta/dub-lock.json
new file mode 100644
index 0000000000000..b45bfa0fd6545
--- /dev/null
+++ b/pkgs/by-name/lu/luneta/dub-lock.json
@@ -0,0 +1,24 @@
+{
+  "dependencies": {
+    "arsd-official": {
+      "version": "7.2.0",
+      "sha256": "1m546r6l0pkk80y5f3ff8im08hp59nwzjb5ikjhfiswvdizpwjlh"
+    },
+    "fuzzyd": {
+      "version": "2.2.0-beta",
+      "sha256": "0wzih4yrlrrj12ls9hd27gnxrj4j4c0ha9xprdfc7azszlv16j6g"
+    },
+    "ncurses": {
+      "version": "1.0.0",
+      "sha256": "0ivl88vp2dy9rpv6x3f9jlyqa7aps2x1kkyx80w2d4vcs31pzmb2"
+    },
+    "riverd-loader": {
+      "version": "1.0.2",
+      "sha256": "0c94551bscnia7vpixaq4xd2anprkd7pkf0q0anyadv5kqa8xgip"
+    },
+    "riverd-ncurses": {
+      "version": "1.0.5",
+      "sha256": "1wgdschv6hpdjykf5bblxphnhnpy2kvw8hq8h5iaygi9zr7jf286"
+    }
+  }
+}
diff --git a/pkgs/by-name/lu/luneta/package.nix b/pkgs/by-name/lu/luneta/package.nix
new file mode 100644
index 0000000000000..02e9a0724da2b
--- /dev/null
+++ b/pkgs/by-name/lu/luneta/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildDubPackage,
+  fetchFromGitHub,
+  ncurses,
+}:
+
+buildDubPackage rec {
+  pname = "luneta";
+  version = "0.7.4";
+
+  src = fetchFromGitHub {
+    owner = "fbeline";
+    repo = "luneta";
+    rev = "v${version}";
+    hash = "sha256-pYE8hccXT87JIMh71PtXzVQBegTzU7bdpVEaV2VkaEk=";
+  };
+
+  # not sure why, but this alias does not resolve
+  postPatch = ''
+    substituteInPlace source/luneta/keyboard.d \
+        --replace-fail "wint_t" "dchar"
+  '';
+
+  # ncurses dub package version is locked to 1.0.0 instead of using ~master
+  dubLock = ./dub-lock.json;
+
+  buildInputs = [ ncurses ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 luneta -t $out/bin
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/fbeline/luneta/releases/tag/${src.rev}";
+    description = "An interactive filter and fuzzy finder for the command-line";
+    homepage = "https://github.com/fbeline/luneta";
+    license = lib.licenses.gpl2Only;
+    mainProgram = "luneta";
+    maintainers = with lib.maintainers; [ tomasajt ];
+  };
+}
diff --git a/pkgs/by-name/lx/lxd-lts/package.nix b/pkgs/by-name/lx/lxd-lts/package.nix
index 67dda7437b8fd..ef61e0a7bcceb 100644
--- a/pkgs/by-name/lx/lxd-lts/package.nix
+++ b/pkgs/by-name/lx/lxd-lts/package.nix
@@ -141,7 +141,7 @@ symlinkJoin {
   '';
 
   passthru = {
-    inherit (lxd-unwrapped-lts) tests ui;
+    inherit (lxd-unwrapped-lts) tests;
   };
 
   inherit (lxd-unwrapped-lts) meta pname version;
diff --git a/pkgs/by-name/ma/maa-assistant-arknights/pin.json b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
index 36f8fcf420708..cb63a81700545 100644
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@@ -1,10 +1,10 @@
 {
   "stable": {
-    "version": "5.2.0",
-    "hash": "sha256-vxGJHm1StQNN+0IVlGMqKVKW56LH6KUC94utDn7FcNo="
+    "version": "5.2.1",
+    "hash": "sha256-pyvHhFfwgozaTP3AhqWPKOuXdC23stXiUW2PpdYRR7M="
   },
   "beta": {
-    "version": "5.2.0",
-    "hash": "sha256-vxGJHm1StQNN+0IVlGMqKVKW56LH6KUC94utDn7FcNo="
+    "version": "5.2.1",
+    "hash": "sha256-pyvHhFfwgozaTP3AhqWPKOuXdC23stXiUW2PpdYRR7M="
   }
 }
diff --git a/pkgs/by-name/ma/matrix-authentication-service/Cargo.lock b/pkgs/by-name/ma/matrix-authentication-service/Cargo.lock
index c9967434debdb..9104af7bb8542 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/Cargo.lock
+++ b/pkgs/by-name/ma/matrix-authentication-service/Cargo.lock
@@ -39,9 +39,9 @@ dependencies = [
 
 [[package]]
 name = "aes"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac1f845298e95f983ff1944b728ae08b8cebab80d684f0a832ed0fc74dfa27e2"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher",
@@ -64,12 +64,12 @@ dependencies = [
 
 [[package]]
 name = "ahash"
-version = "0.8.6"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91429305e9f0a25f6205c5b8e0d2db09e0708a7a6df0f42212bb56c32c8ac97a"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
 dependencies = [
  "cfg-if",
- "getrandom 0.2.11",
+ "getrandom 0.2.12",
  "once_cell",
  "version_check",
  "zerocopy",
@@ -107,9 +107,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.4"
+version = "0.6.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab91ebe16eb252986481c5b62f6098f3b698a45e34b5b98200cf20dd2484a44"
+checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -121,56 +121,56 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.4"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7079075b41f533b8c61d2a4d073c4676e1f8b249ff94a393b0595db304e0dd87"
+checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "317b9a89c1868f5ea6ff1d9539a69f45dffc21ce321ac1fd1160dfa48c8e2140"
+checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.0"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca11d4be1bab0c8bc8734a9aa7bf4ee8316d462a08c6ac5052f888fef5b494b"
+checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.1"
+version = "3.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0699d10d2f4d628a98ee7b57b289abbc98ff3bad977cb3152709d4bf2330628"
+checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
 dependencies = [
  "anstyle",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.75"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
+checksum = "0952808a6c2afd1aa8947271f3a60f1a6763c7b912d210184c5149b5cf147247"
 
 [[package]]
 name = "apalis-core"
-version = "0.4.7"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dbe998f2a77a65433e3e893f7ffba5b0c4835a9601ccab02aa868d1d3ed71eb"
+checksum = "1deb48475efcdece1f23a0553209ee842f264c2a5e9bcc4928bfa6a15a044cde"
 dependencies = [
  "async-stream",
  "async-trait",
  "chrono",
  "futures",
  "graceful-shutdown",
- "http 1.0.0",
+ "http 1.1.0",
  "log",
  "pin-project-lite",
  "serde",
@@ -184,9 +184,9 @@ dependencies = [
 
 [[package]]
 name = "apalis-cron"
-version = "0.4.7"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fc57450bd6a857d2370bb5504cf3d7f2a1fb85c7b68bdb7f92f50aac0e26aac"
+checksum = "43310b7e0132f9520b09224fb6faafb32eec82a672aa79c09e46b5b488ed505b"
 dependencies = [
  "apalis-core",
  "async-stream",
@@ -205,15 +205,15 @@ checksum = "7d5a26814d8dcb93b0e5a0ff3c6d80a8843bafb21b39e8e18a6f05471870e110"
 
 [[package]]
 name = "arc-swap"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bddcadddf5e9015d310179a59bb28c4d4b9920ad0f11e8e14dbadf654890c9a6"
+checksum = "7b3d0060af21e8d11a926981cc00c6c1541aa91dd64b9f881985c3da1094425f"
 
 [[package]]
 name = "argon2"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17ba4cac0a46bc1d2912652a751c47f2a9f3a7fe89bcae2275d418f5270402f9"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
 dependencies = [
  "base64ct",
  "blake2",
@@ -262,43 +262,43 @@ dependencies = [
 
 [[package]]
 name = "async-channel"
-version = "2.1.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d37875bd9915b7d67c2f117ea2c30a0989874d0b2cb694fe25403c85763c0c9e"
+checksum = "f28243a43d821d11341ab73c80bed182dc015c514b951616cf79bd4af39af0c3"
 dependencies = [
  "concurrent-queue",
- "event-listener 3.1.0",
- "event-listener-strategy",
+ "event-listener 5.2.0",
+ "event-listener-strategy 0.5.0",
  "futures-core",
  "pin-project-lite",
 ]
 
 [[package]]
 name = "async-executor"
-version = "1.7.2"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc5ea910c42e5ab19012bab31f53cb4d63d54c3a27730f9a833a88efcf4bb52d"
+checksum = "17ae5ebefcc48e7452b4987947920dac9450be1110cadf34d1b8c116bdbaf97c"
 dependencies = [
- "async-lock 3.1.1",
+ "async-lock 3.3.0",
  "async-task",
  "concurrent-queue",
  "fastrand 2.0.1",
- "futures-lite 2.0.1",
+ "futures-lite 2.3.0",
  "slab",
 ]
 
 [[package]]
 name = "async-global-executor"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4353121d5644cdf2beb5726ab752e79a8db1ebb52031770ec47db31d245526"
+checksum = "05b1b633a2115cd122d73b955eadd9916c18c8f510ec9cd1686404c60ad1c29c"
 dependencies = [
- "async-channel 2.1.0",
+ "async-channel 2.2.0",
  "async-executor",
- "async-io 2.2.0",
- "async-lock 3.1.1",
+ "async-io 2.3.2",
+ "async-lock 3.3.0",
  "blocking",
- "futures-lite 2.0.1",
+ "futures-lite 2.3.0",
  "once_cell",
 ]
 
@@ -320,8 +320,8 @@ dependencies = [
  "fnv",
  "futures-util",
  "handlebars",
- "http 0.2.11",
- "indexmap 2.1.0",
+ "http 0.2.12",
+ "indexmap 2.2.5",
  "mime",
  "multer",
  "num-traits",
@@ -347,12 +347,12 @@ checksum = "c7f329c7eb9b646a72f70c9c4b516c70867d356ec46cb00dcac8ad343fd006b0"
 dependencies = [
  "Inflector",
  "async-graphql-parser",
- "darling 0.20.3",
+ "darling 0.20.8",
  "proc-macro-crate",
  "proc-macro2",
  "quote",
  "strum",
- "syn 2.0.39",
+ "syn 2.0.53",
  "thiserror",
 ]
 
@@ -375,7 +375,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "323a5143f5bdd2030f45e3f2e0c821c9b1d36e79cf382129c64299c50a7f3750"
 dependencies = [
  "bytes",
- "indexmap 2.1.0",
+ "indexmap 2.2.5",
  "serde",
  "serde_json",
 ]
@@ -402,22 +402,21 @@ dependencies = [
 
 [[package]]
 name = "async-io"
-version = "2.2.0"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41ed9d5715c2d329bf1b4da8d60455b99b187f27ba726df2883799af9af60997"
+checksum = "dcccb0f599cfa2f8ace422d3555572f47424da5648a4382a9dd0310ff8210884"
 dependencies = [
- "async-lock 3.1.1",
+ "async-lock 3.3.0",
  "cfg-if",
  "concurrent-queue",
  "futures-io",
- "futures-lite 2.0.1",
+ "futures-lite 2.3.0",
  "parking",
- "polling 3.3.0",
- "rustix 0.38.25",
+ "polling 3.5.0",
+ "rustix 0.38.31",
  "slab",
  "tracing",
- "waker-fn",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -431,12 +430,12 @@ dependencies = [
 
 [[package]]
 name = "async-lock"
-version = "3.1.1"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "655b9c7fe787d3b25cc0f804a1a8401790f0c5bc395beb5a64dc77d8de079105"
+checksum = "d034b430882f8381900d3fe6f0aaa3ad94f2cb4ac519b429692a1bc2dda4ae7b"
 dependencies = [
- "event-listener 3.1.0",
- "event-listener-strategy",
+ "event-listener 4.0.3",
+ "event-listener-strategy 0.4.0",
  "pin-project-lite",
 ]
 
@@ -453,7 +452,7 @@ dependencies = [
  "cfg-if",
  "event-listener 3.1.0",
  "futures-lite 1.13.0",
- "rustix 0.38.25",
+ "rustix 0.38.31",
  "windows-sys 0.48.0",
 ]
 
@@ -463,13 +462,13 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e47d90f65a225c4527103a8d747001fc56e375203592b25ad103e1ca13124c5"
 dependencies = [
- "async-io 2.2.0",
+ "async-io 2.3.2",
  "async-lock 2.8.0",
  "atomic-waker",
  "cfg-if",
  "futures-core",
  "futures-io",
- "rustix 0.38.25",
+ "rustix 0.38.31",
  "signal-hook-registry",
  "slab",
  "windows-sys 0.48.0",
@@ -521,24 +520,24 @@ checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
 name = "async-task"
-version = "4.5.0"
+version = "4.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4eb2cdb97421e01129ccb49169d8279ed21e829929144f4a22a6e54ac549ca1"
+checksum = "fbb36e985947064623dbd357f727af08ffd077f93d696782f3c56365fa2e2799"
 
 [[package]]
 name = "async-trait"
-version = "0.1.74"
+version = "0.1.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a66537f1bb974b254c98ed142ff995236e81b9d0fe4db0575f46612cb15eb0f9"
+checksum = "461abc97219de0eaaf81fe3ef974a540158f3d079c2ab200f891f1a2ef201e85"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -566,16 +565,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
-name = "atomic-write-file"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c232177ba50b16fe7a4588495bd474a62a9e45a8e4ca6fd7d0b7ac29d164631e"
-dependencies = [
- "nix",
- "rand 0.8.5",
-]
-
-[[package]]
 name = "autocfg"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -593,7 +582,7 @@ dependencies = [
  "bytes",
  "futures-util",
  "headers",
- "http 0.2.11",
+ "http 0.2.12",
  "http-body",
  "hyper",
  "itoa",
@@ -623,7 +612,7 @@ dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
- "http 0.2.11",
+ "http 0.2.12",
  "http-body",
  "mime",
  "rustversion",
@@ -640,9 +629,9 @@ dependencies = [
  "axum",
  "axum-core",
  "bytes",
- "cookie",
+ "cookie 0.17.0",
  "futures-util",
- "http 0.2.11",
+ "http 0.2.12",
  "http-body",
  "mime",
  "pin-project-lite",
@@ -659,10 +648,10 @@ version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cdca6a10ecad987bda04e95606ef85a5417dcaac1a78455242d72e031e2b6b62"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -694,9 +683,15 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "base64"
-version = "0.21.5"
+version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35636a1494ede3b646cc98f74f8e62c773a38a659ebc777a2cf26b9b74171df9"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
 
 [[package]]
 name = "base64ct"
@@ -706,13 +701,13 @@ checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
 
 [[package]]
 name = "bcrypt"
-version = "0.15.0"
+version = "0.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d1c9c15093eb224f0baa400f38fcd713fc1391a6f1c389d886beef146d60a3"
+checksum = "e65938ed058ef47d92cf8b346cc76ef48984572ade631927e9937b5ffc7662c7"
 dependencies = [
- "base64 0.21.5",
+ "base64 0.22.0",
  "blowfish",
- "getrandom 0.2.11",
+ "getrandom 0.2.12",
  "subtle",
  "zeroize",
 ]
@@ -734,9 +729,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 dependencies = [
  "serde",
 ]
@@ -774,12 +769,12 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a37913e8dc4ddcc604f0c6d3bf2887c995153af3611de9e23c352b44c1b9118"
 dependencies = [
- "async-channel 2.1.0",
- "async-lock 3.1.1",
+ "async-channel 2.2.0",
+ "async-lock 3.3.0",
  "async-task",
  "fastrand 2.0.1",
  "futures-io",
- "futures-lite 2.0.1",
+ "futures-lite 2.3.0",
  "piper",
  "tracing",
 ]
@@ -796,15 +791,15 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.14.0"
+version = "3.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
+checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
 
 [[package]]
 name = "bytemuck"
-version = "1.14.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "374d28ec25809ee0e23827c2ab573d729e293f281dfe393500e7ad618baa61c6"
+checksum = "5d6d68c57235a3a081186990eca2867354726650f42f7516ca50c28d6281fd15"
 
 [[package]]
 name = "byteorder"
@@ -822,6 +817,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "calendrical_calculations"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8dfe3bc6a50b4667fafdb6d9cf26731c5418c457e317d8166c972014facf9a5d"
+dependencies = [
+ "core_maths",
+ "displaydoc",
+]
+
+[[package]]
 name = "camino"
 version = "1.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -841,15 +846,21 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+checksum = "8cd6604a82acf3039f1144f54b8eb34e91ffba622051189e71b781822d5ee1f5"
 dependencies = [
  "jobserver",
  "libc",
 ]
 
 [[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
 name = "cfg-if"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -881,22 +892,22 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.31"
+version = "0.4.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f2c685bad3eb3d45a01354cedb7d5faa66194d1d58ba6e267a8de788f79db38"
+checksum = "8eaf5903dcbc0a39312feb77df2ff4c76387d591b9fc7b04a238dcf8bb62639a"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
  "num-traits",
  "serde",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.4",
 ]
 
 [[package]]
 name = "chrono-tz"
-version = "0.8.4"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e23185c0e21df6ed832a12e2bda87c7d1def6842881fb634a8511ced741b0d76"
+checksum = "d59ae0466b83e838b81a54256c39d5d7c20b9d7daa10510a242d9b75abd5936e"
 dependencies = [
  "chrono",
  "chrono-tz-build",
@@ -929,7 +940,7 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8eebd66744a15ded14960ab4ccdbfb51ad3b81f51f3f04a80adac98c985396c9"
 dependencies = [
- "hashbrown 0.14.2",
+ "hashbrown 0.14.3",
  "stacker",
 ]
 
@@ -946,9 +957,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.4.8"
+version = "4.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2275f18819641850fa26c89acc84d465c1bf91ce57bc2748b28c420473352f64"
+checksum = "949626d00e063efc93b6dca932419ceb5432f99769911c0b995f7e884c778813"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -956,33 +967,33 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.8"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07cdf1b148b25c1e1f7a42225e30a0d99a615cd4637eae7365548dd4529b95bc"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
 dependencies = [
  "anstream",
  "anstyle",
  "clap_lex",
- "strsim",
+ "strsim 0.11.0",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.4.7"
+version = "4.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
+checksum = "90239a040c80f5e14809ca132ddc4176ab33d5e17e49691793296e3fcb34d72f"
 dependencies = [
- "heck",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
+checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
 
 [[package]]
 name = "colorchoice"
@@ -991,31 +1002,41 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
 
 [[package]]
+name = "combine"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35ed6e9d84f0b51a7f52daf1c7d71dd136fd7a3f41a8462b8cdb8c78d920fad4"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
 name = "concurrent-queue"
-version = "2.3.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f057a694a54f12365049b0958a1685bb52d567f5593b355fbf685838e873d400"
+checksum = "d16048cd947b08fa32c24458a22f5dc5e835264f689f4f5653210c69fd107363"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "console"
-version = "0.15.7"
+version = "0.15.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c926e00cc70edefdc64d3a5ff31cc65bb97a3460097762bd23afb4d8145fccf8"
+checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
 dependencies = [
  "encode_unicode",
  "lazy_static",
  "libc",
- "windows-sys 0.45.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "const-oid"
-version = "0.9.5"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
 name = "convert_case"
@@ -1033,7 +1054,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7efb37c3e1ccb1ff97164ad95ac1606e8ccd35b3fa0a7d99a304c7f4a428cc24"
 dependencies = [
  "aes-gcm",
- "base64 0.21.5",
+ "base64 0.21.7",
  "hkdf",
  "percent-encoding",
  "rand 0.8.5",
@@ -1044,13 +1065,24 @@ dependencies = [
 ]
 
 [[package]]
+name = "cookie"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3cd91cf61412820176e137621345ee43b3f4423e589e7ae4e50d601d93e35ef8"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
+[[package]]
 name = "cookie_store"
-version = "0.20.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "387461abbc748185c3a6e1673d826918b450b87ff22639429c694619a83b6cf6"
+checksum = "4934e6b7e8419148b6ef56950d277af8561060b56afd59e2aadf98b59fce6baa"
 dependencies = [
- "cookie",
- "idna 0.3.0",
+ "cookie 0.18.0",
+ "idna 0.5.0",
  "log",
  "publicsuffix",
  "serde",
@@ -1062,9 +1094,9 @@ dependencies = [
 
 [[package]]
 name = "core-foundation"
-version = "0.9.3"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1072,33 +1104,42 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.4"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
+
+[[package]]
+name = "core_maths"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
+checksum = "e3b02505ccb8c50b0aa21ace0fc08c3e53adebd4e58caa18a36152803c7709a3"
+dependencies = [
+ "libm",
+]
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce420fe07aecd3e67c5f910618fe65e94158f6dcc0adf44e00d69ce2bdfe0fd0"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.102.0"
+version = "0.105.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76eb38f2af690b5a4411d9a8782b6d77dabff3ca939e0518453ab9f9a4392d41"
+checksum = "16d5521e2abca66bbb1ddeecbb6f6965c79160352ae1579b39f8c86183895c24"
 dependencies = [
  "cranelift-entity",
 ]
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.102.0"
+version = "0.105.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39526c036b92912417e8931f52c1e235796688068d3efdbbd8b164f299d19156"
+checksum = "ef40a4338a47506e832ac3e53f7f1375bc59351f049a8379ff736dd02565bd95"
 dependencies = [
  "bumpalo",
  "cranelift-bforest",
@@ -1108,7 +1149,7 @@ dependencies = [
  "cranelift-entity",
  "cranelift-isle",
  "gimli",
- "hashbrown 0.14.2",
+ "hashbrown 0.14.3",
  "log",
  "regalloc2",
  "smallvec",
@@ -1117,33 +1158,33 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.102.0"
+version = "0.105.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb0deedc9fccf2db53a5a3c9c9d0163e44143b0d004dca9bf6ab6a0024cd79a"
+checksum = "d24cd5d85985c070f73dfca07521d09086362d1590105ba44b0932bf33513b61"
 dependencies = [
  "cranelift-codegen-shared",
 ]
 
 [[package]]
 name = "cranelift-codegen-shared"
-version = "0.102.0"
+version = "0.105.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea2d1b274e45aa8e61e9103efa1ba82d4b5a19d12bd1fd10744c3b7380ba3ff"
+checksum = "e0584c4363e3aa0a3c7cb98a778fbd5326a3709f117849a727da081d4051726c"
 
 [[package]]
 name = "cranelift-control"
-version = "0.102.0"
+version = "0.105.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea5977559a71e63db79a263f0e81a89b996e8a38212c4281e37dd1dbaa8b65c"
+checksum = "f25ecede098c6553fdba362a8e4c9ecb8d40138363bff47f9712db75be7f0571"
 dependencies = [
  "arbitrary",
 ]
 
 [[package]]
 name = "cranelift-entity"
-version = "0.102.0"
+version = "0.105.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f871ada808b58158d84dfc43a6a2e2d2756baaf4ed1c51fd969ca8330e6ca5c"
+checksum = "6ea081a42f25dc4c5b248b87efdd87dcd3842a1050a37524ec5391e6172058cb"
 dependencies = [
  "serde",
  "serde_derive",
@@ -1151,9 +1192,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.102.0"
+version = "0.105.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8e6890f587ef59824b3debe577e68fdf9b307b3808c54b8d93a18fd0b70941b"
+checksum = "9796e712f5af797e247784f7518e6b0a83a8907d73d51526982d86ecb3a58b68"
 dependencies = [
  "cranelift-codegen",
  "log",
@@ -1163,15 +1204,15 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.102.0"
+version = "0.105.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8d5fc6d5d3b52d1917002b17a8ecce448c2621b5bf394bb4e77e2f676893537"
+checksum = "f4a66ccad5782f15c80e9dd5af0df4acfe6e3eee98e8f7354a2e5c8ec3104bdd"
 
 [[package]]
 name = "cranelift-native"
-version = "0.102.0"
+version = "0.105.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e10c2e7faa65d4ae7de9a83b44f2c31aca7dc638e17d0a79572fdf8103d720b"
+checksum = "285e80df1d9b79ded9775b285df68b920a277b84f88a7228d2f5bc31fcdc58eb"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -1180,9 +1221,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-wasm"
-version = "0.102.0"
+version = "0.105.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2755807efc7ec80d1cc0b6815e70f10cedf968889f0469091dbff9c5c0741c48"
+checksum = "4135b0ab01fd16aa8f8821196e9e2fe15953552ccaef8ba5153be0ced04ef757"
 dependencies = [
  "cranelift-codegen",
  "cranelift-entity",
@@ -1211,18 +1252,18 @@ checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
 
 [[package]]
 name = "crc32fast"
-version = "1.3.2"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+checksum = "b3855a8a784b474f333699ef2bbca9db2c4a1f6d9088a90a2d25b1eb53111eaa"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "cron"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ff76b51e4c068c52bfd2866e1567bee7c567ae8f24ada09fd4307019e25eab7"
+checksum = "6f8c3e73077b4b4a6ab1ea5047c37c57aee77657bc8ecd6f29b0af082d0b0c07"
 dependencies = [
  "chrono",
  "nom",
@@ -1231,56 +1272,46 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.8"
+version = "0.5.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
+checksum = "ab3db02a9c5b5121e1e42fbdb1aeb65f5e02624cc58c43f2884c6ccac0b82f95"
 dependencies = [
- "cfg-if",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 dependencies = [
- "cfg-if",
  "crossbeam-epoch",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.15"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
- "autocfg",
- "cfg-if",
  "crossbeam-utils",
- "memoffset 0.9.0",
- "scopeguard",
 ]
 
 [[package]]
 name = "crossbeam-queue"
-version = "0.3.8"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1cfb3ea8a53f37c40dea2c7bedcbd88bdfae54f5e2175d6ecaff1c988353add"
+checksum = "df0346b5d5e76ac2fe4e327c5fd1118d6be7c51dfb18f9b7922923f287471e35"
 dependencies = [
- "cfg-if",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.16"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
-dependencies = [
- "cfg-if",
-]
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
 [[package]]
 name = "crypto-bigint"
@@ -1347,12 +1378,12 @@ dependencies = [
 
 [[package]]
 name = "darling"
-version = "0.20.3"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0209d94da627ab5605dcccf08bb18afa5009cfbef48d8a8b7d7bdbc79be25c5e"
+checksum = "54e36fcd13ed84ffdfda6f5be89b31287cbb80c439841fe69e04841435464391"
 dependencies = [
- "darling_core 0.20.3",
- "darling_macro 0.20.3",
+ "darling_core 0.20.8",
+ "darling_macro 0.20.8",
 ]
 
 [[package]]
@@ -1365,22 +1396,22 @@ dependencies = [
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim",
+ "strsim 0.10.0",
  "syn 1.0.109",
 ]
 
 [[package]]
 name = "darling_core"
-version = "0.20.3"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "177e3443818124b357d8e76f53be906d60937f0d3a90773a664fa63fa253e621"
+checksum = "9c2cf1c23a687a1feeb728783b993c4e1ad83d99f351801977dd809b48d0a70f"
 dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim",
- "syn 2.0.39",
+ "strsim 0.10.0",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -1396,13 +1427,13 @@ dependencies = [
 
 [[package]]
 name = "darling_macro"
-version = "0.20.3"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836a9bbc7ad63342d6d6e7b815ccab164bc77a2d95d84bc3117a8c0d5c98e2d5"
+checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
 dependencies = [
- "darling_core 0.20.3",
+ "darling_core 0.20.8",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -1453,9 +1484,9 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.3.9"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f32d04922c60427da6f9fef14d042d9edddef64cb9d4ce0d64d0685fbeb1fd3"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
 dependencies = [
  "powerfmt",
  "serde",
@@ -1502,7 +1533,7 @@ checksum = "487585f4d0c6655fe74905e2504d8ad6908e4db67f744eb140876906c2f3175d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -1513,9 +1544,9 @@ checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
 
 [[package]]
 name = "duration-str"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e172e85f305d6a442b250bf40667ffcb91a24f52c9a1ca59e2fa991ac9b7790"
+checksum = "a8bb6a301a95ba86fa0ebaf71d49ae4838c51f8b84cb88ed140dfb66452bb3c4"
 dependencies = [
  "nom",
  "rust_decimal",
@@ -1524,9 +1555,9 @@ dependencies = [
 
 [[package]]
 name = "dyn-clone"
-version = "1.0.16"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "545b22097d44f8a9581187cdf93de7a71e4722bf51200cfaba810865b49a495d"
+checksum = "0d6ef0072f8a535281e4876be788938b528e9a1d43900b82c2569af7da799125"
 
 [[package]]
 name = "ecdsa"
@@ -1544,9 +1575,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
 dependencies = [
  "serde",
 ]
@@ -1578,7 +1609,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dbfb21b9878cf7a348dcb8559109aabc0ec40d69924bd706fa5149846c4fef75"
 dependencies = [
- "base64 0.21.5",
+ "base64 0.21.7",
  "memchr",
 ]
 
@@ -1611,12 +1642,12 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f258a7194e7f7c2a7837a8913aeab7fd8c383457034fa20ce4dd3dcb813e8eb8"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
 dependencies = [
  "libc",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1649,9 +1680,20 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "4.0.0"
+version = "4.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b215c49b2b248c855fb73579eb1f4f26c38ffdc12973e20e07b91d78d5646e"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "770d968249b5d99410d61f5bf89057f3199a077a04d087092f58e7d10692baae"
+checksum = "2b5fb89194fa3cad959b833185b3063ba881dbfc7030680b314250779fb4cc91"
 dependencies = [
  "concurrent-queue",
  "parking",
@@ -1660,11 +1702,21 @@ dependencies = [
 
 [[package]]
 name = "event-listener-strategy"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d96b852f1345da36d551b9473fa1e2b1eb5c5195585c6c018118bc92a8d91160"
+checksum = "958e4d70b6d5e81971bebec42271ec641e7ff4e170a6fa605f2b8a8b65cb97d3"
 dependencies = [
- "event-listener 3.1.0",
+ "event-listener 4.0.3",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "feedafcaa9b749175d5ac357452a9d41ea2911da598fde46ce1fe02c37751291"
+dependencies = [
+ "event-listener 5.2.0",
  "pin-project-lite",
 ]
 
@@ -1710,9 +1762,9 @@ dependencies = [
 
 [[package]]
 name = "figment"
-version = "0.10.12"
+version = "0.10.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "649f3e5d826594057e9a519626304d8da859ea8a0b18ce99500c586b8d45faee"
+checksum = "7270677e7067213e04f323b55084586195f18308cd7546cfac9f873344ccceb6"
 dependencies = [
  "atomic",
  "parking_lot",
@@ -1769,9 +1821,9 @@ dependencies = [
 
 [[package]]
 name = "futures"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0290714b38af9b4a7b094b8a37086d1b4e61f2df9122c3cad2577669145335"
+checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1784,9 +1836,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff4dd66668b557604244583e3e1e1eada8c5c2e96a6d0d6653ede395b78bbacb"
+checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1794,15 +1846,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb1d22c66e66d9d72e1758f0bd7d4fd0bee04cad842ee34587d68c07e45d088c"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f4fb8693db0cf099eadcca0efe2a5a22e4550f98ed16aba6c48700da29597bc"
+checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -1822,9 +1874,9 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bf34a163b5c4c52d0478a4d757da8fb65cabef42ba90515efee0f6f9fa45aaa"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
 
 [[package]]
 name = "futures-lite"
@@ -1843,52 +1895,51 @@ dependencies = [
 
 [[package]]
 name = "futures-lite"
-version = "2.0.1"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3831c2651acb5177cbd83943f3d9c8912c5ad03c76afcc0e9511ba568ec5ebb"
+checksum = "52527eb5074e35e9339c6b4e8d12600c7128b68fb25dcb9fa9dec18f7c25f3a5"
 dependencies = [
  "fastrand 2.0.1",
  "futures-core",
  "futures-io",
- "memchr",
  "parking",
  "pin-project-lite",
 ]
 
 [[package]]
 name = "futures-macro"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b153fd91e4b0147f4aced87be237c98248656bb01050b96bf3ee89220a8ddb"
+checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e36d3378ee38c2a36ad710c5d30c2911d752cb941c00c72dbabfb786a7970817"
+checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
 
 [[package]]
 name = "futures-task"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efd193069b0ddadc69c46389b740bbccdd97203899b48d09c5f7969591d6bae2"
+checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
 
 [[package]]
 name = "futures-timer"
-version = "3.0.2"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e64b03909df88034c26dc1547e8970b91f98bdb65165d6a4e9110d94263dbb2c"
+checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
 
 [[package]]
 name = "futures-util"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a19526d624e703a3179b3d322efec918b6246ea0fa51d41124525f00f1cc8104"
+checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1926,20 +1977,22 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
+checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
 name = "ghash"
-version = "0.5.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d930750de5717d2dd0b8c0d42c076c0e884c81a73e6cab859bbd2339c71e3e40"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
 dependencies = [
  "opaque-debug",
  "polyval",
@@ -1952,7 +2005,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 dependencies = [
  "fallible-iterator",
- "indexmap 2.1.0",
+ "indexmap 2.2.5",
  "stable_deref_trait",
 ]
 
@@ -1998,17 +2051,17 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.22"
+version = "0.3.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d6250322ef6e60f93f9a2162799302cd6f68f79f6e5d85c8c16f14d1d958178"
+checksum = "4fbd2820c5e49886948654ab546d0688ff24530286bdcf8fca3cefb16d4618eb"
 dependencies = [
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
  "futures-util",
- "http 0.2.11",
- "indexmap 2.1.0",
+ "http 0.2.12",
+ "indexmap 2.2.5",
  "slab",
  "tokio",
  "tokio-util",
@@ -2046,9 +2099,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.14.2"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f93e7192158dbcda357bdec5fb5788eebf8bbac027f3f33e719d29135ae84156"
+checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
 dependencies = [
  "ahash",
  "allocator-api2",
@@ -2060,17 +2113,7 @@ version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
 dependencies = [
- "hashbrown 0.14.2",
-]
-
-[[package]]
-name = "hdrhistogram"
-version = "7.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "765c9198f173dd59ce26ff9f95ef0aafd0a0fe01fb9d72841bc5066a4c06511d"
-dependencies = [
- "byteorder",
- "num-traits",
+ "hashbrown 0.14.3",
 ]
 
 [[package]]
@@ -2079,10 +2122,10 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06683b93020a07e3dbcf5f8c0f6d40080d725bea7936fc01ad345c01b97dc270"
 dependencies = [
- "base64 0.21.5",
+ "base64 0.21.7",
  "bytes",
  "headers-core",
- "http 0.2.11",
+ "http 0.2.12",
  "httpdate",
  "mime",
  "sha1",
@@ -2094,7 +2137,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7f66481bfee273957b1f20485a4ff3362987f85b2c236580d81b4eb7a326429"
 dependencies = [
- "http 0.2.11",
+ "http 0.2.12",
 ]
 
 [[package]]
@@ -2107,10 +2150,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
 name = "hermit-abi"
-version = "0.3.3"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
 [[package]]
 name = "hex"
@@ -2120,9 +2169,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "hkdf"
-version = "0.12.3"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
  "hmac",
 ]
@@ -2138,11 +2187,11 @@ dependencies = [
 
 [[package]]
 name = "home"
-version = "0.5.5"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5444c27eef6923071f7ebcc33e3444508466a76f7a2b93da00ed6e19f30c1ddb"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2158,9 +2207,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
 dependencies = [
  "bytes",
  "fnv",
@@ -2169,9 +2218,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.0.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b32afd38673a8016f7c9ae69e5af41a58f81b1d31689040f2f1959594ce194ea"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
 dependencies = [
  "bytes",
  "fnv",
@@ -2180,12 +2229,12 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
  "bytes",
- "http 0.2.11",
+ "http 0.2.12",
  "pin-project-lite",
 ]
 
@@ -2205,7 +2254,7 @@ dependencies = [
  "async-channel 1.9.0",
  "base64 0.13.1",
  "futures-lite 1.13.0",
- "http 0.2.11",
+ "http 0.2.12",
  "infer",
  "pin-project-lite",
  "rand 0.7.3",
@@ -2230,22 +2279,22 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "0.14.27"
+version = "0.14.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffb1cfd654a8219eaef89881fdb3bb3b1cdc5fa75ded05d6933b2b382e395468"
+checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
 dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
  "futures-util",
  "h2",
- "http 0.2.11",
+ "http 0.2.12",
  "http-body",
  "httparse",
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.4.10",
+ "socket2 0.5.6",
  "tokio",
  "tower-service",
  "tracing",
@@ -2254,36 +2303,24 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.24.2"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+checksum = "399c78f9338483cb7e630c8474b07268983c6bd5acee012e4211f9f7bb21b070"
 dependencies = [
  "futures-util",
- "http 0.2.11",
+ "http 0.2.12",
  "hyper",
- "rustls",
- "rustls-native-certs",
+ "rustls 0.22.2",
+ "rustls-pki-types",
  "tokio",
  "tokio-rustls",
 ]
 
 [[package]]
-name = "hyper-timeout"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbb958482e8c7be4bc3cf272a766a2b0bf1a6755e7a6ae777f017a31d11b13b1"
-dependencies = [
- "hyper",
- "pin-project-lite",
- "tokio",
- "tokio-io-timeout",
-]
-
-[[package]]
 name = "iana-time-zone"
-version = "0.1.58"
+version = "0.1.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8326b86b6cff230b97d0d312a6c40a60726df3332e721f72a1b035f451663b20"
+checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -2303,6 +2340,79 @@ dependencies = [
 ]
 
 [[package]]
+name = "icu_calendar"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7eb932a690c92f87955e923106181ee0d5682e688ff37fb5c7b296e1fe806edb"
+dependencies = [
+ "calendrical_calculations",
+ "displaydoc",
+ "icu_calendar_data",
+ "icu_locid",
+ "icu_locid_transform",
+ "icu_provider",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_calendar_data"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22aec7d032735d9acb256eeef72adcac43c3b7572f19b51576a63d664b524ca2"
+
+[[package]]
+name = "icu_datetime"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1508c7ed627cc0b031c81203eb98f34433e24b32b39d5b2c0238e4962a00957d"
+dependencies = [
+ "displaydoc",
+ "either",
+ "fixed_decimal",
+ "icu_calendar",
+ "icu_datetime_data",
+ "icu_decimal",
+ "icu_locid",
+ "icu_locid_transform",
+ "icu_plurals",
+ "icu_provider",
+ "icu_timezone",
+ "smallvec",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_datetime_data"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6abc569cb4ee80b30707566f05c5c9ed4bed765f91ce41e7f5a37c5e6a75b3f"
+
+[[package]]
+name = "icu_decimal"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcf994f9ed8061c17bb313f28fba6cffc736f0a16c7fab827efc9b73fd3f7778"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_decimal_data",
+ "icu_locid",
+ "icu_locid_transform",
+ "icu_provider",
+ "writeable",
+]
+
+[[package]]
+name = "icu_decimal_data"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df2de3548316b697c70f30dec1395c9212db09df1d86a27624ee24872b71326c"
+
+[[package]]
 name = "icu_list"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2414,10 +2524,55 @@ checksum = "d2abdd3a62551e8337af119c5899e600ca0c88ec8f23a46c60ba216c803dcf1a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
+name = "icu_relativetime"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47825312a5eb0790bad7b718fa8d41a8ea1e0ba597b4f7bb84bcfe97d7fc5aba"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_decimal",
+ "icu_locid_transform",
+ "icu_plurals",
+ "icu_provider",
+ "icu_relativetime_data",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_relativetime_data"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05b55cc15ea8981fbba78e9347d0c4003d4490c85f76e9adc7f270290046cae8"
+
+[[package]]
+name = "icu_timezone"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b35aabe571a7c653c0f543ff1512b8a1b2ad481cfa24b3d25115298d2ff3b50f"
+dependencies = [
+ "displaydoc",
+ "icu_calendar",
+ "icu_locid",
+ "icu_provider",
+ "icu_timezone_data",
+ "tinystr",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_timezone_data"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ceee21e181cce2ab44e95923da6b3418df75369f570df82264c29c51ca398d4"
+
+[[package]]
 name = "id-arena"
 version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2462,12 +2617,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.1.0"
+version = "2.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
+checksum = "7b0b929d511467233429c45a44ac1dcaa21ba0f5ba11e4879e6ed28ddb4f9df4"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.2",
+ "hashbrown 0.14.3",
  "serde",
 ]
 
@@ -2485,13 +2640,13 @@ checksum = "64e9829a50b42bb782c1df523f78d332fe371b10c661e78b7a3c34b0198e9fac"
 
 [[package]]
 name = "inherent"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce243b1bfa62ffc028f1cc3b6034ec63d649f3031bc8a4fbbb004e1ac17d1f68"
+checksum = "0122b7114117e64a63ac49f752a5ca4624d534c7b1c7de796ac196381cd2d947"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -2512,9 +2667,9 @@ dependencies = [
 
 [[package]]
 name = "insta"
-version = "1.34.0"
+version = "1.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d64600be34b2fcfc267740a243fa7744441bb4947a619ac4e5bb6507f35fbfc"
+checksum = "0a7c22c4d34ef4788c351e971c52bfdfe7ea2766f8c5466bc175dd46e52ac22e"
 dependencies = [
  "console",
  "lazy_static",
@@ -2534,12 +2689,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "integer-encoding"
-version = "3.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb03732005da905c88227371639bf1ad885cc712789c011c31c5fb3ab3ccf02"
-
-[[package]]
 name = "io-lifetimes"
 version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2589,25 +2738,54 @@ dependencies = [
 ]
 
 [[package]]
+name = "itertools"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+dependencies = [
+ "either",
+]
+
+[[package]]
 name = "itoa"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
+
+[[package]]
+name = "jni"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6df18c2e3db7e453d3c6ac5b3e9d5182664d28788126d39b91f2d1e22b017ec"
+dependencies = [
+ "cesu8",
+ "combine",
+ "jni-sys",
+ "log",
+ "thiserror",
+ "walkdir",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
 
 [[package]]
 name = "jobserver"
-version = "0.1.27"
+version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c37f63953c4c63420ed5fd3d6d398c719489b9f872b9fa683262f8edd363c7d"
+checksum = "ab46a6e9526ddef3ae7f787c06f0f2600639ba80ea3eade3d8e670a2230f51d6"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.65"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54c0c35952f67de54bb584e9fd912b3023117cbafc0a77d8f3dee1fb5f572fe8"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -2625,9 +2803,9 @@ dependencies = [
 
 [[package]]
 name = "k256"
-version = "0.13.2"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f01b677d82ef7a676aa37e099defd83a28e15687112cafdd112d60236b6115b"
+checksum = "956ff9b67e26e1a6a866cb758f12c6f8746208489e3e4a4b5580802f2f0a587b"
 dependencies = [
  "cfg-if",
  "ecdsa",
@@ -2672,13 +2850,13 @@ checksum = "884e2677b40cc8c339eaefcb701c32ef1fd2493d71118dc0ca4b6a736c93bd67"
 
 [[package]]
 name = "lettre"
-version = "0.11.2"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a48c2e9831b370bc2d7233c2620298c45f3a158ed6b4b8d7416b2ada5a268fd8"
+checksum = "357ff5edb6d8326473a64c82cf41ddf78ab116f89668c50c4fac1b321e5e80f4"
 dependencies = [
  "async-std",
  "async-trait",
- "base64 0.21.5",
+ "base64 0.21.7",
  "chumsky",
  "email-encoding",
  "email_address",
@@ -2690,23 +2868,23 @@ dependencies = [
  "idna 0.5.0",
  "mime",
  "nom",
- "once_cell",
+ "percent-encoding",
  "quoted_printable",
- "rustls",
- "rustls-pemfile",
- "socket2 0.5.5",
+ "rustls 0.22.2",
+ "rustls-pemfile 2.1.1",
+ "socket2 0.5.6",
  "tokio",
  "tokio-rustls",
  "tracing",
  "url",
- "webpki-roots",
+ "webpki-roots 0.26.1",
 ]
 
 [[package]]
 name = "libc"
-version = "0.2.150"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "libm"
@@ -2720,7 +2898,7 @@ version = "0.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85c833ca1e66078851dba29046874e38f08b2c883700aa29a03ddd3b23814ee8"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "libc",
  "redox_syscall",
 ]
@@ -2750,9 +2928,9 @@ checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.11"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
 name = "listenfd"
@@ -2783,9 +2961,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 dependencies = [
  "value-bag",
 ]
@@ -2801,7 +2979,7 @@ dependencies = [
 
 [[package]]
 name = "mas-axum-utils"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "async-trait",
  "axum",
@@ -2810,7 +2988,7 @@ dependencies = [
  "data-encoding",
  "futures-util",
  "headers",
- "http 0.2.11",
+ "http 0.2.12",
  "http-body",
  "icu_locid",
  "mas-data-model",
@@ -2838,17 +3016,18 @@ dependencies = [
 
 [[package]]
 name = "mas-cli"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "axum",
  "camino",
  "clap",
  "dotenvy",
+ "figment",
  "httpdate",
  "hyper",
  "ipnetwork",
- "itertools 0.11.0",
+ "itertools 0.12.1",
  "listenfd",
  "mas-config",
  "mas-data-model",
@@ -2873,17 +3052,16 @@ dependencies = [
  "oauth2-types",
  "opentelemetry",
  "opentelemetry-http",
- "opentelemetry-jaeger",
+ "opentelemetry-jaeger-propagator",
  "opentelemetry-otlp",
  "opentelemetry-prometheus",
  "opentelemetry-semantic-conventions",
  "opentelemetry-stdout",
- "opentelemetry-zipkin",
  "opentelemetry_sdk",
  "prometheus",
  "rand 0.8.5",
  "rand_chacha 0.3.1",
- "rustls",
+ "rustls 0.22.2",
  "sentry",
  "sentry-tower",
  "sentry-tracing",
@@ -2903,10 +3081,9 @@ dependencies = [
 
 [[package]]
 name = "mas-config"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
- "async-trait",
  "camino",
  "chrono",
  "figment",
@@ -2918,7 +3095,8 @@ dependencies = [
  "pem-rfc7468",
  "rand 0.8.5",
  "rand_chacha 0.3.1",
- "rustls-pemfile",
+ "rustls-pemfile 2.1.1",
+ "rustls-pki-types",
  "schemars",
  "serde",
  "serde_json",
@@ -2932,7 +3110,7 @@ dependencies = [
 
 [[package]]
 name = "mas-data-model"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "chrono",
  "crc",
@@ -2941,15 +3119,17 @@ dependencies = [
  "oauth2-types",
  "rand 0.8.5",
  "rand_chacha 0.3.1",
+ "regex",
  "serde",
  "thiserror",
  "ulid",
  "url",
+ "woothee",
 ]
 
 [[package]]
 name = "mas-email"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "async-trait",
  "headers",
@@ -2961,7 +3141,7 @@ dependencies = [
 
 [[package]]
 name = "mas-graphql"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "async-graphql",
@@ -2984,7 +3164,7 @@ dependencies = [
 
 [[package]]
 name = "mas-handlers"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -3047,22 +3227,21 @@ dependencies = [
 
 [[package]]
 name = "mas-http"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
- "axum",
  "bytes",
  "futures-util",
  "headers",
- "http 0.2.11",
+ "http 0.2.12",
  "http-body",
  "hyper",
  "hyper-rustls",
  "mas-tower",
- "once_cell",
  "opentelemetry",
- "rustls",
- "rustls-native-certs",
+ "opentelemetry-semantic-conventions",
+ "rustls 0.22.2",
+ "rustls-platform-verifier",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -3072,20 +3251,22 @@ dependencies = [
  "tower-http",
  "tracing",
  "tracing-opentelemetry",
- "webpki-roots",
 ]
 
 [[package]]
 name = "mas-i18n"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "camino",
+ "icu_calendar",
+ "icu_datetime",
  "icu_list",
  "icu_locid",
  "icu_locid_transform",
  "icu_plurals",
  "icu_provider",
  "icu_provider_adapters",
+ "icu_relativetime",
  "pad",
  "pest",
  "pest_derive",
@@ -3097,7 +3278,7 @@ dependencies = [
 
 [[package]]
 name = "mas-i18n-scan"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "camino",
  "clap",
@@ -3111,7 +3292,7 @@ dependencies = [
 
 [[package]]
 name = "mas-iana"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "schemars",
  "serde",
@@ -3119,7 +3300,7 @@ dependencies = [
 
 [[package]]
 name = "mas-iana-codegen"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3136,7 +3317,7 @@ dependencies = [
 
 [[package]]
 name = "mas-jose"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "base64ct",
  "chrono",
@@ -3167,7 +3348,7 @@ dependencies = [
 
 [[package]]
 name = "mas-keystore"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "aead",
  "base64ct",
@@ -3196,18 +3377,18 @@ dependencies = [
 
 [[package]]
 name = "mas-listener"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "bytes",
- "event-listener 4.0.0",
+ "event-listener 5.2.0",
  "futures-util",
  "http-body",
  "hyper",
  "libc",
  "pin-project-lite",
- "rustls-pemfile",
- "socket2 0.5.5",
+ "rustls-pemfile 2.1.1",
+ "socket2 0.5.6",
  "thiserror",
  "tokio",
  "tokio-rustls",
@@ -3220,11 +3401,11 @@ dependencies = [
 
 [[package]]
 name = "mas-matrix"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "http 0.2.11",
+ "http 0.2.12",
  "serde",
  "tokio",
  "url",
@@ -3232,11 +3413,11 @@ dependencies = [
 
 [[package]]
 name = "mas-matrix-synapse"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "http 0.2.11",
+ "http 0.2.12",
  "mas-axum-utils",
  "mas-http",
  "mas-matrix",
@@ -3248,18 +3429,17 @@ dependencies = [
 
 [[package]]
 name = "mas-oidc-client"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "assert_matches",
  "base64ct",
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "bytes",
  "chrono",
  "form_urlencoded",
- "futures",
  "futures-util",
  "headers",
- "http 0.2.11",
+ "http 0.2.12",
  "http-body",
  "hyper",
  "hyper-rustls",
@@ -3270,10 +3450,10 @@ dependencies = [
  "mas-keystore",
  "mime",
  "oauth2-types",
- "once_cell",
  "rand 0.8.5",
  "rand_chacha 0.3.1",
- "rustls",
+ "rustls 0.22.2",
+ "rustls-platform-verifier",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -3289,7 +3469,7 @@ dependencies = [
 
 [[package]]
 name = "mas-policy"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "mas-data-model",
@@ -3306,7 +3486,7 @@ dependencies = [
 
 [[package]]
 name = "mas-router"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "axum",
  "serde",
@@ -3317,7 +3497,7 @@ dependencies = [
 
 [[package]]
 name = "mas-spa"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "camino",
  "serde",
@@ -3326,7 +3506,7 @@ dependencies = [
 
 [[package]]
 name = "mas-storage"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "apalis-core",
  "async-trait",
@@ -3349,7 +3529,7 @@ dependencies = [
 
 [[package]]
 name = "mas-storage-pg"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "async-trait",
  "chrono",
@@ -3359,6 +3539,7 @@ dependencies = [
  "mas-jose",
  "mas-storage",
  "oauth2-types",
+ "opentelemetry-semantic-conventions",
  "rand 0.8.5",
  "rand_chacha 0.3.1",
  "sea-query",
@@ -3375,7 +3556,7 @@ dependencies = [
 
 [[package]]
 name = "mas-tasks"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "apalis-core",
@@ -3383,8 +3564,8 @@ dependencies = [
  "async-stream",
  "async-trait",
  "chrono",
- "event-listener 4.0.0",
- "futures-lite 2.0.1",
+ "event-listener 5.2.0",
+ "futures-lite 2.3.0",
  "mas-data-model",
  "mas-email",
  "mas-i18n",
@@ -3410,13 +3591,13 @@ dependencies = [
 
 [[package]]
 name = "mas-templates"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "anyhow",
  "arc-swap",
  "camino",
  "chrono",
- "http 0.2.11",
+ "http 0.2.12",
  "mas-data-model",
  "mas-i18n",
  "mas-router",
@@ -3438,9 +3619,9 @@ dependencies = [
 
 [[package]]
 name = "mas-tower"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
- "http 0.2.11",
+ "http 0.2.12",
  "opentelemetry",
  "opentelemetry-http",
  "opentelemetry-semantic-conventions",
@@ -3484,9 +3665,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.6.4"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
 
 [[package]]
 name = "memfd"
@@ -3494,7 +3675,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2cffa4ad52c6f791f4f8b15f0c05f9824b2ced1160e88cc393d64fff9a8ac64"
 dependencies = [
- "rustix 0.38.25",
+ "rustix 0.38.31",
 ]
 
 [[package]]
@@ -3505,15 +3686,6 @@ checksum = "374c335b2df19e62d4cb323103473cbc6510980253119180de862d89184f6a83"
 
 [[package]]
 name = "memoffset"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "memoffset"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
@@ -3539,9 +3711,9 @@ dependencies = [
 
 [[package]]
 name = "minijinja"
-version = "1.0.10"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "208758577ef2c86cf5dd3e85730d161413ec3284e2d73b2ef65d9a24d9971bcb"
+checksum = "562e7acc6adf9a8359061ea3e0634560a3f636dc0539d36cd300c82fd703f528"
 dependencies = [
  "memo-map",
  "self_cell",
@@ -3558,18 +3730,18 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
 dependencies = [
  "adler",
 ]
 
 [[package]]
 name = "mio"
-version = "0.8.9"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dce281c5e46beae905d4de1870d8b1509a9142b62eedf18b443b011ca8343d0"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
  "wasi 0.11.0+wasi-snapshot-preview1",
@@ -3585,7 +3757,7 @@ dependencies = [
  "bytes",
  "encoding_rs",
  "futures-util",
- "http 0.2.11",
+ "http 0.2.12",
  "httparse",
  "log",
  "memchr",
@@ -3595,19 +3767,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "nix"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
-dependencies = [
- "bitflags 1.3.2",
- "cfg-if",
- "libc",
- "memoffset 0.7.1",
- "pin-utils",
-]
-
-[[package]]
 name = "nom"
 version = "7.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3628,6 +3787,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "num-bigint"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
 name = "num-bigint-dig"
 version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3645,20 +3815,25 @@ dependencies = [
 ]
 
 [[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
 name = "num-integer"
-version = "0.1.45"
+version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
 dependencies = [
- "autocfg",
  "num-traits",
 ]
 
 [[package]]
 name = "num-iter"
-version = "0.1.43"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
+checksum = "d869c01cc0c455284163fd0092f1f93835385ccab5a98a0dcc497b2f8bf055a9"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -3667,9 +3842,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
+checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
 dependencies = [
  "autocfg",
  "libm",
@@ -3687,16 +3862,15 @@ dependencies = [
 
 [[package]]
 name = "oauth2-types"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "assert_matches",
  "chrono",
  "data-encoding",
- "http 0.2.11",
+ "http 0.2.12",
  "language-tags",
  "mas-iana",
  "mas-jose",
- "parse-display",
  "serde",
  "serde_json",
  "serde_with",
@@ -3707,29 +3881,29 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.32.1"
+version = "0.32.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0"
+checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
 dependencies = [
  "crc32fast",
- "hashbrown 0.14.2",
- "indexmap 2.1.0",
+ "hashbrown 0.14.3",
+ "indexmap 2.2.5",
  "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "opa-wasm"
 version = "0.1.0"
-source = "git+https://github.com/matrix-org/rust-opa-wasm.git#ba83f2d4391823b1b34de3e786d1454a0fc90efb"
+source = "git+https://github.com/matrix-org/rust-opa-wasm.git#d8a83a223880a863a1bc970811113cd7c819ba7c"
 dependencies = [
  "anyhow",
- "base64 0.21.5",
+ "base64 0.21.7",
  "cc",
  "chrono",
  "chrono-tz",
@@ -3739,6 +3913,7 @@ dependencies = [
  "form_urlencoded",
  "hex",
  "hmac",
+ "indexmap 2.2.5",
  "json-patch",
  "md-5",
  "parse-size",
@@ -3759,9 +3934,9 @@ dependencies = [
 
 [[package]]
 name = "opaque-debug"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "openssl-probe"
@@ -3771,13 +3946,12 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "opentelemetry"
-version = "0.21.0"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e32339a5dc40459130b3bd269e9892439f55b33e772d2a9d402a789baaf4e8a"
+checksum = "900d57987be3f2aeb70d385fff9b27fb74c5723cc9a52d904d4f9c807a0667bf"
 dependencies = [
  "futures-core",
  "futures-sink",
- "indexmap 2.1.0",
  "js-sys",
  "once_cell",
  "pin-project-lite",
@@ -3787,60 +3961,50 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-http"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f51189ce8be654f9b5f7e70e49967ed894e84a06fc35c6c042e64ac1fc5399e"
+checksum = "7cbfa5308166ca861434f0b0913569579b8e587430a3d6bcd7fd671921ec145a"
 dependencies = [
  "async-trait",
  "bytes",
- "http 0.2.11",
+ "http 0.2.12",
  "hyper",
  "opentelemetry",
  "tokio",
 ]
 
 [[package]]
-name = "opentelemetry-jaeger"
-version = "0.20.0"
+name = "opentelemetry-jaeger-propagator"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e617c66fd588e40e0dbbd66932fdc87393095b125d4459b1a3a10feb1712f8a1"
+checksum = "beb4ec62efc537b60aaa89b92624f986f2523d3a609079f3511cc8ee73490826"
 dependencies = [
- "async-trait",
- "futures-core",
- "futures-util",
- "http 0.2.11",
  "opentelemetry",
- "opentelemetry-http",
- "opentelemetry-semantic-conventions",
- "opentelemetry_sdk",
- "thrift",
- "tokio",
 ]
 
 [[package]]
 name = "opentelemetry-otlp"
-version = "0.14.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f24cda83b20ed2433c68241f918d0f6fdec8b1d43b7a9590ab4420c5095ca930"
+checksum = "1a016b8d9495c639af2145ac22387dcb88e44118e45320d9238fbf4e7889abcb"
 dependencies = [
  "async-trait",
  "futures-core",
- "http 0.2.11",
+ "http 0.2.12",
  "opentelemetry",
+ "opentelemetry-http",
  "opentelemetry-proto",
  "opentelemetry-semantic-conventions",
  "opentelemetry_sdk",
  "prost",
  "thiserror",
- "tokio",
- "tonic",
 ]
 
 [[package]]
 name = "opentelemetry-prometheus"
-version = "0.14.1"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8f082da115b0dcb250829e3ed0b8792b8f963a1ad42466e48422fbe6a079bd"
+checksum = "30bbcf6341cab7e2193e5843f0ac36c446a5b3fccb28747afaeda17996dcd02e"
 dependencies = [
  "once_cell",
  "opentelemetry",
@@ -3851,9 +4015,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-proto"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2e155ce5cc812ea3d1dffbd1539aed653de4bf4882d60e6e04dcf0901d674e1"
+checksum = "3a8fddc9b68f5b80dae9d6f510b88e02396f006ad48cac349411fbecc80caae4"
 dependencies = [
  "opentelemetry",
  "opentelemetry_sdk",
@@ -3863,54 +4027,31 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-semantic-conventions"
-version = "0.13.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5774f1ef1f982ef2a447f6ee04ec383981a3ab99c8e77a1a7b30182e65bbc84"
-dependencies = [
- "opentelemetry",
-]
+checksum = "f9ab5bd6c42fb9349dcf28af2ba9a0667f697f9bdcca045d39f2cec5543e2910"
 
 [[package]]
 name = "opentelemetry-stdout"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c13b2df4cd59c176099ac82806725ba340c8fa7b1a7004c0912daad30470f63e"
+checksum = "4bdf28b381f23afcd150afc0b38a4183dd321fc96320c1554752b6b761648f78"
 dependencies = [
  "async-trait",
  "chrono",
  "futures-util",
  "opentelemetry",
  "opentelemetry_sdk",
- "ordered-float 4.1.1",
+ "ordered-float",
  "serde",
  "serde_json",
 ]
 
 [[package]]
-name = "opentelemetry-zipkin"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c2bee3ec1be4d0088378e0eb1dd54c113cbd7ec5622cc4f26181debf1d4d7b5"
-dependencies = [
- "async-trait",
- "futures-core",
- "http 0.2.11",
- "once_cell",
- "opentelemetry",
- "opentelemetry-http",
- "opentelemetry-semantic-conventions",
- "opentelemetry_sdk",
- "serde",
- "serde_json",
- "thiserror",
- "typed-builder",
-]
-
-[[package]]
 name = "opentelemetry_sdk"
-version = "0.21.1"
+version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "968ba3f2ca03e90e5187f5e4f46c791ef7f2c163ae87789c8ce5f5ca3b7b7de5"
+checksum = "9e90c7113be649e31e9a0f8b5ee24ed7a16923b322c3c5ab6367469c049d6b7e"
 dependencies = [
  "async-trait",
  "crossbeam-channel",
@@ -3920,7 +4061,7 @@ dependencies = [
  "glob",
  "once_cell",
  "opentelemetry",
- "ordered-float 4.1.1",
+ "ordered-float",
  "percent-encoding",
  "rand 0.8.5",
  "thiserror",
@@ -3930,31 +4071,22 @@ dependencies = [
 
 [[package]]
 name = "ordered-float"
-version = "2.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "ordered-float"
-version = "4.1.1"
+version = "4.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "536900a8093134cf9ccf00a27deb3532421099e958d9dd431135d0c7543ca1e8"
+checksum = "a76df7075c7d4d01fdcb46c912dd17fba5b60c78ea480b475f2b6ab6f666584e"
 dependencies = [
  "num-traits",
 ]
 
 [[package]]
 name = "os_info"
-version = "3.7.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "006e42d5b888366f1880eda20371fedde764ed2213dc8496f49622fa0c99cd5e"
+checksum = "6cbb46d5d01695d7a1fb8be5f0d1968bd2b2b8ba1d1b3e7062ce2a0593e57af1"
 dependencies = [
  "log",
  "serde",
- "winapi",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -4026,32 +4158,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "parse-display"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6509d08722b53e8dafe97f2027b22ccbe3a5db83cb352931e9716b0aa44bc5c"
-dependencies = [
- "once_cell",
- "parse-display-derive",
- "regex",
-]
-
-[[package]]
-name = "parse-display-derive"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68517892c8daf78da08c0db777fcc17e07f2f63ef70041718f8a7630ad84f341"
-dependencies = [
- "once_cell",
- "proc-macro2",
- "quote",
- "regex",
- "regex-syntax 0.7.5",
- "structmeta",
- "syn 2.0.39",
-]
-
-[[package]]
 name = "parse-size"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4098,9 +4204,9 @@ dependencies = [
 
 [[package]]
 name = "pear"
-version = "0.2.7"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61a386cd715229d399604b50d1361683fe687066f42d56f54be995bc6868f71c"
+checksum = "4ccca0f6c17acc81df8e242ed473ec144cbf5c98037e69aa6d144780aad103c8"
 dependencies = [
  "inlinable_string",
  "pear_codegen",
@@ -4109,14 +4215,14 @@ dependencies = [
 
 [[package]]
 name = "pear_codegen"
-version = "0.2.7"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da9f0f13dac8069c139e8300a6510e3f4143ecf5259c60b116a9b271b4ca0d54"
+checksum = "2e22670e8eb757cff11d6c199ca7b987f352f0346e0be4dd23869ec72cb53c77"
 dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -4136,9 +4242,9 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pest"
-version = "2.7.5"
+version = "2.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae9cee2a55a544be8b89dc6848072af97a20f2422603c10865be2a42b580fff5"
+checksum = "56f8023d0fb78c8e03784ea1c7f3fa36e68a723138990b8d5a47d916b651e7a8"
 dependencies = [
  "memchr",
  "thiserror",
@@ -4147,9 +4253,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.7.5"
+version = "2.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81d78524685f5ef2a3b3bd1cafbc9fcabb036253d9b1463e726a91cd16e2dfc2"
+checksum = "b0d24f72393fd16ab6ac5738bc33cdb6a9aa73f8b902e8fe29cf4e67d7dd1026"
 dependencies = [
  "pest",
  "pest_generator",
@@ -4157,22 +4263,22 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.7.5"
+version = "2.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68bd1206e71118b5356dae5ddc61c8b11e28b09ef6a31acbd15ea48a28e0c227"
+checksum = "fdc17e2a6c7d0a492f0158d7a4bd66cc17280308bbaff78d5bef566dca35ab80"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.7.5"
+version = "2.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c747191d4ad9e4a4ab9c8798f1e82a39affe7ef9648390b7e5548d18e099de6"
+checksum = "934cd7631c050f4674352a6e835d5f6711ffbfb9345c2fc0107155ac495ae293"
 dependencies = [
  "once_cell",
  "pest",
@@ -4219,22 +4325,22 @@ dependencies = [
 
 [[package]]
 name = "pin-project"
-version = "1.1.3"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fda4ed1c6c173e3fc7a83629421152e01d7b1f9b7f65fb301e490e8cfc656422"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.3"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -4300,9 +4406,9 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.27"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
 
 [[package]]
 name = "polling"
@@ -4322,16 +4428,16 @@ dependencies = [
 
 [[package]]
 name = "polling"
-version = "3.3.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e53b6af1f60f36f8c2ac2aad5459d75a5a9b4be1e8cdd40264f315d78193e531"
+checksum = "24f040dee2588b4963afb4e420540439d126f73fdacf4a9c486a96d840bac3c9"
 dependencies = [
  "cfg-if",
  "concurrent-queue",
  "pin-project-lite",
- "rustix 0.38.25",
+ "rustix 0.38.31",
  "tracing",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -4347,9 +4453,9 @@ dependencies = [
 
 [[package]]
 name = "polyval"
-version = "0.6.1"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d52cff9d1d4dee5fe6d03729099f4a310a41179e0a10dbf542039873f2e826fb"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -4390,9 +4496,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.69"
+version = "1.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
+checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
 dependencies = [
  "unicode-ident",
 ]
@@ -4405,7 +4511,7 @@ checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
  "version_check",
  "yansi",
 ]
@@ -4427,9 +4533,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.11.9"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b82eaa1d779e9a4bc1c3217db8ffbeabaae1dca241bf70183242128d48681cd"
+checksum = "146c289cda302b98a28d40c8b3b90498d6e526dd24ac2ecea73e4e491685b94a"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -4437,15 +4543,15 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.11.9"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5d2d8d10f3c6ded6da8b05b5fb3b8a5082514344d56c9f871412d29b4e075b4"
+checksum = "efb6c9a1dd1def8e2124d17e83a20af56f1570d6c2d2bd9e266ccb768df3840e"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.11.0",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -4456,9 +4562,9 @@ checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
 
 [[package]]
 name = "psl"
-version = "2.1.12"
+version = "2.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdc9f7a25d234ba11af714be527b60c8bc7ce1310011ef8dc032bd5ab1a7eadd"
+checksum = "610dd51a0e8bf3e9d042b3c4fa6e66a6d0f70f9a624db7a49348c55046faba35"
 dependencies = [
  "psl-types",
 ]
@@ -4490,9 +4596,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
 dependencies = [
  "proc-macro2",
 ]
@@ -4562,7 +4668,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.11",
+ "getrandom 0.2.12",
 ]
 
 [[package]]
@@ -4576,9 +4682,9 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.8.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
+checksum = "e4963ed1bc86e4f3ee217022bd855b297cef07fb9eac5dfa1f788b220b49b3bd"
 dependencies = [
  "either",
  "rayon-core",
@@ -4586,9 +4692,9 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
 dependencies = [
  "crossbeam-deque",
  "crossbeam-utils",
@@ -4609,7 +4715,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a18479200779601e498ada4e8c1e1f50e3ee19deb0259c25825a98b5603b2cb4"
 dependencies = [
- "getrandom 0.2.11",
+ "getrandom 0.2.12",
  "libredox",
  "thiserror",
 ]
@@ -4629,13 +4735,13 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.10.2"
+version = "1.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
+checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.4.3",
+ "regex-automata 0.4.6",
  "regex-syntax 0.8.2",
 ]
 
@@ -4659,9 +4765,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.3"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -4676,12 +4782,6 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
-
-[[package]]
-name = "regex-syntax"
 version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
@@ -4704,23 +4804,24 @@ dependencies = [
 
 [[package]]
 name = "ring"
-version = "0.17.5"
+version = "0.17.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb0205304757e5d899b9c2e448b867ffd03ae7f988002e47cd24954391394d0b"
+checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
 dependencies = [
  "cc",
- "getrandom 0.2.11",
+ "cfg-if",
+ "getrandom 0.2.12",
  "libc",
  "spin 0.9.8",
  "untrusted",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "rsa"
-version = "0.9.4"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a3211b01eea83d80687da9eef70e39d65144a3894866a5153a2723e425a157f"
+checksum = "5d0e5124fcb30e76a7e79bfee683a2746db83784b86289f6251b54b7950a0dfc"
 dependencies = [
  "const-oid",
  "digest",
@@ -4738,9 +4839,9 @@ dependencies = [
 
 [[package]]
 name = "rust_decimal"
-version = "1.33.1"
+version = "1.34.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06676aec5ccb8fc1da723cc8c0f9a46549f21ebb8753d3915c6c41db1e7f1dc4"
+checksum = "b39449a79f45e8da28c57c341891b69a183044b29518bb8f86dbac9df60bb7df"
 dependencies = [
  "arrayvec",
  "num-traits",
@@ -4783,37 +4884,51 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.25"
+version = "0.38.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc99bc2d4f1fed22595588a013687477aedf3cdcfb26558c559edb67b4d9b22e"
+checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "errno",
  "libc",
- "linux-raw-sys 0.4.11",
- "windows-sys 0.48.0",
+ "linux-raw-sys 0.4.13",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.21.9"
+version = "0.21.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "629648aced5775d558af50b2b4c7b02983a04b312126d45eeead26e7caa498b9"
+checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
 dependencies = [
- "log",
  "ring",
- "rustls-webpki",
+ "rustls-webpki 0.101.7",
  "sct",
 ]
 
 [[package]]
+name = "rustls"
+version = "0.22.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e87c9956bd9807afa1f77e0f7594af32566e830e088a5576d27c5b6f30f49d41"
+dependencies = [
+ "log",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki 0.102.2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "rustls-native-certs"
-version = "0.6.3"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
+checksum = "8f1fb85efa936c42c6d5fc28d2629bb51e4b2f4b8a5211e297d599cc5a093792"
 dependencies = [
  "openssl-probe",
- "rustls-pemfile",
+ "rustls-pemfile 2.1.1",
+ "rustls-pki-types",
  "schannel",
  "security-framework",
 ]
@@ -4824,10 +4939,53 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
 dependencies = [
- "base64 0.21.5",
+ "base64 0.21.7",
 ]
 
 [[package]]
+name = "rustls-pemfile"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f48172685e6ff52a556baa527774f61fcaa884f59daf3375c62a3f1cd2549dab"
+dependencies = [
+ "base64 0.21.7",
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ede67b28608b4c60685c7d54122d4400d90f62b40caee7700e700380a390fa8"
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c35b9a497e588f1fb2e1d18a0d46a6d057710f34c3da7084b27353b319453cc"
+dependencies = [
+ "core-foundation",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls 0.22.2",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki 0.102.2",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-roots 0.26.1",
+ "winapi",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84e217e7fdc8466b5b35d30f8c0a30febd29173df4a3a0c2115d306b9c4117ad"
+
+[[package]]
 name = "rustls-webpki"
 version = "0.101.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4838,6 +4996,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "rustls-webpki"
+version = "0.102.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
 name = "rustversion"
 version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4845,9 +5014,9 @@ checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
 
 [[package]]
 name = "ryu"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 
 [[package]]
 name = "salsa20"
@@ -4869,11 +5038,11 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c3733bf4cf7ea0880754e19cb5a462007c4a8c1914bff372ccc95b464f1df88"
+checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -4884,6 +5053,7 @@ checksum = "45a28f4c49489add4ce10783f7911893516f15afe45d015608d41faca6bc4d29"
 dependencies = [
  "chrono",
  "dyn-clone",
+ "indexmap 1.9.3",
  "schemars_derive",
  "serde",
  "serde_json",
@@ -4931,9 +5101,9 @@ dependencies = [
 
 [[package]]
 name = "sea-query"
-version = "0.30.3"
+version = "0.30.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3472e143a83f7f03d306dcc62af88c5afdcd7e35f96ef0001a806fe244b3b15a"
+checksum = "4166a1e072292d46dc91f31617c2a1cdaf55a8be4b5c9f4bf2ba248e3ac4999b"
 dependencies = [
  "chrono",
  "inherent",
@@ -4949,7 +5119,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "878cf3d57f0e5bfacd425cdaccc58b4c06d68a7b71c63fc28710a20c88676808"
 dependencies = [
  "darling 0.14.4",
- "heck",
+ "heck 0.4.1",
  "quote",
  "syn 1.0.109",
 ]
@@ -4972,10 +5142,10 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25a82fcb49253abcb45cdcb2adf92956060ec0928635eb21b4f7a6d8f25ab0bc"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
  "thiserror",
 ]
 
@@ -5003,6 +5173,7 @@ dependencies = [
  "core-foundation",
  "core-foundation-sys",
  "libc",
+ "num-bigint",
  "security-framework-sys",
 ]
 
@@ -5018,15 +5189,15 @@ dependencies = [
 
 [[package]]
 name = "self_cell"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e388332cd64eb80cd595a00941baf513caffae8dce9cfd0467fc9c66397dade6"
+checksum = "58bf37232d3bb9a2c4e641ca2a11d83b5062066f88df7fed36c28772046d65ba"
 
 [[package]]
 name = "semver"
-version = "1.0.20"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836fa6a3e1e547f9a2c4040802ec865b5d85f4014efe00555d7090a3dcaa1090"
+checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
 
 [[package]]
 name = "sentry"
@@ -5097,7 +5268,7 @@ version = "0.31.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "88e782e369edac4adfc5bf528b27577270bc3e7023c388ebad9db08e1d56b30b"
 dependencies = [
- "http 0.2.11",
+ "http 0.2.12",
  "pin-project",
  "sentry-core",
  "tower-layer",
@@ -5136,22 +5307,22 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.193"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25dd9975e68d0cb5aa1120c288333fc98731bd1dd12f561e468ea4728c042b89"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.193"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43576ca501357b9b071ac53cdc7da8ef0cbd9493d8df094cd821777ea6e894d3"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -5167,10 +5338,11 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.108"
+version = "1.0.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
+checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
 dependencies = [
+ "indexmap 2.2.5",
  "itoa",
  "ryu",
  "serde",
@@ -5178,9 +5350,9 @@ dependencies = [
 
 [[package]]
 name = "serde_path_to_error"
-version = "0.1.14"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4beec8bce849d58d06238cb50db2e1c417cfeafa4c63f692b15c82b7c80f8335"
+checksum = "af99884400da37c88f5e9146b7f1fd0fbcae8f6eec4e9da38b67d05486f814a6"
 dependencies = [
  "itoa",
  "serde",
@@ -5211,16 +5383,17 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.4.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64cd236ccc1b7a29e7e2739f27c0b2dd199804abc4290e32f59f3b68d6405c23"
+checksum = "ee80b0e361bbf88fd2f6e242ccd19cfda072cb0faa6ae694ecee08199938569a"
 dependencies = [
- "base64 0.21.5",
+ "base64 0.21.7",
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.1.0",
+ "indexmap 2.2.5",
  "serde",
+ "serde_derive",
  "serde_json",
  "serde_with_macros",
  "time",
@@ -5228,23 +5401,23 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.4.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93634eb5f75a2323b16de4748022ac4297f9e76b6dced2be287a099f41b5e788"
+checksum = "6561dc161a9224638a31d876ccdfefbc1df91d3f3a8342eddb35f055d48c7655"
 dependencies = [
- "darling 0.20.3",
+ "darling 0.20.8",
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
 name = "serde_yaml"
-version = "0.9.27"
+version = "0.9.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cc7a1570e38322cfe4154732e5110f887ea57e22b76f4bfd32b5bdd3368666c"
+checksum = "a0623d197252096520c6f2a5e1171ee436e5af99a5d7caa2891e55e61950e6d9"
 dependencies = [
- "indexmap 2.1.0",
+ "indexmap 2.2.5",
  "itoa",
  "ryu",
  "serde",
@@ -5303,9 +5476,9 @@ dependencies = [
 
 [[package]]
 name = "similar"
-version = "2.3.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2aeaf503862c419d66959f5d7ca015337d864e9c49485d771b732e2a20453597"
+checksum = "32fea41aca09ee824cc9724996433064c89f7777e60762749a4170a14abbfa21"
 
 [[package]]
 name = "siphasher"
@@ -5330,9 +5503,9 @@ checksum = "826167069c09b99d56f31e9ae5c99049e932a98c9dc2dac47645b08dbbf76ba7"
 
 [[package]]
 name = "smallvec"
-version = "1.11.2"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970"
+checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
 
 [[package]]
 name = "socket2"
@@ -5346,12 +5519,12 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.5.5"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b5fac59a5cb5dd637972e5fca70daf0523c9067fcdc4842f053dae04a18f8e9"
+checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
 dependencies = [
  "libc",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5371,9 +5544,9 @@ dependencies = [
 
 [[package]]
 name = "spki"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1e996ef02c474957d681f1b05213dfb0abab947b446a62d37770b23500184a"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
  "der",
@@ -5381,9 +5554,12 @@ dependencies = [
 
 [[package]]
 name = "sprintf"
-version = "0.1.4"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c0cdea5a20a06e7c57f627094e7b1618e5665592cd88f2d45fa4014e348db58"
+checksum = "f2819cb5194dfe9e6d102f4519a9fb9dc7106d2879b71b4fd4d4677f1175bd39"
+dependencies = [
+ "thiserror",
+]
 
 [[package]]
 name = "sptr"
@@ -5393,20 +5569,20 @@ checksum = "3b9b39299b249ad65f3b7e96443bad61c02ca5cd3589f46cb6d610a0fd6c0d6a"
 
 [[package]]
 name = "sqlformat"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b7b278788e7be4d0d29c0f39497a0eef3fba6bbc8e70d8bf7fde46edeaa9e85"
+checksum = "ce81b7bd7c4493975347ef60d8c7e8b742d4694f4c49f93e0a12ea263938176c"
 dependencies = [
- "itertools 0.11.0",
+ "itertools 0.12.1",
  "nom",
  "unicode_categories",
 ]
 
 [[package]]
 name = "sqlx"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dba03c279da73694ef99763320dea58b51095dfe87d001b1d4b5fe78ba8763cf"
+checksum = "c9a2ccff1a000a5a59cd33da541d9f2fdcd9e6e8229cc200565942bff36d0aaa"
 dependencies = [
  "sqlx-core",
  "sqlx-macros",
@@ -5417,9 +5593,9 @@ dependencies = [
 
 [[package]]
 name = "sqlx-core"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d84b0a3c3739e220d94b3239fd69fb1f74bc36e16643423bd99de3b43c21bfbd"
+checksum = "24ba59a9342a3d9bab6c56c118be528b27c9b60e490080e9711a04dccac83ef6"
 dependencies = [
  "ahash",
  "atoi",
@@ -5428,7 +5604,6 @@ dependencies = [
  "chrono",
  "crc",
  "crossbeam-queue",
- "dotenvy",
  "either",
  "event-listener 2.5.3",
  "futures-channel",
@@ -5438,15 +5613,15 @@ dependencies = [
  "futures-util",
  "hashlink",
  "hex",
- "indexmap 2.1.0",
+ "indexmap 2.2.5",
  "ipnetwork",
  "log",
  "memchr",
  "once_cell",
  "paste",
  "percent-encoding",
- "rustls",
- "rustls-pemfile",
+ "rustls 0.21.10",
+ "rustls-pemfile 1.0.4",
  "serde",
  "serde_json",
  "sha2",
@@ -5458,14 +5633,14 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "webpki-roots",
+ "webpki-roots 0.25.4",
 ]
 
 [[package]]
 name = "sqlx-macros"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89961c00dc4d7dffb7aee214964b065072bff69e36ddb9e2c107541f75e4f2a5"
+checksum = "4ea40e2345eb2faa9e1e5e326db8c34711317d2b5e08d0d5741619048a803127"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5476,14 +5651,13 @@ dependencies = [
 
 [[package]]
 name = "sqlx-macros-core"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0bd4519486723648186a08785143599760f7cc81c52334a55d6a83ea1e20841"
+checksum = "5833ef53aaa16d860e92123292f1f6a3d53c34ba8b1969f152ef1a7bb803f3c8"
 dependencies = [
- "atomic-write-file",
  "dotenvy",
  "either",
- "heck",
+ "heck 0.4.1",
  "hex",
  "once_cell",
  "proc-macro2",
@@ -5503,13 +5677,13 @@ dependencies = [
 
 [[package]]
 name = "sqlx-mysql"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e37195395df71fd068f6e2082247891bc11e3289624bbc776a0cdfa1ca7f1ea4"
+checksum = "1ed31390216d20e538e447a7a9b959e06ed9fc51c37b514b46eb758016ecd418"
 dependencies = [
  "atoi",
- "base64 0.21.5",
- "bitflags 2.4.1",
+ "base64 0.21.7",
+ "bitflags 2.5.0",
  "byteorder",
  "bytes",
  "chrono",
@@ -5547,13 +5721,13 @@ dependencies = [
 
 [[package]]
 name = "sqlx-postgres"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6ac0ac3b7ccd10cc96c7ab29791a7dd236bd94021f31eec7ba3d46a74aa1c24"
+checksum = "7c824eb80b894f926f89a0b9da0c7f435d27cdd35b8c655b114e58223918577e"
 dependencies = [
  "atoi",
- "base64 0.21.5",
- "bitflags 2.4.1",
+ "base64 0.21.7",
+ "bitflags 2.5.0",
  "byteorder",
  "chrono",
  "crc",
@@ -5576,7 +5750,6 @@ dependencies = [
  "rand 0.8.5",
  "serde",
  "serde_json",
- "sha1",
  "sha2",
  "smallvec",
  "sqlx-core",
@@ -5589,9 +5762,9 @@ dependencies = [
 
 [[package]]
 name = "sqlx-sqlite"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "210976b7d948c7ba9fced8ca835b11cbb2d677c59c79de41ac0d397e14547490"
+checksum = "b244ef0a8414da0bed4bb1910426e890b19e5e9bccc27ada6b797d05c55ae0aa"
 dependencies = [
  "atoi",
  "chrono",
@@ -5655,27 +5828,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
-name = "structmeta"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ad9e09554f0456d67a69c1584c9798ba733a5b50349a6c0d0948710523922d"
-dependencies = [
- "proc-macro2",
- "quote",
- "structmeta-derive",
- "syn 2.0.39",
-]
-
-[[package]]
-name = "structmeta-derive"
-version = "0.2.0"
+name = "strsim"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a60bcaff7397072dca0017d1db428e30d5002e00b6847703e2e42005c95fbe00"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.39",
-]
+checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
 
 [[package]]
 name = "strum"
@@ -5692,11 +5848,11 @@ version = "0.25.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23dc1fa9ac9c169a78ba62f0b841814b7abae11bdd047b9c58f893439e309ea0"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -5718,9 +5874,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.39"
+version = "2.0.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
+checksum = "7383cd0e49fff4b6b90ca5670bfd3e9d6a733b3f90c686605aa7eec8c4996032"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5735,95 +5891,72 @@ checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
 [[package]]
 name = "synstructure"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "285ba80e733fac80aa4270fbcdf83772a79b80aa35c97075320abfee4a915b06"
+checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
- "unicode-xid",
+ "syn 2.0.53",
 ]
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.12"
+version = "0.12.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c39fd04924ca3a864207c66fc2cd7d22d7c016007f9ce846cbb9326331930a"
+checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
 
 [[package]]
 name = "tempfile"
-version = "3.8.1"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
+checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
 dependencies = [
  "cfg-if",
  "fastrand 2.0.1",
- "redox_syscall",
- "rustix 0.38.25",
- "windows-sys 0.48.0",
+ "rustix 0.38.31",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "thiserror"
-version = "1.0.50"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2"
+checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.50"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
+checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
 name = "thread_local"
-version = "1.1.7"
+version = "1.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdd6f064ccff2d6567adcb3873ca630700f00b5ad3f060c25b5dcfd9a4ce152"
+checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
 dependencies = [
  "cfg-if",
  "once_cell",
 ]
 
 [[package]]
-name = "threadpool"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
-dependencies = [
- "num_cpus",
-]
-
-[[package]]
-name = "thrift"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e54bc85fc7faa8bc175c4bab5b92ba8d9a3ce893d0e9f42cc455c8ab16a9e09"
-dependencies = [
- "byteorder",
- "integer-encoding",
- "log",
- "ordered-float 2.10.1",
- "threadpool",
-]
-
-[[package]]
 name = "time"
-version = "0.3.30"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4a34ab300f2dee6e562c10a046fc05e358b29f9bf92277f30c3c8d82275f6f5"
+checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
 dependencies = [
  "deranged",
  "itoa",
+ "num-conv",
  "powerfmt",
  "serde",
  "time-core",
@@ -5838,10 +5971,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.15"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
+checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 
@@ -5872,9 +6006,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.34.0"
+version = "1.36.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0c014766411e834f7af5b8f4cf46257aab4036ca95e9d2c144a10f59ad6f5b9"
+checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
 dependencies = [
  "backtrace",
  "bytes",
@@ -5884,22 +6018,12 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.5.5",
+ "socket2 0.5.6",
  "tokio-macros",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
-name = "tokio-io-timeout"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30b74022ada614a1b4834de765f9bb43877f910cc8ce4be40e89042c9223a8bf"
-dependencies = [
- "pin-project-lite",
- "tokio",
-]
-
-[[package]]
 name = "tokio-macros"
 version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5907,24 +6031,25 @@ checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.24.1"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
 dependencies = [
- "rustls",
+ "rustls 0.22.2",
+ "rustls-pki-types",
  "tokio",
 ]
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.14"
+version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
+checksum = "267ac89e0bec6e691e5813911606935d77c476ff49024f98abcea3e7b15e37af"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -5933,9 +6058,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-test"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e89b3cbabd3ae862100094ae433e1def582cf86451b4e9bf83aa7ac1d8a7d719"
+checksum = "2468baabc3311435b55dd935f702f42cd1b8abb7e754fb7dfb16bd36aa88f9f7"
 dependencies = [
  "async-stream",
  "bytes",
@@ -5979,34 +6104,27 @@ version = "0.19.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
 dependencies = [
- "indexmap 2.1.0",
+ "indexmap 2.2.5",
  "toml_datetime",
  "winnow",
 ]
 
 [[package]]
 name = "tonic"
-version = "0.9.2"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3082666a3a6433f7f511c7192923fa1fe07c69332d3c6a2e6bb040b569199d5a"
+checksum = "76c4eb7a4e9ef9d4763600161f12f5070b92a578e1b634db88a6887844c91a13"
 dependencies = [
  "async-trait",
- "axum",
- "base64 0.21.5",
+ "base64 0.21.7",
  "bytes",
- "futures-core",
- "futures-util",
- "h2",
- "http 0.2.11",
+ "http 0.2.12",
  "http-body",
- "hyper",
- "hyper-timeout",
  "percent-encoding",
  "pin-project",
  "prost",
  "tokio",
  "tokio-stream",
- "tower",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -6020,12 +6138,8 @@ checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
 dependencies = [
  "futures-core",
  "futures-util",
- "hdrhistogram",
- "indexmap 1.9.3",
  "pin-project",
  "pin-project-lite",
- "rand 0.8.5",
- "slab",
  "tokio",
  "tokio-util",
  "tower-layer",
@@ -6039,11 +6153,11 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61c5bb1d698276a2443e5ecfabc1008bf15a36c12e6a7176e7bf089ea9131140"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "bytes",
  "futures-core",
  "futures-util",
- "http 0.2.11",
+ "http 0.2.12",
  "http-body",
  "http-range-header",
  "httpdate",
@@ -6104,7 +6218,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -6142,9 +6256,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-opentelemetry"
-version = "0.22.0"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c67ac25c5407e7b961fafc6f7e9aa5958fd297aada2d20fa2ae1737357e55596"
+checksum = "a9be14ba1bbe4ab79e9229f7f89fab8d120b865859f10527f31c033e599d2284"
 dependencies = [
  "js-sys",
  "once_cell",
@@ -6176,20 +6290,9 @@ dependencies = [
 
 [[package]]
 name = "try-lock"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
-
-[[package]]
-name = "typed-builder"
-version = "0.12.0"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6179333b981641242a768f30f371c9baccbfcc03749627000c500ab88bf4528b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typenum"
@@ -6205,13 +6308,15 @@ checksum = "ed646292ffc8188ef8ea4d1e0e0150fb15a5c2e12ad9b8fc191ae7a8a7f3c4b9"
 
 [[package]]
 name = "ulid"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e37c4b6cbcc59a8dcd09a6429fbc7890286bcbb79215cea7b38a3c4c0921d93"
+checksum = "34778c17965aa2a08913b57e1f34db9b4a63f5de31768b55bf20d2795f921259"
 dependencies = [
+ "getrandom 0.2.12",
  "rand 0.8.5",
  "serde",
  "uuid",
+ "web-time",
 ]
 
 [[package]]
@@ -6225,9 +6330,9 @@ dependencies = [
 
 [[package]]
 name = "uncased"
-version = "0.9.9"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b9bc53168a4be7402ab86c3aad243a84dd7381d09be0eddc81280c1da95ca68"
+checksum = "e1b88fcfe09e89d3866a5c11019378088af2d24c3fbd4f0543f96b479ec90697"
 dependencies = [
  "version_check",
 ]
@@ -6243,9 +6348,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-bidi"
-version = "0.3.13"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
 
 [[package]]
 name = "unicode-ident"
@@ -6255,18 +6360,18 @@ checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
 dependencies = [
  "tinyvec",
 ]
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
+checksum = "d4c87d22b6e3f4a18d4d40ef354e97c90fcb14dd91d7dc0aa9d8a1172ebf7202"
 
 [[package]]
 name = "unicode-width"
@@ -6298,9 +6403,9 @@ dependencies = [
 
 [[package]]
 name = "unsafe-libyaml"
-version = "0.2.9"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f28467d3e1d3c6586d8f25fa243f544f5800fec42d97032474e17222c2b75cfa"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 
 [[package]]
 name = "untrusted"
@@ -6334,9 +6439,9 @@ checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
 name = "uuid"
-version = "1.6.1"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e395fcf16a7a3d8127ec99782007af141946b4795001f876d54fb0d55978560"
+checksum = "a183cf7feeba97b4dd1c0d46788634f6221d87fa961b305bed08c851829efcc0"
 dependencies = [
  "serde",
 ]
@@ -6355,9 +6460,9 @@ checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
 
 [[package]]
 name = "value-bag"
-version = "1.4.2"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a72e1902dde2bd6441347de2b70b7f5d59bf157c6c62f0c44572607a1d55bbe"
+checksum = "74797339c3b98616c009c7c3eb53a0ce41e85c8ec66bd3db96ed132d20cfdee8"
 
 [[package]]
 name = "vcpkg"
@@ -6379,9 +6484,9 @@ checksum = "f3c4517f54858c779bbcbf228f4fca63d121bf85fbecb2dc578cdf4a39395690"
 
 [[package]]
 name = "walkdir"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
 dependencies = [
  "same-file",
  "winapi-util",
@@ -6409,10 +6514,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
+[[package]]
 name = "wasm-bindgen"
-version = "0.2.88"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7daec296f25a1bae309c0cd5c29c4b260e510e6d813c286b19eaadf409d40fce"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -6420,24 +6531,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.88"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e397f4664c0e4e428e8313a469aaa58310d302159845980fd23b0f22a847f217"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.38"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afec9963e3d0994cac82455b2b3502b81a7f40f9a0d32181f7528d9f4b43e02"
+checksum = "76bc14366121efc8dbb487ab05bcc9d346b3b5ec0eaa76e46594cabbe51762c0"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -6447,9 +6558,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.88"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5961017b3b08ad5f3fe39f1e79877f8ee7c23c5e5fd5eb80de95abc41f1f16b2"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -6457,60 +6568,62 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.88"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5353b8dab669f5e10f5bd76df26a9360c748f054f862ff5f3f8aae0c7fb3907"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.88"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d046c5d029ba91a1ed14da14dca44b68bf2f124cfbaf741c54151fdb3e0750b"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
 
 [[package]]
 name = "wasm-encoder"
-version = "0.36.2"
+version = "0.41.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "822b645bf4f2446b949776ffca47e2af60b167209ffb70814ef8779d299cd421"
+checksum = "972f97a5d8318f908dded23594188a90bcd09365986b1163e66d70170e5287ae"
 dependencies = [
  "leb128",
 ]
 
 [[package]]
 name = "wasmparser"
-version = "0.116.1"
+version = "0.121.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a58e28b80dd8340cb07b8242ae654756161f6fc8d0038123d679b7b99964fa50"
+checksum = "9dbe55c8f9d0dbd25d9447a5a889ff90c0cc3feaa7395310d3d826b2c703eaab"
 dependencies = [
- "indexmap 2.1.0",
+ "bitflags 2.5.0",
+ "indexmap 2.2.5",
  "semver",
 ]
 
 [[package]]
 name = "wasmtime"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae4b1702ef55144d6f594085f4989dc71fb71a791be1c8354ecc8e489b81199b"
+checksum = "8106d7d22d63d1bcb940e22dcc7b03e46f0fc8bfbaf2fd7b6cb8f448f9449774"
 dependencies = [
  "anyhow",
  "async-trait",
  "bincode",
  "bumpalo",
  "cfg-if",
- "indexmap 2.1.0",
+ "gimli",
+ "indexmap 2.2.5",
  "libc",
  "log",
  "object",
  "once_cell",
  "paste",
- "psm",
+ "rustix 0.38.31",
  "serde",
  "serde_derive",
  "serde_json",
@@ -6521,50 +6634,50 @@ dependencies = [
  "wasmtime-cranelift",
  "wasmtime-environ",
  "wasmtime-fiber",
- "wasmtime-jit",
+ "wasmtime-jit-icache-coherence",
  "wasmtime-runtime",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "wasmtime-asm-macros"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c981d0e87bb3e98e08e76644e7ae5dfdef7f1d4105145853f3d677bb4535d65f"
+checksum = "3b0cf02cea951ace34ee3b0e64b7f446c3519d1c95ad75bc5330f405e275ee8f"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "wasmtime-cache"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d7ba8adaa84fdb9dd659275edcf7fc5282c44b9c9f829986c71d44fd52ea80a"
+checksum = "3249204a71d728d53fb3eea18afd0473f87e520445707a4d567ac4da0bb3eb5d"
 dependencies = [
  "anyhow",
- "base64 0.21.5",
+ "base64 0.21.7",
  "bincode",
  "directories-next",
  "log",
- "rustix 0.38.25",
+ "rustix 0.38.31",
  "serde",
  "serde_derive",
  "sha2",
  "toml",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
  "zstd",
 ]
 
 [[package]]
 name = "wasmtime-component-macro"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c91dcbbd0e1f094351d1ae0e53463c63ba53ec8f8e0e21d17567c1979a8c3758"
+checksum = "7d3786c0531565ec6c9852c0e46299f06cb6e4b58d36e30f3c234cfa69bde376"
 dependencies = [
  "anyhow",
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
  "wasmtime-component-util",
  "wasmtime-wit-bindgen",
  "wit-parser",
@@ -6572,15 +6685,15 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-component-util"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e85f1319a7ed36aa59446ab7e967d0c2fb0cd179bf56913633190b44572023e"
+checksum = "81eae2ec98027ee0b3950da83bc320120a23087ac4d39b3d59201cb5ebf52777"
 
 [[package]]
 name = "wasmtime-cranelift"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1453665878e16245b9a25405e550c4a36c6731c6e34ea804edc002a38c3e6741"
+checksum = "595abdb067acdc812ab0f21d8d46d5aa4022392aa7c3e0632c20bff9ec49ffb4"
 dependencies = [
  "anyhow",
  "cfg-if",
@@ -6603,9 +6716,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-cranelift-shared"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3dface3d9b72b4670781ff72675eabb291e2836b5dded6bb312b577d2bb561f"
+checksum = "e8c24c1fdea167b992d82ebe76471fd1cbe7b0b406bc72f9250f86353000134e"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -6619,14 +6732,15 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-environ"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0116108e7d231cce15fe7dd642c66c3abb14dbcf169b0130e11f223ce8d1ad7"
+checksum = "3279d510005358141550d8a90a5fc989d7e81748e5759d582fe6bfdcbf074a04"
 dependencies = [
  "anyhow",
+ "bincode",
  "cranelift-entity",
  "gimli",
- "indexmap 2.1.0",
+ "indexmap 2.2.5",
  "log",
  "object",
  "serde",
@@ -6639,96 +6753,63 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-fiber"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8a5896355c37bf0f9feb4f1299142ef4bed8c92576aa3a41d150fed0cafa056"
+checksum = "9b1df665f2117741d1265f5663b0d93068b18120c2c4b18b9faed49d00d92c31"
 dependencies = [
  "anyhow",
  "cc",
  "cfg-if",
- "rustix 0.38.25",
+ "rustix 0.38.31",
  "wasmtime-asm-macros",
  "wasmtime-versioned-export-macros",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "wasmtime-jit"
-version = "15.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e32b210767452f6b20157bb7c7d98295b92cc47aaad2a8aa31652f4469813a5d"
-dependencies = [
- "anyhow",
- "bincode",
- "cfg-if",
- "gimli",
- "log",
- "object",
- "rustix 0.38.25",
- "serde",
- "serde_derive",
- "target-lexicon",
- "wasmtime-environ",
- "wasmtime-jit-icache-coherence",
- "wasmtime-runtime",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "wasmtime-jit-debug"
-version = "15.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bffd2785a16c55ac77565613ebda625f5850d4014af0499df750e8de97c04547"
-dependencies = [
- "once_cell",
- "wasmtime-versioned-export-macros",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "wasmtime-jit-icache-coherence"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b73ad1395eda136baec5ece7e079e0536a82ef73488e345456cc9b89858ad0ec"
+checksum = "866634605089b4632b32226b54aa3670d72e1849f9fc425c7e50b3749c2e6df3"
 dependencies = [
  "cfg-if",
  "libc",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "wasmtime-runtime"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77b50f7f3c1a8dabb2607f32a81242917bd77cee75f3dec66e04b02ccbb8ba07"
+checksum = "e11185c88cadf595d228f5ae4ff9b4badbf9ca98dcb37b0310c36e31fa74867f"
 dependencies = [
  "anyhow",
  "cc",
  "cfg-if",
- "indexmap 2.1.0",
+ "indexmap 2.2.5",
  "libc",
  "log",
  "mach",
  "memfd",
- "memoffset 0.9.0",
+ "memoffset",
  "paste",
- "rand 0.8.5",
- "rustix 0.38.25",
+ "psm",
+ "rustix 0.38.31",
  "sptr",
  "wasm-encoder",
  "wasmtime-asm-macros",
  "wasmtime-environ",
  "wasmtime-fiber",
- "wasmtime-jit-debug",
  "wasmtime-versioned-export-macros",
  "wasmtime-wmemcheck",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "wasmtime-types"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "447973db3dc5c24db14130ab0922795c58790aec296d198ad9d253b82ec67471"
+checksum = "f32377cbd827bee06fcb2f6bf97b0477fdcc86888bbe6db7b9cab8e644082e0a"
 dependencies = [
  "cranelift-entity",
  "serde",
@@ -6739,38 +6820,38 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-versioned-export-macros"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a347bb8ecf12275fb180afb1b1c85c9e186553c43109737bffed4f54c2aa365"
+checksum = "4ab8d7566d206c42f8cf1d4ac90c5e40d3582e8eabad9b3b67e9e73c61fc47a1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
 name = "wasmtime-wit-bindgen"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41786c7bbbf250c0e685b291323b50c6bb65f0505a2c0b4f0b598c740f13f185"
+checksum = "faf2c76781a27e07802669f6f0e11eb4441546407eb65be60c3d862200988b92"
 dependencies = [
  "anyhow",
- "heck",
- "indexmap 2.1.0",
+ "heck 0.4.1",
+ "indexmap 2.2.5",
  "wit-parser",
 ]
 
 [[package]]
 name = "wasmtime-wmemcheck"
-version = "15.0.0"
+version = "18.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47907bdd67500c66fa308acbce7387c7bfb63b5505ef81be7fc897709afcca60"
+checksum = "3847d969bd203b8cd239f89581e52432a0f00b8c5c9bc917be2fccd7542c4f2f"
 
 [[package]]
 name = "web-sys"
-version = "0.3.65"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5db499c5f66323272151db0e666cd34f78617522fb0c1604d31a27c50c206a85"
+checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -6778,9 +6859,9 @@ dependencies = [
 
 [[package]]
 name = "web-time"
-version = "0.2.3"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57099a701fb3a8043f993e8228dc24229c7b942e2b009a1b962e54489ba1d3bf"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -6788,15 +6869,28 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "0.25.3"
+version = "0.25.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1778a42e8b3b90bff8d0f5032bf22250792889a5cdc752aa0020c84abe3aaf10"
+checksum = "b3de34ae270483955a94f4b21bdaaeb83d508bb84a01435f393818edb0012009"
+dependencies = [
+ "rustls-pki-types",
+]
 
 [[package]]
 name = "whoami"
-version = "1.4.1"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22fc3756b8a9133049b26c7f61ab35416c130e8c09b660f5b3958b446f52cc50"
+checksum = "a44ab49fad634e88f55bf8f9bb3abd2f27d7204172a112c7c9987e01c1c94ea9"
+dependencies = [
+ "redox_syscall",
+ "wasite",
+]
 
 [[package]]
 name = "winapi"
@@ -6831,20 +6925,11 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows-core"
-version = "0.51.1"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1f8cf84f35d2db49a46868f947758c7a1138116f7fac3bc844f43ade1292e64"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.48.5",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
+ "windows-targets 0.52.4",
 ]
 
 [[package]]
@@ -6857,18 +6942,12 @@ dependencies = [
 ]
 
 [[package]]
-name = "windows-targets"
-version = "0.42.2"
+name = "windows-sys"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
+ "windows-targets 0.52.4",
 ]
 
 [[package]]
@@ -6887,10 +6966,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
+name = "windows-targets"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.4",
+ "windows_aarch64_msvc 0.52.4",
+ "windows_i686_gnu 0.52.4",
+ "windows_i686_msvc 0.52.4",
+ "windows_x86_64_gnu 0.52.4",
+ "windows_x86_64_gnullvm 0.52.4",
+ "windows_x86_64_msvc 0.52.4",
+]
 
 [[package]]
 name = "windows_aarch64_gnullvm"
@@ -6899,10 +6987,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
+name = "windows_aarch64_gnullvm"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -6911,10 +6999,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
+name = "windows_aarch64_msvc"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -6923,10 +7011,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
+name = "windows_i686_gnu"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -6935,10 +7023,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
+name = "windows_i686_msvc"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -6947,10 +7035,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
+name = "windows_x86_64_gnu"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -6959,10 +7047,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
+name = "windows_x86_64_gnullvm"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -6971,23 +7059,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
+
+[[package]]
 name = "winnow"
-version = "0.5.19"
+version = "0.5.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "829846f3e3db426d4cee4510841b71a8e58aa2a76b1132579487ae430ccd9c7b"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "wiremock"
-version = "0.5.21"
+version = "0.5.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "079aee011e8a8e625d16df9e785de30a6b77f80a6126092d76a57375f96448da"
+checksum = "13a3a53eaf34f390dd30d7b1b078287dd05df2aa2e21a589ccb80f5c7253c2e9"
 dependencies = [
  "assert-json-diff",
  "async-trait",
- "base64 0.21.5",
+ "base64 0.21.7",
  "deadpool",
  "futures",
  "futures-timer",
@@ -7003,13 +7097,13 @@ dependencies = [
 
 [[package]]
 name = "wit-parser"
-version = "0.13.0"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15df6b7b28ce94b8be39d8df5cb21a08a4f3b9f33b631aedb4aa5776f785ead3"
+checksum = "316b36a9f0005f5aa4b03c39bc3728d045df136f8c13a73b7db4510dec725e08"
 dependencies = [
  "anyhow",
  "id-arena",
- "indexmap 2.1.0",
+ "indexmap 2.2.5",
  "log",
  "semver",
  "serde",
@@ -7019,6 +7113,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "woothee"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "896174c6a4779d4d7d4523dd27aef7d46609eda2497e370f6c998325c6bf6971"
+dependencies = [
+ "lazy_static",
+ "regex",
+]
+
+[[package]]
 name = "writeable"
 version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -7035,9 +7139,9 @@ dependencies = [
 
 [[package]]
 name = "yansi"
-version = "1.0.0-rc.1"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1367295b8f788d371ce2dbc842c7b709c73ee1364d30351dd300ec2203b12377"
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
 [[package]]
 name = "yoke"
@@ -7059,28 +7163,28 @@ checksum = "9e6936f0cce458098a201c245a11bef556c6a0181129c7034d10d76d1ec3a2b8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.7.26"
+version = "0.7.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e97e415490559a91254a2979b4829267a57d2fcd741a98eee8b722fb57289aa0"
+checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.7.26"
+version = "0.7.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd7e48ccf166952882ca8bd778a43502c64f33bf94c12ebe2a7f08e5a0f6689f"
+checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -7100,7 +7204,7 @@ checksum = "e6a647510471d372f2e6c2e6b7219e44d8c574d24fdc11c610a61455782f18c3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
  "synstructure",
 ]
 
@@ -7111,6 +7215,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
 
 [[package]]
+name = "zerotrie"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0594125a0574fb93059c92c588ab209cc036a23d1baeb3410fa9181bea551a0"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
 name = "zerovec"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -7129,7 +7244,7 @@ checksum = "7b4e5997cbf58990550ef1f0e5124a05e47e1ebd33a84af25739be6031a62c20"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.53",
 ]
 
 [[package]]
diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index ce4748af91d2b..199f42eda3505 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -14,26 +14,26 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "matrix-authentication-service";
-  version = "0.7.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "matrix-authentication-service";
     rev = "refs/tags/v${version}";
-    hash = "sha256-foipChunzRKIbeO+O+XYx0luzaA0G9LKrH59luQl9R0=";
+    hash = "sha256-e5JlkcSJ44iE+pVnGQpGiSNahxUcIFeaPyOjp9E3eD0=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "opa-wasm-0.1.0" = "sha256-GuOlUNGegdDieTvthk9SyfQSTeem7ArJTdiD1t7Ojd4=";
+      "opa-wasm-0.1.0" = "sha256-f3IIln7BbN7NJiCVMgfoell/plzlqkSm4YYK7mqzKgw=";
     };
   };
 
   npmDeps = fetchNpmDeps {
     name = "${pname}-${version}-npm-deps";
     src = "${src}/${npmRoot}";
-    hash = "sha256-ymI+ZkPEGMTLMdTLfKv/v/cgW5iS/nd9PNXFvYaYNjo=";
+    hash = "sha256-xoPclMK+io/3tx139MNyMSP0kr61XHiSzAf3YkX0YZo=";
   };
 
   npmRoot = "frontend";
diff --git a/pkgs/by-name/me/mednafen-server/package.nix b/pkgs/by-name/me/mednafen-server/package.nix
new file mode 100644
index 0000000000000..59247cf46c592
--- /dev/null
+++ b/pkgs/by-name/me/mednafen-server/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mednafen-server";
+  version = "0.5.2";
+
+  src = fetchurl {
+    url = "https://mednafen.github.io/releases/files/mednafen-server-${finalAttrs.version}.tar.xz";
+    hash = "sha256-uJmxaMW+bydfAXq8XDOioMoBOLUsi5OT2Tpbbotsp3Y=";
+  };
+
+  strictDeps = true;
+
+  postInstall = ''
+    install -m 644 -Dt $out/share/mednafen-server standard.conf
+  '';
+
+  meta = {
+    description = "Netplay server for Mednafen";
+    mainProgram = "mednafen-server";
+    homepage = "https://mednafen.github.io/";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/applications/emulators/mednafen/default.nix b/pkgs/by-name/me/mednafen/package.nix
index 816b6c1bd4d7c..057f3ed4cf130 100644
--- a/pkgs/applications/emulators/mednafen/default.nix
+++ b/pkgs/by-name/me/mednafen/package.nix
@@ -1,33 +1,39 @@
-{ lib
-, stdenv
-, fetchurl
-, SDL2
-, SDL2_net
-, alsa-lib
-, flac
-, freeglut
-, libGL
-, libGLU
-, libX11
-, libcdio
-, libjack2
-, libsamplerate
-, libsndfile
-, pkg-config
-, zlib
-, libiconv
+{
+  lib,
+  SDL2,
+  SDL2_net,
+  alsa-lib,
+  fetchurl,
+  flac,
+  freeglut,
+  libGL,
+  libGLU,
+  libX11,
+  libcdio,
+  libiconv,
+  libjack2,
+  libsamplerate,
+  libsndfile,
+  pkg-config,
+  stdenv,
+  zlib,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mednafen";
   version = "1.29.0";
 
   src = fetchurl {
-    url = "https://mednafen.github.io/releases/files/${pname}-${version}.tar.xz";
+    url = "https://mednafen.github.io/releases/files/mednafen-${finalAttrs.version}.tar.xz";
     hash = "sha256-2j+88Ch3+b4PAov6XRy1npU6QEm5D+fjk4ijOG2fNi4=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  outputs = [ "out" "doc" ];
+
+  nativeBuildInputs = [
+    SDL2
+    pkg-config
+  ];
 
   buildInputs = [
     SDL2
@@ -48,16 +54,21 @@ stdenv.mkDerivation rec {
     libiconv
   ];
 
-  hardeningDisable = [ "pic" "format" ];
+  hardeningDisable = [
+    "format"
+    "pic"
+  ];
 
   enableParallelBuilding = true;
 
+  strictDeps = true;
+
   postInstall = ''
-    mkdir -p $out/share/doc
-    mv Documentation $out/share/doc/mednafen
+    mkdir -p $doc/share/doc
+    mv Documentation $doc/share/doc/mednafen
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://mednafen.github.io/";
     description = "A portable, CLI-driven, SDL+OpenGL-based, multi-system emulator";
     longDescription = ''
@@ -91,9 +102,9 @@ stdenv.mkDerivation rec {
       - Sega Saturn (experimental, x86_64 only)
       - Sony PlayStation
     '';
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2Plus;
     mainProgram = "mednafen";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/me/mednaffe/package.nix b/pkgs/by-name/me/mednaffe/package.nix
new file mode 100644
index 0000000000000..5625c380eaa7a
--- /dev/null
+++ b/pkgs/by-name/me/mednaffe/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  autoreconfHook,
+  fetchFromGitHub,
+  gtk3,
+  mednafen,
+  pkg-config,
+  stdenv,
+  wrapGAppsHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mednaffe";
+  version = "0.9.3";
+
+  src = fetchFromGitHub {
+    owner = "AmatCoder";
+    repo = "mednaffe";
+    rev = finalAttrs.version;
+    hash = "sha256-ZizW0EeY/Cc68m87cnbLAkx3G/ULyFT5b6Ku2ObzFRU=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    mednafen
+  ];
+
+  enableParallelBuilding = true;
+
+  strictDeps = true;
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH ':' "${mednafen}/bin"
+    )
+   '';
+
+  meta = {
+    description = "GTK-based frontend for mednafen emulator";
+    mainProgram = "mednaffe";
+    homepage = "https://github.com/AmatCoder/mednaffe";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/mo/mosdepth/package.nix b/pkgs/by-name/mo/mosdepth/package.nix
index dbe5bc87726c7..da7f210ecf57f 100644
--- a/pkgs/by-name/mo/mosdepth/package.nix
+++ b/pkgs/by-name/mo/mosdepth/package.nix
@@ -2,7 +2,7 @@
 
 buildNimPackage (finalAttrs: {
   pname = "mosdepth";
-  version = "0.3.7";
+  version = "0.3.8";
 
   requiredNimVersion = 1;
 
@@ -10,7 +10,7 @@ buildNimPackage (finalAttrs: {
     owner = "brentp";
     repo = "mosdepth";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-VyEZNY/P3BfJ3PCRn7R+37XH4gfc9JEOFB0WmrSxpIc=";
+    sha256 = "sha256-IkCLlIugnOO2LpS79gakURvPR1ZuayFtrOOoPyNKLMQ=";
   };
 
   lockFile = ./lock.json;
diff --git a/pkgs/by-name/mq/mqttui/Cargo.lock b/pkgs/by-name/mq/mqttui/Cargo.lock
index fd3db1ec87029..7726441244f5a 100644
--- a/pkgs/by-name/mq/mqttui/Cargo.lock
+++ b/pkgs/by-name/mq/mqttui/Cargo.lock
@@ -19,9 +19,9 @@ checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "ahash"
-version = "0.8.9"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d713b3834d76b85304d4d525563c1276e2e30dc97cc67bfb4585a4a29fc2c89f"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -31,9 +31,9 @@ dependencies = [
 
 [[package]]
 name = "allocator-api2"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
+checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
 
 [[package]]
 name = "android-tzdata"
@@ -52,9 +52,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.12"
+version = "0.6.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96b09b5178381e0874812a9b157f7fe84982617e48f71f4e3235482775e5b540"
+checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -100,21 +100,22 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.80"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ad32ce52e4161730f7098c077cd2ed6229b5804ccf99e5366be1ab72a98b4e1"
+checksum = "f538837af36e6f6a9be0faa67f9a314f8119e4e4b5867c6ab40ed60360142519"
 
 [[package]]
 name = "async-tungstenite"
-version = "0.23.0"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e9efbe14612da0a19fb983059a0b621e9cf6225d7018ecab4f9988215540dc"
+checksum = "2cca750b12e02c389c1694d35c16539f88b8bbaa5945934fdc1b41a776688589"
 dependencies = [
  "futures-io",
  "futures-util",
  "log",
  "pin-project-lite",
  "rustls-native-certs",
+ "rustls-pki-types",
  "tokio",
  "tokio-rustls",
  "tungstenite",
@@ -134,15 +135,15 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
 
 [[package]]
 name = "backtrace"
-version = "0.3.69"
+version = "0.3.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
+checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
 dependencies = [
  "addr2line",
  "cc",
@@ -155,9 +156,9 @@ dependencies = [
 
 [[package]]
 name = "base64"
-version = "0.21.7"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
 
 [[package]]
 name = "bitflags"
@@ -167,9 +168,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.2"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "block-buffer"
@@ -182,9 +183,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.15.3"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea184aa71bb362a1157c896979544cc23974e08fd265f29ea96b59f0b4a555b"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "byteorder"
@@ -194,9 +195,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "cassowary"
@@ -215,9 +216,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.88"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02f341c093d19155a6e41631ce5971aac4e9a868262212153124c15fa22d1cdc"
+checksum = "17f6e324229dc011159fcc089755d1e2e216a90d43a7dea6853ca740b84f35e7"
 
 [[package]]
 name = "cfg-if"
@@ -227,21 +228,22 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.34"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bc015644b92d5890fab7489e49d21f879d5c990186827d42ec511919404f38b"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
  "num-traits",
- "windows-targets 0.52.3",
+ "serde",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
 name = "clap"
-version = "4.5.1"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c918d541ef2913577a0f9566e9ce27cb35b6df072075769e0b26cb5a554520da"
+checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -249,9 +251,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.1"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f3e7391dad68afb0c2ede1bf619f579a3dc9c2ec67f089baa397123a2f3d1eb"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
 dependencies = [
  "anstream",
  "anstyle",
@@ -262,23 +264,23 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.5.1"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "885e4d7d5af40bfb99ae6f9433e292feac98d452dcb3ec3d25dfe7552b77da8c"
+checksum = "dd79504325bf38b10165b02e89b4347300f855f273c4cb30c4a3209e6583275e"
 dependencies = [
  "clap",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.5.0"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "307bc0538d5f0f83b8248db3087aa92fe504e4691294d0c96c0eabc33f47ba47"
+checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
 dependencies = [
- "heck",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
@@ -347,7 +349,7 @@ version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f476fe445d41c9e991fd07515a6f463074b782242ccf4a5b7b1d1012e70824df"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "crossterm_winapi",
  "libc",
  "mio",
@@ -400,9 +402,9 @@ checksum = "3a68a4904193147e0a8dec3314640e6db742afd5f6e634f428a6af230d9b3591"
 
 [[package]]
 name = "either"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
 
 [[package]]
 name = "errno"
@@ -496,7 +498,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
@@ -541,9 +543,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.12"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "libc",
@@ -573,10 +575,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
 name = "http"
-version = "0.2.11"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
 dependencies = [
  "bytes",
  "fnv",
@@ -624,9 +632,9 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "2.0.4"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e186cfbae8084e513daff4240b4797e342f988cecda4fb6c939150f96315fd8"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
 name = "itertools"
@@ -639,15 +647,15 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "js-sys"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "406cda4b368d531c842222cf9d2600a9a4acce8d29423695379c6868a143a9ee"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -676,9 +684,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "lru"
@@ -691,9 +699,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "miniz_oxide"
@@ -706,9 +714,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
  "log",
@@ -718,7 +726,7 @@ dependencies = [
 
 [[package]]
 name = "mqttui"
-version = "0.20.0"
+version = "0.21.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -735,6 +743,8 @@ dependencies = [
  "rustls",
  "rustls-native-certs",
  "rustls-pemfile",
+ "rustls-pki-types",
+ "serde",
  "serde_json",
  "tui-tree-widget",
  "url",
@@ -817,9 +827,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 
 [[package]]
 name = "pin-utils"
@@ -835,18 +845,18 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.78"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -883,11 +893,11 @@ dependencies = [
 
 [[package]]
 name = "ratatui"
-version = "0.26.1"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcb12f8fbf6c62614b0d56eb352af54f6a22410c3b079eb53ee93c7b97dd31d8"
+checksum = "a564a852040e82671dc50a37d88f3aa83bbc690dfc6844cfe7a2591620206a80"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "cassowary",
  "compact_str",
  "crossterm",
@@ -935,9 +945,9 @@ dependencies = [
 
 [[package]]
 name = "rmp"
-version = "0.8.12"
+version = "0.8.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f9860a6cc38ed1da53456442089b4dfa35e7cedaa326df63017af88385e6b20"
+checksum = "228ed7c16fa39782c3b3468e974aec2795e9089153cd08ee2e9aefb3613334c4"
 dependencies = [
  "byteorder",
  "num-traits",
@@ -946,12 +956,14 @@ dependencies = [
 
 [[package]]
 name = "rmpv"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e0e0214a4a2b444ecce41a4025792fc31f77c7bb89c46d253953ea8c65701ec"
+checksum = "e540282f11751956c82bc5529a7fb71b871b998fbf9cf06c2419b22e1b4350df"
 dependencies = [
  "num-traits",
  "rmp",
+ "serde",
+ "serde_bytes",
 ]
 
 [[package]]
@@ -962,9 +974,9 @@ checksum = "b833d8d034ea094b1ea68aa6d5c740e0d04bad9d16568d08ba6f76823a114316"
 
 [[package]]
 name = "rumqttc"
-version = "0.23.0"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d8941c6791801b667d52bfe9ff4fc7c968d4f3f9ae8ae7abdaaa1c966feafc8"
+checksum = "e1568e15fab2d546f940ed3a21f48bbbd1c494c90c99c4481339364a497f94a9"
 dependencies = [
  "async-tungstenite",
  "bytes",
@@ -998,11 +1010,11 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.31"
+version = "0.38.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
+checksum = "65e04861e65f21776e67888bfbea442b3642beaa0138fdb1dd7a84a52dffdb89"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -1011,52 +1023,63 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.21.10"
+version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
+checksum = "99008d7ad0bbbea527ec27bddbc0e432c5b87d8175178cee68d2eec9c4a1813c"
 dependencies = [
  "log",
  "ring",
+ "rustls-pki-types",
  "rustls-webpki",
- "sct",
+ "subtle",
+ "zeroize",
 ]
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.6.3"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
+checksum = "8f1fb85efa936c42c6d5fc28d2629bb51e4b2f4b8a5211e297d599cc5a093792"
 dependencies = [
  "openssl-probe",
  "rustls-pemfile",
+ "rustls-pki-types",
  "schannel",
  "security-framework",
 ]
 
 [[package]]
 name = "rustls-pemfile"
-version = "1.0.4"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
 dependencies = [
  "base64",
+ "rustls-pki-types",
 ]
 
 [[package]]
+name = "rustls-pki-types"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecd36cc4259e3e4514335c4a138c6b43171a8d61d8f5c9348f9fc7529416f247"
+
+[[package]]
 name = "rustls-webpki"
-version = "0.101.7"
+version = "0.102.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+checksum = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610"
 dependencies = [
  "ring",
+ "rustls-pki-types",
  "untrusted",
 ]
 
 [[package]]
 name = "rustversion"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
+checksum = "80af6f9131f277a45a3fba6ce8e2258037bb0477a67e610d3c1fe046ab31de47"
 
 [[package]]
 name = "ryu"
@@ -1080,20 +1103,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
-name = "sct"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring",
- "untrusted",
-]
-
-[[package]]
 name = "security-framework"
-version = "2.9.2"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05b64fb303737d99b81884b2c63433e9ae28abebe5eb5045dcdd175dc2ecf4de"
+checksum = "770452e37cad93e0a50d5abc3990d2bc351c36d0328f86cefec2f2fb206eaef6"
 dependencies = [
  "bitflags 1.3.2",
  "core-foundation",
@@ -1104,9 +1117,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.9.1"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
+checksum = "41f3cc463c0ef97e11c3461a9d3787412d30e8e7eb907c79180c4a57bf7c04ef"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1120,29 +1133,38 @@ checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
 
 [[package]]
 name = "serde"
-version = "1.0.197"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
+name = "serde_bytes"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b8497c313fd43ab992087548117643f6fcd935cbf36f176ffda0aacf9591734"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "serde_derive"
-version = "1.0.197"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.114"
+version = "1.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
+checksum = "3e17db7126d17feb94eb3fad46bf1a96b034e8aacbc2e775fe81505f8b0b2813"
 dependencies = [
  "itoa",
  "ryu",
@@ -1201,9 +1223,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "socket2"
@@ -1226,12 +1248,12 @@ dependencies = [
 
 [[package]]
 name = "stability"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebd1b177894da2a2d9120208c3386066af06a488255caabc5de8ddca22dbc3ce"
+checksum = "2ff9eaf853dec4c8802325d8b6d3dffa86cc707fd7a1a4cdbf416e13b061787a"
 dependencies = [
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
@@ -1242,48 +1264,43 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
 name = "strsim"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "strum"
-version = "0.26.1"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "723b93e8addf9aa965ebe2d11da6d7540fa2283fcea14b3371ff055f7ba13f5f"
+checksum = "5d8cec3501a5194c432b2b7976db6b7d10ec95c253208b45f83f7136aa985e29"
 dependencies = [
  "strum_macros",
 ]
 
 [[package]]
 name = "strum_macros"
-version = "0.26.1"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a3417fc93d76740d974a01654a09777cb500428cc874ca9f45edfe0c4d4cd18"
+checksum = "c6cf59daf282c0a494ba14fd21610a0325f9f90ec9d1231dea26bcb1d696c946"
 dependencies = [
- "heck",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
-name = "syn"
-version = "1.0.109"
+name = "subtle"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
 
 [[package]]
 name = "syn"
-version = "2.0.51"
+version = "2.0.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ab617d94515e94ae53b8406c628598680aa0c9587474ecbe58188f7b345d66c"
+checksum = "4a6531ffc7b071655e4ce2e04bd464c4830bb585a61cabb96cf808f05172615a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1302,22 +1319,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.57"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e45bcbe8ed29775f228095caf2cd67af7a4ccf756ebff23a306bf3e8b47b24b"
+checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.57"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a953cb265bef375dae3de6663da4d3804eee9682ea80d8e2542529b73c531c81"
+checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
@@ -1337,9 +1354,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.36.0"
+version = "1.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
+checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
 dependencies = [
  "backtrace",
  "bytes",
@@ -1359,16 +1376,17 @@ checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.24.1"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
 dependencies = [
  "rustls",
+ "rustls-pki-types",
  "tokio",
 ]
 
@@ -1391,7 +1409,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
 
 [[package]]
@@ -1415,9 +1433,9 @@ dependencies = [
 
 [[package]]
 name = "tungstenite"
-version = "0.20.1"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e3dac10fd62eaf6617d3a904ae222845979aec67c615d1c842b4002c7666fb9"
+checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1"
 dependencies = [
  "byteorder",
  "bytes",
@@ -1427,6 +1445,7 @@ dependencies = [
  "log",
  "rand",
  "rustls",
+ "rustls-pki-types",
  "sha1",
  "thiserror",
  "url",
@@ -1515,9 +1534,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1e124130aee3fb58c5bdd6b639a0509486b0338acaaae0c84a5124b0f588b7f"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -1525,24 +1544,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e7e1900c352b609c8488ad12639a311045f40a35491fb69ba8c12f758af70b"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b30af9e2d358182b5c7449424f017eba305ed32a7010509ede96cdc4696c46ed"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1550,22 +1569,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "642f325be6301eb8107a83d12a8ac6c1e1c54345a7ef1a9261962dfefda09e66"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
 
 [[package]]
 name = "winapi"
@@ -1595,7 +1614,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.3",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -1613,7 +1632,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.3",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -1633,17 +1652,18 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d380ba1dc7187569a8a9e91ed34b8ccfc33123bbacb8c0aed2d1ad7f3ef2dc5f"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.3",
- "windows_aarch64_msvc 0.52.3",
- "windows_i686_gnu 0.52.3",
- "windows_i686_msvc 0.52.3",
- "windows_x86_64_gnu 0.52.3",
- "windows_x86_64_gnullvm 0.52.3",
- "windows_x86_64_msvc 0.52.3",
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]
 
 [[package]]
@@ -1654,9 +1674,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68e5dcfb9413f53afd9c8f86e56a7b4d86d9a2fa26090ea2dc9e40fba56c6ec6"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -1666,9 +1686,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8dab469ebbc45798319e69eebf92308e541ce46760b49b18c6b3fe5e8965b30f"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -1678,9 +1698,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a4e9b6a7cac734a8b4138a4e1044eac3404d8326b6c0f939276560687a033fb"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -1690,9 +1716,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28b0ec9c422ca95ff34a78755cfa6ad4a51371da2a5ace67500cf7ca5f232c58"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -1702,9 +1728,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "704131571ba93e89d7cd43482277d6632589b18ecf4468f591fbae0a8b101614"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -1714,9 +1740,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42079295511643151e98d61c38c0acc444e52dd42ab456f7ccfd5152e8ecf21c"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -1726,19 +1752,19 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.3"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0770833d60a970638e989b3fa9fd2bb1aaadcf88963d1659fd7d9990196ed2d6"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 
 [[package]]
 name = "ws_stream_tungstenite"
-version = "0.11.0"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e283cc794a890f5bdc01e358ad7c34535025f79ba83c1b5c7e01e5d6c60b336d"
+checksum = "a198f414f083fb19fcc1bffcb0fa0cf46d33ccfa229adf248cac12c180e91609"
 dependencies = [
  "async-tungstenite",
  "async_io_stream",
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "futures-core",
  "futures-io",
  "futures-sink",
@@ -1767,5 +1793,11 @@ checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.51",
+ "syn",
 ]
+
+[[package]]
+name = "zeroize"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
diff --git a/pkgs/by-name/mq/mqttui/package.nix b/pkgs/by-name/mq/mqttui/package.nix
index 6c7ca4cb46292..a1023cb6debae 100644
--- a/pkgs/by-name/mq/mqttui/package.nix
+++ b/pkgs/by-name/mq/mqttui/package.nix
@@ -1,19 +1,20 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, darwin
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mqttui";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "EdJoPaTo";
     repo = "mqttui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NfRPuZFZMZl1ulEGD5oQkS25oJdBVyLiN3QCQWrDej8=";
+    hash = "sha256-aIvT1js+xY1rauZYVCkl71JLfIDjIEGy3W8WdIaTyxY=";
   };
 
   cargoLock = {
@@ -34,7 +35,10 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/EdJoPaTo/mqttui";
     changelog = "https://github.com/EdJoPaTo/mqttui/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ fab sikmir ];
+    maintainers = with maintainers; [
+      fab
+      sikmir
+    ];
     mainProgram = "mqttui";
   };
 }
diff --git a/pkgs/by-name/my/mystmd/package.nix b/pkgs/by-name/my/mystmd/package.nix
index 6c4277ee5823a..2be16bb1c83e6 100644
--- a/pkgs/by-name/my/mystmd/package.nix
+++ b/pkgs/by-name/my/mystmd/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "mystmd";
-  version = "1.1.53";
+  version = "1.1.55";
 
   src = fetchFromGitHub {
     owner = "executablebooks";
     repo = "mystmd";
     rev = "mystmd@${version}";
-    hash = "sha256-neJKlUk0NHdAh7y92Iyv2kouASPzv1PIl79+D0mgckI=";
+    hash = "sha256-aIqIcNXlzpvW90WJs9tJajXvnEQB0IiNCu8B62cwElo=";
   };
 
-  npmDepsHash = "sha256-bXvOzx89MR7KL9wsqzB1uorjGGjh++mw17Ni65LLz28=";
+  npmDepsHash = "sha256-QIGqx1Peogmdo1KLHkzUKqvAuA6jCJRfxeQ1X7p6vTM=";
 
   dontNpmInstall = true;
 
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 01301c63757b4..8413a3843192d 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.356";
+  version = "0.0.359";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-sQZ0kwZXaYoiXCaSvCcnMqYNeLHvtZzHih52+2AYdeY=";
+    hash = "sha256-zLEaQmZKDwTRR6Zi/thCtVu+jJONGouaVOcxKBBIkt4=";
   };
 
-  vendorHash = "sha256-a/e+xPOD9BDSlKknmfcX2tTMyIUrzKxqtUpFXcFIDSE=";
+  vendorHash = "sha256-72cHswoTZszo42NOrPNuokDlqoJ3/YEhGe+rQSKvgAw=";
 
   subPackages = ["cmd/nsc" "cmd/ns" "cmd/docker-credential-nsc"];
 
diff --git a/pkgs/by-name/ne/nemu/package.nix b/pkgs/by-name/ne/nemu/package.nix
new file mode 100644
index 0000000000000..c57b4dca6ec4f
--- /dev/null
+++ b/pkgs/by-name/ne/nemu/package.nix
@@ -0,0 +1,108 @@
+{ busybox
+, cmake
+, coreutils
+, dbus
+, fetchFromGitHub
+, gettext
+, graphviz
+, json_c
+, lib
+, libarchive
+, libusb1
+, libxml2
+, makeWrapper
+, ncurses
+, ninja
+, openssl
+, picocom
+, pkg-config
+, qemu
+, socat
+, sqlite
+, stdenv
+, systemd
+, tigervnc
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nemu";
+  version = "3.3.1";
+
+  src = fetchFromGitHub {
+    owner = "nemuTUI";
+    repo = "nemu";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-6WzqBkspKKs1e8kg1i71ntZHa78s5pJ1u02mXvzpiEc=";
+  };
+
+  cmakeFlags = [
+    "-DNM_WITH_DBUS=ON"
+    "-DNM_WITH_NETWORK_MAP=ON"
+    "-DNM_WITH_REMOTE=ON"
+    "-DNM_WITH_USB=ON"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    busybox # for start-stop-daemon
+    coreutils
+    dbus
+    gettext
+    graphviz
+    json_c
+    libarchive
+    libusb1
+    libxml2
+    ncurses
+    openssl
+    picocom
+    qemu
+    socat
+    sqlite
+    systemd # for libudev
+    tigervnc
+  ];
+
+  runtimeDependencies = [
+    busybox
+    picocom
+    qemu
+    socat
+    tigervnc
+  ];
+
+  postPatch = ''
+    substituteInPlace nemu.cfg.sample \
+      --replace-fail /usr/bin/vncviewer ${tigervnc}/bin/vncviewer \
+      --replace-fail "qemu_bin_path = /usr/bin" "qemu_bin_path = ${qemu}/bin"
+
+    substituteInPlace sh/ntty \
+      --replace-fail /usr/bin/socat ${socat}/bin/socat \
+      --replace-fail /usr/bin/picocom ${picocom}/bin/picocom \
+      --replace-fail start-stop-daemon ${busybox}/bin/start-stop-daemon
+
+    substituteInPlace sh/setup_nemu_nonroot.sh \
+      --replace-fail /usr/bin/nemu $out/bin/nemu
+  '';
+
+  postInstall = ''
+    wrapProgram $out/share/nemu/scripts/upgrade_db.sh \
+      --prefix PATH : "${sqlite}/bin"
+  '';
+
+  meta = {
+    changelog = "https://github.com/nemuTUI/nemu/releases/tag/v${finalAttrs.version}";
+    description = "Ncurses UI for QEMU";
+    homepage = "https://github.com/nemuTUI/nemu";
+    license = lib.licenses.bsd2;
+    mainProgram = "nemu";
+    maintainers = with lib.maintainers; [ msanft ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ne/netbird-dashboard/package.nix b/pkgs/by-name/ne/netbird-dashboard/package.nix
new file mode 100644
index 0000000000000..18353174e118a
--- /dev/null
+++ b/pkgs/by-name/ne/netbird-dashboard/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage rec {
+  pname = "netbird-dashboard";
+  version = "2.3.0";
+
+  src = fetchFromGitHub {
+    owner = "netbirdio";
+    repo = "dashboard";
+    rev = "v${version}";
+    hash = "sha256-4aZ7WGLhjpTHOggJ+sRdln0YOG3jf7TKT9/bH/n3LmQ=";
+  };
+
+  npmDepsHash = "sha256-ts3UuThIMf+wwSr3DpZ+k1i9RnHi/ltvhD/7lomVxQk=";
+  npmFlags = [ "--legacy-peer-deps" ];
+
+  installPhase = ''
+    cp -R out $out
+  '';
+
+  env = {
+    CYPRESS_INSTALL_BINARY = 0;
+  };
+
+  meta = with lib; {
+    description = "NetBird Management Service Web UI Panel";
+    homepage = "https://github.com/netbirdio/dashboard";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ thubrecht ];
+  };
+}
diff --git a/pkgs/by-name/nh/nh/package.nix b/pkgs/by-name/nh/nh/package.nix
index 780e3b2a0693e..3d1480da73d2b 100644
--- a/pkgs/by-name/nh/nh/package.nix
+++ b/pkgs/by-name/nh/nh/package.nix
@@ -10,7 +10,7 @@
 , nix-output-monitor
 }:
 let
-  version = "3.5.10";
+  version = "3.5.13";
   runtimeDeps = [ nvd nix-output-monitor ];
 in
 rustPlatform.buildRustPackage {
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
     owner = "viperML";
     repo = "nh";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uEVd15WsX+Wti9PXW724puFcsFO72VTiJyBwW2WXT9M=";
+    hash = "sha256-lTy5gmB3dJZJKag2uuuxXvZCAt/RhLnI0jbIicBJfCo=";
   };
 
   strictDeps = true;
@@ -47,7 +47,7 @@ rustPlatform.buildRustPackage {
       --prefix PATH : ${lib.makeBinPath runtimeDeps}
   '';
 
-  cargoHash = "sha256-/aqs/l+Qi2b8zxHXqxdHLBpSr5+vVsd6pY/QnHbkmb0=";
+  cargoHash = "sha256-X8+GmPFxvgeNxMuOacoCUCgdZ/+N4mwQFMUtvO1E998=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ni/niri/Cargo.lock b/pkgs/by-name/ni/niri/Cargo.lock
index 8292783edb7da..eed1cf8108d90 100644
--- a/pkgs/by-name/ni/niri/Cargo.lock
+++ b/pkgs/by-name/ni/niri/Cargo.lock
@@ -2138,7 +2138,7 @@ dependencies = [
 
 [[package]]
 name = "niri"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "arrayvec",
@@ -2183,7 +2183,7 @@ dependencies = [
 
 [[package]]
 name = "niri-config"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "bitflags 2.5.0",
  "csscolorparser",
@@ -2198,15 +2198,16 @@ dependencies = [
 
 [[package]]
 name = "niri-ipc"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "clap",
  "serde",
+ "serde_json",
 ]
 
 [[package]]
 name = "niri-visual-tests"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "gtk4",
@@ -3115,7 +3116,7 @@ checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 [[package]]
 name = "smithay"
 version = "0.3.0"
-source = "git+https://github.com/Smithay/smithay.git#e5f006818df7ebb92d206985f45e713ba1e9c1c9"
+source = "git+https://github.com/Smithay/smithay.git#c5e9a697e41f50dc56b918d9ef1e3d2e52c84ac0"
 dependencies = [
  "appendlist",
  "bitflags 2.5.0",
@@ -3187,7 +3188,7 @@ dependencies = [
 [[package]]
 name = "smithay-drm-extras"
 version = "0.1.0"
-source = "git+https://github.com/Smithay/smithay.git#e5f006818df7ebb92d206985f45e713ba1e9c1c9"
+source = "git+https://github.com/Smithay/smithay.git#c5e9a697e41f50dc56b918d9ef1e3d2e52c84ac0"
 dependencies = [
  "drm",
  "edid-rs",
diff --git a/pkgs/by-name/ni/niri/package.nix b/pkgs/by-name/ni/niri/package.nix
index a24619921e529..8413089ece203 100644
--- a/pkgs/by-name/ni/niri/package.nix
+++ b/pkgs/by-name/ni/niri/package.nix
@@ -20,19 +20,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "niri";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "YaLTeR";
     repo = "niri";
     rev = "v${version}";
-    hash = "sha256-lkGIQIMWfg71UOkT/TST8O6hD0IfslENj6oFPevUGl4=";
+    hash = "sha256-YuYowUw5ecPa78bhT72zY2b99wn68mO3vVkop8hnb8M=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "smithay-0.3.0" = "sha256-bWan2DCyMvEC8ZQPwM+XpuOGkOZ/RdDV+LmRCN8UAuc=";
+      "smithay-0.3.0" = "sha256-1ANERwRG7Uwe1gSm6zQnEMQlpRrGSFP8mp6JItzjz0k=";
     };
   };
 
diff --git a/pkgs/by-name/no/normcap/package.nix b/pkgs/by-name/no/normcap/package.nix
index 7018cc5657805..f6e4af16e6b14 100644
--- a/pkgs/by-name/no/normcap/package.nix
+++ b/pkgs/by-name/no/normcap/package.nix
@@ -97,6 +97,8 @@ ps.buildPythonApplication rec {
   disabledTests = [
     # requires a wayland session (no xclip support)
     "test_wl_copy"
+    # RuntimeError: Please destroy the QApplication singleton before creating a new QApplication instance
+    "test_get_application"
     # times out, unknown why
     "test_update_checker_triggers_checked_signal"
     # touches network
@@ -124,6 +126,9 @@ ps.buildPythonApplication rec {
     "tests/tests_gui/test_downloader.py"
     # fails to import, causes pytest to freeze
     "tests/tests_gui/test_language_manager.py"
+    # RuntimeError("Internal C++ object (PySide6.QtGui.QHideEvent) already deleted.")
+    # AttributeError("'LoadingIndicator' object has no attribute 'timer'")
+    "tests/tests_gui/test_loading_indicator.py"
   ] ++ lib.optionals stdenv.isDarwin [
     # requires a display
     "tests/integration/test_normcap.py"
diff --git a/pkgs/by-name/no/novops/package.nix b/pkgs/by-name/no/novops/package.nix
index f5893bf661919..eed3077f5ef33 100644
--- a/pkgs/by-name/no/novops/package.nix
+++ b/pkgs/by-name/no/novops/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "novops";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "PierreBeucher";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-iQFw3m7dpAii/Nc1UQ/ZXTuHvj5vGsp3SOqd14uHUpc=";
+    hash = "sha256-LrEPdEVWgbZ6WyEqdfAhUjKXPuk8Xx7kmLA2ZsPFf1U=";
   };
 
-  cargoHash = "sha256-mQ7Vm80S4FALWiEsV+68pNrah36aYu7PediRlJUXLAk=";
+  cargoHash = "sha256-kI836Z0fgpmPPoX0HtWkZG731xaVWgWkXF0eCaQfM28=";
 
   buildInputs = [
     openssl # required for openssl-sys
diff --git a/pkgs/by-name/nr/nrr/package.nix b/pkgs/by-name/nr/nrr/package.nix
index 6b37d272f5f8a..0992152aed3e9 100644
--- a/pkgs/by-name/nr/nrr/package.nix
+++ b/pkgs/by-name/nr/nrr/package.nix
@@ -5,20 +5,21 @@
 , darwin
 , pkg-config
 , libiconv
+, nrxAlias ? true
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nrr";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "ryanccn";
     repo = "nrr";
     rev = "v${version}";
-    hash = "sha256-4zQi7kQxcRXpYuSjolSZoDqX+CcGmq4dvChPlZZZVso=";
+    hash = "sha256-94BeBCYCxZBoOp6xo4I/uxd6ULjIfmF4nw/vUWoaEpo=";
   };
 
-  cargoHash = "sha256-XNnyEFEzKQ5N0xtskaUudcb2LtAiEsd6h3D/FdyIbHc=";
+  cargoHash = "sha256-DTQTIAk914XC+LecQTXk1TdBc/5sMFG8KiD9lO5HLiM=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreFoundation
@@ -31,8 +32,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
+  postInstall = lib.optionalString nrxAlias "ln -s $out/bin/nr{r,x}";
+
   meta = with lib; {
-    description = "Minimal, blazing fast Node.js script runner";
+    description = "Minimal, blazing fast npm scripts runner";
     maintainers = with maintainers; [ ryanccn ];
     license = licenses.gpl3Only;
     mainProgram = "nrr";
diff --git a/pkgs/by-name/nw/nwg-hello/package.nix b/pkgs/by-name/nw/nwg-hello/package.nix
index eb6126d1300ec..cae3fd2d25218 100644
--- a/pkgs/by-name/nw/nwg-hello/package.nix
+++ b/pkgs/by-name/nw/nwg-hello/package.nix
@@ -9,13 +9,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-hello";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-hello";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Z5Pwn/uJERWfHELXK+1SJ2vh//ZV9gqblD/GqnznJII=";
+    hash = "sha256-naYouinDYgdGwySVxdEOZpNTK0vwnIyUKTkPgYaneew=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/of/offat/package.nix b/pkgs/by-name/of/offat/package.nix
index 145ab32a1bbfa..e5b1186af7a59 100644
--- a/pkgs/by-name/of/offat/package.nix
+++ b/pkgs/by-name/of/offat/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "offat";
-  version = "0.17.0";
+  version = "0.17.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "OFFAT";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tSLlMgvKIDlzHL71gH1OznKI5jEyUoJUy9d9Z8tNXjk=";
+    hash = "sha256-tyQoTc/cfzYxK+vLg9TvZdbKRX3B4tL1Do/wDMArJSA=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/by-name/om/omnictl/package.nix b/pkgs/by-name/om/omnictl/package.nix
new file mode 100644
index 0000000000000..4f803fe35626d
--- /dev/null
+++ b/pkgs/by-name/om/omnictl/package.nix
@@ -0,0 +1,40 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "omnictl";
+  version = "0.32.2";
+
+  src = fetchFromGitHub {
+    owner = "siderolabs";
+    repo = "omni";
+    rev = "v${version}";
+    hash = "sha256-db/bYwMPrOZvD/YPtFaRK80yaYdsE70YPh0xQe0uVi4=";
+  };
+
+  vendorHash = "sha256-uwzVUdA51eT9fi2Wr0ilNPMpXx430UIYYWXQa1hpzRM=";
+
+  ldflags = [ "-s" "-w" ];
+
+  GOWORK = "off";
+
+  subPackages = [ "cmd/omnictl" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd omnictl \
+      --bash <($out/bin/omnictl completion bash) \
+      --fish <($out/bin/omnictl completion fish) \
+      --zsh <($out/bin/omnictl completion zsh)
+  '';
+
+  doCheck = false; # no tests
+
+  meta = with lib; {
+    description = "A CLI for the Sidero Omni Kubernetes management platform";
+    mainProgram = "omnictl";
+    homepage = "https://omni.siderolabs.com/";
+    license = licenses.bsl11;
+    maintainers = with maintainers; [ raylas ];
+  };
+}
diff --git a/pkgs/by-name/op/open-scq30/package.nix b/pkgs/by-name/op/open-scq30/package.nix
index 12b709282f6c5..7ab3452bd2df8 100644
--- a/pkgs/by-name/op/open-scq30/package.nix
+++ b/pkgs/by-name/op/open-scq30/package.nix
@@ -18,13 +18,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "open-scq30";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "Oppzippy";
     repo = "OpenSCQ30";
     rev = "v${version}";
-    hash = "sha256-yls7F6ou0TsoY6CDi694fJrq30Y3B6d96T1VWl47K0w=";
+    hash = "sha256-DL2hYm1j27K0nnBvE3iGnguqm0m1k56bkuG+6+u4u4c=";
   };
 
   nativeBuildInputs = [
@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
     darwin.apple_sdk.frameworks.Foundation
   ];
 
-  cargoHash = "sha256-VxweKzXNWOrBrzLzId8D6O0tZG8bI7HjhD+GJ3vRyhk=";
+  cargoHash = "sha256-YBJd43xOCumQbrvzfV/+F63McYzHg1bGI3icgGzGZrQ=";
 
   INSTALL_PREFIX = placeholder "out";
 
diff --git a/pkgs/by-name/op/openctm/package.nix b/pkgs/by-name/op/openctm/package.nix
new file mode 100644
index 0000000000000..e255e209111dd
--- /dev/null
+++ b/pkgs/by-name/op/openctm/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  freeglut,
+  gtk2,
+  libGLU,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "openctm";
+  version = "1.0.3";
+
+  src = fetchurl {
+    url = "https://downloads.sourceforge.net/project/openctm/OpenCTM-${finalAttrs.version}/OpenCTM-${finalAttrs.version}-src.tar.bz2";
+    hash = "sha256-So0mCNlzZPfuxWt8Y3xWuTCK6YKGs+kNu3QTyQ6UPx0=";
+  };
+
+  outputs = [
+    "bin"
+    "dev"
+    "man"
+    "out"
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    freeglut
+    gtk2
+    libGLU
+  ];
+
+  postPatch = ''
+    substituteInPlace tools/tinyxml/Makefile.linux \
+      --replace-warn "-Wno-format" "-Wno-format -Wno-format-security"
+    substituteInPlace tools/Makefile.linux \
+      --replace-warn "-lglut" "-lglut -lGL -lGLU"
+  '';
+
+  makeFlags = [
+    "BINDIR=$(bin)/bin/"
+    "INCDIR=$(dev)/include/"
+    "LIBDIR=$(out)/lib/"
+    "MAN1DIR=$(man)/share/man//man1"
+  ];
+
+  makefile = if stdenv.isDarwin then "Makefile.macosx" else "Makefile.linux";
+
+  preInstall = "mkdir -p $bin/bin $dev/include $out/lib $man/share/man/man1";
+
+  meta = with lib; {
+    description = "File format, software library and a tool set for compression of 3D triangle meshes";
+    homepage = "https://sourceforge.net/projects/openctm/";
+    license = licenses.zlib;
+    maintainers = with maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/by-name/ot/oterm/package.nix b/pkgs/by-name/ot/oterm/package.nix
index 5dbc79b712bbd..00c9d594179c1 100644
--- a/pkgs/by-name/ot/oterm/package.nix
+++ b/pkgs/by-name/ot/oterm/package.nix
@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "oterm";
-  version = "0.2.5";
+  version = "0.2.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ggozad";
     repo = "oterm";
     rev = "refs/tags/${version}";
-    hash = "sha256-s+TqDrgy7sR0sli8BGKlF546TW1+vzF0k3IkAQV6TpM=";
+    hash = "sha256-I/0U4lYqYZ6QCmWbDYhSOTCQ8o09W2cdd8kW7iN9iHU=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/pi/pingtunnel/package.nix b/pkgs/by-name/pi/pingtunnel/package.nix
new file mode 100644
index 0000000000000..826a562699289
--- /dev/null
+++ b/pkgs/by-name/pi/pingtunnel/package.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "pingtunnel";
+  version = "2.8";
+
+  src = fetchFromGitHub {
+    owner = "esrrhs";
+    repo = "pingtunnel";
+    rev = version;
+    hash = "sha256-qkIeE6gNBUUd5/IhcKhDmXZbzeSTR0r6qCAK/Nz7Kew=";
+  };
+
+  vendorHash = "sha256-SkBHFvQn3Q6fl/d1npEspTYhq1YrnusXNWr/Ky4bv64=";
+
+  ldflags = [ "-s" "-w" ];
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/pingtunnel
+  '';
+
+  meta = with lib; {
+    description = "A tool that send TCP/UDP traffic over ICMP";
+    homepage = "https://github.com/esrrhs/pingtunnel";
+    license = licenses.mit;
+    maintainers = with maintainers; [ oluceps ];
+    mainProgram = "pingtunnel";
+  };
+}
diff --git a/pkgs/by-name/po/pokemon-cursor/package.nix b/pkgs/by-name/po/pokemon-cursor/package.nix
new file mode 100644
index 0000000000000..ef9d35b49c836
--- /dev/null
+++ b/pkgs/by-name/po/pokemon-cursor/package.nix
@@ -0,0 +1,50 @@
+{ fetchFromGitHub
+, lib
+, stdenvNoCC
+
+, # build deps
+  clickgen
+, python3Packages
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "pokemon-cursor";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "ful1e5";
+    repo = "pokemon-cursor";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-EL6Ztbzjm1YuQP+8ZbrhbuBXn+GFiJGG0iGNWzU/rBY=";
+  };
+
+  nativeBuildInputs = [
+    clickgen
+    python3Packages.attrs
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    ctgen build.toml -p x11 -o $out
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/icons
+    mv $out/Pokemon $out/share/icons
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An unofficial open-source Pokemon cursor theme";
+    homepage = "https://github.com/ful1e5/pokemon-cursor";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.getpsyched ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/po/poppins/package.nix b/pkgs/by-name/po/poppins/package.nix
new file mode 100644
index 0000000000000..b56b2c3f2c8d6
--- /dev/null
+++ b/pkgs/by-name/po/poppins/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  unzip,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "poppins";
+  version = "4.003";
+
+  src = fetchFromGitHub {
+    owner = "itfoundry";
+    repo = "poppins";
+    rev = "v${version}";
+    hash = "sha256-7+RQHYxNFqOw2EeS2hgrbK/VbUAiPorUtkyRb5MFh5w=";
+  };
+
+  nativeBuildInputs = [unzip];
+
+  installPhase = ''
+    runHook preInstall
+    unzip products/Poppins-4.003-GoogleFonts-TTF.zip
+    unzip products/PoppinsLatin-5.001-Latin-TTF.zip
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A Devanagari + Latin family for Google Fonts";
+    homepage = "https://github.com/itfoundry/Poppins/";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [nyawox];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/pr/primecount/package.nix b/pkgs/by-name/pr/primecount/package.nix
index e595091dc4415..d2b117138e73f 100644
--- a/pkgs/by-name/pr/primecount/package.nix
+++ b/pkgs/by-name/pr/primecount/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "primecount";
-  version = "7.12";
+  version = "7.13";
 
   src = fetchFromGitHub {
     owner = "kimwalisch";
     repo = "primecount";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GjLLJLGMzFAN75zFAwIfFvaTm8sSC0J20HtH8tn52h8=";
+    hash = "sha256-VjsJjG2pSnDMVg3lY3cmpdnASeqClPjHUGY5wqupf2w=";
   };
 
   outputs = [ "out" "dev" "lib" "man" ];
diff --git a/pkgs/by-name/pr/promptfoo/package.nix b/pkgs/by-name/pr/promptfoo/package.nix
index 30c5024c1c4cc..322886aac67d4 100644
--- a/pkgs/by-name/pr/promptfoo/package.nix
+++ b/pkgs/by-name/pr/promptfoo/package.nix
@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "promptfoo";
-  version = "0.51.0";
+  version = "0.53.0";
 
   src = fetchFromGitHub {
     owner = "promptfoo";
     repo = "promptfoo";
     rev = "${version}";
-    hash = "sha256-M9NmSi8gij4nqWCvy9y7wXL76D2vzH2RzibP82XVTh4=";
+    hash = "sha256-ATZn33w58IjSGptxDhW7CdcI++aX8gw3GlOLSdYk2T4=";
   };
 
-  npmDepsHash = "sha256-bBI87CYDm36MOm2mVMRwnq5n+3RM1AnKFaNX5NZSeaw=";
+  npmDepsHash = "sha256-G7Fl66KPXRuHbdHCwaAqRO31Ff9VrzUWrq+XgGJFjtU=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 65a2d2cad87a7..3eb909bc63466 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -5,11 +5,11 @@
 
 renode.overrideAttrs (finalAttrs: _: {
   pname = "renode-unstable";
-  version = "1.15.0+20240404gitbfa16ba07";
+  version = "1.15.0+20240418git228a25674";
 
   src = fetchurl {
     url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-pXA6sGYBlLU2EnhFvUwRWkYirMi5BTgzyUbQ33sIMrg=";
+    hash = "sha256-v8fWQQM2NZkE+Wsg8pyww6esYLggJzehavqIhzI+EaQ=";
   };
 
   passthru.updateScript =
diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix
index 87470d96c2b70..e6812eaa013e3 100644
--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@@ -32,10 +32,10 @@
 
 let
   # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "16334-fba1db29b";
-  rpcs3Version = "0.0.31-16334-fba1db29b";
-  rpcs3Revision = "fba1db29b32b5cfeb66cb6bd3c2745e190557b10";
-  rpcs3Hash = "sha256-vCdZVecvFeWXYG9Hb0oT/gGdlLnTFOORTUdKGBD9onM=";
+  rpcs3GitVersion = "16364-dff7352e2";
+  rpcs3Version = "0.0.31-16364-dff7352e2";
+  rpcs3Revision = "dff7352e2eca04ebdddff21e44c1130dcc13f0aa";
+  rpcs3Hash = "sha256-kylHB5rtNH1dnx/kn1zwJ6dgnvgt9awvaz2eKzKDjxQ=";
 
   inherit (qt6Packages) qtbase qtmultimedia wrapQtAppsHook qtwayland;
 in
diff --git a/pkgs/by-name/sa/sandbar/package.nix b/pkgs/by-name/sa/sandbar/package.nix
new file mode 100644
index 0000000000000..8c754289aa001
--- /dev/null
+++ b/pkgs/by-name/sa/sandbar/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pixman,
+  fcft,
+  pkg-config,
+  wayland-protocols,
+  wayland-scanner,
+  wayland
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sandbar";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "kolunmi";
+    repo = "sandbar";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-uG+/e75s/OQtEotR+8aXTEjW6p3oJM8btuRNgUVmIiQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    wayland-scanner
+    wayland-protocols
+    wayland
+    pixman
+    fcft
+  ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/kolunmi/sandbar";
+    description = "DWM-like bar for the river wayland compositor";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fccapria ];
+    platforms = platforms.all;
+    badPlatforms = platforms.darwin;
+    mainProgram = "sandbar";
+  };
+})
diff --git a/pkgs/by-name/sh/shadow-tls/package.nix b/pkgs/by-name/sh/shadow-tls/package.nix
new file mode 100644
index 0000000000000..91116caf47505
--- /dev/null
+++ b/pkgs/by-name/sh/shadow-tls/package.nix
@@ -0,0 +1,32 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec{
+  pname = "shadow-tls";
+  version = "0.2.25";
+
+  src = fetchFromGitHub {
+    owner = "ihciah";
+    repo = "shadow-tls";
+    rev = "v${version}";
+    hash = "sha256-T+GPIrcME6Wq5sdfIt4t426/3ew5sUQMykYeZ6zw1ko=";
+  };
+
+  cargoHash = "sha256-w+DQeiQAtVsTw1VJhntX1FXymgS0fxsXiUmd6OjVWLQ=";
+
+  RUSTC_BOOTSTRAP = 1;
+
+  # network required
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/ihciah/shadow-tls";
+    description = "A proxy to expose real tls handshake to the firewall";
+    license = licenses.mit;
+    mainProgram = "shadow-tls";
+    maintainers = with maintainers; [ oluceps ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix
index e49ce5136af12..e37237ea289b7 100644
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.4.35";
+  version = "0.4.36";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     rev = version;
-    hash = "sha256-RJKne2Nq8mrVBgiOkXoM1HKIJ/BU0MQckbequ/0THGk=";
+    hash = "sha256-14Za64G/UpFa6Dfyx7EAQqXMmCWyl5MIQEdutqMQrxE=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
   nativeCheckInputs = [ git dart-sass ];
 
-  vendorHash = "sha256-jQCTdvJVe99sL8C9AkJZDsQV9tUoAXY18ar3+FNXEdM=";
+  vendorHash = "sha256-Zl84hA2YPG4p3t0V8ZPnLYGz4ggoTSln/koC40nbNZ4=";
 
   postInstall = ''
     export HOME="$(mktemp -d)"
diff --git a/pkgs/by-name/so/sopwith/package.nix b/pkgs/by-name/so/sopwith/package.nix
index b881454fff78e..8a4c1f9162010 100644
--- a/pkgs/by-name/so/sopwith/package.nix
+++ b/pkgs/by-name/so/sopwith/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sopwith";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "fragglet";
     repo = "sdl-sopwith";
     rev = "refs/tags/sdl-sopwith-${version}";
-    hash = "sha256-7/xTg41NYxzeGNyt/ClbM/uHMTAE87wn6vc9Ai6P+30=";
+    hash = "sha256-e7/Cv/v5NhYG5eb9B5oVxh/Dbmm2v4Y4KUKI4JI5SFw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ss/ssh-tpm-agent/package.nix b/pkgs/by-name/ss/ssh-tpm-agent/package.nix
index a7335db8daa0d..fc655fce32ad6 100644
--- a/pkgs/by-name/ss/ssh-tpm-agent/package.nix
+++ b/pkgs/by-name/ss/ssh-tpm-agent/package.nix
@@ -25,7 +25,7 @@ buildGo122Module rec {
 
   meta = with lib; {
     description = "SSH agent with support for TPM sealed keys for public key authentication";
-    homepage = "https://github.com/Foxboron/ssh-agent-tpm";
+    homepage = "https://github.com/Foxboron/ssh-tpm-agent";
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ sgo ];
diff --git a/pkgs/by-name/sw/swayosd/package.nix b/pkgs/by-name/sw/swayosd/package.nix
index d3bd68ea1e4e9..d3238053c0196 100644
--- a/pkgs/by-name/sw/swayosd/package.nix
+++ b/pkgs/by-name/sw/swayosd/package.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pkg-config
 , wrapGAppsHook
+, brightnessctl
 , cargo
 , coreutils
 , gtk-layer-shell
@@ -12,25 +13,26 @@
 , meson
 , ninja
 , rustc
+, sassc
 , stdenv
 , udev
 }:
 
 stdenv.mkDerivation rec {
   pname = "swayosd";
-  version = "unstable-2023-09-26";
+  version = "0-unstable-2024-04-15";
 
   src = fetchFromGitHub {
     owner = "ErikReider";
     repo = "SwayOSD";
-    rev = "1c7d2f5b3ee262f25bdd3c899eadf17efb656d26";
-    hash = "sha256-Y22O6Ktya/WIhidnoyxnZu5YvXWNmSS6vecDU8zDD34=";
+    rev = "11271760052c4a4a4057f2d287944d74e8fbdb58";
+    hash = "sha256-qOxnl2J+Ivx/TIqodv3a8nP0JQsYoKIrhqnbD9IxU8g=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-tqbMlygX+n14oR1t+0ngjiSG2mHUk/NbiWHk4yEAb2o=";
+    hash = "sha256-exbVanUvGp0ub4WE3VcsN8hkcK0Ipf0tNfd92UecICg=";
   };
 
   nativeBuildInputs = [
@@ -49,12 +51,19 @@ stdenv.mkDerivation rec {
     libinput
     libpulseaudio
     udev
+    sassc
   ];
 
   patches = [
     ./swayosd_systemd_paths.patch
   ];
 
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : ${lib.makeBinPath [ brightnessctl ]}
+    )
+  '';
+
   postPatch = ''
     substituteInPlace data/udev/99-swayosd.rules \
       --replace /bin/chgrp ${coreutils}/bin/chgrp \
@@ -65,7 +74,7 @@ stdenv.mkDerivation rec {
     description = "A GTK based on screen display for keyboard shortcuts";
     homepage = "https://github.com/ErikReider/SwayOSD";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ aleksana barab-i ];
+    maintainers = with maintainers; [ aleksana barab-i sergioribera ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/sy/syncall/package.nix b/pkgs/by-name/sy/syncall/package.nix
new file mode 100644
index 0000000000000..5ad793b672a28
--- /dev/null
+++ b/pkgs/by-name/sy/syncall/package.nix
@@ -0,0 +1,73 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "syncall";
+  version = "1.8.5";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "bergercookie";
+    repo = "syncall";
+    rev = "v${version}";
+    hash = "sha256-f9WVZ1gpVG0wvIqoAkeaYBE4QsGXSqrYS4KyHy6S+0Q=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+    --replace-fail 'loguru = "^0.5.3"' 'loguru = "^0.7"' \
+    --replace-fail 'PyYAML = "~5.3.1"' 'PyYAML = "^6.0"' \
+    --replace-fail 'bidict = "^0.21.2"' 'bidict = "^0.23"' \
+    --replace-fail 'typing = "^3.7.4"' '''
+  '';
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+    python3.pkgs.poetry-dynamic-versioning
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    bidict
+    bubop
+    click
+    item-synchronizer
+    loguru
+    python-dateutil
+    pyyaml
+    rfc3339
+    typing
+
+    # asana optional-dep
+    asana
+    # caldav optional-dep
+    caldav
+    icalendar
+    # fs optional-dep
+    xattr
+    # gkeep optional-dep
+    # gkeepapi is unavailable in nixpkgs
+    # google optional-dep
+    google-api-python-client
+    google-auth-oauthlib
+    # notion optional-dep
+    # FIXME: notion-client -- broken, doesn't build.
+    # taskwarrior optional-dep
+    taskw-ng
+  ];
+
+  postInstall = ''
+    # We do not support gkeep
+    rm $out/bin/tw_gkeep_sync
+  '';
+
+  pythonImportsCheck = [ "syncall" ];
+
+  meta = with lib; {
+    description = "Bi-directional synchronization between services such as Taskwarrior, Google Calendar, Notion, Asana, and more";
+    homepage = "https://github.com/bergercookie/syncall";
+    license = licenses.mit;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/by-name/sy/systemctl-tui/package.nix b/pkgs/by-name/sy/systemctl-tui/package.nix
index 571c9b15091f7..23a831e9e9c57 100644
--- a/pkgs/by-name/sy/systemctl-tui/package.nix
+++ b/pkgs/by-name/sy/systemctl-tui/package.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "systemctl-tui";
-  version = "0.2.4";
+  version = "0.3.3";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-SZmOCx9S5WWz9fSlicvT/glZKj5AsFDRnxmHbGxM9Ms=";
+    hash = "sha256-oFXLxWS2G+CkG0yuJLkA34SqoGGcXU/eZmFMRYw+Gzo=";
   };
 
-  cargoHash = "sha256-zUc6RchoGtJB+gnJNwNu93to775fdM5JDJ4qYwRdJn0=";
+  cargoHash = "sha256-MKxeRQupgAxA2ui8qSK8BvhxqqgjJarD8pY9wmk8MvA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.AppKit
diff --git a/pkgs/by-name/te/ternimal/package.nix b/pkgs/by-name/te/ternimal/package.nix
new file mode 100644
index 0000000000000..31f796f1ae600
--- /dev/null
+++ b/pkgs/by-name/te/ternimal/package.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustc
+}:
+stdenv.mkDerivation {
+  pname = "ternimal";
+  version = "0.1.0-unstable-2017-12-31";
+
+  src = fetchFromGitHub {
+    owner = "p-e-w";
+    repo = "ternimal";
+    rev = "e7953b4f80e514899e0920f0e36bb3141b685122";
+    hash = "sha256-uIxuwRvStvlC/YiolOvWZd45Qg3b86jsZQ000zZMo3M=";
+  };
+
+  nativeBuildInputs = [ rustc ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    rustc -O $src/ternimal.rs
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp ternimal $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Simulate a lifeform in the terminal";
+    homepage = "https://github.com/p-e-w/ternimal";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ anomalocaris ];
+    platforms = with lib.platforms; linux ++ darwin;
+    mainProgram = "ternimal";
+  };
+}
diff --git a/pkgs/by-name/te/tetrio-desktop/package.json b/pkgs/by-name/te/tetrio-desktop/package.json
new file mode 100644
index 0000000000000..65bf8ea63f762
--- /dev/null
+++ b/pkgs/by-name/te/tetrio-desktop/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "tetrio-desktop",
+  "version": "9.0.0",
+  "author": {
+    "name": "osk",
+    "email": "me@osk.sh"
+  },
+  "license": "© osk 2019-2024. All Rights Reserved.",
+  "homepage": "https://tetr.io/",
+  "main": "main.js",
+  "description": "Puzzle together in this modern yet familiar online stacker!",
+  "dependencies": {
+    "discord-rich-presence": "0.0.8",
+    "electron-store": "^8.1.0",
+    "image-size": "^1.1.1",
+    "node-fetch": "2.6.1",
+    "openpgp": "^5.11.1",
+    "systeminformation": "^5.22.0",
+    "whatwg-url": "^14.0.0",
+    "xmldom": "^0.6.0"
+  }
+}
diff --git a/pkgs/by-name/te/tetrio-desktop/package.nix b/pkgs/by-name/te/tetrio-desktop/package.nix
index d7fed29e7dae7..c3749de57dadc 100644
--- a/pkgs/by-name/te/tetrio-desktop/package.nix
+++ b/pkgs/by-name/te/tetrio-desktop/package.nix
@@ -1,84 +1,65 @@
 { stdenv
 , lib
-, fetchurl
+, fetchzip
 , dpkg
-, autoPatchelfHook
-, wrapGAppsHook
-, alsa-lib
-, cups
-, libGL
-, libX11
-, libXScrnSaver
-, libXtst
-, mesa
-, nss
-, gtk3
-, libpulseaudio
-, systemd
-, withTetrioPlus ? false # For backwards compatibility. At the time of writing, the latest released tetrio plus version is not compatible with tetrio desktop.
-, tetrio-plus ? false # For backwards compatibility. At the time of writing, the latest released tetrio plus version is not compatible with tetrio desktop.
+, makeWrapper
+, callPackage
+, addOpenGLRunpath
+, electron
+, withTetrioPlus ? true
+, tetrio-plus ? null
 }:
 
-lib.warnIf (withTetrioPlus != false) "withTetrioPlus: Currently unsupported with tetrio-desktop 9.0.0. Please remove this attribute."
-lib.warnIf (tetrio-plus != false) "tetrio-plus: Currently unsupported with tetrio-desktop 9.0.0. Please remove this attribute."
-
-(let
-  libPath = lib.makeLibraryPath [
-    libGL
-    libpulseaudio
-    systemd
-  ];
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tetrio-desktop";
   version = "9.0.0";
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://tetr.io/about/desktop/builds/${lib.versions.major finalAttrs.version}/TETR.IO%20Setup.deb";
-    hash = "sha256-UriLwMB8D+/T32H4rPbkJAy/F/FFhNpd++0AR1lwEfs=";
+    hash = "sha256-TgegFy+sHjv0ILaiLO1ghyUhKXoj8v43ACJOJhKyI0c=";
+    nativeBuildInputs = [ dpkg ];
   };
 
   nativeBuildInputs = [
-    dpkg
-    autoPatchelfHook
-    wrapGAppsHook
+    makeWrapper
   ];
 
-  dontWrapGApps = true;
-
-  buildInputs = [
-    alsa-lib
-    cups
-    libX11
-    libXScrnSaver
-    libXtst
-    mesa
-    nss
-    gtk3
-  ];
+  installPhase =
+    let
+      tetrio-plus' =
+        if tetrio-plus == null
+        then callPackage ./tetrio-plus.nix { tetrio-src = finalAttrs.src; }
+        else tetrio-plus;
 
-  unpackCmd = "dpkg -x $curSrc src";
+      asarPath =
+        if withTetrioPlus
+        then "${tetrio-plus'}/app.asar"
+        else "opt/TETR.IO/resources/app.asar";
+    in
+    ''
+      runHook preInstall
 
-  installPhase = ''
-    runHook preInstall
+      mkdir -p $out
+      cp -r usr/share/ $out
 
-    mkdir -p $out/bin
-    cp -r opt/ usr/share/ $out
-    ln -s $out/opt/TETR.IO/TETR.IO $out/bin/tetrio
+      mkdir -p $out/share/TETR.IO/
+      cp ${asarPath} $out/share/TETR.IO/app.asar
 
-    substituteInPlace $out/share/applications/TETR.IO.desktop \
-      --replace-fail "Exec=/opt/TETR.IO/TETR.IO" "Exec=$out/bin/tetrio"
+      substituteInPlace $out/share/applications/TETR.IO.desktop \
+        --replace-fail "Exec=/opt/TETR.IO/TETR.IO" "Exec=$out/bin/tetrio"
 
-    runHook postInstall
-  '';
+      runHook postInstall
+    '';
 
   postFixup = ''
-    wrapProgram $out/opt/TETR.IO/TETR.IO \
-      --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/TETR.IO \
-      ''${gappsWrapperArgs[@]}
+    makeShellWrapper '${lib.getExe electron}' $out/bin/tetrio \
+      --prefix LD_LIBRARY_PATH : ${addOpenGLRunpath.driverLink}/lib \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags $out/share/TETR.IO/app.asar
   '';
 
   meta = {
+    changelog = "https://tetr.io/about/desktop/history/";
     description = "TETR.IO desktop client";
     downloadPage = "https://tetr.io/about/desktop/";
     homepage = "https://tetr.io";
@@ -88,7 +69,8 @@ stdenv.mkDerivation (finalAttrs: {
       Play against friends and foes all over the world, or claim a spot on the leaderboards - the stacker future is yours!
     '';
     mainProgram = "tetrio";
-    maintainers = with lib.maintainers; [ wackbyte ];
+    maintainers = with lib.maintainers; [ wackbyte huantian ];
     platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
   };
-}))
+})
diff --git a/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix b/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
new file mode 100644
index 0000000000000..a0c67265e51ce
--- /dev/null
+++ b/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
@@ -0,0 +1,160 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, rustPlatform
+, rustc
+, wasm-pack
+, wasm-bindgen-cli
+, binaryen
+
+, fetchYarnDeps
+, yarn
+, fixup_yarn_lock
+, nodejs
+, asar
+
+, tetrio-src
+}:
+
+let
+  version = "unstable-2024-03-31";
+
+  src = fetchFromGitLab {
+    owner = "UniQMG";
+    repo = "tetrio-plus";
+    rev = "b13d476a162a2aec4ca0def29eb7a4ada9ebf523";
+    hash = "sha256-bZwx0r2lu4Ed/pYRvNog6IIok/HMoK+UeDIQctggUEs=";
+    fetchSubmodules = true;
+
+    # tetrio-plus uses this info for displaying its version,
+    # so we need to deep clone to have all the revision history.
+    # After we're done, we emulate 'leaveDotGit = false' by removing
+    # all the .git folders.
+    leaveDotGit = true;
+    deepClone = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse --short HEAD~1 > resources/ci-commit-previous
+      git rev-parse --short HEAD > resources/ci-commit
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  wasm-bindgen-82 = wasm-bindgen-cli.override {
+    version = "0.2.82";
+    hash = "sha256-BQ8v3rCLUvyCCdxo5U+NHh30l9Jwvk9Sz8YQv6fa0SU=";
+    cargoHash = "sha256-mP85+qi2KA0GieaBzbrQOBqYxBZNRJipvd2brCRGyOM=";
+  };
+
+  tpsecore = rustPlatform.buildRustPackage {
+    pname = "tpsecore";
+    inherit version src;
+
+    sourceRoot = "${src.name}/tpsecore";
+
+    cargoHash = "sha256-14UjPSlfiuf696cqy8+fz3SmfmFoGQlEDg9obP0EKXg=";
+
+    nativeBuildInputs = [
+      wasm-pack
+      wasm-bindgen-82
+      binaryen
+      rustc.llvmPackages.lld
+    ];
+
+    buildPhase = ''
+      HOME=$(mktemp -d) RUSTFLAGS="-C linker=lld" wasm-pack build --target web --release
+    '';
+
+    installPhase = ''
+      cp -r pkg/ $out
+    '';
+
+    doCheck = false;
+
+    meta = {
+      description = "A self contained toolkit for creating, editing, and previewing TPSE files";
+      homepage = "https://gitlab.com/UniQMG/tpsecore";
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [ huantian wackbyte ];
+      platforms = lib.platforms.linux;
+    };
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = ./yarn.lock;
+    hash = "sha256-VYUh9y6PRc1OTLELkqCxP89Xbesv3Nu+eUq6fkuoQHE=";
+  };
+
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tetrio-plus";
+  inherit version src;
+
+  nativeBuildInputs = [
+    yarn
+    fixup_yarn_lock
+    nodejs
+    asar
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    # 'out' is the directory that the tetrio-plus expects the vanilla asar to be
+    # and this is the directory that will contain the final result that we want
+    asar extract ${tetrio-src}/opt/TETR.IO/resources/app.asar out
+    cd out
+
+    # Install custom package.json/yarn.lock that describe the additional node
+    # dependencies that tetrio-plus needs to run, and install them in our output
+    install -m644 ${./package.json} package.json
+    install -m644 ${./yarn.lock} yarn.lock
+
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror ${offlineCache}
+    fixup_yarn_lock yarn.lock
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    patchShebangs node_modules/
+
+    cd ..
+
+    # The simple build script expects the vanilla asar located here
+    # This patches the vanilla code to load the tetrio-plus code
+    ln -s ${tetrio-src}/opt/TETR.IO/resources/app.asar app.asar
+    node ./scripts/build-electron.js
+
+    # Finally, we install the tetrio-plus code where the above patch script expects
+    cp -r $src out/tetrioplus
+    chmod -R u+w out/tetrioplus
+
+    # We don't need the tpsecore source code bundled
+    rm -rf out/tetrioplus/tpsecore/
+    # since we install the compiled version here
+    cp ${tpsecore}/{tpsecore_bg.wasm,tpsecore.js} out/tetrioplus/source/lib/
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preinstall
+
+    mkdir -p $out
+    asar pack out $out/app.asar
+
+    runHook postinstall
+  '';
+
+  meta = {
+    description = "TETR.IO customization tool suite";
+    downloadPage = "https://gitlab.com/UniQMG/tetrio-plus/-/releases";
+    homepage = "https://gitlab.com/UniQMG/tetrio-plus";
+    license = [
+      lib.licenses.mit
+      # while tetrio-plus is itself mit, the result of this derivation
+      # is a modified version of tetrio-desktop, which is unfree.
+      lib.licenses.unfree
+    ];
+    maintainers = with lib.maintainers; [ huantian wackbyte ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/te/tetrio-desktop/yarn.lock b/pkgs/by-name/te/tetrio-desktop/yarn.lock
new file mode 100644
index 0000000000000..9c6cd6519a9f2
--- /dev/null
+++ b/pkgs/by-name/te/tetrio-desktop/yarn.lock
@@ -0,0 +1,348 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+ajv-formats@^2.1.1:
+  version "2.1.1"
+  resolved "https://registry.yarnpkg.com/ajv-formats/-/ajv-formats-2.1.1.tgz#6e669400659eb74973bbf2e33327180a0996b520"
+  integrity sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==
+  dependencies:
+    ajv "^8.0.0"
+
+ajv@^8.0.0, ajv@^8.6.3:
+  version "8.12.0"
+  resolved "https://registry.yarnpkg.com/ajv/-/ajv-8.12.0.tgz#d1a0527323e22f53562c567c00991577dfbe19d1"
+  integrity sha512-sRu1kpcO9yLtYxBKvqfTeh9KzZEwO3STyX1HT+4CaDzC6HpTGYhIhPIzj9XuKU7KYDwnaeh5hcOwjy1QuJzBPA==
+  dependencies:
+    fast-deep-equal "^3.1.1"
+    json-schema-traverse "^1.0.0"
+    require-from-string "^2.0.2"
+    uri-js "^4.2.2"
+
+asn1.js@^5.0.0:
+  version "5.4.1"
+  resolved "https://registry.yarnpkg.com/asn1.js/-/asn1.js-5.4.1.tgz#11a980b84ebb91781ce35b0fdc2ee294e3783f07"
+  integrity sha512-+I//4cYPccV8LdmBLiX8CYvf9Sp3vQsrqu2QNXRcrbiWvcx/UdlFiqUJJzxRQxgsZmvhXhn4cSKeSmoFjVdupA==
+  dependencies:
+    bn.js "^4.0.0"
+    inherits "^2.0.1"
+    minimalistic-assert "^1.0.0"
+    safer-buffer "^2.1.0"
+
+atomically@^1.7.0:
+  version "1.7.0"
+  resolved "https://registry.yarnpkg.com/atomically/-/atomically-1.7.0.tgz#c07a0458432ea6dbc9a3506fffa424b48bccaafe"
+  integrity sha512-Xcz9l0z7y9yQ9rdDaxlmaI4uJHf/T8g9hOEzJcsEqX2SjCj4J20uK7+ldkDHMbpJDK76wF7xEIgxc/vSlsfw5w==
+
+bindings@^1.3.0:
+  version "1.5.0"
+  resolved "https://registry.yarnpkg.com/bindings/-/bindings-1.5.0.tgz#10353c9e945334bc0511a6d90b38fbc7c9c504df"
+  integrity sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==
+  dependencies:
+    file-uri-to-path "1.0.0"
+
+bn.js@^4.0.0:
+  version "4.12.0"
+  resolved "https://registry.yarnpkg.com/bn.js/-/bn.js-4.12.0.tgz#775b3f278efbb9718eec7361f483fb36fbbfea88"
+  integrity sha512-c98Bf3tPniI+scsdk237ku1Dc3ujXQTSgyiPUDEOe7tRkhrqridvh8klBv0HCEso1OLOYcHuCv/cS6DNxKH+ZA==
+
+conf@^10.2.0:
+  version "10.2.0"
+  resolved "https://registry.yarnpkg.com/conf/-/conf-10.2.0.tgz#838e757be963f1a2386dfe048a98f8f69f7b55d6"
+  integrity sha512-8fLl9F04EJqjSqH+QjITQfJF8BrOVaYr1jewVgSRAEWePfxT0sku4w2hrGQ60BC/TNLGQ2pgxNlTbWQmMPFvXg==
+  dependencies:
+    ajv "^8.6.3"
+    ajv-formats "^2.1.1"
+    atomically "^1.7.0"
+    debounce-fn "^4.0.0"
+    dot-prop "^6.0.1"
+    env-paths "^2.2.1"
+    json-schema-typed "^7.0.3"
+    onetime "^5.1.2"
+    pkg-up "^3.1.0"
+    semver "^7.3.5"
+
+debounce-fn@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/debounce-fn/-/debounce-fn-4.0.0.tgz#ed76d206d8a50e60de0dd66d494d82835ffe61c7"
+  integrity sha512-8pYCQiL9Xdcg0UPSD3d+0KMlOjp+KGU5EPwYddgzQ7DATsg4fuUDjQtsYLmWjnk2obnNHgV3vE2Y4jejSOJVBQ==
+  dependencies:
+    mimic-fn "^3.0.0"
+
+discord-rich-presence@0.0.8:
+  version "0.0.8"
+  resolved "https://registry.yarnpkg.com/discord-rich-presence/-/discord-rich-presence-0.0.8.tgz#7a2b41ff87a278e8a2c8835cd91c9890d6b9fbdd"
+  integrity sha512-IpVMPjv15C9UvppxvrrGdv6bzQHOW1P1vLoMH15HvdJwGJ3dBd2bnrJ63Uy36YRUfrAMxGLiwUDHncvC8AuPaQ==
+  dependencies:
+    discord-rpc "github:discordjs/rpc"
+
+"discord-rpc@github:discordjs/rpc":
+  version "4.0.1"
+  resolved "https://codeload.github.com/discordjs/rpc/tar.gz/9e7de2a6d917591f10a66389e62e1dc053c04fec"
+  dependencies:
+    node-fetch "^2.6.1"
+    ws "^7.3.1"
+  optionalDependencies:
+    register-scheme "github:devsnek/node-register-scheme"
+
+dot-prop@^6.0.1:
+  version "6.0.1"
+  resolved "https://registry.yarnpkg.com/dot-prop/-/dot-prop-6.0.1.tgz#fc26b3cf142b9e59b74dbd39ed66ce620c681083"
+  integrity sha512-tE7ztYzXHIeyvc7N+hR3oi7FIbf/NIjVP9hmAt3yMXzrQ072/fpjGLx2GxNxGxUl5V73MEqYzioOMoVhGMJ5cA==
+  dependencies:
+    is-obj "^2.0.0"
+
+electron-store@^8.1.0:
+  version "8.2.0"
+  resolved "https://registry.yarnpkg.com/electron-store/-/electron-store-8.2.0.tgz#114e6e453e8bb746ab4ccb542424d8c881ad2ca1"
+  integrity sha512-ukLL5Bevdil6oieAOXz3CMy+OgaItMiVBg701MNlG6W5RaC0AHN7rvlqTCmeb6O7jP0Qa1KKYTE0xV0xbhF4Hw==
+  dependencies:
+    conf "^10.2.0"
+    type-fest "^2.17.0"
+
+env-paths@^2.2.1:
+  version "2.2.1"
+  resolved "https://registry.yarnpkg.com/env-paths/-/env-paths-2.2.1.tgz#420399d416ce1fbe9bc0a07c62fa68d67fd0f8f2"
+  integrity sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==
+
+fast-deep-equal@^3.1.1:
+  version "3.1.3"
+  resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525"
+  integrity sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==
+
+file-uri-to-path@1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz#553a7b8446ff6f684359c445f1e37a05dacc33dd"
+  integrity sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==
+
+find-up@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/find-up/-/find-up-3.0.0.tgz#49169f1d7993430646da61ecc5ae355c21c97b73"
+  integrity sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==
+  dependencies:
+    locate-path "^3.0.0"
+
+image-size@^1.1.1:
+  version "1.1.1"
+  resolved "https://registry.yarnpkg.com/image-size/-/image-size-1.1.1.tgz#ddd67d4dc340e52ac29ce5f546a09f4e29e840ac"
+  integrity sha512-541xKlUw6jr/6gGuk92F+mYM5zaFAc5ahphvkqvNe2bQ6gVBkd6bfrmVJ2t4KDAfikAYZyIqTnktX3i6/aQDrQ==
+  dependencies:
+    queue "6.0.2"
+
+inherits@^2.0.1, inherits@~2.0.3:
+  version "2.0.4"
+  resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.4.tgz#0fa2c64f932917c3433a0ded55363aae37416b7c"
+  integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==
+
+is-obj@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/is-obj/-/is-obj-2.0.0.tgz#473fb05d973705e3fd9620545018ca8e22ef4982"
+  integrity sha512-drqDG3cbczxxEJRoOXcOjtdp1J/lyp1mNn0xaznRs8+muBhgQcrnbspox5X5fOw0HnMnbfDzvnEMEtqDEJEo8w==
+
+json-schema-traverse@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz#ae7bcb3656ab77a73ba5c49bf654f38e6b6860e2"
+  integrity sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==
+
+json-schema-typed@^7.0.3:
+  version "7.0.3"
+  resolved "https://registry.yarnpkg.com/json-schema-typed/-/json-schema-typed-7.0.3.tgz#23ff481b8b4eebcd2ca123b4fa0409e66469a2d9"
+  integrity sha512-7DE8mpG+/fVw+dTpjbxnx47TaMnDfOI1jwft9g1VybltZCduyRQPJPvc+zzKY9WPHxhPWczyFuYa6I8Mw4iU5A==
+
+locate-path@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/locate-path/-/locate-path-3.0.0.tgz#dbec3b3ab759758071b58fe59fc41871af21400e"
+  integrity sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==
+  dependencies:
+    p-locate "^3.0.0"
+    path-exists "^3.0.0"
+
+lru-cache@^6.0.0:
+  version "6.0.0"
+  resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-6.0.0.tgz#6d6fe6570ebd96aaf90fcad1dafa3b2566db3a94"
+  integrity sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==
+  dependencies:
+    yallist "^4.0.0"
+
+mimic-fn@^2.1.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/mimic-fn/-/mimic-fn-2.1.0.tgz#7ed2c2ccccaf84d3ffcb7a69b57711fc2083401b"
+  integrity sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==
+
+mimic-fn@^3.0.0:
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/mimic-fn/-/mimic-fn-3.1.0.tgz#65755145bbf3e36954b949c16450427451d5ca74"
+  integrity sha512-Ysbi9uYW9hFyfrThdDEQuykN4Ey6BuwPD2kpI5ES/nFTDn/98yxYNLZJcgUAKPT/mcrLLKaGzJR9YVxJrIdASQ==
+
+minimalistic-assert@^1.0.0:
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz#2e194de044626d4a10e7f7fbc00ce73e83e4d5c7"
+  integrity sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==
+
+node-addon-api@^1.3.0:
+  version "1.7.2"
+  resolved "https://registry.yarnpkg.com/node-addon-api/-/node-addon-api-1.7.2.tgz#3df30b95720b53c24e59948b49532b662444f54d"
+  integrity sha512-ibPK3iA+vaY1eEjESkQkM0BbCqFOaZMiXRTtdB0u7b4djtY6JnsjvPdUHVMg6xQt3B8fpTTWHI9A+ADjM9frzg==
+
+node-fetch@2.6.1:
+  version "2.6.1"
+  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.1.tgz#045bd323631f76ed2e2b55573394416b639a0052"
+  integrity sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==
+
+node-fetch@^2.6.1:
+  version "2.7.0"
+  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.7.0.tgz#d0f0fa6e3e2dc1d27efcd8ad99d550bda94d187d"
+  integrity sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==
+  dependencies:
+    whatwg-url "^5.0.0"
+
+onetime@^5.1.2:
+  version "5.1.2"
+  resolved "https://registry.yarnpkg.com/onetime/-/onetime-5.1.2.tgz#d0e96ebb56b07476df1dd9c4806e5237985ca45e"
+  integrity sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==
+  dependencies:
+    mimic-fn "^2.1.0"
+
+openpgp@^5.11.1:
+  version "5.11.1"
+  resolved "https://registry.yarnpkg.com/openpgp/-/openpgp-5.11.1.tgz#97f3a1dfb3d3573a0a73fe2efb29e6b1f8fefb1c"
+  integrity sha512-TynUBPuaSI7dN0gP+A38CjNRLxkOkkptefNanalDQ71BFAKKm+dLbksymSW5bUrB7RcAneMySL/Y+r/TbLpOnQ==
+  dependencies:
+    asn1.js "^5.0.0"
+
+p-limit@^2.0.0:
+  version "2.3.0"
+  resolved "https://registry.yarnpkg.com/p-limit/-/p-limit-2.3.0.tgz#3dd33c647a214fdfffd835933eb086da0dc21db1"
+  integrity sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==
+  dependencies:
+    p-try "^2.0.0"
+
+p-locate@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/p-locate/-/p-locate-3.0.0.tgz#322d69a05c0264b25997d9f40cd8a891ab0064a4"
+  integrity sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==
+  dependencies:
+    p-limit "^2.0.0"
+
+p-try@^2.0.0:
+  version "2.2.0"
+  resolved "https://registry.yarnpkg.com/p-try/-/p-try-2.2.0.tgz#cb2868540e313d61de58fafbe35ce9004d5540e6"
+  integrity sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==
+
+path-exists@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/path-exists/-/path-exists-3.0.0.tgz#ce0ebeaa5f78cb18925ea7d810d7b59b010fd515"
+  integrity sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ==
+
+pkg-up@^3.1.0:
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/pkg-up/-/pkg-up-3.1.0.tgz#100ec235cc150e4fd42519412596a28512a0def5"
+  integrity sha512-nDywThFk1i4BQK4twPQ6TA4RT8bDY96yeuCVBWL3ePARCiEKDRSrNGbFIgUJpLp+XeIR65v8ra7WuJOFUBtkMA==
+  dependencies:
+    find-up "^3.0.0"
+
+punycode@^2.1.0, punycode@^2.3.1:
+  version "2.3.1"
+  resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5"
+  integrity sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==
+
+queue@6.0.2:
+  version "6.0.2"
+  resolved "https://registry.yarnpkg.com/queue/-/queue-6.0.2.tgz#b91525283e2315c7553d2efa18d83e76432fed65"
+  integrity sha512-iHZWu+q3IdFZFX36ro/lKBkSvfkztY5Y7HMiPlOUjhupPcG2JMfst2KKEpu5XndviX/3UhFbRngUPNKtgvtZiA==
+  dependencies:
+    inherits "~2.0.3"
+
+"register-scheme@github:devsnek/node-register-scheme":
+  version "0.0.2"
+  resolved "https://codeload.github.com/devsnek/node-register-scheme/tar.gz/e7cc9a63a1f512565da44cb57316d9fb10750e17"
+  dependencies:
+    bindings "^1.3.0"
+    node-addon-api "^1.3.0"
+
+require-from-string@^2.0.2:
+  version "2.0.2"
+  resolved "https://registry.yarnpkg.com/require-from-string/-/require-from-string-2.0.2.tgz#89a7fdd938261267318eafe14f9c32e598c36909"
+  integrity sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==
+
+safer-buffer@^2.1.0:
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
+  integrity sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==
+
+semver@^7.3.5:
+  version "7.6.0"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.6.0.tgz#1a46a4db4bffcccd97b743b5005c8325f23d4e2d"
+  integrity sha512-EnwXhrlwXMk9gKu5/flx5sv/an57AkRplG3hTK68W7FRDN+k+OWBj65M7719OkA82XLBxrcX0KSHj+X5COhOVg==
+  dependencies:
+    lru-cache "^6.0.0"
+
+systeminformation@^5.22.0:
+  version "5.22.7"
+  resolved "https://registry.yarnpkg.com/systeminformation/-/systeminformation-5.22.7.tgz#9a20810c7eacad4aebe7591cb7c78c0dd96dbd1a"
+  integrity sha512-AWxlP05KeHbpGdgvZkcudJpsmChc2Y5Eo/GvxG/iUA/Aws5LZKHAMSeAo+V+nD+nxWZaxrwpWcnx4SH3oxNL3A==
+
+tr46@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/tr46/-/tr46-5.0.0.tgz#3b46d583613ec7283020d79019f1335723801cec"
+  integrity sha512-tk2G5R2KRwBd+ZN0zaEXpmzdKyOYksXwywulIX95MBODjSzMIuQnQ3m8JxgbhnL1LeVo7lqQKsYa1O3Htl7K5g==
+  dependencies:
+    punycode "^2.3.1"
+
+tr46@~0.0.3:
+  version "0.0.3"
+  resolved "https://registry.yarnpkg.com/tr46/-/tr46-0.0.3.tgz#8184fd347dac9cdc185992f3a6622e14b9d9ab6a"
+  integrity sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==
+
+type-fest@^2.17.0:
+  version "2.19.0"
+  resolved "https://registry.yarnpkg.com/type-fest/-/type-fest-2.19.0.tgz#88068015bb33036a598b952e55e9311a60fd3a9b"
+  integrity sha512-RAH822pAdBgcNMAfWnCBU3CFZcfZ/i1eZjwFU/dsLKumyuuP3niueg2UAukXYF0E2AAoc82ZSSf9J0WQBinzHA==
+
+uri-js@^4.2.2:
+  version "4.4.1"
+  resolved "https://registry.yarnpkg.com/uri-js/-/uri-js-4.4.1.tgz#9b1a52595225859e55f669d928f88c6c57f2a77e"
+  integrity sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==
+  dependencies:
+    punycode "^2.1.0"
+
+webidl-conversions@^3.0.0:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/webidl-conversions/-/webidl-conversions-3.0.1.tgz#24534275e2a7bc6be7bc86611cc16ae0a5654871"
+  integrity sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==
+
+webidl-conversions@^7.0.0:
+  version "7.0.0"
+  resolved "https://registry.yarnpkg.com/webidl-conversions/-/webidl-conversions-7.0.0.tgz#256b4e1882be7debbf01d05f0aa2039778ea080a"
+  integrity sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==
+
+whatwg-url@^14.0.0:
+  version "14.0.0"
+  resolved "https://registry.yarnpkg.com/whatwg-url/-/whatwg-url-14.0.0.tgz#00baaa7fd198744910c4b1ef68378f2200e4ceb6"
+  integrity sha512-1lfMEm2IEr7RIV+f4lUNPOqfFL+pO+Xw3fJSqmjX9AbXcXcYOkCe1P6+9VBZB6n94af16NfZf+sSk0JCBZC9aw==
+  dependencies:
+    tr46 "^5.0.0"
+    webidl-conversions "^7.0.0"
+
+whatwg-url@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/whatwg-url/-/whatwg-url-5.0.0.tgz#966454e8765462e37644d3626f6742ce8b70965d"
+  integrity sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==
+  dependencies:
+    tr46 "~0.0.3"
+    webidl-conversions "^3.0.0"
+
+ws@^7.3.1:
+  version "7.5.9"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.9.tgz#54fa7db29f4c7cec68b1ddd3a89de099942bb591"
+  integrity sha512-F+P9Jil7UiSKSkppIiD94dN07AwvFixvLIj1Og1Rl9GGMuNipJnV9JzjD6XuqmAeiswGvUmNLjr5cFuXwNS77Q==
+
+xmldom@^0.6.0:
+  version "0.6.0"
+  resolved "https://registry.yarnpkg.com/xmldom/-/xmldom-0.6.0.tgz#43a96ecb8beece991cef382c08397d82d4d0c46f"
+  integrity sha512-iAcin401y58LckRZ0TkI4k0VSM1Qg0KGSc3i8rU+xrxe19A/BN1zHyVSJY7uoutVlaTSzYyk/v5AmkewAP7jtg==
+
+yallist@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/yallist/-/yallist-4.0.0.tgz#9bb92790d9c0effec63be73519e11a35019a3a72"
+  integrity sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==
diff --git a/pkgs/by-name/tk/tkey-ssh-agent/package.nix b/pkgs/by-name/tk/tkey-ssh-agent/package.nix
new file mode 100644
index 0000000000000..3a38389ae4a9d
--- /dev/null
+++ b/pkgs/by-name/tk/tkey-ssh-agent/package.nix
@@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "tkey-ssh-agent";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "tillitis";
+    repo = "tkey-ssh-agent";
+    rev = "v${version}";
+    sha256 = "sha256-Uf3VJJfZn4UYX1q79JdaOfrore+L/Mic3whzpP32JV0=";
+  };
+
+  vendorHash = "sha256-SFyp1UB6+m7/YllRyY56SwweJ3X175bChXQYiG2M7zM=";
+
+  subPackages = [
+    "cmd/tkey-ssh-agent"
+  ];
+
+  meta = with lib; {
+    description = "SSH Agent for TKey, the flexible open hardware/software USB security key";
+    homepage    = "https://tillitis.se/app/tkey-ssh-agent/";
+    license     = licenses.gpl2;
+    maintainers = with maintainers; [ bbigras ];
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/to/tootik/package.nix b/pkgs/by-name/to/tootik/package.nix
index 9e7a2c801cf55..51d890f5c731a 100644
--- a/pkgs/by-name/to/tootik/package.nix
+++ b/pkgs/by-name/to/tootik/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tootik";
-  version = "0.10.0";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "dimkr";
     repo = "tootik";
     rev = version;
-    hash = "sha256-5rv+hkIBRu5uIUYsy7drJvcAHwL9tY8qD/dTj1mbarQ=";
+    hash = "sha256-roB1mrhq9LQcdi7ynPzI9UmeawSw9fX7jl3bb6+ygfM=";
   };
 
   vendorHash = "sha256-Lsc8nK4I1gZEW7RbEapHr3IJ6wTATLElX3XfNX1LwvM=";
diff --git a/pkgs/by-name/tp/tplay/cargo.diff b/pkgs/by-name/tp/tplay/cargo.diff
deleted file mode 100644
index 8248bdb8bd36a..0000000000000
--- a/pkgs/by-name/tp/tplay/cargo.diff
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 0eb70e4..8d81ba0 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -2069,7 +2069,7 @@ checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
- 
- [[package]]
- name = "tplay"
--version = "0.4.4"
-+version = "0.4.5"
- dependencies = [
-  "clap",
-  "crossbeam-channel",
diff --git a/pkgs/by-name/tp/tplay/package.nix b/pkgs/by-name/tp/tplay/package.nix
index 619192ddf50a9..4258bf6960cc4 100644
--- a/pkgs/by-name/tp/tplay/package.nix
+++ b/pkgs/by-name/tp/tplay/package.nix
@@ -11,17 +11,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "tplay";
-  version = "0.4.5";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "maxcurzi";
     repo = "tplay";
     rev =  "v${version}";
-    hash = "sha256-qt5I5rel88NWJZ6dYLCp063PfVmGTzkUUKgF3JkhLQk=";
+    hash = "sha256-/3ui0VOxf+kYfb0JQXPVbjAyXPph2LOg2xB0DGmAbwc=";
   };
 
-  cargoHash = "sha256-0kHh7Wb9Dp+t2G9/Kz/3K43bQdFCl+q2Vc3W32koc2I=";
-  cargoPatches = [ ./cargo.diff ];
+  cargoHash = "sha256-zRkIEH37pvxHUbnfg25GW1Z7od9XMkRmP2Qvs64uUjg=";
   checkFlags = [
         # requires network access
     "--skip=pipeline::image_pipeline::tests::test_process"
@@ -46,6 +45,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/maxcurzi/tplay";
     platforms = lib.platforms.linux;
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ demine ];
+    maintainers = with lib.maintainers; [ demine colemickens ];
   };
 }
diff --git a/pkgs/by-name/tr/troubadix/package.nix b/pkgs/by-name/tr/troubadix/package.nix
index 2386693e11f2b..9575a83ce48f4 100644
--- a/pkgs/by-name/tr/troubadix/package.nix
+++ b/pkgs/by-name/tr/troubadix/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "troubadix";
-  version = "24.4.0";
+  version = "24.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "troubadix";
     rev = "refs/tags/v${version}";
-    hash = "sha256-I/c26dqD7cJ0AtLhJK4XaR5vvud/NsoeXr6/k6+Dezk=";
+    hash = "sha256-+JrMUog04SS24ZKiBFB46AyYTDzVu7d4IdoX9SRMhpk=";
   };
 
   pythonRelaxDeps = [ "validators" ];
diff --git a/pkgs/by-name/tu/tuifimanager/package.nix b/pkgs/by-name/tu/tuifimanager/package.nix
index aaa4902933fa0..eee63fb90c9d5 100644
--- a/pkgs/by-name/tu/tuifimanager/package.nix
+++ b/pkgs/by-name/tu/tuifimanager/package.nix
@@ -5,29 +5,24 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "tuifimanager";
-  version = "3.3.5";
+  version = "4.0.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "GiorgosXou";
     repo = "TUIFIManager";
-    rev = "refs/tags/v.${version}";
-    hash = "sha256-O4cAHFurgF6QzpeAMoipX2/JywU1drZOTw/Ob9Pa8WQ=";
+    rev = "v${version}";
+    hash = "sha256-bv/+x2xppUK9i3HOm93FIQRu1xlB4wCKZzAapkVlrM0=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "Send2Trash == 1.8.0" "Send2Trash >= 1.8.0"
-  '';
-
   nativeBuildInputs = [
     python3.pkgs.setuptools
     python3.pkgs.setuptools-scm
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
-    send2trash
-    unicurses
+  propagatedBuildInputs = [
+    python3.pkgs.send2trash
+    python3.pkgs.unicurses
   ];
   pythonImportsCheck = [ "TUIFIManager" ];
 
diff --git a/pkgs/by-name/ug/ugrep-indexer/package.nix b/pkgs/by-name/ug/ugrep-indexer/package.nix
index 07bd5edac2539..2dd2cde3a266e 100644
--- a/pkgs/by-name/ug/ugrep-indexer/package.nix
+++ b/pkgs/by-name/ug/ugrep-indexer/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ugrep-indexer";
-  version = "0.9.6";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = "ugrep-indexer";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZXZF9ZSdfQ2gxi5JkDJCUzMbkTs9KLzZBsyYxR/v4tI=";
+    hash = "sha256-XKjCAYPBRQgId66LupTlODPh2ctzvk7rHWznkLd4C8c=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/un/universal-android-debloater/package.nix b/pkgs/by-name/un/universal-android-debloater/package.nix
index 6ce6fb28a8c52..ad5cf9d11e069 100644
--- a/pkgs/by-name/un/universal-android-debloater/package.nix
+++ b/pkgs/by-name/un/universal-android-debloater/package.nix
@@ -57,7 +57,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation";
     license = licenses.gpl3Only;
     mainProgram = "uad-ng";
-    maintainers = with maintainers; [ xfix ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/uv/uv/Cargo.lock b/pkgs/by-name/uv/uv/Cargo.lock
index c5cdd1e90081a..2044212a42c25 100644
--- a/pkgs/by-name/uv/uv/Cargo.lock
+++ b/pkgs/by-name/uv/uv/Cargo.lock
@@ -2732,7 +2732,7 @@ dependencies = [
  "indoc",
  "libc",
  "memoffset 0.9.1",
- "parking_lot 0.12.1",
+ "parking_lot 0.11.2",
  "portable-atomic",
  "pyo3-build-config",
  "pyo3-ffi",
@@ -3025,9 +3025,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.12.3"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e6cc1e89e689536eb5aeede61520e874df5a4707df811cd5da4aa5fbb2aae19"
+checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
 dependencies = [
  "async-compression",
  "base64 0.22.0",
@@ -4397,7 +4397,7 @@ checksum = "a183cf7feeba97b4dd1c0d46788634f6221d87fa961b305bed08c851829efcc0"
 
 [[package]]
 name = "uv"
-version = "0.1.34"
+version = "0.1.35"
 dependencies = [
  "anstream",
  "anyhow",
@@ -4595,6 +4595,7 @@ dependencies = [
  "clap",
  "itertools 0.12.1",
  "pep508_rs",
+ "platform-tags",
  "rustc-hash",
  "schemars",
  "serde",
@@ -4990,7 +4991,7 @@ dependencies = [
 
 [[package]]
 name = "uv-version"
-version = "0.1.34"
+version = "0.1.35"
 
 [[package]]
 name = "uv-virtualenv"
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 5a1491a25d311..f4aab33401c08 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uv";
-  version = "0.1.34";
+  version = "0.1.35";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     rev = version;
-    hash = "sha256-B0UvQM1A1DRPb59HcLMNZo4r86lF4fcI+R8/fLWHkHM=";
+    hash = "sha256-GcAvpX7oanJ8G1dgTyTa8jk9xhTroF2G+ir8j7Yua1M=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/va/vaults/package.nix b/pkgs/by-name/va/vaults/package.nix
new file mode 100644
index 0000000000000..e44c3b73efecf
--- /dev/null
+++ b/pkgs/by-name/va/vaults/package.nix
@@ -0,0 +1,85 @@
+{ fetchFromGitHub
+, lib
+, stdenv
+, appstream-glib
+, desktop-file-utils
+, meson
+, ninja
+, pkg-config
+, python3
+, rustPlatform
+, rustc
+, cargo
+, wrapGAppsHook
+, glib
+, gtk4
+, libadwaita
+, wayland
+, gocryptfs
+, cryfs
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "vaults";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "mpobaschnig";
+    repo = "Vaults";
+    rev = version;
+    hash = "sha256-jA7OeyRqc5DxkS4sMx9cIbVlZwd++aCQi09uBQik1oA=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-l9Zer6d6kgjIUNiQ1VdQQ57caVNWfzCkdsMf79X8Ar4=";
+  };
+
+  postPatch = ''
+    patchShebangs build-aux
+  '';
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : "${lib.makeBinPath [ gocryptfs cryfs ]}"
+    )
+  '';
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+    cargo
+    rustc
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    appstream-glib
+    gtk4
+    python3
+    glib
+    libadwaita
+    wayland
+    gocryptfs
+    cryfs
+  ];
+
+  meta = {
+    description = "GTK frontend for encrypted vaults supporting gocryptfs and CryFS for encryption";
+    homepage = "https://mpobaschnig.github.io/vaults/";
+    changelog = "https://github.com/mpobaschnig/vaults/releases/tag/${version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ benneti ];
+    mainProgram = "vaults";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index 17fb994f2ba47..980258ed863a4 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -8,15 +8,11 @@
 , copyDesktopItems
 , vencord
 , electron
-, pipewire
-, libpulseaudio
 , libicns
-, libnotify
 , jq
 , moreutils
 , cacert
 , nodePackages
-, speechd
 , withTTS ? true
   # Enables the use of vencord from nixpkgs instead of
   # letting vesktop manage it's own version
@@ -116,15 +112,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   # this is consistent with other nixpkgs electron packages and upstream, as far as I am aware
   installPhase =
-    let
-      # this is mainly required for venmic
-      libPath = lib.makeLibraryPath ([
-        libpulseaudio
-        libnotify
-        pipewire
-        stdenv.cc.cc.lib
-      ] ++ lib.optional withTTS speechd);
-    in
     ''
       runHook preInstall
 
@@ -139,7 +126,6 @@ stdenv.mkDerivation (finalAttrs: {
       done
 
       makeWrapper ${electron}/bin/electron $out/bin/vesktop \
-        --prefix LD_LIBRARY_PATH : ${libPath} \
         --add-flags $out/opt/Vesktop/resources/app.asar \
         ${lib.optionalString withTTS "--add-flags \"--enable-speech-dispatcher\""} \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
diff --git a/pkgs/by-name/vl/vlc-bittorrent/package.nix b/pkgs/by-name/vl/vlc-bittorrent/package.nix
index d87e30579c5a4..d4107d59cd3ab 100644
--- a/pkgs/by-name/vl/vlc-bittorrent/package.nix
+++ b/pkgs/by-name/vl/vlc-bittorrent/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vlc-bittorrent";
-  version = "2.15.0";
+  version = "2.15";
 
   src = fetchFromGitHub {
     owner = "johang";
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index d5c6c8d064750..f0d9321a1f2f6 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,10 +1,10 @@
 {
   "darwin": {
-    "hash": "sha256-tNNT8FqMvrjGFuyhizbyd2gAimbd5SLyCMVt6bFcbyQ=",
-    "version": "0.2024.04.02.08.02.stable_01"
+    "hash": "sha256-t8Qobl20YXY71vZVAIq6uJ+vnEeT3wFTmAy2dfthvIY=",
+    "version": "0.2024.04.16.08.02.stable_00"
   },
   "linux": {
-    "hash": "sha256-xnXRg23AdfCk2TKBr+PZ3wDYqTN4+8wLSodWpmh3D/Y=",
-    "version": "0.2024.04.02.08.02.stable_01"
+    "hash": "sha256-V1bG4Sx0cWv1+5mPnktQ3pPQm6Qwj0Ec6qDXmxGqB+8=",
+    "version": "0.2024.04.16.08.02.stable_00"
   }
 }
diff --git a/pkgs/by-name/wa/waycheck/package.nix b/pkgs/by-name/wa/waycheck/package.nix
index ddbd67e882200..064638efd8ff1 100644
--- a/pkgs/by-name/wa/waycheck/package.nix
+++ b/pkgs/by-name/wa/waycheck/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waycheck";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "serebit";
     repo = "waycheck";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kwkdTMA15oJHz9AXEkBGeuzYdEUpNuv/xnhzoKOHCE4=";
+    hash = "sha256-82jOYWhgD9JNDn24eCAeMm63R5BTy20lQVpiAwhDIOk=";
   };
 
   nativeBuildInputs = [
@@ -38,13 +38,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontWrapGApps = true;
 
-  preFixup = ''
-    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  postPatch = ''
+    substituteInPlace scripts/mesonPostInstall.sh \
+      --replace-fail "#!/usr/bin/env sh" "#!${stdenv.shell}" \
+      --replace-fail "update-desktop-database -q" "update-desktop-database $out/share/applications"
   '';
 
-  preInstall = ''
-    substituteInPlace ../scripts/mesonPostInstall.sh \
-      --replace "update-desktop-database -q" "update-desktop-database $out/share/applications"
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 
   meta = {
diff --git a/pkgs/by-name/we/wechat-uos/package.nix b/pkgs/by-name/we/wechat-uos/package.nix
index d151c022ed66b..7a8f806426ce0 100644
--- a/pkgs/by-name/we/wechat-uos/package.nix
+++ b/pkgs/by-name/we/wechat-uos/package.nix
@@ -229,6 +229,16 @@ buildFHSEnv {
   runScript = writeShellScript "wechat-uos-launcher" ''
     export QT_QPA_PLATFORM=xcb
     export LD_LIBRARY_PATH=${lib.makeLibraryPath wechat-uos-runtime}
+
+    if [[ ''${XMODIFIERS} =~ fcitx ]]; then
+      export QT_IM_MODULE=fcitx
+      export GTK_IM_MODULE=fcitx
+    elif [[ ''${XMODIFIERS} =~ ibus ]]; then
+      export QT_IM_MODULE=ibus
+      export GTK_IM_MODULE=ibus
+      export IBUS_USE_PORTAL=1
+    fi
+
     ${wechat.outPath}/opt/apps/com.tencent.wechat/files/wechat
   '';
   extraInstallCommands = ''
diff --git a/pkgs/tools/networking/wireproxy/default.nix b/pkgs/by-name/wi/wireproxy/package.nix
index 1c5eda9f1cd49..b244364c8c9bf 100644
--- a/pkgs/tools/networking/wireproxy/default.nix
+++ b/pkgs/by-name/wi/wireproxy/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "wireproxy";
-  version = "1.0.8";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "pufferffish";
     repo = "wireproxy";
     rev = "v${version}";
-    hash = "sha256-2gio+kyjIvaNjb/+M8M5YvbAPbQX+B9A/Qly2kyFZXw=";
+    hash = "sha256-VPIEgvUg0h80Cd611zXQ5mhamfJTQpaDK9kiUMy2G0A=";
   };
 
   ldflags = [
@@ -22,7 +22,7 @@ buildGoModule rec {
     "-X main.version=v${version}"
   ];
 
-  vendorHash = "sha256-u5/ppH+8mcR3AdPnA6vDFL4GwVzbUj679I4zBw80HU0=";
+  vendorHash = "sha256-DNTPzZSxcjkcv7RygTpOIgdYEQ8wBPkuJqfzZGt8ExI=";
 
   passthru.tests.version = testers.testVersion {
     package = wireproxy;
@@ -32,7 +32,7 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "Wireguard client that exposes itself as a socks5 proxy";
-    homepage = "https://github.com/octeep/wireproxy";
+    homepage = "https://github.com/pufferffish/wireproxy";
     license = licenses.isc;
     maintainers = with maintainers; [ _3JlOy-PYCCKUi ];
     mainProgram = "wireproxy";
diff --git a/pkgs/by-name/wt/wtfis/package.nix b/pkgs/by-name/wt/wtfis/package.nix
index 56d302208d9c9..886d7de4baa90 100644
--- a/pkgs/by-name/wt/wtfis/package.nix
+++ b/pkgs/by-name/wt/wtfis/package.nix
@@ -5,12 +5,12 @@
 
 let
   pname = "wtfis";
-  version = "0.8.0";
+  version = "0.9.0";
   src = fetchFromGitHub {
     owner = "pirxthepilot";
     repo = "wtfis";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eSmvyDr8PbB15UWIl67Qp2qHeOq+dmnP8eMsvcGypVw=";
+    hash = "sha256-LeIb2MLxulDsgQepNr7I81u8gG4HQC6PsszKZKVjFkw=";
   };
 in python3.pkgs.buildPythonApplication {
   inherit pname version src;
diff --git a/pkgs/by-name/yt/ytdownloader/package.nix b/pkgs/by-name/yt/ytdownloader/package.nix
index 9a607c16e4aac..b471ec8193298 100644
--- a/pkgs/by-name/yt/ytdownloader/package.nix
+++ b/pkgs/by-name/yt/ytdownloader/package.nix
@@ -10,13 +10,13 @@
 
 buildNpmPackage rec {
   pname = "ytDownloader";
-  version = "3.17.3";
+  version = "3.17.4";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "ytDownloader";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aqQGOqPLKKTBjWjL3KyRD4paBGCQLhCBjXwVVhoHDSk=";
+    hash = "sha256-GW+17DfPiFxw2QyJ5KTMZLDWmqXfnHfkg+QpM5XOP0M=";
   };
 
   npmDepsHash = "sha256-lhFyiWy9dgnxxaElavzqA4YpRm7cVC23pvL5Kwve58E=";
diff --git a/pkgs/by-name/ze/zed-editor/Cargo.lock b/pkgs/by-name/ze/zed-editor/Cargo.lock
index 5e6ebe7f1758e..04d3e032fb15e 100644
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@@ -166,6 +166,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "anes"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
+
+[[package]]
 name = "anstream"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1433,8 +1439,8 @@ dependencies = [
 
 [[package]]
 name = "blade-graphics"
-version = "0.3.0"
-source = "git+https://github.com/kvark/blade?rev=61cbd6b2c224791d52b150fe535cee665cc91bb2#61cbd6b2c224791d52b150fe535cee665cc91bb2"
+version = "0.4.0"
+source = "git+https://github.com/kvark/blade?rev=810ec594358aafea29a4a3d8ab601d25292b2ce4#810ec594358aafea29a4a3d8ab601d25292b2ce4"
 dependencies = [
  "ash",
  "ash-window",
@@ -1464,7 +1470,7 @@ dependencies = [
 [[package]]
 name = "blade-macros"
 version = "0.2.1"
-source = "git+https://github.com/kvark/blade?rev=61cbd6b2c224791d52b150fe535cee665cc91bb2#61cbd6b2c224791d52b150fe535cee665cc91bb2"
+source = "git+https://github.com/kvark/blade?rev=810ec594358aafea29a4a3d8ab601d25292b2ce4#810ec594358aafea29a4a3d8ab601d25292b2ce4"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1807,6 +1813,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "cast"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
+
+[[package]]
 name = "castaway"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1915,6 +1927,33 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cca491388666e04d7248af3f60f0c40cfb0991c72205595d7c396e3510207d1a"
 
 [[package]]
+name = "ciborium"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
+dependencies = [
+ "ciborium-io",
+ "ciborium-ll",
+ "serde",
+]
+
+[[package]]
+name = "ciborium-io"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
+
+[[package]]
+name = "ciborium-ll"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
+dependencies = [
+ "ciborium-io",
+ "half",
+]
+
+[[package]]
 name = "cipher"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2784,6 +2823,42 @@ dependencies = [
 ]
 
 [[package]]
+name = "criterion"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c76e09c1aae2bc52b3d2f29e13c6572553b30c4aa1b8a49fd70de6412654cb"
+dependencies = [
+ "anes",
+ "atty",
+ "cast",
+ "ciborium",
+ "clap 3.2.25",
+ "criterion-plot",
+ "itertools 0.10.5",
+ "lazy_static",
+ "num-traits",
+ "oorandom",
+ "plotters",
+ "rayon",
+ "regex",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "tinytemplate",
+ "walkdir",
+]
+
+[[package]]
+name = "criterion-plot"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"
+dependencies = [
+ "cast",
+ "itertools 0.10.5",
+]
+
+[[package]]
 name = "crossbeam-channel"
 version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2837,6 +2912,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "crunchy"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
+
+[[package]]
 name = "crypto-bigint"
 version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4295,6 +4376,7 @@ dependencies = [
 name = "go_to_line"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "editor",
  "gpui",
  "indoc",
@@ -4302,7 +4384,10 @@ dependencies = [
  "menu",
  "project",
  "rope",
+ "schemars",
+ "serde",
  "serde_json",
+ "settings",
  "text",
  "theme",
  "tree-sitter-rust",
@@ -4480,6 +4565,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "half"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dd08c532ae367adf81c312a4580bc67f1d0fe8bc9c460520283f4c0ff277888"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+]
+
+[[package]]
 name = "hashbrown"
 version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5339,7 +5434,6 @@ dependencies = [
  "tree-sitter-c",
  "tree-sitter-cpp",
  "tree-sitter-css",
- "tree-sitter-dart",
  "tree-sitter-elixir",
  "tree-sitter-elm",
  "tree-sitter-embedded-template",
@@ -5349,7 +5443,6 @@ dependencies = [
  "tree-sitter-gowork",
  "tree-sitter-hcl",
  "tree-sitter-heex",
- "tree-sitter-html",
  "tree-sitter-jsdoc",
  "tree-sitter-json 0.20.0",
  "tree-sitter-lua",
@@ -5678,10 +5771,13 @@ dependencies = [
 name = "markdown_preview"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "async-recursion 1.0.5",
  "editor",
  "gpui",
  "language",
+ "linkify",
+ "log",
  "pretty_assertions",
  "pulldown-cmark",
  "theme",
@@ -6400,6 +6496,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "oorandom"
+version = "11.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ab1bc2a289d34bd04a330323ac98a1b4bc82c9d9fcb1e66b63caa84da26b575"
+
+[[package]]
 name = "opaque-debug"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -6880,6 +6982,34 @@ dependencies = [
 ]
 
 [[package]]
+name = "plotters"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2c224ba00d7cadd4d5c660deaf2098e5e80e07846537c51f9cfa4be50c1fd45"
+dependencies = [
+ "num-traits",
+ "plotters-backend",
+ "plotters-svg",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "plotters-backend"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e76628b4d3a7581389a35d5b6e2139607ad7c75b17aed325f210aa91f4a9609"
+
+[[package]]
+name = "plotters-svg"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38f6d39893cca0701371e3c27294f09797214b86f1fb951b89ade8ec04e2abab"
+dependencies = [
+ "plotters-backend",
+]
+
+[[package]]
 name = "png"
 version = "0.16.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -7794,6 +7924,7 @@ version = "0.1.0"
 dependencies = [
  "arrayvec 0.7.4",
  "bromberg_sl2",
+ "criterion",
  "gpui",
  "log",
  "rand 0.8.5",
@@ -9498,16 +9629,19 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "editor",
+ "file_icons",
  "fuzzy",
  "gpui",
  "itertools 0.11.0",
  "language",
- "menu",
  "picker",
  "project",
+ "schemars",
  "serde",
  "serde_json",
+ "settings",
  "task",
+ "terminal",
  "tree-sitter-rust",
  "tree-sitter-typescript",
  "ui",
@@ -9829,6 +9963,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "tinytemplate"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
 name = "tinyvec"
 version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -10220,15 +10364,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "tree-sitter-dart"
-version = "0.0.1"
-source = "git+https://github.com/agent3bood/tree-sitter-dart?rev=48934e3bf757a9b78f17bdfaa3e2b4284656fdc7#48934e3bf757a9b78f17bdfaa3e2b4284656fdc7"
-dependencies = [
- "cc",
- "tree-sitter",
-]
-
-[[package]]
 name = "tree-sitter-elixir"
 version = "0.1.0"
 source = "git+https://github.com/elixir-lang/tree-sitter-elixir?rev=a2861e88a730287a60c11ea9299c033c7d076e30#a2861e88a730287a60c11ea9299c033c7d076e30"
@@ -12380,7 +12515,7 @@ dependencies = [
 
 [[package]]
 name = "zed"
-version = "0.130.7"
+version = "0.131.6"
 dependencies = [
  "activity_indicator",
  "anyhow",
@@ -12493,6 +12628,20 @@ dependencies = [
 ]
 
 [[package]]
+name = "zed_dart"
+version = "0.0.1"
+dependencies = [
+ "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "zed_emmet"
+version = "0.0.1"
+dependencies = [
+ "zed_extension_api 0.0.4",
+]
+
+[[package]]
 name = "zed_erlang"
 version = "0.0.1"
 dependencies = [
@@ -12511,16 +12660,29 @@ dependencies = [
 [[package]]
 name = "zed_extension_api"
 version = "0.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5f4ae4e302a80591635ef9a236b35fde6fcc26cfd060e66fde4ba9f9fd394a1"
 dependencies = [
  "wit-bindgen",
 ]
 
 [[package]]
 name = "zed_extension_api"
-version = "0.0.5"
+version = "0.0.6"
+dependencies = [
+ "serde",
+ "serde_json",
+ "wit-bindgen",
+]
+
+[[package]]
+name = "zed_extension_api"
+version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5f4ae4e302a80591635ef9a236b35fde6fcc26cfd060e66fde4ba9f9fd394a1"
+checksum = "77ca8bcaea3feb2d2ce9dbeb061ee48365312a351faa7014c417b0365fe9e459"
 dependencies = [
+ "serde",
+ "serde_json",
  "wit-bindgen",
 ]
 
@@ -12528,13 +12690,20 @@ dependencies = [
 name = "zed_gleam"
 version = "0.0.2"
 dependencies = [
- "zed_extension_api 0.0.4",
+ "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
 [[package]]
 name = "zed_haskell"
 version = "0.0.1"
 dependencies = [
+ "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "zed_html"
+version = "0.0.1"
+dependencies = [
  "zed_extension_api 0.0.4",
 ]
 
@@ -12563,14 +12732,14 @@ dependencies = [
 name = "zed_svelte"
 version = "0.0.1"
 dependencies = [
- "zed_extension_api 0.0.4",
+ "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
 [[package]]
 name = "zed_toml"
 version = "0.0.2"
 dependencies = [
- "zed_extension_api 0.0.5 (registry+https://github.com/rust-lang/crates.io-index)",
+ "zed_extension_api 0.0.5",
 ]
 
 [[package]]
@@ -12584,7 +12753,7 @@ dependencies = [
 name = "zed_zig"
 version = "0.0.1"
 dependencies = [
- "zed_extension_api 0.0.5 (registry+https://github.com/rust-lang/crates.io-index)",
+ "zed_extension_api 0.0.5",
 ]
 
 [[package]]
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 6de47e35491e9..d656f2a33e90f 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -27,13 +27,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zed";
-  version = "0.130.7";
+  version = "0.131.6";
 
   src = fetchFromGitHub {
     owner = "zed-industries";
     repo = "zed";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nGE4RjquH5tEz6vHR1f5F44TX4GtPwiPP3V3lWPpmxk=";
+    hash = "sha256-IhFOA+g2I5vb72CTSZ8WTa9K0ieYbPD/BMShGqaUb84=";
     fetchSubmodules = true;
   };
 
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "async-pipe-0.1.3" = "sha256-g120X88HGT8P6GNCrzpS5SutALx5H+45Sf4iSSxzctE=";
-      "blade-graphics-0.3.0" = "sha256-0TmunFnq9MBxm4TrAkI0PxB58qJEf7oWLWhHq5cVsQ8=";
+      "blade-graphics-0.4.0" = "sha256-S1PNdQ9YbJgLLsJU1mvDZ3feVDIrZGwU37JqIm+kfcE=";
       "bromberg_sl2-0.6.0" = "sha256-+bwdnk3EgYEAxQSP4KpEPicCfO+r2er1DRZjvfF4jSM=";
       "font-kit-0.11.0" = "sha256-+4zMzjFyMS60HfLMEXGfXqKn6P+pOngLA45udV09DM8=";
       "lsp-types-0.94.1" = "sha256-kplgPsafrgZFMI1D9pQCwmg+FKMn5HNWLbcgdXHUFVU=";
@@ -52,7 +52,6 @@ rustPlatform.buildRustPackage rec {
       "tree-sitter-bash-0.20.4" = "sha256-VP7rJfE/k8KV1XN1w5f0YKjCnDMYU1go/up0zj1mabM=";
       "tree-sitter-cpp-0.20.0" = "sha256-2QYEFkpwcRmh2kf4qEAL2a5lGSa316CetOhF73e7rEM=";
       "tree-sitter-css-0.19.0" = "sha256-5Qti/bFac2A1PJxqZEOuSLK3GGKYwPDKAp3OOassBxU=";
-      "tree-sitter-dart-0.0.1" = "sha256-FE6zXy0lAUWWayrM3urZFnQaEYBcnmaVANcUUnvw1q4=";
       "tree-sitter-elixir-0.1.0" = "sha256-hBHqQ3eBjknRPJjP+lQJU6NPFhUMtiv4FbKsTw28Bog=";
       "tree-sitter-elm-5.6.4" = "sha256-0LpuyebOB5ew9fULBcaw8aUbF7HM5sXQpv+Jroz4tXg=";
       "tree-sitter-glsl-0.1.4" = "sha256-TRuiT3ndCeDCsCFokAN8cosNKccB0NjWVRiBJuBJXZw=";
diff --git a/pkgs/by-name/zw/zwave-js-server/package.nix b/pkgs/by-name/zw/zwave-js-server/package.nix
index bde444b7aab3e..dfdf0ce3072f4 100644
--- a/pkgs/by-name/zw/zwave-js-server/package.nix
+++ b/pkgs/by-name/zw/zwave-js-server/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-server";
-  version = "1.34.0";
+  version = "1.35.0";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = pname;
     rev = version;
-    hash = "sha256-aTUV9FYE4m/f7rGv7BBFNzCVQpSO9vK1QkeofnMnbzM=";
+    hash = "sha256-9TUS8m3Vizs36GVYaDQTRXPO8zLLJUs8RPkArRRCqsw=";
   };
 
-  npmDepsHash = "sha256-Jne4vzPcNNfHO1LQa609Jdv22Nh3md9KfBXuQoILpbY=";
+  npmDepsHash = "sha256-zTcN04g7EsLFCA+rdqhSQMy06NoMFYCyiUxe9ck2kIE=";
 
   # For some reason the zwave-js dependency is in devDependencies
   npmFlags = [ "--include=dev" ];
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index ad8f2c0a8e021..1350b01d96fe5 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "29.2.0";
+  version = "29.2.1";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-7g0eogqiBdfTwg8btkHExrY4fpqf0hUZbvlElFtKrB8=";
+    hash = "sha256-WWumGi6+jaQUGi1eArS9l3G8sOQL4ZetixVB5RWDPQ4=";
   };
 
-  npmDepsHash = "sha256-lSKh16qN4EAmC0wtBokkFyl6Vung85vPTyr8Icc4rU0=";
+  npmDepsHash = "sha256-Gm3R8lWmYbLOfyGW+f8CYXlodp11vMCMAhagILxLKFA=";
 
   nativeBuildInputs = [
     remarshal
diff --git a/pkgs/data/icons/gruppled-cursors/default.nix b/pkgs/data/icons/gruppled-cursors/default.nix
new file mode 100644
index 0000000000000..f78becfd615f4
--- /dev/null
+++ b/pkgs/data/icons/gruppled-cursors/default.nix
@@ -0,0 +1,30 @@
+{
+  stdenvNoCC,
+  fetchFromGitHub,
+  theme,
+  lib,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "gruppled-cursors";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "nim65s";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ejlgdogjIYevZvB23si6bEeU6qY7rWXflaUyVk5MzqU=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/icons/${theme}
+    cp -r ${theme}/{cursors,index.theme} $out/share/icons/${theme}
+  '';
+
+  meta = with lib; {
+    description = "Gruppled Cursors theme";
+    homepage = "https://github.com/nim65s/gruppled-cursors";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/data/icons/gruppled-lite-cursors/default.nix b/pkgs/data/icons/gruppled-lite-cursors/default.nix
new file mode 100644
index 0000000000000..eba7daeb0d80e
--- /dev/null
+++ b/pkgs/data/icons/gruppled-lite-cursors/default.nix
@@ -0,0 +1,30 @@
+{
+  stdenvNoCC,
+  fetchFromGitHub,
+  theme,
+  lib,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "gruppled-lite-cursors";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "nim65s";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-adCXYu8v6mFKXubVQb/RCZXS87//YgixQp20kMt7KT8=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/icons/${theme}
+    cp -r ${theme}/{cursors,index.theme} $out/share/icons/${theme}
+  '';
+
+  meta = with lib; {
+    description = "Gruppled Lite Cursors theme";
+    homepage = "https://github.com/nim65s/gruppled-lite-cursors";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index 5422eaac80739..5fd04d5a1b1d8 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "24.03.12";
+  version = "24.04.16";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-WWgppmMIXa7AtMu8Tu3TOt4JvsAkpufZva1reE+UaWg=";
+    sha256 = "sha256-1SBIEqbgJwRcoCPWDL5YoapNHsrqWcpjFo0xp+GSXXs=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/data/icons/tela-circle-icon-theme/default.nix b/pkgs/data/icons/tela-circle-icon-theme/default.nix
index 9b1043467f14a..68ac8454662c5 100644
--- a/pkgs/data/icons/tela-circle-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-circle-icon-theme/default.nix
@@ -19,13 +19,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "black" "blue" "brow
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2023-10-07";
+  version = "2024-04-19";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    hash = "sha256-il+bYIcwm0BQF6U0J6h6rlzHSGSHYN/O8BezehYIpQ4=";
+    hash = "sha256-vtEmnoARlz1F+E+T3ceFDgLXjlCi8UzHLr4AwTA39fA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/icons/whitesur-icon-theme/default.nix b/pkgs/data/icons/whitesur-icon-theme/default.nix
index e9ca757add207..70f5357a89f84 100644
--- a/pkgs/data/icons/whitesur-icon-theme/default.nix
+++ b/pkgs/data/icons/whitesur-icon-theme/default.nix
@@ -27,13 +27,13 @@ lib.checkListOfEnum "${pname}: theme variants" [
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2024.04.08";
+  version = "2024-04-22";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    hash = "sha256-Baf0BowyR4P7MDx+LmH6MHlANl+9lXlCaQispN4/i9o=";
+    hash = "sha256-CnAnD5ky+LNcyE59O/iGeoe+1JyhtPM/XUHwU5d8FA4=";
   };
 
   nativeBuildInputs = [ gtk3 jdupes ];
diff --git a/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix b/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
index a36251e81ec86..88d492cfcee06 100644
--- a/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
+++ b/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
@@ -55,6 +55,7 @@ let
       longDescription = description;
       homepage = link;
       license = lib.licenses.gpl2Plus; # https://wiki.gnome.org/Projects/GnomeShell/Extensions/Review#Licensing
+      platforms = lib.platforms.linux;
       maintainers = with lib.maintainers; [ ];
     };
     passthru = {
diff --git a/pkgs/development/compilers/cakelisp/default.nix b/pkgs/development/compilers/cakelisp/default.nix
index 1dffc52f7576f..c71f2dd48e21c 100644
--- a/pkgs/development/compilers/cakelisp/default.nix
+++ b/pkgs/development/compilers/cakelisp/default.nix
@@ -3,12 +3,12 @@
 stdenv.mkDerivation {
   pname = "cakelisp";
   # using unstable as it's the only version that builds against gcc-13
-  version = "0.3.0-unstable-2024-04-01";
+  version = "0.3.0-unstable-2024-04-18";
 
   src = fetchgit {
     url = "https://macoy.me/code/macoy/cakelisp";
-    rev = "7f09a08623f4141d3c2940bca3e8ea646a7049cc";
-    hash = "sha256-5ey2j38bhoRADMFcTGcUiOHE/UlU2mPGqzfv7dEk6oQ=";
+    rev = "115ab436056602b7f3a1ca30be40edbfcc88299d";
+    hash = "sha256-rgBtT24aopXLTeDffjXGvJ3RgT+QLlr50Ju9a6ccyzc=";
   };
 
   buildInputs = [ gcc ];
diff --git a/pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix
index 40e44e22954de..40d3832675b17 100644
--- a/pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix
@@ -1,22 +1,22 @@
 # Generated by update.sh script
 {
-  "version" = "24.0.0";
+  "version" = "24.0.1";
   "hashes" = {
     "aarch64-linux" = {
-      sha256 = "0nq2wnc7kb3x37m68b2ylay6c341fzv4453k150a47fnj0p4d85p";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.0/truffleruby-community-24.0.0-linux-aarch64.tar.gz";
+      sha256 = "145199fv1kpf992gvidcbs0zs2950gbbvmm8qg17sbi8fg1ggqkq";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.1/truffleruby-community-24.0.1-linux-aarch64.tar.gz";
     };
     "x86_64-linux" = {
-      sha256 = "1h8zqf9clxg3azma86gdm6yl8mif2sgmyhnvqdilap28vmj4mpns";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.0/truffleruby-community-24.0.0-linux-amd64.tar.gz";
+      sha256 = "06vc8ym8bwyw057i4bjybbi92af8v3ic2yq4n1fms374n3iism4a";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.1/truffleruby-community-24.0.1-linux-amd64.tar.gz";
     };
     "x86_64-darwin" = {
-      sha256 = "03c4bxdzdz5m7n1kkmzsb8x0m1h4ms6ah29p9m4wrz8pjsb8682l";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.0/truffleruby-community-24.0.0-macos-amd64.tar.gz";
+      sha256 = "0q419zpa02zlmf5lgmn9a12wlizm83d3ikwjzayp2h6mrg8zv825";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.1/truffleruby-community-24.0.1-macos-amd64.tar.gz";
     };
     "aarch64-darwin" = {
-      sha256 = "0ph6ki66w4kqwnznbpgfd8k85xx6cgqslzy07v4sywhp9k246qld";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.0/truffleruby-community-24.0.0-macos-aarch64.tar.gz";
+      sha256 = "02ri76ain3vjg3d0v8jf7ii0b0ppmqq7nbc73mvzvg7hl3hxlir7";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-24.0.1/truffleruby-community-24.0.1-macos-aarch64.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix
index 99fde9c66a591..f7a05f8d1455c 100644
--- a/pkgs/development/compilers/haxe/default.nix
+++ b/pkgs/development/compilers/haxe/default.nix
@@ -2,8 +2,8 @@
 
 let
   ocamlDependencies = version:
-    if lib.versionAtLeast version "4.2"
-    then with ocaml-ng.ocamlPackages_4_12; [
+    if lib.versionAtLeast version "4.3"
+    then with ocaml-ng.ocamlPackages_4_14; [
       ocaml
       findlib
       sedlex
@@ -126,7 +126,7 @@ in {
     sha256 = "0rns6d28qzkbai6yyws08yzbyvxfn848nj0fsji7chdi0y7pzzj0";
   };
   haxe_4_3 = generic {
-    version = "4.3.3";
-    sha256 = "sha256-sMklqQkVbWCYCKpOU23AjkuxzcVV7Aa8ljlFpruam9Y=";
+    version = "4.3.4";
+    sha256 = "sha256-XGV4VG8nUofHGjHbtrLA+2kIpnnPqw5IlcNrP3EsL+Q=";
   };
 }
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index 0d9202df8aeeb..45955dc5e1b36 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -56,7 +56,7 @@ let
     then tools.bintools
     else bootBintools;
 
-  in rec {
+  in {
 
     libllvm = callPackage ./llvm {
       inherit llvm_meta;
@@ -74,7 +74,7 @@ let
         ./clang/gnu-install-dirs.patch
         (substituteAll {
           src = ../common/clang/clang-11-15-LLVMgold-path.patch;
-          libllvmLibdir = "${libllvm.lib}/lib";
+          libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
       inherit clang-tools-extra_src llvm_meta;
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index ecdbd14e98e74..018fb0c638505 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -82,7 +82,7 @@ in let
     then tools.bintools
     else bootBintools;
 
-  in rec {
+  in {
 
     libllvm = callPackage ./llvm {
       inherit llvm_meta;
@@ -105,7 +105,7 @@ in let
         ../common/clang/add-nostdlibinc-flag.patch
         (substituteAll {
           src = ../common/clang/clang-11-15-LLVMgold-path.patch;
-          libllvmLibdir = "${libllvm.lib}/lib";
+          libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
       inherit llvm_meta;
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index fb1b8743b6ebb..588dc8fffefdd 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -78,7 +78,7 @@ in let
     then tools.bintools
     else bootBintools;
 
-  in rec {
+  in {
 
     libllvm = callPackage ./llvm {
       inherit llvm_meta;
@@ -96,7 +96,7 @@ in let
         ../common/clang/add-nostdlibinc-flag.patch
         (substituteAll {
           src = ../common/clang/clang-11-15-LLVMgold-path.patch;
-          libllvmLibdir = "${libllvm.lib}/lib";
+          libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
       inherit llvm_meta;
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index ce8426857ebe7..bfcbe2b86e247 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -84,7 +84,7 @@ in let
     then tools.bintools
     else bootBintools;
 
-  in rec {
+  in {
 
     libllvm = callPackage ./llvm {
       inherit llvm_meta;
@@ -102,7 +102,7 @@ in let
         ../common/clang/add-nostdlibinc-flag.patch
         (substituteAll {
           src = ../common/clang/clang-11-15-LLVMgold-path.patch;
-          libllvmLibdir = "${libllvm.lib}/lib";
+          libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
       inherit llvm_meta;
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 5716267426b24..5dd07d77cf8c6 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -85,7 +85,7 @@ in let
     then tools.bintools
     else bootBintools;
 
-  in rec {
+  in {
 
     libllvm = callPackage ./llvm {
       inherit llvm_meta;
@@ -103,7 +103,7 @@ in let
         ../common/clang/add-nostdlibinc-flag.patch
         (substituteAll {
           src = ../common/clang/clang-at-least-16-LLVMgold-path.patch;
-         libllvmLibdir = "${libllvm.lib}/lib";
+          libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
       inherit llvm_meta;
diff --git a/pkgs/development/compilers/llvm/17/default.nix b/pkgs/development/compilers/llvm/17/default.nix
index 2f60666536f37..9f4be2261b0cf 100644
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ b/pkgs/development/compilers/llvm/17/default.nix
@@ -80,7 +80,7 @@ in let
     then tools.bintools
     else bootBintools;
 
-  in rec {
+  in {
 
     libllvm = callPackage ./llvm {
       inherit llvm_meta;
@@ -98,7 +98,7 @@ in let
         ../common/clang/add-nostdlibinc-flag.patch
         (substituteAll {
           src = ../common/clang/clang-at-least-16-LLVMgold-path.patch;
-          libllvmLibdir = "${libllvm.lib}/lib";
+          libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
       inherit llvm_meta;
diff --git a/pkgs/development/compilers/llvm/18/default.nix b/pkgs/development/compilers/llvm/18/default.nix
index 0a30288755e6f..4d2b160a23ff1 100644
--- a/pkgs/development/compilers/llvm/18/default.nix
+++ b/pkgs/development/compilers/llvm/18/default.nix
@@ -80,7 +80,7 @@ in let
     then tools.bintools
     else bootBintools;
 
-  in rec {
+  in {
 
     libllvm = callPackage ./llvm {
       inherit llvm_meta;
@@ -98,7 +98,7 @@ in let
         ../common/clang/add-nostdlibinc-flag.patch
         (substituteAll {
           src = ../common/clang/clang-at-least-16-LLVMgold-path.patch;
-          libllvmLibdir = "${libllvm.lib}/lib";
+          libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
       inherit llvm_meta;
diff --git a/pkgs/development/compilers/llvm/common/libcxx/default.nix b/pkgs/development/compilers/llvm/common/libcxx/default.nix
index de895125f8832..0e91f50551c55 100644
--- a/pkgs/development/compilers/llvm/common/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/common/libcxx/default.nix
@@ -124,7 +124,7 @@ stdenv.mkDerivation (rec {
   # libc++.so.1 and libc++abi.so or the external cxxabi. ld-wrapper doesn't
   # support linker scripts so the external cxxabi needs to be symlinked in
   postInstall = lib.optionalString (cxxabi != null) ''
-    lndir ${lib.getDev cxxabi}/include $out/include/c++/v1
+    lndir ${lib.getDev cxxabi}/include $dev/include/c++/v1
     lndir ${lib.getLib cxxabi}/lib $out/lib
   '';
 
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 56fae64d59d8d..1a34130679db2 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -85,7 +85,7 @@ in let
     then tools.bintools
     else bootBintools;
 
-  in rec {
+  in {
 
     libllvm = callPackage ./llvm {
       inherit llvm_meta;
@@ -103,7 +103,7 @@ in let
         ../common/clang/add-nostdlibinc-flag.patch
         (substituteAll {
           src = ../common/clang/clang-at-least-16-LLVMgold-path.patch;
-          libllvmLibdir = "${libllvm.lib}/lib";
+          libllvmLibdir = "${tools.libllvm.lib}/lib";
         })
       ];
       inherit llvm_meta;
diff --git a/pkgs/development/compilers/miranda/default.nix b/pkgs/development/compilers/miranda/default.nix
index f0d95323fe33f..8385f5063db9e 100644
--- a/pkgs/development/compilers/miranda/default.nix
+++ b/pkgs/development/compilers/miranda/default.nix
@@ -55,7 +55,11 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: types.o:(.bss+0x11b0): multiple definition of `current_file'; y.tab.o:(.bss+0x70): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = toString ([
+    "-fcommon"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error=int-conversion"
+  ]);
 
   makeFlags = [
     "CC=${stdenv.cc.targetPrefix}cc"
diff --git a/pkgs/development/compilers/ocaml/5.2.nix b/pkgs/development/compilers/ocaml/5.2.nix
index 26d77f63044d4..8df6f1d5d48ea 100644
--- a/pkgs/development/compilers/ocaml/5.2.nix
+++ b/pkgs/development/compilers/ocaml/5.2.nix
@@ -1,9 +1,9 @@
 import ./generic.nix {
   major_version = "5";
   minor_version = "2";
-  patch_version = "0-beta1";
+  patch_version = "0-beta2";
   src = fetchTarball {
-    url = "https://caml.inria.fr/pub/distrib/ocaml-5.2/ocaml-5.2.0~beta1.tar.xz";
-    sha256 = "sha256:0prf87a41k2y1znnh2pjkggrvhh5cihj68sxqrjn162889rf7wam";
+    url = "https://caml.inria.fr/pub/distrib/ocaml-5.2/ocaml-5.2.0~beta2.tar.xz";
+    sha256 = "sha256:1cyw0w79j7kyr3x0ivsqm1si704b29ic33yj621dq7f125jabk00";
   };
 }
diff --git a/pkgs/development/compilers/scryer-prolog/default.nix b/pkgs/development/compilers/scryer-prolog/default.nix
index 02383e6b4a512..28744a00a5f16 100644
--- a/pkgs/development/compilers/scryer-prolog/default.nix
+++ b/pkgs/development/compilers/scryer-prolog/default.nix
@@ -7,6 +7,7 @@
 , libmpc
 , mpfr
 , stdenv
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,12 +24,15 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "sha256-q8s6HAJhKnMhsgZk5plR+ar3CpLKNqjrD14roDWLwfo=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl gmp libmpc mpfr ];
+
+  buildInputs = [ openssl gmp libmpc mpfr ]
+                ++ lib.optionals stdenv.isDarwin [
+                  darwin.apple_sdk.frameworks.SystemConfiguration
+                ];
 
   CARGO_FEATURE_USE_SYSTEM_LIBS = true;
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "A modern Prolog implementation written mostly in Rust";
     mainProgram = "scryer-prolog";
     homepage = "https://github.com/mthom/scryer-prolog";
diff --git a/pkgs/development/compilers/zig/0.12.nix b/pkgs/development/compilers/zig/0.12.nix
new file mode 100644
index 0000000000000..e234b600bc227
--- /dev/null
+++ b/pkgs/development/compilers/zig/0.12.nix
@@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, llvmPackages
+, libxml2
+, zlib
+, coreutils
+, callPackage
+}@args:
+
+import ./generic.nix args {
+  version = "0.12.0";
+
+  hash = "sha256-RNZiUZtaKXoab5kFrDij6YCAospeVvlLWheTc3FGMks=";
+
+  outputs = [ "out" "doc" ];
+
+  cmakeFlags = [
+    # file RPATH_CHANGE could not write new RPATH
+    (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
+
+    # always link against static build of LLVM
+    (lib.cmakeBool "ZIG_STATIC_LLVM" true)
+
+    # ensure determinism in the compiler build
+    (lib.cmakeFeature "ZIG_TARGET_MCPU" "baseline")
+  ];
+
+  postBuild = ''
+    stage3/bin/zig run ../tools/docgen.zig -- ../doc/langref.html.in langref.html --zig $PWD/stage3/bin/zig
+  '';
+
+  postInstall = ''
+    install -Dm444 langref.html -t $doc/share/doc/zig-$version/html
+  '';
+}
diff --git a/pkgs/development/compilers/zig/generic.nix b/pkgs/development/compilers/zig/generic.nix
index 220f3240f2852..f3c725e1e5ce0 100644
--- a/pkgs/development/compilers/zig/generic.nix
+++ b/pkgs/development/compilers/zig/generic.nix
@@ -40,7 +40,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Zig's build looks at /usr/bin/env to find dynamic linking info. This doesn't
   # work in Nix's sandbox. Use env from our coreutils instead.
-  postPatch = ''
+  postPatch = if lib.versionAtLeast args.version "0.12" then ''
+    substituteInPlace lib/std/zig/system.zig \
+      --replace "/usr/bin/env" "${coreutils}/bin/env"
+  '' else ''
     substituteInPlace lib/std/zig/system/NativeTargetInfo.zig \
       --replace "/usr/bin/env" "${coreutils}/bin/env"
   '';
diff --git a/pkgs/development/embedded/avrdude/default.nix b/pkgs/development/embedded/avrdude/default.nix
index 924c502358216..41b6c5ffc9401 100644
--- a/pkgs/development/embedded/avrdude/default.nix
+++ b/pkgs/development/embedded/avrdude/default.nix
@@ -1,16 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, cmake, bison, flex, libusb-compat-0_1, libelf
-, libftdi1, readline, libserialport
-# documentation building is broken on darwin
-, docSupport ? (!stdenv.isDarwin), texliveMedium, texinfo, texi2html, unixtools }:
+{ lib, callPackage, stdenv, fetchFromGitHub, cmake, bison, flex, libusb1, elfutils
+, libftdi1, readline, hidapi, libserialport
+# Documentation building doesn't work on Darwin. It fails with:
+#   Undefined subroutine &Locale::Messages::dgettext called in ... texi2html
+#
+# https://github.com/NixOS/nixpkgs/issues/224761
+, docSupport ? (!stdenv.hostPlatform.isDarwin), texliveMedium, texinfo, texi2html, unixtools }:
 
-stdenv.mkDerivation rec {
+let
+  useElfutils = lib.meta.availableOn stdenv.hostPlatform elfutils;
+in
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "avrdude";
   version = "7.3";
 
   src = fetchFromGitHub {
     owner = "avrdudes";
-    repo = pname;
-    rev = "v${version}";
+    repo = "avdude";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-JqW3AOMmAfcy+PQRcqviWlxA6GoMSEfzIFt1pRYY7Dw=";
   };
 
@@ -21,17 +28,36 @@ stdenv.mkDerivation rec {
     texi2html
   ];
 
-  buildInputs = [ libusb-compat-0_1 libelf libftdi1 libserialport readline ];
-
-  cmakeFlags = lib.optionals docSupport [
-    "-DBUILD_DOC=ON"
+  buildInputs = [
+    (if useElfutils then elfutils else finalAttrs.finalPackage.passthru.libelf)
+    hidapi
+    libusb1
+    libftdi1
+    libserialport
+    readline
   ];
 
+  postPatch = lib.optionalString (!useElfutils) ''
+    # vendored libelf is a static library
+    sed -i "s/PREFERRED_LIBELF elf/PREFERRED_LIBELF libelf.a elf/" CMakeLists.txt
+  '';
+
+  # Not used:
+  #   -DHAVE_LINUXGPIO=ON    because it's incompatible with libgpiod 2.x
+  cmakeFlags = lib.optionals docSupport [ "-DBUILD_DOC=ON" ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ "-DHAVE_LINUXSPI=ON" "-DHAVE_PARPORT=ON" ];
+
   # dvips output references texlive in comments, resulting in a huge closure
   postInstall = lib.optionalString docSupport ''
-    rm $out/share/doc/${pname}/*.ps
+    rm $out/share/doc/avrdude/*.ps
   '';
 
+  passthru = {
+    # Vendored and mutated copy of libelf for avrdudes use.
+    # Produces a static library only.
+    libelf = callPackage ./libelf.nix { };
+  };
+
   meta = with lib; {
     description = "Command-line tool for programming Atmel AVR microcontrollers";
     mainProgram = "avrdude";
@@ -45,4 +71,4 @@ stdenv.mkDerivation rec {
     platforms = with platforms; linux ++ darwin;
     maintainers = [ maintainers.bjornfor ];
   };
-}
+})
diff --git a/pkgs/development/embedded/avrdude/libelf.nix b/pkgs/development/embedded/avrdude/libelf.nix
new file mode 100644
index 0000000000000..bd7b7be7066a3
--- /dev/null
+++ b/pkgs/development/embedded/avrdude/libelf.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation {
+  pname = "libelf";
+  version = "0.8.13-unstable-2023-01-14";
+
+  src = fetchFromGitHub {
+    owner = "avrdudes";
+    repo = "libelf";
+    rev = "0c55bfe1d3020a20bddf6ce57c0d9d98ccb12586";
+    hash = "sha256-jz7Ef0Eg673IJVZvVNklY40s13LCuMVAc7FGrRI7scQ=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/lib
+    cp liblibelf.a $out/lib/libelf.a
+    cp -r $src/include $out/include
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "ELF object file access library (vendored by avrdudes)";
+    homepage = "https://github.com/avrdudes/libelf";
+    license = lib.licenses.lgpl2Plus;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.bjornfor ];
+  };
+}
diff --git a/pkgs/development/interpreters/babashka/clojure-tools.nix b/pkgs/development/interpreters/babashka/clojure-tools.nix
index afd170a419386..082cb99f476d9 100644
--- a/pkgs/development/interpreters/babashka/clojure-tools.nix
+++ b/pkgs/development/interpreters/babashka/clojure-tools.nix
@@ -6,10 +6,10 @@
 }:
 clojure.overrideAttrs (previousAttrs: {
   pname = "babashka-clojure-tools";
-  version = "1.11.1.1435";
+  version = "1.11.2.1446";
 
   src = fetchurl {
     url = previousAttrs.src.url;
-    hash = "sha256-RS/FebIED8RYYXRXBKXZPRROO0HqyDo0zhb+p4Q5m8A=";
+    hash = "sha256-qn7/sPyVDfjZPLeWxlUBBljAW/d8cCw6lEm3/deS73E=";
   };
 })
diff --git a/pkgs/development/interpreters/babashka/default.nix b/pkgs/development/interpreters/babashka/default.nix
index 9844920366c7b..4b8376a330906 100644
--- a/pkgs/development/interpreters/babashka/default.nix
+++ b/pkgs/development/interpreters/babashka/default.nix
@@ -9,11 +9,11 @@
 let
   babashka-unwrapped = buildGraalvmNativeImage rec {
     pname = "babashka-unwrapped";
-    version = "1.3.189";
+    version = "1.3.190";
 
     src = fetchurl {
       url = "https://github.com/babashka/babashka/releases/download/v${version}/babashka-${version}-standalone.jar";
-      sha256 = "sha256-C3N++tTTvebtQid3p+zrnBgHTqQmECQhiS2/3VIEojI=";
+      sha256 = "sha256-zGWUuFyCOZXrcAOJ2sGvzvfJbFti1IlDS1gx9Oye9fg=";
     };
 
     graalvmDrv = graalvmCEPackages.graalvm-ce;
diff --git a/pkgs/development/libraries/embree/default.nix b/pkgs/development/libraries/embree/default.nix
index 419572f3ff160..d956eae27e8da 100644
--- a/pkgs/development/libraries/embree/default.nix
+++ b/pkgs/development/libraries/embree/default.nix
@@ -1,32 +1,24 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, cmake, pkg-config, ispc, tbb, glfw,
+{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, ispc, tbb, glfw,
   openimageio, libjpeg, libpng, libpthreadstubs, libX11, glib }:
 
 stdenv.mkDerivation rec {
   pname = "embree";
-  version = "3.13.5";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "embree";
     repo = "embree";
     rev = "v${version}";
-    sha256 = "sha256-tfM4SGOFVBG0pQK9B/iN2xDaW3yjefnTtsoUad75m80=";
+    sha256 = "sha256-gQPlk0bDn04s2pncF22m/OpIbzF3NXKkRCZbmxfXEY4=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fixed-compilation-issues-for-arm-aarch64-processor-under-linux.patch";
-      url = "https://github.com/embree/embree/commit/82ca6b5ccb7abe0403a658a0e079926478f04cb1.patch";
-      hash = "sha256-l9S4PBk+yQUypQ22l05daD0ruouZKE4VHkGvzKxkH4o=";
-    })
-  ];
-
   postPatch = ''
     # Fix duplicate /nix/store/.../nix/store/.../ paths
     sed -i "s|SET(EMBREE_ROOT_DIR .*)|set(EMBREE_ROOT_DIR $out)|" \
       common/cmake/embree-config.cmake
     sed -i "s|$""{EMBREE_ROOT_DIR}/||" common/cmake/embree-config.cmake
-    substituteInPlace common/math/math.h --replace 'defined(__MACOSX__) && !defined(__INTEL_COMPILER)' 0
-    substituteInPlace common/math/math.h --replace 'defined(__WIN32__) || defined(__FreeBSD__)' 'defined(__WIN32__) || defined(__FreeBSD__) || defined(__MACOSX__)'
+    substituteInPlace common/math/emath.h --replace 'defined(__MACOSX__) && !defined(__INTEL_COMPILER)' 0
+    substituteInPlace common/math/emath.h --replace 'defined(__WIN32__) || defined(__FreeBSD__)' 'defined(__WIN32__) || defined(__FreeBSD__) || defined(__MACOSX__)'
   '';
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index 1786d84e7a4ba..cb2fc48c31de6 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -54,14 +54,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flatpak";
-  version = "1.14.5";
+  version = "1.14.6";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [ "out" "dev" "man" "doc" "devdoc" "installedTests" ];
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-W3DGTOesE04eoIARJW5COuXFTydyl0QVg/d9AT8n/6w="; # Taken from https://github.com/flatpak/flatpak/releases/
+    sha256 = "sha256-U482ssb4xw7v0S0TrVsa2DCCAQaovTqfa45NnegeSUY="; # Taken from https://github.com/flatpak/flatpak/releases/
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gensio/default.nix b/pkgs/development/libraries/gensio/default.nix
index 74eb0f05d3f2b..ea3fd6e1ac784 100644
--- a/pkgs/development/libraries/gensio/default.nix
+++ b/pkgs/development/libraries/gensio/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gensio";
-  version = "2.8.3";
+  version = "2.8.4";
 
   src = fetchFromGitHub {
     owner = "cminyard";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-GmVekTySfSOIWkKLdVuhhtJFQBBBfHBj410jNUfSrkc=";
+    sha256 = "sha256-UPAYqgZSJMp6/pRIVJYqh8i5olBSVoMUv2zCd14JBOg=";
   };
 
   passthru = {
diff --git a/pkgs/development/libraries/glfw/3.x.nix b/pkgs/development/libraries/glfw/3.x.nix
index 014e5f7e9f0e5..5e0b6adbb2267 100644
--- a/pkgs/development/libraries/glfw/3.x.nix
+++ b/pkgs/development/libraries/glfw/3.x.nix
@@ -1,47 +1,54 @@
 { stdenv, lib, fetchFromGitHub, cmake
 , libGL, libXrandr, libXinerama, libXcursor, libX11, libXi, libXext
 , Carbon, Cocoa, Kernel, OpenGL, fixDarwinDylibNames
-, waylandSupport ? false, extra-cmake-modules, wayland
-, wayland-protocols, libxkbcommon
+, extra-cmake-modules, wayland
+, wayland-scanner, wayland-protocols, libxkbcommon
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.3.10";
+  version = "3.4";
   pname = "glfw";
 
   src = fetchFromGitHub {
     owner = "glfw";
     repo = "GLFW";
     rev = version;
-    sha256 = "sha256-kTRXsfQ+9PFurG3ffz0lwnITAYAXtNl3h/3O6FSny5o=";
+    sha256 = "sha256-FcnQPDeNHgov1Z07gjFze0VMz2diOrpbKZCsI96ngz0=";
   };
 
   # Fix linkage issues on X11 (https://github.com/NixOS/nixpkgs/issues/142583)
-  patches = lib.optional (!waylandSupport) ./x11.patch;
+  patches = ./x11.patch;
 
   propagatedBuildInputs =
     lib.optionals stdenv.isDarwin [ OpenGL ]
     ++ lib.optionals stdenv.isLinux [ libGL ];
 
-  nativeBuildInputs = [ cmake ]
+  nativeBuildInputs = [ cmake extra-cmake-modules ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames
-    ++ lib.optional waylandSupport extra-cmake-modules;
+    ++ lib.optionals stdenv.isLinux [ wayland-scanner ];
 
   buildInputs =
     lib.optionals stdenv.isDarwin [ Carbon Cocoa Kernel ]
-    ++ lib.optionals (stdenv.isLinux && waylandSupport) [ wayland wayland-protocols libxkbcommon ]
-    ++ lib.optionals (stdenv.isLinux && !waylandSupport) [ libX11 libXrandr libXinerama libXcursor libXi libXext ];
+    ++ lib.optionals stdenv.isLinux [
+      wayland
+      wayland-protocols
+      libxkbcommon
+      libX11
+      libXrandr
+      libXinerama
+      libXcursor
+      libXi
+      libXext
+    ];
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
   ] ++ lib.optionals (!stdenv.isDarwin && !stdenv.hostPlatform.isWindows) [
     "-DCMAKE_C_FLAGS=-D_GLFW_GLX_LIBRARY='\"${lib.getLib libGL}/lib/libGL.so.1\"'"
-  ] ++ lib.optionals waylandSupport [
-    "-DGLFW_USE_WAYLAND=ON"
     "-DCMAKE_C_FLAGS=-D_GLFW_EGL_LIBRARY='\"${lib.getLib libGL}/lib/libEGL.so.1\"'"
   ];
 
-  postPatch = lib.optionalString waylandSupport ''
+  postPatch = lib.optionalString stdenv.isLinux ''
     substituteInPlace src/wl_init.c \
       --replace "libxkbcommon.so.0" "${lib.getLib libxkbcommon}/lib/libxkbcommon.so.0"
   '';
diff --git a/pkgs/development/libraries/gumbo/default.nix b/pkgs/development/libraries/gumbo/default.nix
index 68416ef2edc03..118646c619ae0 100644
--- a/pkgs/development/libraries/gumbo/default.nix
+++ b/pkgs/development/libraries/gumbo/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitea {
     domain = "codeberg.org";
-    owner = "grisha";
+    owner = "gumbo-parser";
     repo = "gumbo-parser";
     rev = version;
     hash = "sha256-d4V4bI08Prmg3U0KGu4yIwpHcvTJT3NAd4lbzdBU/AE=";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "C99 HTML parsing algorithm";
-    homepage = "https://github.com/google/gumbo-parser";
+    homepage = "https://codeberg.org/gumbo-parser/gumbo-parser";
     maintainers = [ maintainers.nico202 ];
     platforms = with platforms; linux ++ darwin;
     license = licenses.asl20;
diff --git a/pkgs/development/libraries/libcxxrt/default.nix b/pkgs/development/libraries/libcxxrt/default.nix
index c18e699eaf869..cd9e7778a80be 100644
--- a/pkgs/development/libraries/libcxxrt/default.nix
+++ b/pkgs/development/libraries/libcxxrt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "libcxxrt";
-  version = "unstable-2024-02-05";
+  version = "unstable-2024-04-15";
 
   src = fetchFromGitHub {
     owner = "libcxxrt";
     repo = "libcxxrt";
-    rev = "bd4fa85d7f772f2ad32146d5681c91612fc93842";
-    sha256 = "2F6MmLfKyFl7HzdTb1NDBVHMSRVzVhcib93JVaR58Qw=";
+    rev = "25541e312f7094e9c90895000d435af520d42418";
+    sha256 = "d5uhtlO+28uc2Xnf5trXsy43jgmzBHs2jZhCK57qRM4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libtiff/4.5.nix b/pkgs/development/libraries/libtiff/4.5.nix
deleted file mode 100644
index 3b24c6f1a2e1d..0000000000000
--- a/pkgs/development/libraries/libtiff/4.5.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitLab
-, fetchpatch
-
-, autoreconfHook
-, pkg-config
-, sphinx
-
-, libdeflate
-, libjpeg
-, xz
-, zlib
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libtiff";
-  version = "4.5.1";
-
-  src = fetchFromGitLab {
-    owner = "libtiff";
-    repo = "libtiff";
-    rev = "v${version}";
-    hash = "sha256-qQEthy6YhNAQmdDMyoCIvK8f3Tx25MgqhJZW74CB93E=";
-  };
-
-  patches = [
-    # cf. https://bugzilla.redhat.com/2224974
-    (fetchpatch {
-      name = "CVE-2023-40745.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/bdf7b2621c62e04d0408391b7d5611502a752cd0.diff";
-      hash = "sha256-HdU02YJ1/T3dnCT+yG03tUyAHkgeQt1yjZx/auCQxyw=";
-    })
-    # cf. https://bugzilla.redhat.com/2224971
-    (fetchpatch {
-      name = "CVE-2023-41175.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/965fa243004e012adc533ae8e38db3055f101a7f.diff";
-      hash = "sha256-Pvg6JfJWOIaTrfFF0YSREZkS9saTG9IsXnsXtcyKILA=";
-    })
-    # FreeImage needs this patch
-    ./headers-4.5.patch
-    # libc++abi 11 has an `#include <version>`, this picks up files name
-    # `version` in the project's include paths
-    ./rename-version-4.5.patch
-  ];
-
-  postPatch = ''
-    mv VERSION VERSION.txt
-  '';
-
-  outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
-
-  postFixup = ''
-    moveToOutput include/tif_config.h $dev_private
-    moveToOutput include/tif_dir.h $dev_private
-    moveToOutput include/tif_hash_set.h $dev_private
-    moveToOutput include/tiffiop.h $dev_private
-  '';
-
-  # If you want to change to a different build system, please make
-  # sure cross-compilation works first!
-  nativeBuildInputs = [ autoreconfHook pkg-config sphinx ];
-
-  propagatedBuildInputs = [
-    libdeflate
-    libjpeg
-    xz
-    zlib
-  ];
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-
-  meta = with lib; {
-    description = "Library and utilities for working with the TIFF image file format";
-    homepage = "https://libtiff.gitlab.io/libtiff";
-    changelog = "https://libtiff.gitlab.io/libtiff/v${version}.html";
-    # XXX not enabled for now to keep hydra builds running,
-    # but we have to keep an eye on security updates in supported version
-    #knownVulnerabilities = [ "support for version 4.5 ended in Sept 2023" ];
-    maintainers = with maintainers; [ yarny ];
-    license = licenses.libtiff;
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 04b67ff83bdeb..c8871a4ba68e8 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -28,9 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libtiff";
   version = "4.6.0";
 
-  # if you update this, please consider adding patches and/or
-  # setting `knownVulnerabilities` in libtiff `4.5.nix`
-
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";
@@ -93,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "Library and utilities for working with the TIFF image file format";
     homepage = "https://libtiff.gitlab.io/libtiff";
-    changelog = "https://libtiff.gitlab.io/libtiff/v${finalAttrs.version}.html";
+    changelog = "https://libtiff.gitlab.io/libtiff/releases/v${finalAttrs.version}.html";
     license = licenses.libtiff;
     platforms = platforms.unix ++ platforms.windows;
     pkgConfigModules = [ "libtiff-4" ];
diff --git a/pkgs/development/libraries/libtiff/headers-4.5.patch b/pkgs/development/libraries/libtiff/headers-4.5.patch
deleted file mode 100644
index 49af1abb0a54a..0000000000000
--- a/pkgs/development/libraries/libtiff/headers-4.5.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-export private headers for freeimage
---- i/libtiff/Makefile.am
-+++ w/libtiff/Makefile.am
-@@ -36,8 +36,12 @@ EXTRA_DIST = \
- 	tiffconf.h.cmake.in
-
- libtiffinclude_HEADERS = \
-+	tif_config.h \
-+	tif_dir.h \
-+	tif_hash_set.h \
- 	tiff.h \
- 	tiffio.h \
-+	tiffiop.h \
- 	tiffvers.h
-
- if HAVE_CXX
diff --git a/pkgs/development/libraries/libtiff/libtiff_t.nix b/pkgs/development/libraries/libtiff/libtiff_t.nix
new file mode 100644
index 0000000000000..37e48f6ea14f4
--- /dev/null
+++ b/pkgs/development/libraries/libtiff/libtiff_t.nix
@@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, fetchzip
+
+, autoreconfHook
+, pkg-config
+, sphinx
+
+, libdeflate
+, libjpeg
+, xz
+, zlib
+}:
+
+# This is a fork created by the hylafaxplus developer to
+# restore tools dropped by original libtiff in version 4.6.0.
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libtiff_t";
+  version = "4.6.0t";
+
+  src = fetchzip {
+    url = "http://www.libtiff.org/downloads/tiff-${finalAttrs.version}.tar.xz";
+    hash = "sha256-9ov4w2jw4LtKr82/4jWMAGhc5GEdviJ7bT+y0+U/Ac4=";
+  };
+
+  patches = [
+    # FreeImage needs this patch
+    ./headers.patch
+    # libc++abi 11 has an `#include <version>`, this picks up files name
+    # `version` in the project's include paths
+    ./rename-version.patch
+  ];
+
+  postPatch = ''
+    mv VERSION VERSION.txt
+  '';
+
+  outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
+
+  postFixup = ''
+    moveToOutput include/tif_config.h $dev_private
+    moveToOutput include/tif_dir.h $dev_private
+    moveToOutput include/tif_hash_set.h $dev_private
+    moveToOutput include/tiffiop.h $dev_private
+  '';
+
+  # If you want to change to a different build system, please make
+  # sure cross-compilation works first!
+  nativeBuildInputs = [ autoreconfHook pkg-config sphinx ];
+
+  # TODO: opengl support (bogus configure detection)
+  propagatedBuildInputs = [
+    libdeflate
+    libjpeg
+    xz
+    zlib
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Library and utilities for working with the TIFF image file format (fork containing tools dropped in original libtiff version)";
+    homepage = "http://www.libtiff.org";
+    changelog = "http://www.libtiff.org/releases/v${finalAttrs.version}.html";
+    maintainers = with maintainers; [ yarny ];
+    license = licenses.libtiff;
+    platforms = platforms.unix ++ platforms.windows;
+    pkgConfigModules = [ "libtiff-4" ];
+  };
+})
diff --git a/pkgs/development/libraries/libtiff/rename-version-4.5.patch b/pkgs/development/libraries/libtiff/rename-version-4.5.patch
deleted file mode 100644
index 3e93569d4245a..0000000000000
--- a/pkgs/development/libraries/libtiff/rename-version-4.5.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-fix case-insensitive build
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -34,7 +34,7 @@ docfiles = \
- 	README.md \
- 	RELEASE-DATE \
- 	TODO \
--	VERSION
-+	VERSION.txt
-
- EXTRA_DIST = \
- 	cmake \
-@@ -61,7 +61,7 @@ SUBDIRS = port libtiff tools build contrib test doc
-
- release:
-	(rm -f $(top_srcdir)/RELEASE-DATE && echo $(LIBTIFF_RELEASE_DATE) > $(top_srcdir)/RELEASE-DATE)
--	(rm -f $(top_srcdir)/VERSION && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION)
-+	(rm -f $(top_srcdir)/VERSION.txt && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION.txt)
-	(rm -f $(top_srcdir)/libtiff/tiffvers.h && sed 's,LIBTIFF_VERSION,$(LIBTIFF_VERSION),;s,LIBTIFF_RELEASE_DATE,$(LIBTIFF_RELEASE_DATE),;s,LIBTIFF_MAJOR_VERSION,$(LIBTIFF_MAJOR_VERSION),;s,LIBTIFF_MINOR_VERSION,$(LIBTIFF_MINOR_VERSION),;s,LIBTIFF_MICRO_VERSION,$(LIBTIFF_MICRO_VERSION),' $(top_srcdir)/libtiff/tiffvers.h.in > $(top_srcdir)/libtiff/tiffvers.h)
-
- pkgconfigdir = $(libdir)/pkgconfig
diff --git a/pkgs/development/libraries/libucl/default.nix b/pkgs/development/libraries/libucl/default.nix
index 77f8f6bfb920a..6275a85e6ee2e 100644
--- a/pkgs/development/libraries/libucl/default.nix
+++ b/pkgs/development/libraries/libucl/default.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libucl";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "vstakhov";
     repo = pname;
     rev = version;
-    sha256 = "sha256-udgsgo6bT7WnUYnAzqHxOtdDg6av3XplptS8H5ukxjo=";
+    sha256 = "sha256-esNEVBa660rl3Oo2SLaLrFThFkjbqtZ1r0tjMq3h6cM=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
diff --git a/pkgs/development/libraries/libzim/default.nix b/pkgs/development/libraries/libzim/default.nix
index 50cb0847089be..80d3db6d2e322 100644
--- a/pkgs/development/libraries/libzim/default.nix
+++ b/pkgs/development/libraries/libzim/default.nix
@@ -1,25 +1,26 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, icu
-, meson
-, ninja
-, pkg-config
-, python3
-, xapian
-, xz
-, zstd
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  icu,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  xapian,
+  xz,
+  zstd,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libzim";
-  version = "9.1.0";
+  version = "9.2.0";
 
   src = fetchFromGitHub {
     owner = "openzim";
-    repo = pname;
+    repo = "libzim";
     rev = "refs/tags/${version}";
-    hash = "sha256-yWnW/+CaQwbemrNLzvQpXw5yvW2Q6LtwDgvA58+fVUs=";
+    hash = "sha256-WAbNSrgm/lTARD7Ml4vVLChQLNR23vEZtyE4MXnhnB4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/pipewire/wireplumber.nix b/pkgs/development/libraries/pipewire/wireplumber.nix
index dc0236a378afb..2e2ef053a1198 100644
--- a/pkgs/development/libraries/pipewire/wireplumber.nix
+++ b/pkgs/development/libraries/pipewire/wireplumber.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation rec {
   pname = "wireplumber";
-  version = "0.5.1";
+  version = "0.5.2";
 
   outputs = [ "out" "dev" ] ++ lib.optional enableDocs "doc";
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     owner = "pipewire";
     repo = "wireplumber";
     rev = version;
-    hash = "sha256-l5s7GTKpqGvRs1o14QNXq3kyQsoPwwUmd0TKlBKTAKE=";
+    hash = "sha256-SXLHQbjh4IygV+925fsPXgj7DFIPQj48oLNKWkUhuK8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/python-qt/default.nix b/pkgs/development/libraries/python-qt/default.nix
index d238b8137d337..16c2124cf0831 100644
--- a/pkgs/development/libraries/python-qt/default.nix
+++ b/pkgs/development/libraries/python-qt/default.nix
@@ -1,39 +1,42 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, python, qmake,
-  qtwebengine, qtxmlpatterns,
-  qttools, unzip }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  python3,
+  qmake,
+  qtwebengine,
+  qtxmlpatterns,
+  qttools,
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "python-qt";
-  version = "3.4.2";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "MeVisLab";
     repo = "pythonqt";
-    rev = "v${version}";
-    hash = "sha256-xJYOD07ACOKtY3psmfHNSCjm6t0fr8JU9CrL0w5P5G0=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-IED6UFk8UTle7g/yPC0nXOEgJwrs6sB/Dk3OTyVgHPo=";
   };
 
-  # https://github.com/CsoundQt/CsoundQt/blob/develop/BUILDING.md#pythonqt
-  postPatch = ''
-    substituteInPlace build/python.prf \
-      --replace "PYTHON_VERSION=2.7" "PYTHON_VERSION=${python.pythonVersion}"
-  '';
-
-  hardeningDisable = [ "all" ];
-
-  nativeBuildInputs = [ qmake qtwebengine qtxmlpatterns qttools unzip ];
+  nativeBuildInputs = [
+    qmake
+    qttools
+    qtxmlpatterns
+    qtwebengine
+  ];
 
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
 
   qmakeFlags = [
-    "PythonQt.pro"
-    "PYTHON_DIR=${python}"
+    "PYTHON_DIR=${python3}"
+    "PYTHON_VERSION=3.${python3.sourceVersion.minor}"
   ];
 
   dontWrapQtApps = true;
 
-  unpackCmd = "unzip $src";
-
   installPhase = ''
     mkdir -p $out/include/PythonQt
     cp -r ./lib $out
@@ -42,6 +45,15 @@ stdenv.mkDerivation rec {
     cp -r ./extensions $out/include/PythonQt
   '';
 
+  preFixup = lib.optionalString stdenv.isDarwin ''
+    install_name_tool -id \
+      $out/lib/libPythonQt-Qt5-Python3.${python3.sourceVersion.minor}.dylib \
+      $out/lib/libPythonQt-Qt5-Python3.${python3.sourceVersion.minor}.dylib
+    install_name_tool -id \
+      $out/lib/libPythonQt_QtAll-Qt5-Python3.${python3.sourceVersion.minor}.dylib \
+      $out/lib/libPythonQt_QtAll-Qt5-Python3.${python3.sourceVersion.minor}.dylib
+  '';
+
   meta = with lib; {
     description = "PythonQt is a dynamic Python binding for the Qt framework. It offers an easy way to embed the Python scripting language into your C++ Qt applications";
     homepage = "https://pythonqt.sourceforge.net/";
@@ -49,4 +61,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ hlolli ];
   };
-}
+})
diff --git a/pkgs/development/libraries/structuresynth/default.nix b/pkgs/development/libraries/structuresynth/default.nix
new file mode 100644
index 0000000000000..362aaa7e25c95
--- /dev/null
+++ b/pkgs/development/libraries/structuresynth/default.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  qtbase,
+  wrapQtAppsHook,
+  libGL,
+  libGLU,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "structuresynth";
+  version = "1.5.1";
+
+  src = fetchFromGitHub {
+    owner = "alemuntoni";
+    repo = "structuresynth";
+    rev = finalAttrs.version;
+    hash = "sha256-uFz4WPwA586B/5p+DUJ/W8KzbHLBhLIwP6mySZJ1vPY=";
+  };
+
+  patches = [
+    # This PR in 2 commits allow packaging of this project as standalone.
+    # It was merged upstream, so those 2 patches can be removed on next release.
+    (fetchpatch {
+      name = "shared-lib.patch";
+      url = "https://github.com/alemuntoni/StructureSynth/pull/1/commits/fdb87c55a03c6a0faa4335de5d29f0fb547b6102.patch";
+      hash = "sha256-/66x8HGyNhGwoxsbV+QIRFYQNuFSHYXNYkJzAn4jyJI=";
+    })
+    (fetchpatch {
+      name = "install-project.patch";
+      url = "https://github.com/alemuntoni/StructureSynth/pull/1/commits/f96a90f6a4c60e9e0316edd20ea77674a2b764a7.patch";
+      hash = "sha256-cSZAL1N2/Gd0x+9UkTUQxqVlb2m2MM8AA1Zzlo6S35w=";
+    })
+  ];
+
+  outputs = [
+    "dev"
+    "out"
+  ];
+
+  buildInputs = [
+    libGL
+    libGLU
+    qtbase
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];
+
+  meta = with lib; {
+    description = "Generate 3D structures by specifying a design grammar";
+    homepage = "https://github.com/alemuntoni/StructureSynth";
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 37cc66834462b..0eb3bda4286da 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -113,7 +113,7 @@ stdenv.mkDerivation rec {
         --replace 'current_toolchain == host_toolchain || !use_xcode_clang' \
                   'false'
     ''}
-    ${lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    ${lib.optionalString stdenv.isDarwin ''
       substituteInPlace build/config/compiler/BUILD.gn \
         --replace "-Wl,-fatal_warnings" ""
     ''}
@@ -143,7 +143,11 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional stdenv.cc.isClang ''clang_base_path="${llvmCcAndBintools}"''
   ++ lib.optional stdenv.isDarwin ''use_lld=false'';
 
-  env.NIX_CFLAGS_COMPILE = "-O2";
+  env.NIX_CFLAGS_COMPILE = toString ([
+    "-O2"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error=enum-constexpr-conversion"
+  ]);
   FORCE_MAC_SDK_MIN = stdenv.hostPlatform.sdkVer or "10.12";
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/xdg-desktop-portal/default.nix b/pkgs/development/libraries/xdg-desktop-portal/default.nix
index 561342a7b052e..626c40f3bb336 100644
--- a/pkgs/development/libraries/xdg-desktop-portal/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal/default.nix
@@ -31,7 +31,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xdg-desktop-portal";
-  version = "1.18.3";
+  version = "1.18.4";
 
   outputs = [ "out" "installedTests" ];
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "flatpak";
     repo = "xdg-desktop-portal";
     rev = finalAttrs.version;
-    hash = "sha256-VqIQLUAf/n5m1tHCvnlxi0eaLOuG1R44tMFI/Hc992A=";
+    hash = "sha256-o+aO7uGewDPrtgOgmp/CE2uiqiBLyo07pVCFrtlORFQ=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/zziplib/default.nix b/pkgs/development/libraries/zziplib/default.nix
index e90df0888a0db..c40cf9594cfa9 100644
--- a/pkgs/development/libraries/zziplib/default.nix
+++ b/pkgs/development/libraries/zziplib/default.nix
@@ -13,36 +13,15 @@
 
 stdenv.mkDerivation rec {
   pname = "zziplib";
-  version = "0.13.72";
+  version = "0.13.74";
 
   src = fetchFromGitHub {
     owner = "gdraheim";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Ht3fBgdrTm4mCi5uhgQPNtpGzADoRVOpSuGPsIS6y0Q=";
+    hash = "sha256-MjqGHzb+dsAq2PrcBhU3sv4eMX3afkgFWUbhDp+5o/s=";
   };
 
-  patches = [
-    # apply https://github.com/gdraheim/zziplib/pull/113
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/82a7773cd17828a3b0a4f5f552ae80c1cc8777c7.diff";
-      sha256 = "0ifqdzxwb5d19mziy9j6lhl8wj95jpxzm0d2c6y3bgwa931avd3y";
-    })
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/1cd611514c5f9559eb9dfc191d678dfc991f66db.diff";
-      sha256 = "11w9qa46xq49l113k266dnv8izzdk1fq4y54yy5w8zps8zd3xfny";
-    })
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/e47b1e1da952a92f917db6fb19485b8a0b1a42f3.diff";
-      sha256 = "0d032hkmi3s3db12z2zbppl2swa3gdpbj0c6w13ylv2g2ixglrwg";
-    })
-    # Fixes invalid pointer conversions that cause compilation to fail with clang 15+
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/38e4d5f561318fa825e6544c2ef55ac5899c81b0.diff";
-      sha256 = "sha256-VJuFyiPhuAZlDxmNHBty+JbYwG85ea5u2sv7HZRHMwo=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     perl
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 31ff2e6e3c580..45cd51b717538 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -480,6 +480,16 @@ in
     };
   });
 
+  haskell-tools-nvim  = prev.haskell-tools-nvim.overrideAttrs(oa: {
+    doCheck = lua.luaversion == "5.1";
+    nativeCheckInputs = [ final.nlua final.busted ];
+    checkPhase = ''
+      runHook preCheck
+      export HOME=$(mktemp -d)
+      busted --lua=nlua
+      runHook postCheck
+      '';
+  });
 
   plenary-nvim = prev.plenary-nvim.overrideAttrs (oa: {
     postPatch = ''
@@ -585,6 +595,15 @@ in
     };
   });
 
+  nlua = prev.nlua.overrideAttrs(oa: {
+
+    # patchShebang removes the nvim in nlua's shebang so we hardcode one
+    postFixup = ''
+      sed -i -e "1 s|.*|#\!${coreutils}/bin/env -S ${neovim-unwrapped}/bin/nvim -l|" "$out/bin/nlua"
+      '';
+    dontPatchShebangs = true;
+  });
+
   rapidjson = prev.rapidjson.overrideAttrs (oa: {
     preBuild = ''
       sed -i '/set(CMAKE_CXX_FLAGS/d' CMakeLists.txt
diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
index 97e899731e34b..9129ad98ae6ae 100644
--- a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -14,13 +14,13 @@
 
 buildDunePackage rec {
   pname = "ca-certs-nss";
-  version = "3.92";
+  version = "3.98";
 
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-${version}.tbz";
-    hash = "sha256-F6eF5jQO9qJACQldad8va5jXPj05o61L8Bp1SDXHBTg=";
+    hash = "sha256-N1/cz8e3KB3pBd5+ZV/JbuW6FaaVijNhok7QyMB7ppc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/janestreet/old.nix b/pkgs/development/ocaml-modules/janestreet/old.nix
deleted file mode 100644
index 8b4a6ed529624..0000000000000
--- a/pkgs/development/ocaml-modules/janestreet/old.nix
+++ /dev/null
@@ -1,639 +0,0 @@
-{ self
-, super
-, lib
-, stdenv
-, openssl
-}:
-
-let
-  inherit (super)
-    janePackage
-    ocaml
-    ocamlbuild
-    cryptokit
-    ctypes
-    magic-mime
-    ocaml-migrate-parsetree
-    octavius
-    ounit
-    ppx_deriving
-    re
-    zarith
-    num
-    ;
-
-in
-
-with self;
-
-{
-
-  # Jane Street packages, up to ppx_core
-
-  sexplib = janePackage {
-    pname = "sexplib";
-    meta.description = "Automated S-expression conversion";
-    version = "0.10.0";
-    hash = "1agw649n0rnf6h4y2dr1zs1970nncxgjmf90848vbxv8y9im4yy2";
-    buildInputs = [ num ];
-  };
-
-  base = janePackage {
-    pname = "base";
-    version = "0.9.4";
-    hash = "0x85xi66b4zwlbdwmyc99zcmawgpp75gxqbl55rr67awavw162rw";
-    propagatedBuildInputs = [ sexplib ];
-    meta.description = "Full standard library replacement for OCaml";
-  };
-
-  ocaml-compiler-libs = janePackage {
-    pname = "ocaml-compiler-libs";
-    hash = "1jz3nfrb6295sj4xj1j0zld8mhfj0xy2k4vlp9yf9sh3748n090l";
-    meta.description = "OCaml compiler libraries repackaged";
-  };
-
-  ppx_ast = janePackage ({
-    pname = "ppx_ast";
-    propagatedBuildInputs = [ ocaml-compiler-libs ocaml-migrate-parsetree ];
-    meta.description = "OCaml AST used by Jane Street ppx rewriters";
-  } // (if lib.versionAtLeast ocaml.version "4.06"
-    then {
-      version = "0.9.2";
-      hash = "1h4qf26rg23z21rrw83fakiavw9km7174p3830pg0gg4bwakvba0";
-    } else {
-      version = "0.9.1";
-      hash = "0a9rxwavy2748k0yd4db3hg1ypq7mpqnwq9si5a5qdiclgkhcggw";
-    }
-  ));
-
-  ppx_traverse_builtins = janePackage {
-    pname = "ppx_traverse_builtins";
-    hash = "10ajvz02ka6qimlfrq7py4ljhk8awqkga6240kn8j046b4xfyxzi";
-    meta.description = "Builtins for Ppx_traverse";
-  };
-
-  stdio = janePackage {
-    pname = "stdio";
-    version = "0.9.1";
-    hash = "13rj3ii0rvmklfim9ild0ib44ssdadig7a9ccjbz22m0pw84a1sx";
-    propagatedBuildInputs = [ base ];
-    meta.description = "Standard IO library for OCaml";
-  };
-
-  ppx_core = janePackage {
-    pname = "ppx_core";
-    hash = "15400zxxkqdimmjpdjcs36gcbxbrhylmaczlzwd6x65v1h9aydz3";
-    propagatedBuildInputs = [ ppx_ast ppx_traverse_builtins stdio ];
-    meta.description = "Jane Street's standard library for ppx rewriters";
-  };
-
-  # Jane Street packages, up to ppx_base
-
-  ppx_optcomp = janePackage {
-    pname = "ppx_optcomp";
-    hash = "1wfj6fnh92s81yncq7yyhmax7j6zpjj1sg1f3qa1f9c5kf4kkzrd";
-    propagatedBuildInputs = [ ppx_core ];
-    meta.description = "Optional compilation for OCaml";
-  };
-
-  ppx_driver = janePackage {
-    pname = "ppx_driver";
-    version = "0.9.1";
-    hash = "1amz49x6v4sh1v2my6618cah0zv5i7jmsapbk9ydps6419g5asay";
-    buildInputs = [ ocamlbuild ];
-    propagatedBuildInputs = [ ppx_optcomp ];
-    meta.description = "Feature-full driver for OCaml AST transformers";
-  };
-
-  ppx_metaquot = janePackage {
-    pname = "ppx_metaquot";
-    hash = "15qfd3s4x2pz006nx5316laxd3gqqi472x432qg4rfx4yh3vn31k";
-    propagatedBuildInputs = [ ppx_driver ];
-    meta.description = "Metaquotations for ppx_ast";
-  };
-
-  ppx_type_conv = janePackage {
-    pname = "ppx_type_conv";
-    hash = "0a0gxjvjiql9vg37k0akn8xr5724nv3xb7v37xpidv7ld927ks7p";
-    propagatedBuildInputs = [ ppx_metaquot ppx_deriving ];
-    meta.description = "Support Library for type-driven code generators";
-  };
-
-  ppx_sexp_conv = janePackage {
-    pname = "ppx_sexp_conv";
-    hash = "03cg2sym0wvpd5l7q4w9bclp589z5byygwsmnnq9h1ih56cmd55l";
-    propagatedBuildInputs = [ ppx_type_conv sexplib ];
-    meta.description = "Generation of S-expression conversion functions from type definitions";
-  };
-
-  ppx_compare = janePackage {
-    pname = "ppx_compare";
-    hash = "0wrszpvn1nms5sb5rb29p7z1wmqyd15gfzdj4ax8f843p5ywx3w9";
-    propagatedBuildInputs = [ ppx_type_conv ];
-    meta.description = "Generation of comparison functions from types";
-  };
-
-  ppx_enumerate = janePackage {
-    pname = "ppx_enumerate";
-    hash = "1dfy86j2z12p5n9yrwaakx1ngphs5246vxy279kz6i6j34cwxm46";
-    propagatedBuildInputs = [ ppx_type_conv ];
-    meta.description = "Generate a list containing all values of a finite type";
-  };
-
-  ppx_hash = janePackage {
-    pname = "ppx_hash";
-    hash = "1w1riy2sqd9i611sc5f5z2rqqgjl2gvvkzi5xibpv309nacnl01d";
-    propagatedBuildInputs = [ ppx_compare ppx_sexp_conv ];
-    meta.description = "A ppx rewriter that generates hash functions from type expressions and definitions";
-  };
-
-  ppx_js_style = janePackage {
-    pname = "ppx_js_style";
-    hash = "09k02b1l2r7svf9l3ls69h8xydsyiang2ziigxnny2i7gy7b0w59";
-    propagatedBuildInputs = [ ppx_metaquot octavius ];
-    meta.description = "Code style checker for Jane Street Packages";
-  };
-
-  ppx_base = janePackage {
-    pname = "ppx_base";
-    hash = "0qikfzbkd2wyxfrvizz6rgi6vg4ykvxkivacj4gr178dbgfl5if3";
-    propagatedBuildInputs = [ ppx_enumerate ppx_hash ppx_js_style ];
-    meta.description = "Base set of ppx rewriters";
-  };
-
-  # Jane Street packages, up to ppx_bin_prot
-
-  fieldslib = janePackage {
-    pname = "fieldslib";
-    hash = "1wxh59888l1bfz9ipnbcas58gwg744icaixzdbsg4v8f7wymc501";
-    propagatedBuildInputs = [ ppx_driver ];
-    meta.description = "OCaml record fields as first class values";
-  };
-
-  variantslib = janePackage {
-    pname = "variantslib";
-    hash = "0kj53n62193j58q9vip8lfhhyf6w9d25wyvxzc163hx5m68yw0fz";
-    propagatedBuildInputs = [ ppx_driver ];
-    meta.description = "OCaml variants as first class values";
-  };
-
-  ppx_traverse = janePackage {
-    pname = "ppx_traverse";
-    hash = "1sdqgwyq0w71i03vhc5jq4jk6rsbgwhvain48fnrllpkb5kj2la2";
-    propagatedBuildInputs = [ ppx_type_conv ];
-    meta.description = "Automatic generation of open recursion classes";
-  };
-
-  ppx_custom_printf = janePackage {
-    pname = "ppx_custom_printf";
-    hash = "0cjy2c2c5g3qxqvwx1yb6p7kbmmpnpb1hll55f7a44x215lg8x19";
-    propagatedBuildInputs = [ ppx_sexp_conv ppx_traverse ];
-    meta.description = "Printf-style format-strings for user-defined string conversion";
-  };
-
-  ppx_fields_conv = janePackage {
-    pname = "ppx_fields_conv";
-    hash = "0qp8zgmk58iskzrkf4g06i471kg6lrh3wqpy9klrb8pp9mg0xr9z";
-    propagatedBuildInputs = [ fieldslib ppx_type_conv ];
-    meta.description = "Generation of accessor and iteration functions for OCaml records";
-  };
-
-  ppx_variants_conv = janePackage {
-    pname = "ppx_variants_conv";
-    hash = "1xayhyglgbdjqvb9123kjbwjcv0a3n3302nb0j7g8gmja8w5y834";
-    propagatedBuildInputs = [ ppx_type_conv variantslib ];
-    meta.description = "Generation of accessor and iteration functions for OCaml variant types";
-  };
-
-  bin_prot = janePackage {
-    pname = "bin_prot";
-    version = "0.9.1";
-    hash = "1bgcmkgz6b5i522996x589zsaiy5b3h37887lwbqvpps8by2ayvk";
-    propagatedBuildInputs = [ ppx_compare ppx_custom_printf ppx_fields_conv ppx_variants_conv ];
-    meta.description = "Binary protocol generator";
-  };
-
-  ppx_here = janePackage {
-    pname = "ppx_here";
-    hash = "0pjscw5ydxgy4fcxakgsazpp09ka057w5n2fp2dpkv2k5gil6rzh";
-    propagatedBuildInputs = [ ppx_driver ];
-    meta.description = "Expands [%here] into its location";
-  };
-
-  ppx_bin_prot = janePackage {
-    pname = "ppx_bin_prot";
-    hash = "0qw9zqrc5yngzrzpk9awnlnd68xrb7wz5lq807c80ibxk0xvnqn3";
-    propagatedBuildInputs = [ ppx_here bin_prot ];
-    meta.description = "Generation of bin_prot readers and writers from types";
-  };
-
-  # Jane Street packages, up to ppx_jane
-
-  ppx_assert = janePackage {
-    pname = "ppx_assert";
-    hash = "1s5c75wkc46nlcwmgic5h7f439s26ssrzrcil501c5kpib2hlv6z";
-    propagatedBuildInputs = [ ppx_sexp_conv ppx_here ppx_compare ];
-    meta.description = "Assert-like extension nodes that raise useful errors on failure";
-  };
-
-  ppx_inline_test = janePackage {
-    pname = "ppx_inline_test";
-    version = "0.9.2";
-    hash = "17j36ihiqprbpa2bk02449k93vaidid2sly5djrk848ccjq8n5aa";
-    propagatedBuildInputs = [ ppx_metaquot ];
-    meta.description = "Syntax extension for writing in-line tests in OCaml code";
-  };
-
-  typerep = janePackage {
-    pname = "typerep";
-    hash = "0hlc0xiznli1k6azv2mhm1s4xghhxqqd957np7828bfp7r8n2jy3";
-    propagatedBuildInputs = [ base ];
-    meta.description = "Runtime types for OCaml";
-  };
-
-  ppx_bench = janePackage {
-    pname = "ppx_bench";
-    hash = "1qk4y6c2mpw7bqjppi2nam74vs2sc89wzq162j92wsqxyqsv4p93";
-    propagatedBuildInputs = [ ppx_inline_test ];
-    meta.description = "Syntax extension for writing in-line benchmarks in OCaml code";
-  };
-
-  ppx_expect = janePackage {
-    pname = "ppx_expect";
-    hash = "1bik53k51wcqv088f0h10n3ms9h51yvg6ha3g1s903i2bxr3xs6b";
-    propagatedBuildInputs = [ ppx_inline_test ppx_fields_conv ppx_custom_printf ppx_assert ppx_variants_conv re ];
-    meta.description = "Cram like framework for OCaml";
-  };
-
-  ppx_fail = janePackage {
-    pname = "ppx_fail";
-    hash = "0qz0vlazasjyg7cv3iwpzxlvsah3zmn9dzd029xxqr1bji067s32";
-    propagatedBuildInputs = [ ppx_here ppx_metaquot ];
-    meta.description = "Add location to calls to failwiths";
-  };
-
-  ppx_let = janePackage {
-    pname = "ppx_let";
-    hash = "1b914a5nynwxjvfx42v61yigvjhnd548m4yqjfchf38dmqi1f4nr";
-    propagatedBuildInputs = [ ppx_driver ];
-    meta.description = "Monadic let-bindings";
-  };
-
-  ppx_optional = janePackage {
-    pname = "ppx_optional";
-    hash = "1vknsarxba0zcp5k2jb31wfpvqrv3bpanxbahfl5s2fwspsfdc82";
-    propagatedBuildInputs = [ ppx_metaquot ];
-    meta.description = "Pattern matching on flat options";
-  };
-
-  ppx_pipebang = janePackage {
-    pname = "ppx_pipebang";
-    hash = "1wyfyyjvyi94ds1p90l60wdr85q2v3fq1qdf3gnv9zjfy6sb0g9h";
-    propagatedBuildInputs = [ ppx_metaquot ];
-    meta.description = "A ppx rewriter that inlines reverse application operators |> and |!";
-  };
-
-  ppx_sexp_message = janePackage {
-    pname = "ppx_sexp_message";
-    hash = "0r0skyr1zf2jh48xrxbs45gzywynhlivkq24xwc0qq435fmc2jqv";
-    propagatedBuildInputs = [ ppx_sexp_conv ppx_here ];
-    meta.description = "A ppx rewriter for easy construction of s-expressions";
-  };
-
-  ppx_sexp_value = janePackage {
-    pname = "ppx_sexp_value";
-    hash = "0hha5mmx700m8fy9g4znb8278l09chgwlpshny83vsmmzgq2jhah";
-    propagatedBuildInputs = [ ppx_sexp_conv ppx_here ];
-    meta.description = "A ppx rewriter that simplifies building s-expressions from OCaml values";
-  };
-
-  ppx_typerep_conv = janePackage {
-    pname = "ppx_typerep_conv";
-    hash = "0bzgfpbqijwxm8x9jq1zb4xi5sbzymk17lw5rylri3hf84p60aq1";
-    propagatedBuildInputs = [ ppx_type_conv typerep ];
-    meta.description = "Generation of runtime types from type declarations";
-  };
-
-  ppx_jane = janePackage {
-    pname = "ppx_jane";
-    hash = "16m5iw0qyp452nqj83kd0g0x3rw40lrz7392hwpd4di1wi6v2qzc";
-    propagatedBuildInputs = [ ppx_base ppx_bench ppx_bin_prot ppx_expect ppx_fail ppx_let ppx_optional ppx_pipebang ppx_sexp_message ppx_sexp_value ppx_typerep_conv ];
-    meta.description = "Standard Jane Street ppx rewriters";
-  };
-
-  # Jane Street packages, up to core
-
-  configurator = janePackage {
-    pname = "configurator";
-    version = "0.9.1";
-    hash = "1q0s0ghcrcrxdj6zr9zr27g7sr4qr9l14kizjphwqwwvgbzawdix";
-    propagatedBuildInputs = [ ppx_base ];
-    meta.description = "Helper library for gathering system configuration";
-  };
-
-  jane-street-headers = janePackage {
-    pname = "jane-street-headers";
-    hash = "0cdab6sblsidjbwvyvmspykyhqh44rpsjzi2djbfd5m4vh2h14gy";
-    meta.description = "Jane Street header files";
-  };
-
-  core_kernel = janePackage {
-    pname = "core_kernel";
-    hash = "05iwvggx9m81x7ijgv9gcv5znf5rmsmb76dg909bm9gkr3hbh7wh";
-    propagatedBuildInputs = [ configurator jane-street-headers ppx_jane ];
-    meta.description = "Jane Street's standard library overlay (kernel)";
-  };
-
-  spawn = janePackage {
-    pname = "spawn";
-    hash = "1w53b8ni06ajj62yaqjy0pkbm952l0m5fzr088yk15078qaxsnb5";
-    meta.description = "Spawning sub-processes";
-  };
-
-  core = janePackage {
-    pname = "core";
-    version = "0.9.1";
-    hash = "1643r0namsgj8xwfr9niimcdwyyq4ddiwd02d73ipb4a8710aqi8";
-    propagatedBuildInputs = [ core_kernel spawn ];
-    meta.description = "Jane Street's standard library overlay";
-  };
-
-  # Jane Street packages, up to core_extended
-
-  re2 = janePackage {
-    pname = "re2";
-    hash = "1qmhl3yd6y0lq401rz72b1bsbpglb0wighpxn3x8y1ixq415p4xi";
-    propagatedBuildInputs = [ core_kernel ];
-    meta = {
-      description = "OCaml bindings for RE2";
-      broken = stdenv.isDarwin;
-    };
-  };
-
-  textutils = janePackage {
-    pname = "textutils";
-    hash = "1y6j2qw7rc8d80343lfv1dygnfrhn2qllz57mx28pl5kan743f6d";
-    propagatedBuildInputs = [ core ];
-    meta.description = "Text output utilities";
-  };
-
-  core_extended = janePackage {
-    pname = "core_extended";
-    hash = "05cnzzj0kigz9c9gsmd6mfar82wmkbqm9qzrydb80sy2fz5b30rk";
-    propagatedBuildInputs = [ core re2 textutils ];
-    postPatch = ''
-      patchShebangs src/discover.sh
-    '';
-    meta = {
-      description = "Jane Street Capital's standard library overlay";
-    };
-  };
-
-  # Jane Street async packages
-
-  async_kernel = janePackage {
-    pname = "async_kernel";
-    hash = "1zwxhzy7f9900rcjls2fql9cpfmwrcah3fazzdz4h2i51f41w62x";
-    propagatedBuildInputs = [ core_kernel ];
-    meta.description = "Jane Street Capital's asynchronous execution library (core)";
-  };
-
-  async_rpc_kernel = janePackage {
-    pname = "async_rpc_kernel";
-    hash = "1xk3s6s3xkj182p10kig2cqy8md6znif3v661h9cd02n8s57c40b";
-    propagatedBuildInputs = [ core_kernel async_kernel ];
-    meta.description = "Platform-independent core of Async RPC library";
-  };
-
-  async_unix = janePackage {
-    pname = "async_unix";
-    hash = "0yd4z28j5vdj2zxqi0fkgh2ic1s9h740is2dk0raga0zr5a1z03d";
-    propagatedBuildInputs = [ core async_kernel ];
-    meta.description = "Jane Street Capital's asynchronous execution library (unix)";
-  };
-
-  async_extra = janePackage {
-    pname = "async_extra";
-    hash = "0rpy5lc5dh5mir7flq1jrppd8imby8wyw191yg4nmklg28xp5sx0";
-    propagatedBuildInputs = [ async_rpc_kernel async_unix ];
-    meta.description = "Jane Street's asynchronous execution library (extra)";
-  };
-
-  async = janePackage {
-    pname = "async";
-    hash = "10ykzym19srgdiikj0s74dndx5nk15hjq1r2hc61iz48f6caxkb1";
-    propagatedBuildInputs = [ async_extra ];
-    meta.description = "Jane Street Capital's asynchronous execution library";
-  };
-
-  async_find = janePackage {
-    pname = "async_find";
-    hash = "11dmhdzgf5kn4m0cm6zr28wpwhi2kr4lak9nmgxbrxsq28bcncxq";
-    propagatedBuildInputs = [ async ];
-    meta.description = "Directory traversal with Async";
-  };
-
-  async_interactive = janePackage {
-    pname = "async_interactive";
-    hash = "1mmqqp6bi2wg7bmgf0sw34jn3iyl5kbm200dax8yqq6rfprcs49j";
-    propagatedBuildInputs = [ async ];
-    meta.description = "Utilities for building simple command-line based user interfaces";
-  };
-
-  async_parallel = janePackage {
-    pname = "async_parallel";
-    hash = "0mdprhr1pv4g65g10gr3gaifrzknsdgarwfdbjlvhzfs86075kyn";
-    propagatedBuildInputs = [ async ];
-    meta.description = "Distributed computing library";
-  };
-
-  async_shell = janePackage {
-    pname = "async_shell";
-    hash = "02clpz3xv3i5avzifwalylb9gfxzpgnr8bnlfsjixxfk2m7kvsj2";
-    propagatedBuildInputs = [ core_extended async ];
-    meta = {
-      description = "Shell helpers for Async";
-    };
-  };
-
-  async_ssl = janePackage {
-    pname = "async_ssl";
-    hash = "01w3bg38q61lc3hfh8jsr0sy1ylyv0m6g6h9yvsk8ngj6qk70nss";
-    propagatedBuildInputs = [ async ctypes openssl ];
-    meta.description = "Async wrappers for SSL";
-  };
-
-  # Jane Street packages, up to expect_test_helpers
-
-  sexp_pretty = janePackage {
-    pname = "sexp_pretty";
-    hash = "1bx8va468j5b813m0vsh1jzgb6h2qnnjfmjlf2hb82sarv8lllfx";
-    propagatedBuildInputs = [ ppx_base re ];
-    meta.description = "S-expression pretty-printer";
-  };
-
-  expect_test_helpers_kernel = janePackage {
-    pname = "expect_test_helpers_kernel";
-    hash = "1ycqir8sqgq5nialnrfg29nqn0cqg6jjpgv24drdycdhqf5r2zg6";
-    propagatedBuildInputs = [ core_kernel sexp_pretty ];
-    meta.description = "Helpers for writing expectation tests";
-  };
-
-  expect_test_helpers = janePackage {
-    pname = "expect_test_helpers";
-    hash = "0rsh6rwbqfcrqisk8jp7srlnicsadbzrs02ri6zyx0p3lmznw5r2";
-    propagatedBuildInputs = [ async expect_test_helpers_kernel ];
-    meta.description = "Async helpers for writing expectation tests";
-  };
-
-  # Miscellaneous Jane Street packages
-
-  bignum = janePackage {
-    pname = "bignum";
-    hash = "0g80mzsi7vc1kq4mzha8y9nl95h6cd041vix3wjrqgkdvb1qd4f3";
-    propagatedBuildInputs = [ core_kernel zarith ];
-    meta.description = "Core-flavoured wrapper around zarith's arbitrary-precision rationals";
-  };
-
-  cinaps = janePackage {
-    pname = "cinaps";
-    hash = "02fpjiwrygkpx2q4jfldhbqh0mqxmf955wizr8k4vmsq4wsis0p5";
-    propagatedBuildInputs = [ re ];
-    meta.description = "Trivial Metaprogramming tool using the OCaml toplevel";
-  };
-
-  command_rpc = janePackage {
-    pname = "command_rpc";
-    hash = "0w58z9jkz5qzbvf33wrzhfshzdvnrphj6dq8dmi52ykhfvxm7824";
-    propagatedBuildInputs = [ async ];
-    meta.description = "Utilities for Versioned RPC communication with a child process over stdin and stdout";
-  };
-
-  core_bench = janePackage {
-    pname = "core_bench";
-    hash = "1m2q7217nmcsck29i59djkm0h6z3aj0i01niijzr5f6ilbnmyd3h";
-    propagatedBuildInputs = [ core_extended ];
-    meta = {
-      description = "Micro-benchmarking library for OCaml";
-    };
-  };
-
-  core_profiler = janePackage {
-    pname = "core_profiler";
-    hash = "1ir2v3wdfbf5xzqcma16asc73mkx2q6dzq5y1bx6q1rpa7iznx44";
-    propagatedBuildInputs = [ core_extended ];
-    meta = {
-      description = "Profiling library";
-    };
-  };
-
-  csvfields = janePackage {
-    pname = "csvfields";
-    hash = "0lbvs1kwl22ryxhw6s089f6683hj2920bn518mvr22rnv7qijy0v";
-    propagatedBuildInputs = [ core ];
-    meta.description = "Runtime support for ppx_xml_conv and ppx_csv_conv";
-  };
-
-  ecaml = janePackage {
-    pname = "ecaml";
-    hash = "1a2534bzbwgpm71aj3sm71sm0lkcjdfjj1mk91p1pg9kxn8c5x4i";
-    propagatedBuildInputs = [ async ];
-    meta.description = "Writing Emacs plugin in OCaml";
-  };
-
-  email_message = janePackage {
-    pname = "email_message";
-    hash = "0cpaf6wn5g883bxdz029bksvrfzih99m7hzbb30fhqglmpmmkniz";
-    propagatedBuildInputs = [ async core_extended cryptokit magic-mime ounit ];
-    meta = {
-      description = "E-mail message parser";
-    };
-  };
-
-  incremental_kernel = janePackage {
-    pname = "incremental_kernel";
-    hash = "0zq48wbgqcflh84n10iygi8aa3f0zzmgc7r0jwvsyg7i8zccgvf5";
-    propagatedBuildInputs = [ core_kernel ];
-    meta.description = "Library for incremental computations depending only on core_kernel";
-  };
-
-  incremental = janePackage {
-    pname = "incremental";
-    hash = "05sx8ia46v4dlvzcn7xgjcwxvbd0wmvv9r2bpvniapjnwr1nvcfh";
-    propagatedBuildInputs = [ core incremental_kernel ];
-    meta.description = "Library for incremental computations";
-  };
-
-  incr_map = janePackage {
-    pname = "incr_map";
-    hash = "0358qg9irxbbhn18laqww3mn43mdwvlbr0h2mvg3vdbb2c5jp4fv";
-    propagatedBuildInputs = [ incremental_kernel ];
-    meta.description = "Helpers for incremental operations on map like data structures";
-  };
-
-  ocaml_plugin = janePackage {
-    pname = "ocaml_plugin";
-    hash = "0q33swnlx9p1gcn1aj95501kapb7cnbzbsavid69csczwmzcxr14";
-    buildInputs = [ ocamlbuild ];
-    propagatedBuildInputs = [ async ];
-    meta.description = "Automatically build and dynlink ocaml source files";
-  };
-
-  parsexp = janePackage {
-    pname = "parsexp";
-    hash = "0brrifvnfqbfk873v6y5b2jixs2d73hpispj9r440kca5cfsv23b";
-    propagatedBuildInputs = [ ppx_compare ppx_fields_conv ppx_js_style ppx_sexp_value ];
-    meta.description = "S-expression parsing library";
-  };
-
-  parsexp_io = janePackage {
-    pname = "parsexp_io";
-    hash = "0gcmh4dg48xgszladq92yhk1hf492zf0smz462xrwknzlfdkz6a5";
-    propagatedBuildInputs = [ parsexp ];
-    meta.description = "S-expression parsing library (IO functions)";
-  };
-
-  patience_diff = janePackage {
-    pname = "patience_diff";
-    hash = "0vpx9xj1ich5qmj3m26vlmix3nsdj7pd1xzhqwbc7ad2kqwy3grg";
-    propagatedBuildInputs = [ core_kernel ];
-    meta.description = "Tool and library implementing patience diff";
-  };
-
-  posixat = janePackage {
-    pname = "posixat";
-    hash = "0ak93dyzi6sc6gb0j07fj85b24d8bv6g2hm7jj5xwb39kjwh51jl";
-    propagatedBuildInputs = [ ppx_sexp_conv ];
-    meta.description = "Binding to the posix *at functions";
-    meta.broken = lib.versionAtLeast ocaml.version "4.05";
-  };
-
-  rpc_parallel = janePackage {
-    pname = "rpc_parallel";
-    hash = "0s72msl2p27bz0knjlpgy5qwp0w4z76cq801ps0sab35f8jjfs38";
-    propagatedBuildInputs = [ async ];
-    meta.description = "Type-safe library for building parallel applications";
-  };
-
-  shexp = janePackage {
-    pname = "shexp";
-    hash = "1fkz4l9z4i0fz2kccd5blm2j9x2x4z6y1cn29wjmc3spqfxbq37y";
-    propagatedBuildInputs = [ posixat spawn ];
-    meta.description = "Process library and s-expression based shell";
-  };
-
-  topological_sort = janePackage {
-    pname = "topological_sort";
-    hash = "1d64fyq0clsgham9p1f5rk01z8pxalglp92xmqw2iznyw0vxhvsy";
-    propagatedBuildInputs = [ core_kernel ];
-    meta.description = "Topological sort algorithm";
-  };
-
-  typerep_extended = janePackage {
-    pname = "typerep_extended";
-    hash = "15gq8mrvlipd616rffr3f0wqw5d0ijnnizix610g2d5viirh0j9p";
-    propagatedBuildInputs = [ core_kernel ];
-    meta.description = "Runtime types for OCaml (Extended)";
-  };
-
-}
diff --git a/pkgs/development/ocaml-modules/letsencrypt/default.nix b/pkgs/development/ocaml-modules/letsencrypt/default.nix
index 9fdff45b6a541..3eb8c2c08b558 100644
--- a/pkgs/development/ocaml-modules/letsencrypt/default.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/default.nix
@@ -21,11 +21,11 @@
 
 buildDunePackage rec {
   pname = "letsencrypt";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchurl {
     url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-${version}.tbz";
-    hash = "sha256-XGroZiNyP0ItOMrXK07nrVqT4Yz9RKXYvZuRkDp089M=";
+    hash = "sha256-uQOHpdyPg5kms+negxpQMxfhow6auZ0ipt5ksoXYo1w=";
   };
 
   minimalOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix b/pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix
index 067b61212acec..ed9b299320d89 100644
--- a/pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix
@@ -49,5 +49,9 @@ buildDunePackage rec {
       and de-serialization function from a .proto file.
     '';
     maintainers = [ lib.maintainers.GirardR1006 ];
+    # Broken with Dune 3.15.1:
+    #   Error: Dependency cycle between:
+    #      %{read:config/support_proto3_optional.conf} at test/dune:16
+    broken = true;
   };
 }
diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index 40709f4b49739..28606fdfa2e27 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -16,7 +16,7 @@ php.buildComposerProject (finalAttrs: {
   # use together with the version from this package to keep the
   # bootstrap phar file up-to-date together with the end user composer
   # package.
-  passthru.pharHash = "sha256-BJuODtnyZNdwoFEIWM/7w1QBUQdZ7cmnhLOlxuAgvKw=";
+  passthru.pharHash = "sha256-/MAv8ES1oE++z/AVjLYEHCXo94rElAmHNv7NK7TzgeQ=";
 
   composer = callPackage ../../../build-support/php/pkgs/composer-phar.nix {
     inherit (finalAttrs) version;
@@ -24,13 +24,13 @@ php.buildComposerProject (finalAttrs: {
   };
 
   pname = "composer";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     owner = "composer";
     repo = "composer";
     rev = finalAttrs.version;
-    hash = "sha256-Rev3OW1G+LVgJmHLwuV5u0s7F7lKrvtI43eS7y9SAYA=";
+    hash = "sha256-4cQ/p6lC8qgba/GSKuP2rFc0mZrUc+HuwvBMXnVERoU=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
@@ -40,7 +40,7 @@ php.buildComposerProject (finalAttrs: {
       --prefix PATH : ${lib.makeBinPath [ _7zz cacert curl git unzip xz ]}
   '';
 
-  vendorHash = "sha256-JLMhjOradyo64mPNos0qtM5bTnAYTRvSWnFUQrLQNjw=";
+  vendorHash = "sha256-dNNV9fTyGyRoGeDV/vBjn0aMgkaUMsrKQv5AOoiYokQ=";
 
   meta = {
     changelog = "https://github.com/composer/composer/releases/tag/${finalAttrs.version}";
diff --git a/pkgs/development/python-modules/aiojobs/default.nix b/pkgs/development/python-modules/aiojobs/default.nix
index b4ccb7b7fb4e2..62633de45385f 100644
--- a/pkgs/development/python-modules/aiojobs/default.nix
+++ b/pkgs/development/python-modules/aiojobs/default.nix
@@ -3,6 +3,7 @@
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
@@ -23,6 +24,13 @@ buildPythonPackage rec {
     hash = "sha256-LwFXb/SHP6bbqPg1tqYwE03FKHf4Mv1PPOxnPdESH0I=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/aio-libs/aiojobs/commit/1b88049841397b01f88aee7d92174ac5a15217c1.patch";
+      hash = "sha256-b38Ipa29T6bEVsPe04ZO3WCcs6+0fOQDCJM+w8K1bVY=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace "--cov=aiojobs/ --cov=tests/ --cov-report term" ""
diff --git a/pkgs/development/python-modules/aiomisc/default.nix b/pkgs/development/python-modules/aiomisc/default.nix
index e3b0b7de9b486..9182859bb90ef 100644
--- a/pkgs/development/python-modules/aiomisc/default.nix
+++ b/pkgs/development/python-modules/aiomisc/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "aiomisc";
-  version = "17.5.4";
+  version = "17.5.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/2WEaM9ZM9dbMA73XADOE2u5r3SfMAyjH8isOsXaJhE=";
+    hash = "sha256-oq4z+ULN6VYkXX4Oz/JqKZSIh55AHOxFJVLyaNGqaNA=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/airtouch5py/default.nix b/pkgs/development/python-modules/airtouch5py/default.nix
new file mode 100644
index 0000000000000..f474e23457863
--- /dev/null
+++ b/pkgs/development/python-modules/airtouch5py/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  pythonOlder,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+  pythonRelaxDepsHook,
+
+  # dependencies
+  bitarray,
+  crc,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "airtouch5py";
+  version = "0.2.8";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "danzel";
+    repo = "airtouch5py";
+    rev = "refs/tags/${version}";
+    hash = "sha256-MpwppyAWDiA3CZXCIUQ/vidzcxKXZJSlrFRhmrPMgCE=";
+  };
+
+  build-system = [ poetry-core ];
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+  pythonRelaxDeps = [ "crc" ];
+
+  dependencies = [
+    bitarray
+    crc
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "airtouch5py" ];
+
+  meta = with lib; {
+    changelog = "https://github.com/danzel/airtouch5py/releases/tag/${version}";
+    description = "Python client for the airtouch 5";
+    homepage = "https://github.com/danzel/airtouch5py";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/apkinspector/default.nix b/pkgs/development/python-modules/apkinspector/default.nix
index 9bc15aafb82a8..925845c73da3f 100644
--- a/pkgs/development/python-modules/apkinspector/default.nix
+++ b/pkgs/development/python-modules/apkinspector/default.nix
@@ -1,40 +1,38 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, poetry-core
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "apkinspector";
-  version = "1.2.2";
+  version = "1.2.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-6n5WCQ6V63kbWT6b7t9PEFbrJpxEg1WOE9XV70tHnGA=";
+  src = fetchFromGitHub {
+    owner = "erev0s";
+    repo = "apkInspector";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-n6uVyN5XBEM/nuN7mvhNRwMUgUT5abOsh3CbhKK6ifY=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
-  # Tests are not available
-  # https://github.com/erev0s/apkInspector/issues/21
-  doCheck = false;
+  nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [
-    "apkInspector"
-  ];
+  pythonImportsCheck = [ "apkInspector" ];
 
   meta = with lib; {
     description = "Module designed to provide detailed insights into the zip structure of APK files";
-    mainProgram = "apkInspector";
     homepage = "https://github.com/erev0s/apkInspector";
+    changelog = "https://github.com/erev0s/apkInspector/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "apkInspector";
   };
 }
diff --git a/pkgs/development/python-modules/aranet4/default.nix b/pkgs/development/python-modules/aranet4/default.nix
index 338e53fcb7880..cc1c93c8677f7 100644
--- a/pkgs/development/python-modules/aranet4/default.nix
+++ b/pkgs/development/python-modules/aranet4/default.nix
@@ -1,16 +1,17 @@
-{ lib
-, bleak
-, buildPythonPackage
-, fetchFromGitHub
-, pytestCheckHook
-, pythonOlder
-, requests
-, setuptools
+{
+  lib,
+  bleak,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "aranet4";
-  version = "2.2.3";
+  version = "2.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,25 +20,19 @@ buildPythonPackage rec {
     owner = "Anrijs";
     repo = "Aranet4-Python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Jd7yuddxwRrO7XFQsVGy5vRQxwIUZdwFSjiZZHdkE3g=";
+    hash = "sha256-j53d2Ki9xVWGHWkAu1wkjYE56Xq7kfMmqQrQiKrBg2I=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bleak
     requests
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [
-    "aranet4"
-  ];
+  pythonImportsCheck = [ "aranet4" ];
 
   disabledTests = [
     # Test compares rendered output
@@ -46,9 +41,9 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Module to interact with Aranet4 devices";
-    mainProgram = "aranetctl";
     homepage = "https://github.com/Anrijs/Aranet4-Python";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "aranetctl";
   };
 }
diff --git a/pkgs/development/python-modules/aspy.yaml/default.nix b/pkgs/development/python-modules/aspy-yaml/default.nix
index 09543479014e4..732d19be0d10c 100644
--- a/pkgs/development/python-modules/aspy.yaml/default.nix
+++ b/pkgs/development/python-modules/aspy-yaml/default.nix
@@ -1,12 +1,13 @@
 { lib, buildPythonPackage, fetchPypi, pyyaml }:
 
 buildPythonPackage rec {
-  pname = "aspy.yaml";
+  pname = "aspy-yaml";
   version = "1.3.0";
   format = "setuptools";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "aspy.yaml";
+    inherit version;
     sha256 = "0i9z2jm2hjwdxdv4vw4kbs70h2ciz49rv8w73zbawb7z5qw45iz7";
   };
 
diff --git a/pkgs/development/python-modules/awscrt/default.nix b/pkgs/development/python-modules/awscrt/default.nix
index 3343c46241bbd..d5d0cb5891719 100644
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "awscrt";
-  version = "0.20.6";
+  version = "0.20.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4LcUK7Zx1EVE2HlyhUbf1NnH7EYNEyJNXacwvqePkW0=";
+    hash = "sha256-JDeFrJ7mSUXgR5wjhDJVRfKVl1dXQ86Ew3FVbRAU5j4=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/backports_shutil_get_terminal_size/default.nix b/pkgs/development/python-modules/backports-shutil-get-terminal-size/default.nix
index aec6077dd7667..237cde584ebde 100644
--- a/pkgs/development/python-modules/backports_shutil_get_terminal_size/default.nix
+++ b/pkgs/development/python-modules/backports-shutil-get-terminal-size/default.nix
@@ -6,7 +6,7 @@
 }:
 
 if !(pythonOlder "3.3") then null else buildPythonPackage {
-  pname = "backports.shutil_get_terminal_size";
+  pname = "backports-shutil-get-terminal-size";
   version = "unstable-2016-02-21";
 
   # there have been numerous fixes committed since the initial release.
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 8c1502a8e1c5e..38c938bb74247 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -4,6 +4,7 @@
 , click
 , click-log
 , fetchFromGitHub
+, fetchpatch2
 , pure-pcapy3
 , pyserial-asyncio
 , pytest-asyncio
@@ -29,6 +30,13 @@ buildPythonPackage rec {
     hash = "sha256-oxPzjDb+FdHeHsgeGKH3SVvKb0vCB9dIhT7lGzhDcBw=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/zigpy/bellows/commit/7833647083f27f55b7ad345f4aaa7dffaa369abc.patch";
+      hash = "sha256-v+BOPqikWoyNtZ1qRWe3RwraG6nQnfZqoV6yj9PpGX8=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail '"setuptools-git-versioning<2"' "" \
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 97a05b6d10ccf..7d2776ffe76a1 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -366,7 +366,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.87";
+  version = "1.34.88";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -374,7 +374,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-fGIC78m332fXc8IYRCcwA/pmx41z7kKE4u9L9rrMCHo=";
+    hash = "sha256-I8qeDNDT53AtZjGh6UpCCKJrOfprEsc0Qn5op/pklHc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 3a1e67f4a0716..3b536f15577c5 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.34.87";
+  version = "1.34.88";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-Dy67vF7mCc19wz/In6b4i+yLvir8+BSteoi+AOp3QdY=";
+    hash = "sha256-ZW6WbqFSpPKCiJKqepZzvJF5mZj1qO/Y6P45D2HC9PE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bubop/default.nix b/pkgs/development/python-modules/bubop/default.nix
new file mode 100644
index 0000000000000..72c9737ce7b58
--- /dev/null
+++ b/pkgs/development/python-modules/bubop/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, loguru
+, python-dateutil
+, pyyaml
+, tqdm
+, click
+}:
+
+buildPythonPackage rec {
+  pname = "bubop";
+  version = "0.1.12";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "bergercookie";
+    repo = "bubop";
+    rev = "v${version}";
+    hash = "sha256-p4Mv73oX5bsYKby7l0nGon89KyAMIUhDAEKSTNB++Cw=";
+  };
+
+  postPatch = ''
+    # Those versions seems to work with `bubop`.
+    substituteInPlace pyproject.toml \
+    --replace-fail 'loguru = "^0.5.3"' 'loguru = "^0.7"' \
+    --replace-fail 'PyYAML = "~5.3.1"' 'PyYAML = "^6.0"'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    loguru
+    python-dateutil
+    pyyaml
+    tqdm
+    click
+  ];
+
+  pythonImportsCheck = [ "bubop" ];
+
+  meta = with lib; {
+    description = "Bergercookie's Useful Bits Of Python; helper libraries for Bergercookie's programs";
+    homepage = "https://github.com/bergercookie/bubop";
+    changelog = "https://github.com/bergercookie/bubop/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/development/python-modules/cachelib/default.nix b/pkgs/development/python-modules/cachelib/default.nix
index 12f2a88cb2499..26b69651ffc34 100644
--- a/pkgs/development/python-modules/cachelib/default.nix
+++ b/pkgs/development/python-modules/cachelib/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "cachelib";
-  version = "0.12.0";
+  version = "0.13.0";
   format = "setuptools";
   disabled = pythonOlder "3.6";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "pallets";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-gSBY8zMGVn5Ndu4OexMP1v7bhXAAdl2UcEjjKFa21rE=";
+    hash = "sha256-8jg+zfdIATvu/GSFvqHl4cNMu+s2IFWC22vPZ7Q3WYI=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/camel-converter/default.nix b/pkgs/development/python-modules/camel-converter/default.nix
index 65703ad76bd09..95967d2300e4d 100644
--- a/pkgs/development/python-modules/camel-converter/default.nix
+++ b/pkgs/development/python-modules/camel-converter/default.nix
@@ -1,15 +1,16 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, poetry-core
-, pydantic
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pydantic,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "camel-converter";
-  version = "3.1.1";
+  version = "3.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,31 +19,23 @@ buildPythonPackage rec {
     owner = "sanders41";
     repo = "camel-converter";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xrdk5Y3H8KlQaGtJYdJNHq16Qfos2p+93uIAfIl098c=";
+    hash = "sha256-CJbflRI3wfUmPoVuLwZDYcobESmySvnS99PdpSDhDLk=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "--cov=camel_converter --cov-report term-missing --no-cov-on-fail" ""
+      --replace-fail "--cov=camel_converter --cov-report term-missing --no-cov-on-fail" ""
   '';
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
   passthru.optional-dependencies = {
-    pydantic = [
-      pydantic
-    ];
+    pydantic = [ pydantic ];
   };
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ] ++ passthru.optional-dependencies.pydantic;
+  nativeCheckInputs = [ pytestCheckHook ] ++ passthru.optional-dependencies.pydantic;
 
-  pythonImportsCheck = [
-    "camel_converter"
-  ];
+  pythonImportsCheck = [ "camel_converter" ];
 
   disabledTests = [
     # AttributeError: 'Test' object has no attribute 'model_dump'
diff --git a/pkgs/development/python-modules/clarifai/default.nix b/pkgs/development/python-modules/clarifai/default.nix
index ee6a1eb6bc644..b1085bdc5b99c 100644
--- a/pkgs/development/python-modules/clarifai/default.nix
+++ b/pkgs/development/python-modules/clarifai/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "clarifai";
-  version = "10.3.0";
+  version = "10.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "Clarifai";
     repo = "clarifai-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-8EPs6kGB+Px9Fs2Z+YwDcmEYI5+z/kOIKLraJFMykF0=";
+    hash = "sha256-KCJ1Ev0fgww0JU1tDp9X/A9EIcXQRaFKeA/MRNnp5ng=";
   };
 
   pythonRelaxDeps = [ "clarifai-grpc" ];
diff --git a/pkgs/development/python-modules/cloudsmith-api/default.nix b/pkgs/development/python-modules/cloudsmith-api/default.nix
index 5f51009f4bd77..e49a0eb5f92f4 100644
--- a/pkgs/development/python-modules/cloudsmith-api/default.nix
+++ b/pkgs/development/python-modules/cloudsmith-api/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "cloudsmith-api";
-  version = "2.0.12";
+  version = "2.0.13";
   format = "wheel";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "cloudsmith_api";
     inherit format version;
-    hash = "sha256-a33t963Q5+gnZI9pha4viuyWz3xLHUdcGE4ccw/w0s8=";
+    hash = "sha256-xPPARaxclTRy7thJXtXaMK0F5/91q7o35LyzSmx1HPU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dbt-redshift/default.nix b/pkgs/development/python-modules/dbt-redshift/default.nix
index 7d7f2e3765c6d..ea543b6ee4af5 100644
--- a/pkgs/development/python-modules/dbt-redshift/default.nix
+++ b/pkgs/development/python-modules/dbt-redshift/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dbt-redshift";
-  version = "1.7.6";
+  version = "1.7.7";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-redshift";
     rev = "refs/tags/v${version}";
-    hash = "sha256-p75WEozbkPXBThuW8i1tpJmca1nxBXTlGQR9U976mOs=";
+    hash = "sha256-DKqJ/8hEPe9O9YrAjrTL2Gh1lj6QrdtHtd7aarZ7GkQ=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/ducc0/default.nix b/pkgs/development/python-modules/ducc0/default.nix
index f655aebf8910c..aa44378f6c793 100644
--- a/pkgs/development/python-modules/ducc0/default.nix
+++ b/pkgs/development/python-modules/ducc0/default.nix
@@ -1,9 +1,19 @@
-{ stdenv, lib, buildPythonPackage, fetchFromGitLab, pythonOlder, pytestCheckHook, pybind11, numpy }:
+{
+  stdenv,
+  lib,
+  buildPythonPackage,
+  fetchFromGitLab,
+  numpy,
+  pybind11,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+}:
 
 buildPythonPackage rec {
   pname = "ducc0";
-  version = "0.33.0";
-  format = "setuptools";
+  version = "0.34.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -11,14 +21,17 @@ buildPythonPackage rec {
     domain = "gitlab.mpcdf.mpg.de";
     owner = "mtr";
     repo = "ducc";
-    rev = "ducc0_${lib.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-MezcqQRitBkK4/1rRQM2c9w+iZb2kIsDdcNd6I8CPoI=";
+    rev = "ducc0_${lib.replaceStrings [ "." ] [ "_" ] version}";
+    hash = "sha256-lxNqB3Lt+n4vIH7cVW4DAwhjuPn49y+/3RLKVO8IuJM=";
   };
 
   buildInputs = [ pybind11 ];
   propagatedBuildInputs = [ numpy ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    setuptools
+  ];
   pytestFlagsArray = [ "python/test" ];
   pythonImportsCheck = [ "ducc0" ];
 
diff --git a/pkgs/development/python-modules/dungeon-eos/default.nix b/pkgs/development/python-modules/dungeon-eos/default.nix
index ace614bcaeb4c..9f357168b0b5e 100644
--- a/pkgs/development/python-modules/dungeon-eos/default.nix
+++ b/pkgs/development/python-modules/dungeon-eos/default.nix
@@ -19,6 +19,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/SkyTemple/dungeon-eos";
     description = "A package that simulates PMD EoS dungeon generation";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ marius851000 xfix ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/editdistpy/default.nix b/pkgs/development/python-modules/editdistpy/default.nix
index 537f4851f6a93..5a53b3e868008 100644
--- a/pkgs/development/python-modules/editdistpy/default.nix
+++ b/pkgs/development/python-modules/editdistpy/default.nix
@@ -16,16 +16,16 @@
 
 buildPythonPackage rec {
   pname = "editdistpy";
-  version = "0.1.3";
+  version = "0.1.4";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mammothb";
     repo = "editdistpy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4CtKadKpFmlZnz10NG0404oFl9DkdQwWwRSWgUPdh94=";
+    hash = "sha256-OSJXiuJtZ4w1IiRaZQZH2DDxA0AGoRHp0BKXdysff0Y=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/etelemetry/default.nix b/pkgs/development/python-modules/etelemetry/default.nix
index 24777c4e9cf8b..a3b9008fc1caa 100644
--- a/pkgs/development/python-modules/etelemetry/default.nix
+++ b/pkgs/development/python-modules/etelemetry/default.nix
@@ -1,20 +1,37 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27, ci-info, ci-py, requests }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, ci-info
+, ci-py
+, requests
+, setuptools
+}:
 
 buildPythonPackage rec {
-  version = "0.2.1";
-  format = "setuptools";
   pname = "etelemetry";
-  disabled = isPy27;
+  version = "0.3.1";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1rw8im09ppnb7z7p7rx658rp5ib8zca8byxg1kiflqwgx5c8zddz";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "sensein";
+    repo = "etelemetry-client";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UaE5JQhv2AtzXKY7YD2/g6Kj1igKhmnY3zlf1P9B/iQ=";
   };
 
-  propagatedBuildInputs = [ ci-info ci-py requests ];
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    ci-info
+    ci-py
+    requests
+  ];
 
-  # all 2 of the tests both try to pull down from a url
-  doCheck = false;
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [
     "etelemetry"
@@ -24,7 +41,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Lightweight python client to communicate with the etelemetry server";
-    homepage = "https://github.com/mgxd/etelemetry-client";
+    homepage = "https://github.com/sensein/etelemetry-client";
+    changelog = "https://github.com/sensein/etelemetry-client/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/explorerscript/default.nix b/pkgs/development/python-modules/explorerscript/default.nix
index 014fa1057d56d..4adc91b25dbae 100644
--- a/pkgs/development/python-modules/explorerscript/default.nix
+++ b/pkgs/development/python-modules/explorerscript/default.nix
@@ -64,6 +64,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/SkyTemple/explorerscript";
     description = "A programming language + compiler/decompiler for creating scripts for Pokémon Mystery Dungeon Explorers of Sky";
     license = licenses.mit;
-    maintainers = with maintainers; [ marius851000 xfix ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/gios/default.nix b/pkgs/development/python-modules/gios/default.nix
index d7f9845b3075a..1d972641d3923 100644
--- a/pkgs/development/python-modules/gios/default.nix
+++ b/pkgs/development/python-modules/gios/default.nix
@@ -8,23 +8,29 @@
 , pytest-error-for-skips
 , pytestCheckHook
 , pythonOlder
+, setuptools
+, syrupy
 }:
 
 buildPythonPackage rec {
   pname = "gios";
-  version = "3.2.2";
-  format = "setuptools";
+  version = "4.0.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "bieniu";
-    repo = pname;
+    repo = "gios";
     rev = "refs/tags/${version}";
-    hash = "sha256-5CiKikhIZ+1pb5/NJ2XzpG1XHrkyuW1WUvvNEpxJIcw=";
+    hash = "sha256-rjC4zWWtaPxuBcjiO9dVsXD4dTa47iwkKuSFx+QXeXw=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     aiohttp
     dacite
   ];
@@ -34,6 +40,7 @@ buildPythonPackage rec {
     pytest-asyncio
     pytest-error-for-skips
     pytestCheckHook
+    syrupy
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/githubkit/default.nix b/pkgs/development/python-modules/githubkit/default.nix
index ac9ed0be67d5f..3a8f62f6a02d6 100644
--- a/pkgs/development/python-modules/githubkit/default.nix
+++ b/pkgs/development/python-modules/githubkit/default.nix
@@ -1,22 +1,22 @@
-{ lib
-, anyio
-, buildPythonPackage
-, fetchFromGitHub
-, hishel
-, httpx
-, poetry-core
-, pydantic
-, pyjwt
-, pytest-xdist
-, pytestCheckHook
-, pythonOlder
-, pythonRelaxDepsHook
-, typing-extensions
+{
+  lib,
+  anyio,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hishel,
+  httpx,
+  poetry-core,
+  pydantic,
+  pyjwt,
+  pytest-xdist,
+  pytestCheckHook,
+  pythonOlder,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "githubkit";
-  version = "0.11.3";
+  version = "0.11.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,22 +25,15 @@ buildPythonPackage rec {
     owner = "yanyongyu";
     repo = "githubkit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GRuEzRqDfhLCanuQnCkMXmDnfNkLFb35Gixl9pWmA8w=";
+    hash = "sha256-uxXRDavp5c3e1MOZR2B4wUxEHh6K81avTeaIVsOdup8=";
   };
 
-  pythonRelaxDeps = [
-    "hishel"
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "--cov=githubkit --cov-append --cov-report=term-missing" ""
   '';
 
-  build-system = [
-    poetry-core
-    pythonRelaxDepsHook
-  ];
+  build-system = [ poetry-core ];
 
   dependencies = [
     hishel
@@ -54,15 +47,9 @@ buildPythonPackage rec {
       anyio
       pyjwt
     ];
-    jwt = [
-      pyjwt
-    ];
-    auth-app = [
-      pyjwt
-    ];
-    auth-oauth-device = [
-      anyio
-    ];
+    jwt = [ pyjwt ];
+    auth-app = [ pyjwt ];
+    auth-oauth-device = [ anyio ];
     auth = [
       anyio
       pyjwt
@@ -74,9 +61,7 @@ buildPythonPackage rec {
     pytest-xdist
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
-  pythonImportsCheck = [
-    "githubkit"
-  ];
+  pythonImportsCheck = [ "githubkit" ];
 
   disabledTests = [
     # Tests require network access
diff --git a/pkgs/development/python-modules/google-generativeai/default.nix b/pkgs/development/python-modules/google-generativeai/default.nix
index a63b61ca09c21..4425966a00638 100644
--- a/pkgs/development/python-modules/google-generativeai/default.nix
+++ b/pkgs/development/python-modules/google-generativeai/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "google-generativeai";
-  version = "0.5.0";
+  version = "0.5.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "google";
     repo = "generative-ai-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WFkzqsiYADrxVUHClBHY0+oYz2sF52DrVblHT+94QYw=";
+    hash = "sha256-R1ndVzGKXWRNkWvvuP4HFBXbuk54bCZZvMJY+yalJGU=";
   };
 
   pythonRelaxDeps = [ "google-ai-generativelanguage" ];
diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index dbadab9432191..d14710b17b96e 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.62.1";
+  version = "1.62.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nlYYCpQbHTKgd9dJHgYR0Eg8OWNYr9U0m/ABUmEuRYM=";
+    hash = "sha256-pE0eoeFRC1xiJl2toE2GYhuxSR113ph3E8nA6gBcEKg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index 799a805ba564a..4001d3663fbdb 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.62.1";
+  version = "1.62.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-q9RTABmRhxAxMV7y2Cr/6TCAwEM/o6AHvjS/Qn4oqIo=";
+    hash = "sha256-LdRIBtaNAAZjZSm9pXMBKxmkIoFHjC0FHNquu5HiUWw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/influxdb-client/default.nix b/pkgs/development/python-modules/influxdb-client/default.nix
index d95aa2b2323a0..b2480e4684b79 100644
--- a/pkgs/development/python-modules/influxdb-client/default.nix
+++ b/pkgs/development/python-modules/influxdb-client/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "influxdb-client";
-  version = "1.41.0";
+  version = "1.42.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "influxdata";
     repo = "influxdb-client-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wrgbc8sMISJvXxefGl2PBsJ3d308BXVH7wYIeaFmdZ8=";
+    hash = "sha256-PY0GpwO1OG4DKutMR3MF9HtTJbLFRCWypeoqVoiRD4o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/influxdb3-python/default.nix b/pkgs/development/python-modules/influxdb3-python/default.nix
index f023b498c05a1..23b4bcc4c3bf5 100644
--- a/pkgs/development/python-modules/influxdb3-python/default.nix
+++ b/pkgs/development/python-modules/influxdb3-python/default.nix
@@ -1,19 +1,20 @@
-{ lib
-, buildPythonPackage
-, certifi
-, fetchFromGitHub
-, pyarrow
-, pytestCheckHook
-, python-dateutil
-, pythonOlder
-, reactivex
-, setuptools
-, urllib3
+{
+  lib,
+  buildPythonPackage,
+  certifi,
+  fetchFromGitHub,
+  pyarrow,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  reactivex,
+  setuptools,
+  urllib3,
 }:
 
 buildPythonPackage rec {
   pname = "influxdb3-python";
-  version = "0.3.6";
+  version = "0.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,14 +23,12 @@ buildPythonPackage rec {
     owner = "InfluxCommunity";
     repo = "influxdb3-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZKN3chJvtOenk2jp02rvw+HooJcee0hwxWoLvEYjfcg=";
+    hash = "sha256-qFcXqbYsjn27BPeKxTsWxKJdF6y8Oz3VBrmSyO0vCGo=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     certifi
     pyarrow
     python-dateutil
diff --git a/pkgs/development/python-modules/item-synchronizer/default.nix b/pkgs/development/python-modules/item-synchronizer/default.nix
new file mode 100644
index 0000000000000..2f568499eb086
--- /dev/null
+++ b/pkgs/development/python-modules/item-synchronizer/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, bidict
+, bubop
+}:
+
+buildPythonPackage rec {
+  pname = "item-synchronizer";
+  version = "1.1.5";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "bergercookie";
+    repo = "item_synchronizer";
+    rev = "v${version}";
+    hash = "sha256-+mviKtCLlJhYV576Q07kcFJvtls5qohKSrqZtBqE/s4=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace-fail 'bidict = "^0.21.4"' 'bidict = "^0.23"'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bidict
+    bubop
+  ];
+
+  pythonImportsCheck = [ "item_synchronizer" ];
+
+  meta = with lib; {
+    description = "";
+    homepage = "https://github.com/bergercookie/item_synchronizer";
+    changelog = "https://github.com/bergercookie/item_synchronizer/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/development/python-modules/jedi-language-server/default.nix b/pkgs/development/python-modules/jedi-language-server/default.nix
index fdc1d1a5a9b1d..0a67730726bc6 100644
--- a/pkgs/development/python-modules/jedi-language-server/default.nix
+++ b/pkgs/development/python-modules/jedi-language-server/default.nix
@@ -11,11 +11,12 @@
 , pytestCheckHook
 , python-lsp-jsonrpc
 , pythonOlder
+, stdenv
 }:
 
 buildPythonPackage rec {
   pname = "jedi-language-server";
-  version = "0.41.3";
+  version = "0.41.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,8 +24,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "pappasam";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-+k4WOoEbVe7mlPyPj0ttBM+kmjq8V739yHi36BDYK2U=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RDLwL9AZ3G8CzVwDtWqFFZNH/ulpHeFBhglbWNv/ZIk=";
   };
 
   nativeBuildInputs = [
@@ -49,6 +50,12 @@ buildPythonPackage rec {
     HOME="$(mktemp -d)"
   '';
 
+  disabledTests = lib.optionals stdenv.isDarwin [
+    # https://github.com/pappasam/jedi-language-server/issues/313
+    "test_publish_diagnostics_on_change"
+    "test_publish_diagnostics_on_save"
+  ];
+
   pythonImportsCheck = [
     "jedi_language_server"
   ];
diff --git a/pkgs/development/python-modules/lacuscore/default.nix b/pkgs/development/python-modules/lacuscore/default.nix
index 7bf59e72eb8a3..950c215e9005d 100644
--- a/pkgs/development/python-modules/lacuscore/default.nix
+++ b/pkgs/development/python-modules/lacuscore/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "lacuscore";
-  version = "1.9.1";
+  version = "1.9.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "ail-project";
     repo = "LacusCore";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DUgMql/KCy8g63HvA7qbrv9qia+nchPLIkufWmUXKDg=";
+    hash = "sha256-vfhRbbutNuZW/oI/eCJUXydCn47ThOlWRz2NJJrE3Tw=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/llama-index-embeddings-openai/default.nix b/pkgs/development/python-modules/llama-index-embeddings-openai/default.nix
index 00572d723d8f6..d15b27e075cf9 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-openai/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-embeddings-openai";
-  version = "0.1.7";
+  version = "0.1.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_embeddings_openai";
     inherit version;
-    hash = "sha256-xxzJggaAxM7fyYRdyHuU9oUdHMzh5Ib8kSmPj6jZ8n0=";
+    hash = "sha256-quTOPsL+LLYE2URkaYLHFmOouZ7V+MNwgj7oLu9N3Ts=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/llama-index-llms-openai/default.nix b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
index 121cfee981e87..288fa1d35c4d9 100644
--- a/pkgs/development/python-modules/llama-index-llms-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-llms-openai";
-  version = "0.1.15";
+  version = "0.1.16";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_openai";
     inherit version;
-    hash = "sha256-a9vzB7HUOpp8KlL3K6fbYcuW2QT5nn6l2IndeBjxCBQ=";
+    hash = "sha256-MTu8F8JBmSQwpr9oahse3EJ2yCVq1rBVCqG+oeD+0aY=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/maestral/default.nix b/pkgs/development/python-modules/maestral/default.nix
index 92c8dee9b0bec..4a733bb60a6f8 100644
--- a/pkgs/development/python-modules/maestral/default.nix
+++ b/pkgs/development/python-modules/maestral/default.nix
@@ -21,14 +21,14 @@
 , survey
 , typing-extensions
 , watchdog
+, xattr
 , pytestCheckHook
 , nixosTests
-, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
   pname = "maestral";
-  version = "1.8.0";
+  version = "1.9.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "SamSchott";
     repo = "maestral";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YYbdd0GLVKE7+Oi0mpQjqhFdjdlquk/XnIg5WrtKcfI=";
+    hash = "sha256-Bb0yE2OKdlZd6ZsTEWOD+hMuV41fZanesY49L+v4BBE=";
   };
 
   propagatedBuildInputs = [
@@ -58,6 +58,7 @@ buildPythonPackage rec {
     survey
     typing-extensions
     watchdog
+    xattr
   ];
 
   makeWrapperArgs = [
@@ -68,14 +69,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    pythonRelaxDepsHook
-  ];
-
-  pythonRelaxDeps = [
-    # https://github.com/samschott/maestral/commit/2c50d2ddb49a845ea97bd6b0f68c45d723fb304c
-    # Allow the use of survey >= 5
-    # Remove after new maestral release along with pythonRelaxDepsHook
-    "survey"
   ];
 
   preCheck = ''
@@ -95,6 +88,8 @@ buildPythonPackage rec {
     "test_cased_path_candidates"
     # AssertionError
     "test_locking_multiprocess"
+    # OSError: [Errno 95] Operation not supported
+    "test_move_preserves_xattrs"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/marimo/default.nix b/pkgs/development/python-modules/marimo/default.nix
index 4031b10f55d03..aeb881754345b 100644
--- a/pkgs/development/python-modules/marimo/default.nix
+++ b/pkgs/development/python-modules/marimo/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "marimo";
-  version = "0.4.0";
+  version = "0.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IiM7iJs3CIl6WjstgvtJzIylVL49jRG246GU5G5GEG0=";
+    hash = "sha256-wFDx90zTaPF9gHLZnWBJQlMBuz8iZQRHkcS8BAxcZRA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mdformat-admon/default.nix b/pkgs/development/python-modules/mdformat-admon/default.nix
index 10be705e1440e..7025864b440a8 100644
--- a/pkgs/development/python-modules/mdformat-admon/default.nix
+++ b/pkgs/development/python-modules/mdformat-admon/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "mdformat-admon";
-  version = "2.0.2";
+  version = "2.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KyleKing";
     repo = "mdformat-admon";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TybbkF6+dIfG+1fGYp+bTEdw2GXINZJfOX0QiAaqiWY=";
+    hash = "sha256-zKc0kKap4ipZ+P+RYDXcwqyzq9NKcTnCmx64cApFxFg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mechanize/default.nix b/pkgs/development/python-modules/mechanize/default.nix
index 0f89f3f42525a..3724fa64d06e7 100644
--- a/pkgs/development/python-modules/mechanize/default.nix
+++ b/pkgs/development/python-modules/mechanize/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch2
 , html5lib
 , pytestCheckHook
 , pythonOlder
@@ -19,6 +20,14 @@ buildPythonPackage rec {
     hash = "sha256-aaXtsJYvkh6LEINzaMIkLYrQSfC5H/aZzn9gG/xDFSE=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # python 3.11+ compat
+      url = "https://github.com/python-mechanize/mechanize/commit/1324b09b661aaac7d4cdc7e1e9d49e1c3851db2c.patch";
+      hash = "sha256-d0Zuz6m2Uv8pnR8TC0L+AStS82rPPTpQrrjkCZnJliE=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 860900902794a..8de8d9b8260d6 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -45,7 +45,7 @@
 
 buildPythonPackage rec {
   pname = "mitmproxy";
-  version = "10.2.4";
+  version = "10.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     owner = "mitmproxy";
     repo = "mitmproxy";
     rev = "refs/tags/${version}";
-    hash = "sha256-6TPhxprrP6Bgc1yAhN3pBdr98WpvfGnVNvkNtFxROgE=";
+    hash = "sha256-YjvGsnpQQ8GWLyKmnd3lOxesnr+F2xCNXyahZh0JQnc=";
   };
 
   nativeBuildInputs = [
@@ -122,7 +122,9 @@ buildPythonPackage rec {
     "test_commands_exist"
     "test_contentview_flowview"
     "test_flowview"
+    "test_get_hex_editor"
     "test_integration"
+    "test_spawn_editor"
     "test_statusbar"
     # FileNotFoundError: [Errno 2] No such file or directory
     # likely wireguard is also not working in the sandbox
diff --git a/pkgs/development/python-modules/ndspy/default.nix b/pkgs/development/python-modules/ndspy/default.nix
index dbdce14ae1f47..c4a7a6bf5578b 100644
--- a/pkgs/development/python-modules/ndspy/default.nix
+++ b/pkgs/development/python-modules/ndspy/default.nix
@@ -35,6 +35,6 @@ buildPythonPackage rec {
     description = "Python library for many Nintendo DS file formats";
     homepage = "https://github.com/RoadrunnerWMC/ndspy";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ xfix ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/nettigo-air-monitor/default.nix b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
index 538aec6b4f248..a33f9d5286307 100644
--- a/pkgs/development/python-modules/nettigo-air-monitor/default.nix
+++ b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
@@ -1,36 +1,36 @@
-{ lib
-, aiohttp
-, aioresponses
-, aqipy-atmotech
-, buildPythonPackage
-, dacite
-, fetchFromGitHub
-, pytest-asyncio
-, pytest-error-for-skips
-, pytestCheckHook
-, pythonOlder
-, setuptools
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  aqipy-atmotech,
+  buildPythonPackage,
+  dacite,
+  fetchFromGitHub,
+  pytest-asyncio,
+  pytest-error-for-skips,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  syrupy,
 }:
 
 buildPythonPackage rec {
   pname = "nettigo-air-monitor";
-  version = "2.2.2";
+  version = "3.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = "nettigo-air-monitor";
     rev = "refs/tags/${version}";
-    hash = "sha256-Z88IkXQi9Uqc+HX++Cp5nj4S0puwMfToqXzBCnbG59g=";
+    hash = "sha256-aiJoY+6sNfBmE1057UuMjV80hjVJ29t2X16IIe6dxWs=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     aqipy-atmotech
     dacite
@@ -41,11 +41,10 @@ buildPythonPackage rec {
     pytest-asyncio
     pytest-error-for-skips
     pytestCheckHook
+    syrupy
   ];
 
-  pythonImportsCheck = [
-    "nettigo_air_monitor"
-  ];
+  pythonImportsCheck = [ "nettigo_air_monitor" ];
 
   meta = with lib; {
     description = "Python module to get air quality data from Nettigo Air Monitor devices";
diff --git a/pkgs/development/python-modules/nextdns/default.nix b/pkgs/development/python-modules/nextdns/default.nix
index 7d81eccbcabf7..9b84c400e5298 100644
--- a/pkgs/development/python-modules/nextdns/default.nix
+++ b/pkgs/development/python-modules/nextdns/default.nix
@@ -1,30 +1,35 @@
-{ lib
-, aiohttp
-, aioresponses
-, buildPythonPackage
-, fetchFromGitHub
-, orjson
-, pytest-asyncio
-, pytest-error-for-skips
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  buildPythonPackage,
+  fetchFromGitHub,
+  orjson,
+  pytest-asyncio,
+  pytest-error-for-skips,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  syrupy,
 }:
 
 buildPythonPackage rec {
   pname = "nextdns";
-  version = "2.1.0";
-  format = "setuptools";
+  version = "3.0.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = "nextdns";
     rev = "refs/tags/${version}";
-    hash = "sha256-haw6t7pepMN77LFVgDFBbV4StRqcRMvnCaup8K38kEg=";
+    hash = "sha256-ka/VT7c72la4z/BVAWnV06MxVmu52ZcJ4GsEeP7vbKA=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     aiohttp
     orjson
   ];
@@ -34,11 +39,10 @@ buildPythonPackage rec {
     pytest-asyncio
     pytest-error-for-skips
     pytestCheckHook
+    syrupy
   ];
 
-  pythonImportsCheck = [
-    "nextdns"
-  ];
+  pythonImportsCheck = [ "nextdns" ];
 
   meta = with lib; {
     description = "Module for the NextDNS API";
diff --git a/pkgs/development/python-modules/nvchecker/default.nix b/pkgs/development/python-modules/nvchecker/default.nix
index 87f2fcfb43fb5..81ba9863d411d 100644
--- a/pkgs/development/python-modules/nvchecker/default.nix
+++ b/pkgs/development/python-modules/nvchecker/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "nvchecker";
-  version = "2.14";
+  version = "2.14.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,15 +30,9 @@ buildPythonPackage rec {
     owner = "lilydjwg";
     repo = "nvchecker";
     rev = "v${version}";
-    hash = "sha256-QqfF8PGY8sULv1x0blu21ucWxqhOpQ7jyLuRCzDIpco=";
+    hash = "sha256-V2lTGeaiwUsh8IONbZ5GQrqevJMhjeuFLTDF8UdWg8Q=";
   };
 
-  postPatch = ''
-    # Fix try/except syntax. Remove with the next release
-    substituteInPlace tests/test_jq.py \
-      --replace-warn "except jq" "except ImportError"
-  '';
-
   nativeBuildInputs = [
     setuptools
     docutils
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index ab9f362de4e6f..179ecd1a312e4 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "3.4.0";
+  version = "3.4.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_parser";
-    hash = "sha256-knMxVBibaX3wK7VNBODHeLeAbBOXHKNbyxjItiNcIfw=";
+    hash = "sha256-AZkbLTMWSUfrbgXZzvKy+maNaB7AwLPoh3Q8QT4Zq5U=";
   };
 
   buildInputs = [ pip ];
diff --git a/pkgs/development/python-modules/ondilo/default.nix b/pkgs/development/python-modules/ondilo/default.nix
index 1c5a25e048f45..ea863658e9918 100644
--- a/pkgs/development/python-modules/ondilo/default.nix
+++ b/pkgs/development/python-modules/ondilo/default.nix
@@ -1,16 +1,17 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, oauthlib
-, pythonOlder
-, requests
-, requests-oauthlib
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  oauthlib,
+  pythonOlder,
+  requests,
+  requests-oauthlib,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "ondilo";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -19,12 +20,10 @@ buildPythonPackage rec {
     owner = "JeromeHXP";
     repo = "ondilo";
     rev = "refs/tags/${version}";
-    hash = "sha256-BieWdPakQts0QxzQzJYlP6a7ieZ40rAyYqhy8zEvU38=";
+    hash = "sha256-l9pmamJbB/FAqB49S4vQAan9Wgj3qu1J2pboQO1Hg/Q=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     oauthlib
@@ -35,9 +34,7 @@ buildPythonPackage rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "ondilo"
-  ];
+  pythonImportsCheck = [ "ondilo" ];
 
   meta = with lib; {
     description = "Python package to access Ondilo ICO APIs";
diff --git a/pkgs/development/python-modules/openai-triton/default.nix b/pkgs/development/python-modules/openai-triton/default.nix
index 018852bdc7437..2bdb8d918af3f 100644
--- a/pkgs/development/python-modules/openai-triton/default.nix
+++ b/pkgs/development/python-modules/openai-triton/default.nix
@@ -115,6 +115,9 @@ buildPythonPackage rec {
 
   # Avoid GLIBCXX mismatch with other cuda-enabled python packages
   preConfigure = ''
+    # Ensure that the build process uses the requested number of cores
+    export MAX_JOBS="$NIX_BUILD_CORES"
+
     # Upstream's setup.py tries to write cache somewhere in ~/
     export HOME=$(mktemp -d)
 
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index 1668cfa9f9be9..8d9d06b053112 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "1.20.0";
+  version = "1.23.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7.1";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aR/OEOz6xUKjsZk3lynx0SZJ4lnWk0uDFioO/NakVl8=";
+    hash = "sha256-ScBD+g+xbbZOdIip4ISXYug9MqKLahutUNIoQnD1tHc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/openstacksdk/default.nix b/pkgs/development/python-modules/openstacksdk/default.nix
index 94d2c1b7c216c..3f997d4d4cede 100644
--- a/pkgs/development/python-modules/openstacksdk/default.nix
+++ b/pkgs/development/python-modules/openstacksdk/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "openstacksdk";
-  version = "3.0.0";
+  version = "3.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sMf5oCXV2pKtTHYpQeasxMtTkwoH/3OamuvMXlpySuY=";
+    hash = "sha256-cH8V1+wHSrJDS5peGYT6yrAPgi0nL0wqXeDSKgnrec0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openusd/default.nix b/pkgs/development/python-modules/openusd/default.nix
index 52a4bdc40573b..bc67c43a6b0b8 100644
--- a/pkgs/development/python-modules/openusd/default.nix
+++ b/pkgs/development/python-modules/openusd/default.nix
@@ -9,6 +9,7 @@
   draco,
   embree,
   fetchFromGitHub,
+  fetchpatch,
   flex,
   git,
   graphviz-nox,
@@ -63,6 +64,14 @@ buildPythonPackage rec {
 
   format = "other";
 
+  patches = [
+    (fetchpatch {
+      name = "port-to-embree-4.patch";
+      url = "https://github.com/PixarAnimationStudios/OpenUSD/pull/2266/commits/4b6c23d459c602fdac5e0ebc9b7722cbd5475e86.patch";
+      hash = "sha256-yjqdGAVqfEsOX1W/tG6c+GgQLYya5U9xgUe/sNIuDbw=";
+    })
+  ];
+
   cmakeFlags = [
     "-DPXR_BUILD_ALEMBIC_PLUGIN=ON"
     "-DPXR_BUILD_DRACO_PLUGIN=ON"
diff --git a/pkgs/development/python-modules/ovoenergy/default.nix b/pkgs/development/python-modules/ovoenergy/default.nix
index 1aaf94710311e..c2d2bea352226 100644
--- a/pkgs/development/python-modules/ovoenergy/default.nix
+++ b/pkgs/development/python-modules/ovoenergy/default.nix
@@ -1,54 +1,48 @@
-{ lib
-, aiohttp
-, buildPythonPackage
-, click
-, fetchFromGitHub
-, incremental
-, pydantic
-, pythonOlder
-, typer
+{
+  lib,
+  aiohttp,
+  buildPythonPackage,
+  click,
+  fetchFromGitHub,
+  incremental,
+  pythonOlder,
+  setuptools,
+  typer,
 }:
 
 buildPythonPackage rec {
   pname = "ovoenergy";
-  version = "1.3.1";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "timmo001";
-    repo = pname;
+    repo = "ovoenergy";
     rev = "refs/tags/${version}";
-    hash = "sha256-oeNwBmzlkE8JewSwuFG8OYigyispP4xdwO3s2CAcfW4=";
+    hash = "sha256-ZcTSf7UejEUqQo0qEXP3fWjZYRx0a3ZBNVkwS2dL3Yk=";
   };
 
-  nativeBuildInputs = [
-    incremental
-  ];
+  build-system = [ setuptools ];
 
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "typer==0.6.1" "typer"
-  '';
+  nativeBuildInputs = [ incremental ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     click
-    pydantic
     typer
   ];
 
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "ovoenergy"
-  ];
+  pythonImportsCheck = [ "ovoenergy" ];
 
   meta = with lib; {
     description = "Python client for getting data from OVO's API";
     homepage = "https://github.com/timmo001/ovoenergy";
+    changelog = "https://github.com/timmo001/ovoenergy/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pipdeptree/default.nix b/pkgs/development/python-modules/pipdeptree/default.nix
index a7b132c230889..f42041f1a56f0 100644
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pipdeptree";
-  version = "2.16.2";
+  version = "2.18.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "tox-dev";
     repo = "pipdeptree";
     rev = "refs/tags/${version}";
-    hash = "sha256-g0O0ndHd2ehBUmHwb0HoWgCGSsqbjmlPFOd6KrkUv2Y=";
+    hash = "sha256-fzxshqh2QurpbilG0gC3NWnUntTRoxOHPpfpg6bPI98=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/playwrightcapture/default.nix b/pkgs/development/python-modules/playwrightcapture/default.nix
index 367ccb2e669d3..8acdacb7c9b68 100644
--- a/pkgs/development/python-modules/playwrightcapture/default.nix
+++ b/pkgs/development/python-modules/playwrightcapture/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "playwrightcapture";
-  version = "1.24.4";
+  version = "1.24.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "Lookyloo";
     repo = "PlaywrightCapture";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/6Sdn4SdJ7e2Lm6Gl0oaLNWeb6XouLgtjNJbVYstL4w=";
+    hash = "sha256-3xbjcvBx5pHlCwqAVJUpiGsa4s9lScORlEB4YLfkvv4=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/plexapi/default.nix b/pkgs/development/python-modules/plexapi/default.nix
index a8e2c3ef4bc18..1519e44dac0bd 100644
--- a/pkgs/development/python-modules/plexapi/default.nix
+++ b/pkgs/development/python-modules/plexapi/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "plexapi";
-  version = "4.15.11";
+  version = "4.15.12";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "pkkid";
     repo = "python-plexapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-OPhmw7nCe0n7VLekXeB5PiLdBk2DPmLoQ1nZiGEwqis=";
+    hash = "sha256-i+Vg1SWxDKprZu+crf0iallaAIApDpidJ//2mivAn18=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 0e53ee17e04af..358b81eb4c209 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -1,27 +1,28 @@
- { lib
-, aiohttp
-, async-timeout
-, buildPythonPackage
-, crcmod
-, defusedxml
-, fetchFromGitHub
-, freezegun
-, jsonpickle
-, munch
-, pyserial
-, pytest-aiohttp
-, pytest-asyncio
-, pytestCheckHook
-, python-dateutil
-, pythonOlder
-, semver
-, setuptools
-, wheel
+{
+  lib,
+  aiohttp,
+  async-timeout,
+  buildPythonPackage,
+  crcmod,
+  defusedxml,
+  fetchFromGitHub,
+  freezegun,
+  jsonpickle,
+  munch,
+  pyserial,
+  pytest-aiohttp,
+  pytest-asyncio,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  semver,
+  setuptools,
+  wheel,
 }:
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.37.2";
+  version = "0.37.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -30,7 +31,7 @@ buildPythonPackage rec {
     owner = "plugwise";
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zPh4yko35aMhiTTIDbaBgVruRDyolhtvTzTIhF5fo+Y=";
+    hash = "sha256-aQz0p+DNi1XVoFwdFjc3RjpHqA2kGf4pU1QS6m271gU=";
   };
 
   postPatch = ''
@@ -64,9 +65,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "plugwise"
-  ];
+  pythonImportsCheck = [ "plugwise" ];
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/development/python-modules/pluthon/default.nix b/pkgs/development/python-modules/pluthon/default.nix
index 51f73a7381c61..1ff7d05300023 100644
--- a/pkgs/development/python-modules/pluthon/default.nix
+++ b/pkgs/development/python-modules/pluthon/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     setuptools
     uplc
     ordered-set
-  ] ++ lib.optionals (pythonOlder "3.9") graphlib-backport;
+  ] ++ lib.optional (pythonOlder "3.9") graphlib-backport;
 
   pythonImportsCheck = [ "pluthon" ];
 
diff --git a/pkgs/development/python-modules/pmdsky-debug-py/default.nix b/pkgs/development/python-modules/pmdsky-debug-py/default.nix
index 8a8b89e604552..17511c8fc23b8 100644
--- a/pkgs/development/python-modules/pmdsky-debug-py/default.nix
+++ b/pkgs/development/python-modules/pmdsky-debug-py/default.nix
@@ -27,6 +27,6 @@ buildPythonPackage rec {
     description = "Autogenerated and statically check-able pmdsky-debug symbol definitions for Python";
     homepage = "https://github.com/SkyTemple/pmdsky-debug-py";
     license = licenses.mit;
-    maintainers = with maintainers; [ marius851000 xfix ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/prefixed/default.nix b/pkgs/development/python-modules/prefixed/default.nix
index 9b0efcad461ea..fadc4be3ff2c3 100644
--- a/pkgs/development/python-modules/prefixed/default.nix
+++ b/pkgs/development/python-modules/prefixed/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "prefixed";
-  version = "0.7.0";
+  version = "0.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-C1TRXmAuuK9Kwxsdsho36pXOWJDgdBuw3Z3tSTzvu+k=";
+    hash = "sha256-0QrJCs/EzBTYLBQIszCy/ahe187CIGqADUOJn4w4UmU=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/proton-core/default.nix b/pkgs/development/python-modules/proton-core/default.nix
index 9623cb0544d9d..07eb0b9fc7072 100644
--- a/pkgs/development/python-modules/proton-core/default.nix
+++ b/pkgs/development/python-modules/proton-core/default.nix
@@ -10,16 +10,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-core";
-  version = "0.1.15-unstable-2023-10-24";
+  version = "0.1.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-core";
-    rev = "5e795e04094dff67c03c56f2f3de03ff43514cc4";
-    hash = "sha256-hchwrolc65tVmSe2IzxwH2zDU2JZzXrCMzWaETWcMDI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-072XuHvgWludlFwp/tqLpuAU89vzifFhwQ01FuiCoL8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-keyring-linux-secretservice/default.nix b/pkgs/development/python-modules/proton-keyring-linux-secretservice/default.nix
index 78de141dad56b..db8a0d14cdb31 100644
--- a/pkgs/development/python-modules/proton-keyring-linux-secretservice/default.nix
+++ b/pkgs/development/python-modules/proton-keyring-linux-secretservice/default.nix
@@ -6,16 +6,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-keyring-linux-secretservice";
-  version = "0.0.1-unstable-2023-04-14";
+  version = "0.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-keyring-linux-secretservice";
-    rev = "973d2646ec4d04bc270df53058df892950244e70";
-    hash = "sha256-JlhvJBpbewT2c8k31CPMUlvvo/orWW1qfylFZLnDxeY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-IZPT2bL/1YD2TH/djwIQHUE1RRbYMTkQDacjjoqDQWo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-keyring-linux/default.nix b/pkgs/development/python-modules/proton-keyring-linux/default.nix
index 4dac98134ac0a..231a482658b37 100644
--- a/pkgs/development/python-modules/proton-keyring-linux/default.nix
+++ b/pkgs/development/python-modules/proton-keyring-linux/default.nix
@@ -7,16 +7,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-keyring-linux";
-  version = "0.0.1-unstable-2023-04-14";
+  version = "0.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-keyring-linux";
-    rev = "5ff3c7f9a1a162836649502dd23c2fbe1f487d73";
-    hash = "sha256-4d8ZePG8imURhdNtLbraMRisrTLoRvJ+L2UuuOo3MPM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-c2wdbd8Hkz2hF9zYMy4/V/W6uZRItz7tWqLJqTsJoHU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-api-core/default.nix b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
index ba8869e42daa4..3e602ab839de8 100644
--- a/pkgs/development/python-modules/proton-vpn-api-core/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
@@ -7,20 +7,21 @@
 , proton-vpn-logger
 , proton-vpn-killswitch
 , proton-vpn-session
+, sentry-sdk
 , distro
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "proton-vpn-api-core";
-  version = "0.20.3";
+  version = "0.22.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-api-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-acck0Nc/15soTJBC/4y83ID9fjF/q4vrYr6SsLAAVRY=";
+    hash = "sha256-BGei6tw6VTKkHmaIWa2VJfKOL5cRUbauOQ7zp1RY9Bo=";
   };
 
   nativeBuildInputs = [
@@ -34,6 +35,7 @@ buildPythonPackage rec {
     proton-vpn-logger
     proton-vpn-killswitch
     proton-vpn-session
+    sentry-sdk
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/proton-vpn-connection/default.nix b/pkgs/development/python-modules/proton-vpn-connection/default.nix
index 2257130c20e0e..9fb7250f10b33 100644
--- a/pkgs/development/python-modules/proton-vpn-connection/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-connection/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-connection";
-  version = "0.11.3";
+  version = "0.14.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-connection";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RuLnc/olI8S09WFG126N2xZgW4gf+DDpRstcelqMhs4=";
+    hash = "sha256-Ze/te0G0tDzyZPGVVqvuJlZoHWJqJ36LnHO+Cy5nxx8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-killswitch-network-manager/default.nix b/pkgs/development/python-modules/proton-vpn-killswitch-network-manager/default.nix
index d0f62ac6f9982..78e9b29a29254 100644
--- a/pkgs/development/python-modules/proton-vpn-killswitch-network-manager/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-killswitch-network-manager/default.nix
@@ -11,16 +11,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-vpn-killswitch-network-manager";
-  version = "0.2.0-unstable-2023-09-05";
+  version = "0.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-killswitch-network-manager";
-    rev = "39d4398f169539e335c1f661e0dfc5551df0e6af";
-    hash = "sha256-vmTXMIhXZgRvXeUX/XslT+ShqY60w4P7kJBQzWhA66k=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kN41b6OZ2YXoBsmNZD3NrX4uJChSmm6DVP+5LYwiZMw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-killswitch/default.nix b/pkgs/development/python-modules/proton-vpn-killswitch/default.nix
index d36dedfbd4aa9..912980453ad9c 100644
--- a/pkgs/development/python-modules/proton-vpn-killswitch/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-killswitch/default.nix
@@ -6,16 +6,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-vpn-killswitch";
-  version = "0.2.0-unstable-2023-09-05";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-killswitch";
-    rev = "6e84588ea6ae0946141d4b44b2cf5df8465d5eba";
-    hash = "sha256-eFwWN8E+nIDpbut8tkWqXucLhzm7HaLAMBIbAq/X2eo=";
+    rev = "v${version}";
+    hash = "sha256-XZqjAhxgIiATJd3JcW2WWUMC1b6+cfZRhXlIPyMUFH8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix b/pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix
index 9eca560ac0058..57c2615f53fcd 100644
--- a/pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix
@@ -8,16 +8,16 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "proton-vpn-network-manager-openvpn";
-  version = "0.0.4-unstable-2023-07-05";
+  version = "0.0.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-network-manager-openvpn";
-    rev = "b79f6732646378ef1b92696de3665ff9560286d3";
-    hash = "sha256-Z5X8RRu+1KaZ0pnH7tzGhfeST2W8bxMZnuryLhFjG/g=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-AHG4jEEv1ihpboQwz6FmNtlqCE83qyOeGzBDHQcvD6o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-network-manager/default.nix b/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
index ccd84eda66988..0327354e79277 100644
--- a/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-network-manager";
-  version = "0.3.3";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-network-manager";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UEXoIFLB3/q3G3ASrgsXxF21iT5rCWm4knGezcmxmnk=";
+    hash = "sha256-zw6fzay1zCBIrouDg2EMhaxDLKIYV5TKYK5lQ3v8W6o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-session/default.nix b/pkgs/development/python-modules/proton-vpn-session/default.nix
index 38d89bb6d3e02..6295038b6f9ee 100644
--- a/pkgs/development/python-modules/proton-vpn-session/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-session/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-session";
-  version = "0.6.5";
+  version = "0.6.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-session";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1oyCxBO9YqMopbw88UJF8k4BJFP4+m23NwSrqTYqcg8=";
+    hash = "sha256-/5ju/2bxhqK6JWchkxFe3amBKHtO98GCVQWIrUsn+nQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index e80b04011e94c..a8cd6193d74be 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "0.10.0.20240416";
+  version = "0.10.0.20240420";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Y0QP9SNJQOMGEKAEeDwKNTRQtFiwUOWGLbkGJx66SBk=";
+    hash = "sha256-s8xPkes/xFlejqfOlMZOPLmNK92e2TLK18UZmv3/a6I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pulsectl-asyncio/default.nix b/pkgs/development/python-modules/pulsectl-asyncio/default.nix
index 54500916e8844..1a985c8ab1d33 100644
--- a/pkgs/development/python-modules/pulsectl-asyncio/default.nix
+++ b/pkgs/development/python-modules/pulsectl-asyncio/default.nix
@@ -1,16 +1,16 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pulsectl
-, pythonOlder
-, setuptools
-, wheel
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pulsectl,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pulsectl-asyncio";
-  version = "1.1.1";
-  format = "pyproject";
+  version = "1.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -18,24 +18,17 @@ buildPythonPackage rec {
     owner = "mhthies";
     repo = "pulsectl-asyncio";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Uc8iUo9THWNPRRsvJxfw++41cnKrANe/Fk6e8bgLSkc=";
+    hash = "sha256-WqUO4eERJkRg6O+gCmjqfdVbBT/3TVVBUUduoIxcPNQ=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
-    pulsectl
-  ];
+  dependencies = [ pulsectl ];
 
   # Tests require a running pulseaudio instance
   doCheck = false;
 
-  pythonImportsCheck = [
-    "pulsectl_asyncio"
-  ];
+  pythonImportsCheck = [ "pulsectl_asyncio" ];
 
   meta = with lib; {
     description = "Python bindings library for PulseAudio";
diff --git a/pkgs/development/python-modules/py-desmume/default.nix b/pkgs/development/python-modules/py-desmume/default.nix
index 6d63a7db9c8f0..1009a1fbedb7a 100644
--- a/pkgs/development/python-modules/py-desmume/default.nix
+++ b/pkgs/development/python-modules/py-desmume/default.nix
@@ -64,6 +64,6 @@ buildPythonPackage rec {
     description = "Python library to interface with DeSmuME, the Nintendo DS emulator";
     homepage = "https://github.com/SkyTemple/py-desmume";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ marius851000 xfix ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/pyfritzhome/default.nix b/pkgs/development/python-modules/pyfritzhome/default.nix
index 32450e254ea12..4118e780d3d0b 100644
--- a/pkgs/development/python-modules/pyfritzhome/default.nix
+++ b/pkgs/development/python-modules/pyfritzhome/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyfritzhome";
-  version = "0.6.10";
+  version = "0.6.11";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "hthiery";
     repo = "python-fritzhome";
     rev = "refs/tags/${version}";
-    hash = "sha256-jdv49cpd2ewfrhWzjWM5Uxhaj3UZfOXMMOZeobpXe0E=";
+    hash = "sha256-YzrRkFa4J3NXdc4W5CHrHvqSVJ8yBGtaf6gRqmiY7gI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pygtkspellcheck/default.nix b/pkgs/development/python-modules/pygtkspellcheck/default.nix
index 22b71bdbac833..1f9ac10b9eb45 100644
--- a/pkgs/development/python-modules/pygtkspellcheck/default.nix
+++ b/pkgs/development/python-modules/pygtkspellcheck/default.nix
@@ -39,6 +39,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/koehlma/pygtkspellcheck";
     description = "A Python spell-checking library for GtkTextViews based on Enchant";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ xfix ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pylitterbot/default.nix b/pkgs/development/python-modules/pylitterbot/default.nix
index ecf1ca2e4ef61..add82ecc2d15f 100644
--- a/pkgs/development/python-modules/pylitterbot/default.nix
+++ b/pkgs/development/python-modules/pylitterbot/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pylitterbot";
-  version = "2023.4.11";
+  version = "2023.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "natekspencer";
     repo = "pylitterbot";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OTyQgcGGNktCgYJN33SZn7La7ec+gwR/yVDuH7kcEh4=";
+    hash = "sha256-MSQdX2PKQohmPGqtRZnUmCCVgKgaf4+cHAUItiPv7pY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyowm/default.nix b/pkgs/development/python-modules/pyowm/default.nix
index d95cda12d600b..d342ce313e8cb 100644
--- a/pkgs/development/python-modules/pyowm/default.nix
+++ b/pkgs/development/python-modules/pyowm/default.nix
@@ -1,58 +1,54 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, geojson
-, pysocks
-, pythonOlder
-, requests
-, pytestCheckHook
-, pythonRelaxDepsHook
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  geojson,
+  pysocks,
+  pythonOlder,
+  requests,
+  setuptools,
+  pytestCheckHook,
+  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
   pname = "pyowm";
   version = "3.3.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "csparpa";
-    repo = pname;
-    rev = version;
+    repo = "pyowm";
+    rev = "refs/tags/${version}";
     hash = "sha256-cSOhm3aDksLBChZzgw1gjUjLQkElR2/xGFMOb9K9RME=";
   };
 
-  pythonRelaxDeps = [
-    "geojson"
-  ];
+  pythonRelaxDeps = [ "geojson" ];
 
-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     geojson
     pysocks
     requests
+    setuptools
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   # Run only tests which don't require network access
-  pytestFlagsArray = [
-    "tests/unit"
-  ];
+  pytestFlagsArray = [ "tests/unit" ];
 
-  pythonImportsCheck = [
-    "pyowm"
-  ];
+  pythonImportsCheck = [ "pyowm" ];
 
   meta = with lib; {
     description = "Python wrapper around the OpenWeatherMap web API";
     homepage = "https://pyowm.readthedocs.io/";
+    changelog = "https://github.com/csparpa/pyowm/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pypresence/default.nix b/pkgs/development/python-modules/pypresence/default.nix
index 32f81827836b4..87b32a590769a 100644
--- a/pkgs/development/python-modules/pypresence/default.nix
+++ b/pkgs/development/python-modules/pypresence/default.nix
@@ -17,6 +17,6 @@ buildPythonPackage rec {
     homepage = "https://qwertyquerty.github.io/pypresence/html/index.html";
     description = "Discord RPC client written in Python";
     license = licenses.mit;
-    maintainers = with maintainers; [ xfix ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pyqtdarktheme/add-missing-argument-to-the-proxy-style-initializer.patch b/pkgs/development/python-modules/pyqtdarktheme/add-missing-argument-to-the-proxy-style-initializer.patch
new file mode 100644
index 0000000000000..9d77e2901bed0
--- /dev/null
+++ b/pkgs/development/python-modules/pyqtdarktheme/add-missing-argument-to-the-proxy-style-initializer.patch
@@ -0,0 +1,25 @@
+From 816afb6a3a6a340ae2a2a06dc054dd8e65ff9d8f Mon Sep 17 00:00:00 2001
+From: Pavel Sobolev <paveloom@riseup.net>
+Date: Mon, 30 Oct 2023 20:42:31 +0300
+Subject: [PATCH] Add missing argument to the `proxy_style` initializer.
+
+---
+ qdarktheme/_proxy_style.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/qdarktheme/_proxy_style.py b/qdarktheme/_proxy_style.py
+index b1fb358..f04f01e 100644
+--- a/qdarktheme/_proxy_style.py
++++ b/qdarktheme/_proxy_style.py
+@@ -14,7 +14,7 @@ class QDarkThemeStyle(QProxyStyle):
+
+     def __init__(self):
+         """Initialize style proxy."""
+-        super().__init__()
++        super().__init__(None)
+
+     def standardIcon(  # noqa: N802
+         self, standard_icon: QStyle.StandardPixmap, option: QStyleOption | None, widget
+--
+2.42.0
+
diff --git a/pkgs/development/python-modules/pyqtdarktheme/default.nix b/pkgs/development/python-modules/pyqtdarktheme/default.nix
new file mode 100644
index 0000000000000..0d60c8039898f
--- /dev/null
+++ b/pkgs/development/python-modules/pyqtdarktheme/default.nix
@@ -0,0 +1,70 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+
+, darkdetect
+, poetry-core
+
+, pyqt5
+, pytest-mock
+, pytest-qt
+, pytestCheckHook
+, qt5
+}:
+
+buildPythonPackage rec {
+  pname = "pyqtdarktheme";
+  version = "2.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "5yutan5";
+    repo = "PyQtDarkTheme";
+    rev = "v${version}";
+    hash = "sha256-jK+wnIyPE8Bav0pzbvVisYYCzdRshYw1S2t0H3Pro5M=";
+  };
+
+  patches = [
+    ./add-missing-argument-to-the-proxy-style-initializer.patch
+  ];
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    darkdetect
+  ];
+
+  nativeCheckInputs = [
+    pyqt5
+    pytest-mock
+    pytest-qt
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "qdarktheme"
+  ];
+
+  prePatch = ''
+    sed -i 's#darkdetect = ".*"#darkdetect = "*"#' pyproject.toml
+  '';
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    export QT_PLUGIN_PATH="${qt5.qtbase.bin}/${qt5.qtbase.qtPluginPrefix}"
+    export QT_QPA_PLATFORM_PLUGIN_PATH="${qt5.qtbase.bin}/lib/qt-${qt5.qtbase.version}/plugins";
+    export QT_QPA_PLATFORM=offscreen
+  '';
+
+  meta = with lib; {
+    description = "A flat dark theme for PySide and PyQt";
+    homepage = "https://pyqtdarktheme.readthedocs.io/en/stable";
+    license = licenses.mit;
+    maintainers = with maintainers; [ paveloom ];
+  };
+}
diff --git a/pkgs/development/python-modules/pysolcast/default.nix b/pkgs/development/python-modules/pysolcast/default.nix
index 891856f35b8c0..3123b1f392c68 100644
--- a/pkgs/development/python-modules/pysolcast/default.nix
+++ b/pkgs/development/python-modules/pysolcast/default.nix
@@ -1,20 +1,21 @@
-{ lib
-, anyconfig
-, buildPythonPackage
-, fetchFromGitHub
-, isodate
-, pytestCheckHook
-, pythonOlder
-, pyyaml
-, requests
-, responses
-, poetry-core
-, pythonRelaxDepsHook
+{
+  lib,
+  anyconfig,
+  buildPythonPackage,
+  fetchFromGitHub,
+  isodate,
+  pytestCheckHook,
+  pythonOlder,
+  pyyaml,
+  requests,
+  responses,
+  poetry-core,
+  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
   pname = "pysolcast";
-  version = "2.0.1";
+  version = "2.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,19 +24,16 @@ buildPythonPackage rec {
     owner = "mcaulifn";
     repo = "solcast";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JzGrE6zKj16Uzm3EC8ysMbgP5ouA00Gact7NYXbEkXI=";
+    hash = "sha256-DXJkbAlkxBjUEbziFNdr8SilB2GRUoAwvrr0HY56Deg=";
   };
 
-  pythonRelaxDeps = [
-    "responses"
-  ];
+  pythonRelaxDeps = [ "responses" ];
 
-  nativeBuildInputs = [
-    poetry-core
-    pythonRelaxDepsHook
-  ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [
     anyconfig
     isodate
     pyyaml
@@ -47,9 +45,7 @@ buildPythonPackage rec {
     responses
   ];
 
-  pythonImportsCheck = [
-    "pysolcast"
-  ];
+  pythonImportsCheck = [ "pysolcast" ];
 
   meta = with lib; {
     description = "Python library for interacting with the Solcast API";
diff --git a/pkgs/development/python-modules/python-homeassistant-analytics/default.nix b/pkgs/development/python-modules/python-homeassistant-analytics/default.nix
new file mode 100644
index 0000000000000..633e8baf58532
--- /dev/null
+++ b/pkgs/development/python-modules/python-homeassistant-analytics/default.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  aiohttp,
+  yarl,
+  mashumaro,
+  orjson,
+
+  # tests
+  pytestCheckHook,
+  aioresponses,
+  pytest-asyncio,
+  syrupy,
+}:
+
+buildPythonPackage rec {
+  pname = "python-homeassistant-analytics";
+  version = "0.6.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.11";
+
+  src = fetchFromGitHub {
+    owner = "joostlek";
+    repo = "python-homeassistant-analytics";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uGi72UCIIvb5XZl7RkiAiR/TS+5VCpyvZfBsmlPzQEs=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "--cov" ""
+  '';
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    aiohttp
+    yarl
+    mashumaro
+    orjson
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    aioresponses
+    pytest-asyncio
+    syrupy
+  ];
+
+  pythonImportsCheck = [ "python_homeassistant_analytics" ];
+
+  meta = with lib; {
+    changelog = "https://github.com/joostlek/python-homeassistant-analytics
+/releases/tag/v${version}";
+    description = "Asynchronous Python client for Homeassistant Analytics";
+    homepage = "https://github.com/joostlek/python-homeassistant-analytics
+";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/qtile-extras/default.nix b/pkgs/development/python-modules/qtile-extras/default.nix
index 198cbdcdddf31..84cc437e48ca4 100644
--- a/pkgs/development/python-modules/qtile-extras/default.nix
+++ b/pkgs/development/python-modules/qtile-extras/default.nix
@@ -1,50 +1,52 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, setuptools-scm
-, pytestCheckHook
-, xorgserver
-, imagemagick
-, gobject-introspection
-, pulseaudio
-, pytest-asyncio
-, pytest-lazy-fixture
-, qtile
-, keyring
-, requests
-, librsvg
-, gtk3
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  gobject-introspection,
+  gtk3,
+  imagemagick,
+  keyring,
+  librsvg,
+  pulseaudio,
+  pytest-asyncio,
+  pytest-lazy-fixture,
+  pytestCheckHook,
+  qtile,
+  requests,
+  setuptools-scm,
+  xorgserver,
 }:
 
 buildPythonPackage rec {
   pname = "qtile-extras";
   version = "0.25.0";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elParaguayo";
-    repo = pname;
+    repo = "qtile-extras";
     rev = "refs/tags/v${version}";
     hash = "sha256-OYzSKOVg4D5gKxaEreclYq3D16dl8ddLipSdifokDNY=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];
+
+  dependencies = [ gtk3 ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-    xorgserver
-    imagemagick
     gobject-introspection
-  ];
-  checkInputs = [
+    imagemagick
+    keyring
+    pulseaudio
     pytest-asyncio
     pytest-lazy-fixture
+    pytestCheckHook
     qtile
-    pulseaudio
-    keyring
     requests
+    xorgserver
     # stravalib  # marked as broken due to https://github.com/stravalib/stravalib/issues/379
   ];
+
   disabledTests = [
     # Needs a running DBUS
     "test_brightness_power_saving"
@@ -55,12 +57,13 @@ buildPythonPackage rec {
     "test_wifiicon_internet_check"
     # Image difference is outside tolerance
     "test_decoration_output"
-    # Needs github token
+    # Needs Github token
     "test_githubnotifications_reload_token"
     # AttributeError: 'NoneType' object has no attribute 'theta'
     "test_image_size_horizontal"
     "test_image_size_vertical"
   ];
+
   disabledTestPaths = [
     # Needs a running DBUS
     "test/widget/test_iwd.py"
@@ -68,16 +71,13 @@ buildPythonPackage rec {
     # Marked as broken due to https://github.com/stravalib/stravalib/issues/379
     "test/widget/test_strava.py"
   ];
+
   preCheck = ''
     export HOME=$(mktemp -d)
     export GDK_PIXBUF_MODULE_FILE=${librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache
     sed -i 's#/usr/bin/sleep#sleep#' test/widget/test_snapcast.py
   '';
 
-  propagatedBuildInputs = [
-    gtk3
-  ];
-
   pythonImportsCheck = [ "qtile_extras" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/qtile/default.nix b/pkgs/development/python-modules/qtile/default.nix
index 9a3ecbafc049e..3067892e638ac 100644
--- a/pkgs/development/python-modules/qtile/default.nix
+++ b/pkgs/development/python-modules/qtile/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "qtile";
-  version = "0.24.0";
+  version = "0.25.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "qtile";
     repo = "qtile";
-    rev = "v${version}";
-    hash = "sha256-mgMRkoKT0Gp5/OfVQbkeDTkg9QRFn4PU3ziM5E6V+oI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-j5hpXfUSDUT9nBr6CafIzqdTYQxSWok+ZlQA7bGdVvk=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/recurring-ical-events/default.nix b/pkgs/development/python-modules/recurring-ical-events/default.nix
index b4f5df6e42da0..fd5cdb62dd7c5 100644
--- a/pkgs/development/python-modules/recurring-ical-events/default.nix
+++ b/pkgs/development/python-modules/recurring-ical-events/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "recurring-ical-events";
-  version = "2.1.3";
+  version = "2.2.0";
 
   disabled = pythonOlder "3.7";
 
@@ -25,14 +25,14 @@ buildPythonPackage rec {
     owner = "niccokunzmann";
     repo = "python-recurring-ical-events";
     rev = "v${version}";
-    hash = "sha256-K2pflwHpzuYDMNUB7YQu6NX21O0aOwRChBgjdiwFQ+Y=";
+    hash = "sha256-Njd+sc35jlA96iVf2uuVN2BK92ctwUDfBAUfpgqtPs0=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     icalendar
     pytz
     python-dateutil
diff --git a/pkgs/development/python-modules/result/default.nix b/pkgs/development/python-modules/result/default.nix
index 3f15c2ce4c1a7..111c8dad2a306 100644
--- a/pkgs/development/python-modules/result/default.nix
+++ b/pkgs/development/python-modules/result/default.nix
@@ -2,18 +2,20 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pytest-asyncio
+, nix-update-script
 }:
 
 buildPythonPackage rec {
   pname = "result";
-  version = "0.7.0";
+  version = "0.16.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "rustedpy";
     repo = "result";
-     rev = "v${version}";
-    hash = "sha256-bEf3OJg6ksDvzZE7ezA58Q2FObb5V7BG8vkKtX284Jg=";
+    rev = "v${version}";
+    hash = "sha256-7BvFIQbl4Udd9GTpbMrAqP0P1BGn/C1CHQ3QUCEMXPs=";
   };
 
   postPatch = ''
@@ -28,19 +30,16 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-asyncio
   ];
 
-  disabledTestPaths = [
-    #TODO: figure out the failure "match o:" Invalid Syntax
-    "tests/test_pattern_matching.py"
-  ];
-
+  passthru.updateScript = nix-update-script {};
   pythonImportsCheck = [ "result" ];
 
   meta = with lib; {
     description = "A simple Result type for Python 3 inspired by Rust, fully type annotated";
     homepage = "https://github.com/rustedpy/result";
     license = licenses.mit;
-    maintainers = [];
+    maintainers = with lib.maintainers; [ emattiza ];
   };
 }
diff --git a/pkgs/development/python-modules/rustworkx/default.nix b/pkgs/development/python-modules/rustworkx/default.nix
index b199defc2a080..69b231854995d 100644
--- a/pkgs/development/python-modules/rustworkx/default.nix
+++ b/pkgs/development/python-modules/rustworkx/default.nix
@@ -15,19 +15,19 @@
 
 buildPythonPackage rec {
   pname = "rustworkx";
-  version = "0.13.1";
+  version = "0.14.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Qiskit";
     repo = pname;
     rev = version;
-    hash = "sha256-WwQuvRMDGiY9VrWPfxL0OotPCUhCsvbXoVSCNhmIF/g=";
+    hash = "sha256-gck5X6J4Yg5it/YCBsk/yZ5qXg/iwCEbyDIKfBTRxHM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
-    hash = "sha256-QuzBJyM83VtB6CJ7i9/SFE8h6JbxkX/LQ9lOFSQIidU=";
+    hash = "sha256-FNCa5pshcnsYpjlz6yDITe2k0cHLTybj3rF34qrsRVU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/setuptools-dso/default.nix b/pkgs/development/python-modules/setuptools-dso/default.nix
index c33a89deabf6d..306d6b794e609 100644
--- a/pkgs/development/python-modules/setuptools-dso/default.nix
+++ b/pkgs/development/python-modules/setuptools-dso/default.nix
@@ -25,6 +25,6 @@ buildPythonPackage rec {
     description = "setuptools extension for building non-Python Dynamic Shared Objects";
     homepage = "https://github.com/mdavidsaver/setuptools_dso";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ marius851000 xfix ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/skytemple-dtef/default.nix b/pkgs/development/python-modules/skytemple-dtef/default.nix
index 1c1edb663e3c9..92b03f7d35496 100644
--- a/pkgs/development/python-modules/skytemple-dtef/default.nix
+++ b/pkgs/development/python-modules/skytemple-dtef/default.nix
@@ -38,6 +38,6 @@ buildPythonPackage rec {
     description = "A format for standardized rule-based tilesets with 256 adjacency combinations";
     homepage = "https://github.com/SkyTemple/skytemple-dtef";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ marius851000 xfix ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/skytemple-eventserver/default.nix b/pkgs/development/python-modules/skytemple-eventserver/default.nix
index dc31cbcbd9eca..94c38cbcf468c 100644
--- a/pkgs/development/python-modules/skytemple-eventserver/default.nix
+++ b/pkgs/development/python-modules/skytemple-eventserver/default.nix
@@ -19,6 +19,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/SkyTemple/skytemple-eventserver";
     description = "Websocket server that emits SkyTemple UI events";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ marius851000 xfix ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/skytemple-files/default.nix b/pkgs/development/python-modules/skytemple-files/default.nix
index 1b8d744b7d175..1f91f3a4bea20 100644
--- a/pkgs/development/python-modules/skytemple-files/default.nix
+++ b/pkgs/development/python-modules/skytemple-files/default.nix
@@ -89,7 +89,7 @@ buildPythonPackage rec {
     description = "Python library to edit the ROM of Pokémon Mystery Dungeon Explorers of Sky";
     mainProgram = "skytemple_export_maps";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ xfix marius851000 ];
+    maintainers = with maintainers; [ marius851000 ];
     broken = stdenv.isDarwin; # pyobjc is missing
   };
 }
diff --git a/pkgs/development/python-modules/skytemple-icons/default.nix b/pkgs/development/python-modules/skytemple-icons/default.nix
index 34b9dd5cee730..b78bc27e3c259 100644
--- a/pkgs/development/python-modules/skytemple-icons/default.nix
+++ b/pkgs/development/python-modules/skytemple-icons/default.nix
@@ -19,6 +19,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/SkyTemple/skytemple-icons";
     description = "Icons for SkyTemple";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ xfix ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/skytemple-rust/default.nix b/pkgs/development/python-modules/skytemple-rust/default.nix
index 411aadb9b400e..5a604db033e61 100644
--- a/pkgs/development/python-modules/skytemple-rust/default.nix
+++ b/pkgs/development/python-modules/skytemple-rust/default.nix
@@ -40,6 +40,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/SkyTemple/skytemple-rust";
     description = "Binary Rust extensions for SkyTemple";
     license = licenses.mit;
-    maintainers = with maintainers; [ xfix marius851000 ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix b/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix
index c378053c206af..324f34f33524d 100644
--- a/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix
+++ b/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix
@@ -58,6 +58,6 @@ buildPythonPackage rec {
     description = "Script Engine Debugger for Pokémon Mystery Dungeon Explorers of Sky";
     mainProgram = "skytemple-ssb-debugger";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ marius851000 xfix ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/skytemple-ssb-emulator/default.nix b/pkgs/development/python-modules/skytemple-ssb-emulator/default.nix
index d3bbb87d6e09a..39c034e3d87a2 100644
--- a/pkgs/development/python-modules/skytemple-ssb-emulator/default.nix
+++ b/pkgs/development/python-modules/skytemple-ssb-emulator/default.nix
@@ -73,6 +73,6 @@ buildPythonPackage rec {
     description = "SkyTemple Script Engine Debugger Emulator Backend";
     homepage = "https://github.com/SkyTemple/skytemple-ssb-emulator";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ marius851000 xfix ];
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/development/python-modules/smpp.pdu/default.nix b/pkgs/development/python-modules/smpp-pdu/default.nix
index 8860c4b2c531b..e320b7e242c64 100644
--- a/pkgs/development/python-modules/smpp.pdu/default.nix
+++ b/pkgs/development/python-modules/smpp-pdu/default.nix
@@ -10,7 +10,7 @@
 }:
 
 buildPythonPackage {
-  pname = "smpp.pdu";
+  pname = "smpp-pdu";
   version = "unstable-2022-09-02";
   format = "pyproject";
 
diff --git a/pkgs/development/python-modules/snorkel/default.nix b/pkgs/development/python-modules/snorkel/default.nix
index 8da4fd87d736c..04e605d14554b 100644
--- a/pkgs/development/python-modules/snorkel/default.nix
+++ b/pkgs/development/python-modules/snorkel/default.nix
@@ -16,7 +16,7 @@
 , pyspark
 , dill
 , dask
-, spacy_models
+, spacy-models
 }:
 let
   pname = "snorkel";
@@ -56,7 +56,7 @@ buildPythonPackage {
     pyspark
     dill
     dask
-    spacy_models.en_core_web_sm
+    spacy-models.en_core_web_sm
   ] ++ dask.optional-dependencies.distributed;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix b/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix
index c9e1f3400f3a1..f2b4bfb3a068f 100644
--- a/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pytest, spacy_models }:
+{ stdenv, pytest, spacy-models }:
 
 stdenv.mkDerivation {
   name = "spacy-transformers-annotation-test";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   dontBuild = true;
   doCheck = true;
 
-  nativeCheckInputs = [ pytest spacy_models.en_core_web_trf ];
+  nativeCheckInputs = [ pytest spacy-models.en_core_web_trf ];
 
   checkPhase = ''
     pytest annotate.py
diff --git a/pkgs/development/python-modules/spacy/annotation-test/default.nix b/pkgs/development/python-modules/spacy/annotation-test/default.nix
index c7d5efe86641a..91ab0f33acaac 100644
--- a/pkgs/development/python-modules/spacy/annotation-test/default.nix
+++ b/pkgs/development/python-modules/spacy/annotation-test/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pytest, spacy_models }:
+{ stdenv, pytest, spacy-models }:
 
 stdenv.mkDerivation {
   name = "spacy-annotation-test";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   dontBuild = true;
   doCheck = true;
 
-  nativeCheckInputs = [ pytest spacy_models.en_core_web_sm ];
+  nativeCheckInputs = [ pytest spacy-models.en_core_web_sm ];
 
   checkPhase = ''
     pytest annotate.py
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index fa1c101ecb386..8e2bd3cb48707 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -123,7 +123,7 @@ buildPythonPackage rec {
       nix-update python3Packages.spacy
 
       # update spacy models as well
-      echo | nix-shell maintainers/scripts/update.nix --argstr package python3Packages.spacy_models.en_core_web_sm
+      echo | nix-shell maintainers/scripts/update.nix --argstr package python3Packages.spacy-models.en_core_web_sm
     '';
     tests.annotation = callPackage ./annotation-test { };
   };
diff --git a/pkgs/development/python-modules/sphinx-codeautolink/default.nix b/pkgs/development/python-modules/sphinx-codeautolink/default.nix
index e7defb682db32..6b024d4fd83bf 100644
--- a/pkgs/development/python-modules/sphinx-codeautolink/default.nix
+++ b/pkgs/development/python-modules/sphinx-codeautolink/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "sphinx-codeautolink";
-  version = "0.15.0";
+  version = "0.15.1";
   format = "pyproject";
 
   outputs = [ "out" "doc" ];
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "felix-hilden";
     repo = "sphinx-codeautolink";
     rev = "refs/tags/v${version}";
-    hash = "sha256-iXUdOwyTRViDTDRPCcteiJ2Rcdbpiol7JPEzqbUwIPc=";
+    hash = "sha256-BnGcLAM/KK8Ub+GmRY1oatUCyP4hvY2O1WTjLHBebpw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/srpenergy/default.nix b/pkgs/development/python-modules/srpenergy/default.nix
index 35a937f960888..8d82ad614d0dc 100644
--- a/pkgs/development/python-modules/srpenergy/default.nix
+++ b/pkgs/development/python-modules/srpenergy/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, setuptools
 , python-dateutil
 , requests
 , pytestCheckHook
@@ -9,19 +10,28 @@
 
 buildPythonPackage rec {
   pname = "srpenergy";
-  version = "1.3.6";
-  format = "setuptools";
+  version = "1.3.7";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "lamoreauxlab";
     repo = "srpenergy-api-client-python";
-    rev = version;
-    hash = "sha256-aZnqGtfklWgigac2gdkQv29Qy5HC34zGGY2iWr2cOMo=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-bdBF5y9hRj4rceUD5qjHOM9TIaHGElJ36YjWCJgCzX8=";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools==" "setuptools>="
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     python-dateutil
     requests
   ];
@@ -33,6 +43,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "srpenergy.client" ];
 
   meta = with lib; {
+    changelog = "https://github.com/lamoreauxlab/srpenergy-api-client-python/releases/tag/${version}";
     description = "Unofficial Python module for interacting with Srp Energy data";
     homepage = "https://github.com/lamoreauxlab/srpenergy-api-client-python";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/std-uritemplate/default.nix b/pkgs/development/python-modules/std-uritemplate/default.nix
index 0c26a135d0ef1..5b5d2faa301c7 100644
--- a/pkgs/development/python-modules/std-uritemplate/default.nix
+++ b/pkgs/development/python-modules/std-uritemplate/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "std-uritemplate";
-  version = "0.0.56";
+  version = "0.0.57";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "std_uritemplate";
     inherit version;
-    hash = "sha256-85dldY+2WB+Hn6fBBHoKJ7fIe7fDyddYxAjDD83lHGc=";
+    hash = "sha256-9K3HF67BOFYuZSuV2nT8aBWpQiMdlxMUhWuB9DTBuUw=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/taskw-ng/default.nix b/pkgs/development/python-modules/taskw-ng/default.nix
new file mode 100644
index 0000000000000..28c15922d2544
--- /dev/null
+++ b/pkgs/development/python-modules/taskw-ng/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, poetry-dynamic-versioning
+, kitchen
+, packaging
+, python-dateutil
+, pytz
+, taskwarrior
+}:
+
+buildPythonPackage rec {
+  pname = "taskw-ng";
+  version = "0.2.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bergercookie";
+    repo = "taskw-ng";
+    rev = "v${version}";
+    hash = "sha256-tlidTt0TzWnvfajYiIfvRv7OfakHY6zWAicmAwq/Z8w=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'pytz = "^2023.3.post1"' 'pytz = "*"'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+    poetry-dynamic-versioning
+  ];
+
+  propagatedBuildInputs = [
+    kitchen
+    packaging
+    python-dateutil
+    pytz
+  ];
+
+  checkInputs = [
+    taskwarrior
+  ];
+
+  # TODO: doesn't pass because `can_use` fails and `task --version` seems not to be answering.
+  # pythonImportsCheck = [ "taskw_ng" ];
+
+  meta = with lib; {
+    description = "";
+    homepage = "https://github.com/bergercookie/taskw-ng";
+    changelog = "https://github.com/bergercookie/taskw-ng/blob/${src.rev}/CHANGELOG.rst";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index ca7643127fb6c..771971445156f 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1131";
+  version = "3.0.1133";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-7VhDVpBcW/uDOvwkCpB+dHrTa+fC7mu6UWuSbnymJgU=";
+    hash = "sha256-RQudhUn4BfsdwQOCt9CUuKVVlXbHLMEohg6C2srZ9pk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tilequant/default.nix b/pkgs/development/python-modules/tilequant/default.nix
index c25c9ff2659c6..906f644d89b11 100644
--- a/pkgs/development/python-modules/tilequant/default.nix
+++ b/pkgs/development/python-modules/tilequant/default.nix
@@ -51,7 +51,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/SkyTemple/tilequant";
     changelog = "https://github.com/SkyTemple/tilequant/releases/tag/${version}";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ marius851000 xfix ];
+    maintainers = with maintainers; [ marius851000 ];
     mainProgram = "tilequant";
   };
 }
diff --git a/pkgs/development/python-modules/txtai/default.nix b/pkgs/development/python-modules/txtai/default.nix
index 4bf59621b5ca7..256ed0889bfe7 100644
--- a/pkgs/development/python-modules/txtai/default.nix
+++ b/pkgs/development/python-modules/txtai/default.nix
@@ -52,7 +52,7 @@
 , unittestCheckHook
 }:
 let
-  version = "7.0.0";
+  version = "7.1.0";
   api = [ aiohttp fastapi uvicorn ];
   # cloud = [ apache-libcloud ];
   console = [ rich ];
@@ -105,7 +105,7 @@ buildPythonPackage {
     owner = "neuml";
     repo = "txtai";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dYAzbdGEu9gAUzptuSfej6T5LPyTneRWigdAMlGgeqM=";
+    hash = "sha256-L+L2jRkCQKOgd1k3N4mft0Kt6kvCN81lgSQUjoon5rk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-psycopg2/default.nix b/pkgs/development/python-modules/types-psycopg2/default.nix
index 4dce98b9c3795..e9901ef6678d5 100644
--- a/pkgs/development/python-modules/types-psycopg2/default.nix
+++ b/pkgs/development/python-modules/types-psycopg2/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-psycopg2";
-  version = "2.9.21.20240311";
+  version = "2.9.21.20240417";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cilF3/pqcpvrxmDxQTfzft/OrVosFesjQhKn0BfugHI=";
+    hash = "sha256-Bdslb0pFn7IaQmuOf8oGVsNTkQX/Agjq9r2vQGo4cIc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-redis/default.nix b/pkgs/development/python-modules/types-redis/default.nix
index 53d38125f8f56..9b81e9e8e57bd 100644
--- a/pkgs/development/python-modules/types-redis/default.nix
+++ b/pkgs/development/python-modules/types-redis/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "types-redis";
-  version = "4.6.0.20240409";
+  version = "4.6.0.20240417";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ziF8J5WB12nfmSxbdtYcZUJbCmeWJgSOYz5kOGjriBs=";
+    hash = "sha256-i+Sz5ZRRIKze8KI0jAS+QolOhMbWFiiLkIo9jtXomo0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/types-tqdm/default.nix b/pkgs/development/python-modules/types-tqdm/default.nix
index 3029545302aa1..339a83f7b17ca 100644
--- a/pkgs/development/python-modules/types-tqdm/default.nix
+++ b/pkgs/development/python-modules/types-tqdm/default.nix
@@ -7,17 +7,17 @@
 
 buildPythonPackage rec {
   pname = "types-tqdm";
-  version = "4.66.0.20240106";
+  version = "4.66.0.20240417";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-es9KreW6097XbrgpeD+ZYbHCGHlI6qbdGuhkTf+VqTg=";
+    hash = "sha256-Ftzp71IuqNQOT1uNhN2KEWbu/BPO7np+FYvw8aFCGjE=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/unidata-blocks/default.nix b/pkgs/development/python-modules/unidata-blocks/default.nix
index 1275543088d39..93857756bb651 100644
--- a/pkgs/development/python-modules/unidata-blocks/default.nix
+++ b/pkgs/development/python-modules/unidata-blocks/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "unidata-blocks";
-  version = "0.0.9";
+  version = "0.0.10";
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     pname = "unidata_blocks";
     inherit version;
-    hash = "sha256-OuIhajgUyO5qdcxJCO06Q1xNbeSNGzlbaWnAqXORm9g=";
+    hash = "sha256-wwiOjfIAx6AZtK98uuPQ0jwblq+CdnMQp+JkQWh+RgM=";
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/vt-py/default.nix b/pkgs/development/python-modules/vt-py/default.nix
index 2db6ff91f9ed4..f8e2a8bd56936 100644
--- a/pkgs/development/python-modules/vt-py/default.nix
+++ b/pkgs/development/python-modules/vt-py/default.nix
@@ -1,40 +1,42 @@
-{ lib
-, aiohttp
-, buildPythonPackage
-, fetchFromGitHub
-, pytest-asyncio
-, pytest-httpserver
-, pytestCheckHook
-, pythonOlder
-, setuptools
+{
+  lib,
+  aiohttp,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytest-asyncio,
+  pytest-httpserver,
+  pytestCheckHook,
+  pythonRelaxDepsHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "vt-py";
-  version = "0.18.0";
+  version = "0.18.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
-    repo = pname;
+    repo = "vt-py";
     rev = "refs/tags/${version}";
-    hash = "sha256-QEe/ZoKM0uVH7Yqpgo7V17Odn4xqdEgdQeMVB+57xbA=";
+    hash = "sha256-rWzANh7tkayFR6V3JaF3BLhIjUlnrPMmEmI36Ncqz2M=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "pytest-runner" ""
+      --replace-fail "pytest-runner" ""
   '';
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  pythonRelaxDeps = [ "aiohttp" ];
 
-  propagatedBuildInputs = [
-    aiohttp
-  ];
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [ aiohttp ];
 
   nativeCheckInputs = [
     pytest-asyncio
@@ -42,9 +44,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "vt"
-  ];
+  pythonImportsCheck = [ "vt" ];
 
   meta = with lib; {
     description = "Python client library for VirusTotal";
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 543c5f2db195e..6d5832f810432 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.69";
+  version = "3.2.72";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-q2hiIceWxQXwJWLXBuA3V3weqcr634yKbc6/VgQFkcQ=";
+    hash = "sha256-DcheCxZ21/wEwC0dYoL546wXyp1yIIfLkWbjkS0iKC0=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];
diff --git a/pkgs/development/tools/analysis/cppcheck/default.nix b/pkgs/development/tools/analysis/cppcheck/default.nix
index 0da5fcc9efbbb..00fd9b08b1e13 100644
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cppcheck";
-  version = "2.13.4";
+  version = "2.14.0";
 
   outputs = [ "out" "man" ];
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "danmar";
     repo = "cppcheck";
     rev = finalAttrs.version;
-    hash = "sha256-Bz8ACCsxKfN1Y8TpS+oD/6lixLItL1TQR0Ud4gj1txk=";
+    hash = "sha256-w5k7WO2Kwx0ac/vP54ndPUp/AG6jG3MDf03h5z/+Cso=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/coder/default.nix b/pkgs/development/tools/coder/default.nix
index 5557c4db17e5f..bee71dc2aeae7 100644
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@@ -1,4 +1,5 @@
 { lib
+, channel ? "stable"
 , fetchurl
 , installShellFiles
 , makeBinaryWrapper
@@ -9,18 +10,33 @@
 
 let
   inherit (stdenvNoCC.hostPlatform) system;
+
+  channels = {
+    stable = {
+      version = "2.9.3";
+      hash = {
+        x86_64-linux = "sha256-6VS21x2egWBV6eJqRCBGG7mEGPIDFtY9GN6Ry4ilC70=";
+        x86_64-darwin = "sha256-UBUGjA+jUkT6p9714l8IvDDI/qhWNctVFOvcA2S5kQU=";
+        aarch64-linux = "sha256-2QAahqcM2gi3lT+18q2Nm9GNqVsqzX3RajBsTn+KB1c=";
+        aarch64-darwin = "sha256-uEH7Y7c9BcU/Q/jwx/inFMvUrgm2dUruID+FJL+rA6Y=";
+      };
+    };
+    mainline = {
+      version = "2.10.1";
+      hash = {
+        x86_64-linux = "sha256-jNPL30e5xvyajlIqivtEpSb3cRhfgFhLFlC+CaLY2IM=";
+        x86_64-darwin = "sha256-U1eQaYwnm/mdQoZ8YxK/+s3HboVfMIAtdI7aQnCiDM8=";
+        aarch64-linux = "sha256-YtSyKZYG8vdubZUfo2FjEoVwSF82TXzeLJjPpHqgFDk=";
+        aarch64-darwin = "sha256-aQSiXK7voP5/mPFIscfTnSc4Ae5/f+WW8MR6ZtuC/eY=";
+      };
+    };
+  };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "coder";
-  version = "2.9.1";
-
+  version = channels.${channel}.version;
   src = fetchurl {
-    hash = {
-      x86_64-linux = "sha256-r4+u/s/dOn2GhyhEROu8i03QY3VA/bIyO/Yj7KSqicY=";
-      x86_64-darwin = "sha256-uShCmMvb5OcinqP0CmrlP9QAJkjfG3g1QuHE4JRDOjE=";
-      aarch64-linux = "sha256-tvpzfJ95YYfCY5V4iayjAmY5PDw+1uHUhY5F3pv/2Uk=";
-      aarch64-darwin = "sha256-sP9HnB2DzAU9IvL3+QPmIFLvRkGkoxSoa68uXGQrNkw=";
-    }.${system};
+    hash = (channels.${channel}.hash).${system};
 
     url =
       let
diff --git a/pkgs/development/tools/coder/update.sh b/pkgs/development/tools/coder/update.sh
index cf6febe7d8230..ebd40e3d5adbf 100755
--- a/pkgs/development/tools/coder/update.sh
+++ b/pkgs/development/tools/coder/update.sh
@@ -5,12 +5,13 @@ set -eu -o pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-LATEST_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/coder/coder/releases/latest | jq -r '.tag_name')
-LATEST_VERSION=$(echo ${LATEST_TAG} | sed 's/^v//')
+# Fetch the latest stable version
+LATEST_STABLE_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/coder/coder/releases/latest | jq -r '.tag_name')
+LATEST_STABLE_VERSION=$(echo ${LATEST_STABLE_TAG} | sed 's/^v//')
 
-# change version number
-sed -e "s/version =.*;/version = \"$LATEST_VERSION\";/g" \
-    -i ./default.nix
+# Fetch the latest mainline version
+LATEST_MAINLINE_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/coder/coder/releases | jq -r '.[0].tag_name')
+LATEST_MAINLINE_VERSION=$(echo ${LATEST_MAINLINE_TAG} | sed 's/^v//')
 
 # Define the platforms
 declare -A ARCHS=(["x86_64-linux"]="linux_amd64.tar.gz"
@@ -18,15 +19,33 @@ declare -A ARCHS=(["x86_64-linux"]="linux_amd64.tar.gz"
                   ["x86_64-darwin"]="darwin_amd64.zip"
                   ["aarch64-darwin"]="darwin_arm64.zip")
 
-# Update hashes for each architecture
-for ARCH in "${!ARCHS[@]}"; do
-  URL="https://github.com/coder/coder/releases/download/v${LATEST_VERSION}/coder_${LATEST_VERSION}_${ARCHS[$ARCH]}"
-  echo "Fetching hash for $ARCH..."
+update_version_and_hashes() {
+    local version=$1
+    local channel=$2
 
-  # Fetch the new hash using nix-prefetch-url
-  NEW_HASH=$(nix-prefetch-url --type sha256 $URL)
-  SRI_HASH=$(nix hash to-sri --type sha256 $NEW_HASH)
+    # Update version number, using '#' as delimiter
+    sed -i "/${channel} = {/,/};/{
+        s#^\(\s*\)version = .*#\1version = \"$version\";#
+    }" ./default.nix
 
-  # Update the Nix file with the new hash
-  sed -i "s|${ARCH} = \"sha256-.*\";|${ARCH} = \"${SRI_HASH}\";|" ./default.nix
-done
+    # Update hashes for each architecture
+    for ARCH in "${!ARCHS[@]}"; do
+        local URL="https://github.com/coder/coder/releases/download/v${version}/coder_${version}_${ARCHS[$ARCH]}"
+        echo "Fetching hash for $channel/$ARCH..."
+
+        # Fetch the new hash using nix-prefetch-url
+        local NEW_HASH=$(nix-prefetch-url --type sha256 $URL)
+        local SRI_HASH=$(nix hash to-sri --type sha256 $NEW_HASH)
+
+        # Update the Nix file with the new hash, using '#' as delimiter and preserving indentation
+        sed -i "/${channel} = {/,/};/{
+            s#^\(\s*\)${ARCH} = .*#\1${ARCH} = \"${SRI_HASH}\";#
+        }" ./default.nix
+    done
+}
+
+# Update stable channel
+update_version_and_hashes $LATEST_STABLE_VERSION "stable"
+
+# Update mainline channel
+update_version_and_hashes $LATEST_MAINLINE_VERSION "mainline"
diff --git a/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix b/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
index d252266f2377e..c9ec0cc84ad4d 100644
--- a/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
+++ b/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "codeberg-pages";
-  version = "4.6.2";
+  version = "5.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "Codeberg";
     repo = "pages-server";
-    rev = "ce241fa40adee2b12f8e225db98e09a45bc2acbb";
-    sha256 = "sha256-mL2Xs7eyldoZK4zrX6WFlFtwdLN0iVyl1Qh8X6b2u9c=";
+    rev = "ea68a82cd22a8a8c1f265260af22b9406f13e3a9";
+    hash = "sha256-TSXRB0oq1CtHC9ooO+Y3ICS5YE+q+ivZAcYBSd1oWi0=";
   };
 
-  vendorHash = "sha256-R/LuZkA2xHmu7SO3BVyK1C6n9U+pYn50kNkyLltn2ng=";
+  vendorHash = "sha256-vTYB3ka34VooN2Wh/Rcj+2S1qAsA2a/VtXlILn1W7oU=";
 
   patches = [ ./disable_httptest.patch ];
 
diff --git a/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch b/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch
index 2095b603badc3..90c815712d388 100644
--- a/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch
+++ b/pkgs/development/tools/continuous-integration/codeberg-pages/disable_httptest.patch
@@ -1,12 +1,13 @@
 diff --git a/server/handler/handler_test.go b/server/handler/handler_test.go
 deleted file mode 100644
-index 626564a..0000000
+index 6521633..0000000
 --- a/server/handler/handler_test.go
 +++ /dev/null
-@@ -1,49 +0,0 @@
+@@ -1,52 +0,0 @@
 -package handler
 -
 -import (
+-	"net/http"
 -	"net/http/httptest"
 -	"testing"
 -	"time"
@@ -24,13 +25,15 @@ index 626564a..0000000
 -		"https://docs.codeberg.org/pages/raw-content/",
 -		[]string{"/.well-known/acme-challenge/"},
 -		[]string{"raw.codeberg.org", "fonts.codeberg.org", "design.codeberg.org"},
+-		[]string{"pages"},
+-		cache.NewKeyValueCache(),
 -		cache.NewKeyValueCache(),
 -		cache.NewKeyValueCache(),
 -	)
 -
 -	testCase := func(uri string, status int) {
 -		t.Run(uri, func(t *testing.T) {
--			req := httptest.NewRequest("GET", uri, nil)
+-			req := httptest.NewRequest("GET", uri, http.NoBody)
 -			w := httptest.NewRecorder()
 -
 -			log.Printf("Start: %v\n", time.Now())
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index 169332f46647e..10f2d9faba12b 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchurl, common-updater-scripts, coreutils, git, gnused
-, makeWrapper, nix, nixfmt-classic, openjdk, writeScript, nixosTests, jq, cacert, curl
-}:
+, makeWrapper, nix, nixfmt-classic, openjdk, writeScript, nixosTests, jq, cacert
+, curl }:
 
 stdenv.mkDerivation rec {
   pname = "jenkins";
-  version = "2.440.2";
+  version = "2.440.3";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    hash = "sha256-gSZijp4vjuL4B9SJ7ApuN/yfXWuoT6jzcY5/PionMS4=";
+    hash = "sha256-+NR9v9WTWVUa6tg4j6StcAXtp8R84hxmTJlhDKBK42c=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index 922f3c081d5d2..38f5ba2f19e5c 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jShFLwoxZdUEHA+gd87n3R+faOdC6TboXuPvcZp89+Y=";
+    hash = "sha256-crn2FSJm7CSBg5TOcB5bJOsWqBrlwDoik7OS3HiCIGw=";
   };
 
-  vendorHash = "sha256-kBk2KhPDVYBGIUQpXq4ANA7WX+JUOxz7/Ad+4h2CD1c=";
+  vendorHash = "sha256-eFGQ59fdS+QQounT/byA0w9W+MK2Lhp+mlXAWWAtk6U=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/database/sqlfluff/default.nix b/pkgs/development/tools/database/sqlfluff/default.nix
index b452658e9fe96..110131532e604 100644
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "3.0.4";
+  version = "3.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sqlfluff";
     repo = "sqlfluff";
     rev = "refs/tags/${version}";
-    hash = "sha256-C8xH7LMCVXeJerdp8skIsTBQHkz0pPVKgUG+tEwx5GI=";
+    hash = "sha256-jH6o1moyyugKtIIccp8Tbcg5EAMOxzNco9saUgoDzWY=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/development/tools/electron/common.nix b/pkgs/development/tools/electron/common.nix
index 9aa3b1c932deb..fd17d7aa35555 100644
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@@ -13,7 +13,10 @@
 , unzip
 , pkgs
 , pkgsBuildHost
-
+, pipewire
+, libsecret
+, libpulseaudio
+, speechd
 , info
 }:
 
@@ -190,6 +193,23 @@ in (chromium.override { upstream-info = info.chromium; }).mkDerivation (base: {
     runHook postInstall
   '';
 
+  postFixup =
+    let
+      libPath = lib.makeLibraryPath [
+        libnotify
+        pipewire
+        stdenv.cc.cc.lib
+        libsecret
+        libpulseaudio
+        speechd
+      ];
+    in
+  base.postFixup + ''
+    patchelf \
+      --add-rpath "${libPath}" \
+      $out/libexec/electron/electron
+  '';
+
   requiredSystemFeatures = [ "big-parallel" ];
 
   passthru = {
diff --git a/pkgs/development/tools/go-migrate/default.nix b/pkgs/development/tools/go-migrate/default.nix
index 7044262373de2..e9d907c6f86d9 100644
--- a/pkgs/development/tools/go-migrate/default.nix
+++ b/pkgs/development/tools/go-migrate/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "go-migrate";
-  version = "4.17.0";
+  version = "4.17.1";
 
   src = fetchFromGitHub {
     owner = "golang-migrate";
     repo = "migrate";
     rev = "v${version}";
-    sha256 = "sha256-lsqSWhozTdLPwqnwYMLxH3kF62MsUCcjzKJ7qTU79qQ=";
+    sha256 = "sha256-9PJ3XxEA2PEaPFE3BbZkJB8XdJmm0gZf2Ko5T9DAZBw=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-q8wShIcVHZtpnhvZfsxiI5FLq0xneA8IBMDWd/vpz/0=";
+  vendorHash = "sha256-03nNN1FkGee01gNOmIASc2B7mMTes1pEDc6Lo08dhcw=";
 
   subPackages = [ "cmd/migrate" ];
 
diff --git a/pkgs/development/tools/go-minimock/default.nix b/pkgs/development/tools/go-minimock/default.nix
index 279004b9c8c71..10010fa822237 100644
--- a/pkgs/development/tools/go-minimock/default.nix
+++ b/pkgs/development/tools/go-minimock/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "go-minimock";
-  version = "3.3.6";
+  version = "3.3.7";
 
   src = fetchFromGitHub {
     owner = "gojuno";
     repo = "minimock";
     rev = "v${version}";
-    sha256 = "sha256-ru3+MJ1GbzVDi6niiz7SpL0qa9mE89uhcH5/PHbVugE=";
+    sha256 = "sha256-jwQT3JmVFS7e6wr+hCFLlA1YhiKdTrMai0RfClJafJQ=";
   };
 
   ldflags = [
     "-s" "-w" "-X main.version=${version}"
   ];
 
-  vendorHash = "sha256-eCM/EDdXZSa+pg35V6YiZ5gaC4rj8Wt8HhCgaMPoP+Y=";
+  vendorHash = "sha256-vcYhLMs/skZlhzdeEWUcv28VkRvraavziBwbwrgLZio=";
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/gqlgenc/default.nix b/pkgs/development/tools/gqlgenc/default.nix
index 6b3b8b940ef6d..e807618188981 100644
--- a/pkgs/development/tools/gqlgenc/default.nix
+++ b/pkgs/development/tools/gqlgenc/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gqlgenc";
-  version = "0.20.0";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "yamashou";
     repo = "gqlgenc";
     rev = "v${version}";
-    sha256 = "sha256-RniriePoHo608PlT3XrxogWI2oXq0Q48+Jaxz/2xIVo=";
+    sha256 = "sha256-XvvwVdovFTJNTqfqnX+luaRHD+7nmPLdQAu9TLRI/TQ=";
   };
 
   excludedPackages = [ "example" ];
diff --git a/pkgs/development/tools/kubeswitch/default.nix b/pkgs/development/tools/kubeswitch/default.nix
index 64701124a1593..470fdac9b3c22 100644
--- a/pkgs/development/tools/kubeswitch/default.nix
+++ b/pkgs/development/tools/kubeswitch/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kubeswitch";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "danielfoehrKn";
     repo = "kubeswitch";
     rev = version;
-    hash = "sha256-0SY7JLFkhLEFcE1veqac9I9DZstXfxtnmSYIdDiVieg=";
+    hash = "sha256-cvMTuiXSpx+ZicN1P3JjGExzW7d51nN1YIpsGArXHzw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/language-servers/ccls/default.nix b/pkgs/development/tools/language-servers/ccls/default.nix
index 078d9129f58a2..c2e6ed7a0ea54 100644
--- a/pkgs/development/tools/language-servers/ccls/default.nix
+++ b/pkgs/development/tools/language-servers/ccls/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ccls";
-  version = "0.20230717";
+  version = "0.20240202";
 
   src = fetchFromGitHub {
     owner = "MaskRay";
     repo = "ccls";
     rev = version;
-    sha256 = "sha256-u499fHd2lyqOYXJApFdiIXHQGF+QEVlQ4E8jm5VMb3w=";
+    sha256 = "sha256-xVx3+cnmIdoA7R1S31EaiPj+DOTqkINoQeMgauW61Ys=";
   };
 
   nativeBuildInputs = [ cmake llvmPackages.llvm.dev ];
diff --git a/pkgs/development/tools/micronaut/default.nix b/pkgs/development/tools/micronaut/default.nix
index 7acf37c5ccf83..99f51272c573b 100644
--- a/pkgs/development/tools/micronaut/default.nix
+++ b/pkgs/development/tools/micronaut/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "micronaut";
-  version = "4.3.8";
+  version = "4.4.0";
 
   src = fetchzip {
     url = "https://github.com/micronaut-projects/micronaut-starter/releases/download/v${version}/micronaut-cli-${version}.zip";
-    sha256 = "sha256-8sUXJExg1CApMbF95Lx3B/mnOJ5Y6HAck8+0UgF0bdc=";
+    sha256 = "sha256-hoy7hvabXvrU/ZcW9dRJnO1l4fnOIFpbgvAZ+CBnSbA=";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
diff --git a/pkgs/development/tools/misc/hydra/unstable.nix b/pkgs/development/tools/misc/hydra/unstable.nix
index 37029689e63f0..972f137034415 100644
--- a/pkgs/development/tools/misc/hydra/unstable.nix
+++ b/pkgs/development/tools/misc/hydra/unstable.nix
@@ -43,6 +43,7 @@
 , cacert
 , glibcLocales
 , fetchFromGitHub
+, fetchpatch2
 , nixosTests
 }:
 
@@ -205,6 +206,15 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  patches = [
+    # https://github.com/NixOS/hydra/security/advisories/GHSA-2p75-6g9f-pqgx
+    (fetchpatch2 {
+      name = "CVE-2024-32657.patch";
+      url = "https://github.com/NixOS/hydra/commit/b72528be5074f3e62e9ae2c2ae8ef9c07a0b4dd3.patch";
+      hash = "sha256-+y27N8AIaHj13mj0LwW7dkpzfzZ4xfjN8Ld23c5mzuU=";
+    })
+  ];
+
   postPatch = ''
     # Change 5s timeout for init to 30s
     substituteInPlace t/lib/HydraTestContext.pm \
diff --git a/pkgs/development/tools/misc/one_gadget/Gemfile.lock b/pkgs/development/tools/misc/one_gadget/Gemfile.lock
index 202e17ebdb77b..0a62128d508d6 100644
--- a/pkgs/development/tools/misc/one_gadget/Gemfile.lock
+++ b/pkgs/development/tools/misc/one_gadget/Gemfile.lock
@@ -1,10 +1,10 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    bindata (2.4.15)
+    bindata (2.5.0)
     elftools (1.1.3)
       bindata (~> 2)
-    one_gadget (1.8.1)
+    one_gadget (1.9.0)
       elftools (>= 1.0.2, < 1.2.0)
 
 PLATFORMS
@@ -14,4 +14,4 @@ DEPENDENCIES
   one_gadget
 
 BUNDLED WITH
-   2.4.19
+   2.5.7
diff --git a/pkgs/development/tools/misc/one_gadget/default.nix b/pkgs/development/tools/misc/one_gadget/default.nix
index 6ad2c909c39a1..4bf550cea52a8 100644
--- a/pkgs/development/tools/misc/one_gadget/default.nix
+++ b/pkgs/development/tools/misc/one_gadget/default.nix
@@ -18,6 +18,7 @@ bundlerApp {
     homepage    = "https://github.com/david942j/one_gadget";
     license     = licenses.mit;
     maintainers = with maintainers; [ artemist nicknovitski ];
+    mainProgram = "one_gadget";
     platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/misc/one_gadget/gemset.nix b/pkgs/development/tools/misc/one_gadget/gemset.nix
index 98227bdbe7e5d..c1127a8b6c6a2 100644
--- a/pkgs/development/tools/misc/one_gadget/gemset.nix
+++ b/pkgs/development/tools/misc/one_gadget/gemset.nix
@@ -4,10 +4,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04y4zgh4bbcb8wmkxwfqg4saky1d1f3xw8z6yk543q13h8ky8rz5";
+      sha256 = "08r67nglsqnxrbn803szf5bdnqhchhq8kf2by94f37fcl65wpp19";
       type = "gem";
     };
-    version = "2.4.15";
+    version = "2.5.0";
   };
   elftools = {
     dependencies = ["bindata"];
@@ -26,9 +26,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0dwsmjhr9i8gwwbbpiyddbhcx74cvqqk90a5l8zbsjhjfs679irc";
+      sha256 = "1j9478h929jm5hq2fs3v8y37a7y2hhpli90mbps7yvka4ykci7mw";
       type = "gem";
     };
-    version = "1.8.1";
+    version = "1.9.0";
   };
 }
diff --git a/pkgs/development/tools/misc/reviewdog/default.nix b/pkgs/development/tools/misc/reviewdog/default.nix
index 90a9505980316..6f6d2c11c4158 100644
--- a/pkgs/development/tools/misc/reviewdog/default.nix
+++ b/pkgs/development/tools/misc/reviewdog/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "reviewdog";
-  version = "0.17.3";
+  version = "0.17.4";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-9iXQKwzcWATnqsKrDAyLAkuRHUsfxfEpyeCxZ1JUpV8=";
+    hash = "sha256-G2mN7f5dpE6fF5ti7JJXVk8qBiwKO/yy5cyOYBxDJNo=";
   };
 
-  vendorHash = "sha256-cq8KD2STIpPSB3RXv9sl8Bty1noUQak5FZfrfq1rj10=";
+  vendorHash = "sha256-ux3nrQtY1sY4VJIeTSZAipfURspWDqnZ9YfxmFUvElI=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/misc/sccache/default.nix b/pkgs/development/tools/misc/sccache/default.nix
index 1f6e6e7a040b8..5a99ef9b35ecc 100644
--- a/pkgs/development/tools/misc/sccache/default.nix
+++ b/pkgs/development/tools/misc/sccache/default.nix
@@ -8,17 +8,17 @@
 }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.7.7";
+  version = "0.8.0";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
     rev = "v${version}";
-    sha256 = "sha256-nWSMWaz1UvjsA2V7q7WKx44G45VVaoQxteZqrKAlxY8=";
+    sha256 = "sha256-GKJKesvOtnZsLcYQjSsnUcolBIqqiYSX0VSZru416mk=";
   };
 
-  cargoHash = "sha256-ezub+pOqNjCfH7QgjLBrYtsyYbPM3/SADLpNgPtlG+I=";
+  cargoHash = "sha256-GacjuBLlVawNRFutsjfywYHo34QKJHCPgi/QCPjcaAA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/msgpack-tools/default.nix b/pkgs/development/tools/msgpack-tools/default.nix
index a7b3c36d87b2f..5b3bc7b1472cd 100644
--- a/pkgs/development/tools/msgpack-tools/default.nix
+++ b/pkgs/development/tools/msgpack-tools/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     description = "Command-line tools for converting between MessagePack and JSON";
     homepage = "https://github.com/ludocode/msgpack-tools";
     license = licenses.mit;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ alibabzo ];
   };
 }
diff --git a/pkgs/development/tools/ocaml/dune/3.nix b/pkgs/development/tools/ocaml/dune/3.nix
index 42d13fcbb320d..7e1d1d6305991 100644
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@@ -6,11 +6,11 @@ else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "3.15.0";
+  version = "3.15.1";
 
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    hash = "sha256-tcPRD29gSL+vVvxPCULVY4G1WvQofK+CUUh9TE55INc=";
+    hash = "sha256-tbeKSgLU3QiUI02/cYv/R3/Nheff3/6OzgC5oM89VHs=";
   };
 
   nativeBuildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 64562c17f5a0a..56b07f8aee0f4 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "19.20.0";
+  version = "19.21.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-f85CKfYPNh06eVHu5nn4MhX5wuptpJCmvSiPHWGzjkg=";
+    hash = "sha256-Vhqk7U4FKl9r7WMX/FJ/4LEtuTUsZquM98A+nQRFqMQ=";
   };
 
-  vendorHash = "sha256-SeeVHqeQCfOJTNfWIfTd71jGk5mYH5HRArUosZqRreY=";
+  vendorHash = "sha256-rcw9HgN677NxrMZDrpNFLHNyHdlRXvgxCtQnLt0TRLw=";
 
   sourceRoot = "${src.name}/src";
 
diff --git a/pkgs/development/tools/pscale/default.nix b/pkgs/development/tools/pscale/default.nix
index 1255470fb7147..cb8f2f91ea392 100644
--- a/pkgs/development/tools/pscale/default.nix
+++ b/pkgs/development/tools/pscale/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.191.0";
+  version = "0.195.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-+QGzLPJQbIql5Xomve/v3vGB5kdCDamxkRM6weIZMMw=";
+    sha256 = "sha256-Dgp4N4R239NSewHJ7iVhWwfoppXsnhhL8ZrDEbiM9v4=";
   };
 
-  vendorHash = "sha256-dcMKi12YFTpQShGRm97Zptiw9JK55CAXm0r8UG+c1Dg=";
+  vendorHash = "sha256-0rzX54AdlFvvYhfZvS3qBxV4bIF2li8HwKdtm0jS04g=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/development/tools/rust/cargo-dist/default.nix b/pkgs/development/tools/rust/cargo-dist/default.nix
index bd87644a7d38e..04aae84d0d860 100644
--- a/pkgs/development/tools/rust/cargo-dist/default.nix
+++ b/pkgs/development/tools/rust/cargo-dist/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-dist";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "axodotdev";
     repo = "cargo-dist";
     rev = "v${version}";
-    hash = "sha256-uav2Q6NG7JW3ZrYkDWXNxR816bI3nxs71KoOdNr/unQ=";
+    hash = "sha256-sD3Y/FFfUgMtvBoSP0BBhS5aCZy+TkyO8S28q8Hoc5I=";
   };
 
-  cargoHash = "sha256-Kd7roUUfXfWlV6IHpu20f0VPoZWmGOPAJjELNqVS3b8=";
+  cargoHash = "sha256-efVhaL1yUEpOgNZ4Bog1OB37lT1yQHJVE9M938jnGeE=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/rust/cargo-modules/default.nix b/pkgs/development/tools/rust/cargo-modules/default.nix
index b237c64dc2af7..6fa78cef0b4d0 100644
--- a/pkgs/development/tools/rust/cargo-modules/default.nix
+++ b/pkgs/development/tools/rust/cargo-modules/default.nix
@@ -2,21 +2,44 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-modules";
-  version = "0.11.2";
+  version = "0.15.5";
 
   src = fetchFromGitHub {
     owner = "regexident";
     repo = pname;
-    rev = version;
-    hash = "sha256-dfeY9YylHF1QHNv7yTNYxUBxzcb276H80WL6JgXR/KY=";
+    rev = "v${version}";
+    hash = "sha256-+jHanZ2/BIgNLUpMlibfUAVfA6QTPlavRci2YD1w3zE=";
   };
 
-  cargoHash = "sha256-elzLO2YNDsD9FjCW0+2pUWgcJzOvzK+lyZBxrjVXoA8=";
+  cargoHash = "sha256-umaKVs1fFiUKz2HIJuB+7skSwRQbG12dl9eD+et42go=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
   ];
 
+  checkFlags = [
+    "--skip=cfg_test::smoke"
+    "--skip=colors::ansi::smoke"
+    "--skip=colors::plain::smoke"
+    "--skip=colors::truecolor::smoke"
+    "--skip=focus_on::glob_path::smoke"
+    "--skip=focus_on::self_path::smoke"
+    "--skip=focus_on::simple_path::smoke"
+    "--skip=focus_on::use_tree::smoke"
+    "--skip=functions::function_body"
+    "--skip=functions::function_inputs"
+    "--skip=functions::function_outputs"
+    "--skip=max_depth::depth_2::smoke"
+    "--skip=selection::no_fns::smoke"
+    "--skip=selection::no_modules::smoke"
+    "--skip=selection::no_traits::smoke"
+    "--skip=selection::no_types::smoke"
+    "--skip=fields::enum_fields"
+    "--skip=fields::struct_fields"
+    "--skip=fields::tuple_fields"
+    "--skip=fields::union_fields"
+  ];
+
   meta = with lib; {
     description = "A cargo plugin for showing a tree-like overview of a crate's modules";
     mainProgram = "cargo-modules";
diff --git a/pkgs/development/tools/rust/cargo-mutants/default.nix b/pkgs/development/tools/rust/cargo-mutants/default.nix
index 33204d80b9d23..fd83af91f15e7 100644
--- a/pkgs/development/tools/rust/cargo-mutants/default.nix
+++ b/pkgs/development/tools/rust/cargo-mutants/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-mutants";
-  version = "24.3.0";
+  version = "24.4.0";
 
   src = fetchFromGitHub {
     owner = "sourcefrog";
     repo = "cargo-mutants";
     rev = "v${version}";
-    hash = "sha256-FlD2bSCNToyXLiMb4c2tJYJxHN4QORMJPeFPuFpjMEM=";
+    hash = "sha256-u59NnxDFQN92BMkm2sHy8OhundFJElJ2H1SgdeLpOMs=";
   };
 
-  cargoHash = "sha256-GJFUSOAY6F0ZmqF/9SHOGMNFssfHUdFIcsgz6JwZuqE=";
+  cargoHash = "sha256-7dLpqhT3v7b0I1wmn7Q6IL1M5Ul/Mu9xxrdwlI2xKAs=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/development/tools/rust/cargo-semver-checks/default.nix b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
index fa6bc5ce3634d..2c3269681d7e4 100644
--- a/pkgs/development/tools/rust/cargo-semver-checks/default.nix
+++ b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-semver-checks";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-5+UE1Ka2pciuNrkrPDCJMp12+IUbgq7k3cKSP5pahw4=";
+    hash = "sha256-iumHMVDlgwjjQsn0aoSJUPoOKmLztD47b7he2nJhins=";
   };
 
-  cargoHash = "sha256-GuajrFdPlgneL95eWT3n2MdzfsbuID/pI9ED8TlVOCo=";
+  cargoHash = "sha256-/mrVrbPHi4lo2iu/IWwDYIjqWZYNkm/4lWpRMLKBNpA=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/tools/rust/cargo-spellcheck/default.nix b/pkgs/development/tools/rust/cargo-spellcheck/default.nix
index 23de1bc2a0708..f6312ee3f00dd 100644
--- a/pkgs/development/tools/rust/cargo-spellcheck/default.nix
+++ b/pkgs/development/tools/rust/cargo-spellcheck/default.nix
@@ -19,6 +19,11 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-6dhM+FzuLtKtRp2mpE9nlpT+0PBcgGqvBa9vqs6Rs7s=";
 
+  postPatch = ''
+    substituteInPlace src/lib.rs \
+      --replace "#![deny(dead_code)]" "#![warn(dead_code)]"
+  '';
+
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
diff --git a/pkgs/development/tools/rust/cargo-tauri/default.nix b/pkgs/development/tools/rust/cargo-tauri/default.nix
index 02a06edf5d238..a7737222d3480 100644
--- a/pkgs/development/tools/rust/cargo-tauri/default.nix
+++ b/pkgs/development/tools/rust/cargo-tauri/default.nix
@@ -17,20 +17,20 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "tauri";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "tauri-apps";
     repo = pname;
     rev = "tauri-v${version}";
-    hash = "sha256-P0/c9GTQRdErwE3/uuZpMqiTl/nFGSaHoWGRtBDjc8M=";
+    hash = "sha256-sqBZVCVJkgqCK5JcNcJ6kKxL26XGxOA1uDlOOt/+iDo=";
   };
 
   # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
   # https://discourse.nixos.org/t/difficulty-using-buildrustpackage-with-a-src-containing-multiple-cargo-workspaces/10202
   sourceRoot = "${src.name}/tooling/cli";
 
-  cargoHash = "sha256-+uRjitfaSbjsO1yO5NL3gw+qjx4neiht3BDvWltogX0=";
+  cargoHash = "sha256-g1uDF7lL9dmZY5J8uNDAsA8dG5IVrV7MumN1w+fk1/8=";
 
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isLinux [ glibc libsoup cairo gtk3 webkitgtk ]
     ++ lib.optionals stdenv.isDarwin [ CoreServices Security SystemConfiguration ];
diff --git a/pkgs/development/tools/rust/svd2rust/default.nix b/pkgs/development/tools/rust/svd2rust/default.nix
index 8891b364b56c9..260809a5c9bf7 100644
--- a/pkgs/development/tools/rust/svd2rust/default.nix
+++ b/pkgs/development/tools/rust/svd2rust/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svd2rust";
-  version = "0.33.0";
+  version = "0.33.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-EdU/Hr1OQ02Jeq4OgJPOS//4wltBPoYdUcFMvlOjIBY=";
+    hash = "sha256-omAL/nRdB5wngOQTaZdnq9XaPnDj6kxda+27TQS7dUQ=";
   };
 
-  cargoHash = "sha256-T4QRrSBjf47wGJIVfxZNGig8k7KWvQQIvV8zwRUP/38=";
+  cargoHash = "sha256-YmnKZhGDQ+eqHy/KQxp3ZdCxKrZEKcS2R+5/t6HhOCg=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
diff --git a/pkgs/development/tools/rust/typeshare/default.nix b/pkgs/development/tools/rust/typeshare/default.nix
index 8f784bc72d6cd..745784fc03047 100644
--- a/pkgs/development/tools/rust/typeshare/default.nix
+++ b/pkgs/development/tools/rust/typeshare/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typeshare";
-  version = "1.9.0";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "1password";
     repo = "typeshare";
     rev = "v${version}";
-    hash = "sha256-20IaTC0fMt6ADSwyQh9yBn3i3z6cmQ1j/wy1KNB3Dog=";
+    hash = "sha256-ccUeIywOHZYqfo4o0rKKswFmdPcQkwD18OP9v/wkfe0=";
   };
 
-  cargoHash = "sha256-5jY4GO/EbBokE9p9e68bTKj6nJ0LhtWYHtFGfTIf9Po=";
+  cargoHash = "sha256-mPA19+8Ti2fluOFn/oDvf62JZTtZNQRggMhf9cem5rU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/scenebuilder/default.nix b/pkgs/development/tools/scenebuilder/default.nix
index e10ebf1e5519d..6e0b80497f4bd 100644
--- a/pkgs/development/tools/scenebuilder/default.nix
+++ b/pkgs/development/tools/scenebuilder/default.nix
@@ -1,80 +1,104 @@
-{ lib, stdenv, fetchFromGitHub, openjdk20, maven, makeDesktopItem, copyDesktopItems, makeWrapper, glib, wrapGAppsHook }:
+{ lib
+, jdk21
+, maven
+, fetchFromGitHub
+, makeDesktopItem
+, copyDesktopItems
+, glib
+, makeWrapper
+, wrapGAppsHook
+}:
 
 let
-  jdk = openjdk20.override (lib.optionalAttrs stdenv.isLinux {
+  jdk = jdk21.override {
     enableJavaFX = true;
-  });
+  };
   maven' = maven.override {
     inherit jdk;
   };
-  selectSystem = attrs:
-    attrs.${stdenv.hostPlatform.system}
-      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 in
 maven'.buildMavenPackage rec {
   pname = "scenebuilder";
-  version = "20.0.0";
+  version = "21.0.1";
 
   src = fetchFromGitHub {
     owner = "gluonhq";
-    repo = pname;
+    repo = "scenebuilder";
     rev = version;
-    hash = "sha256-Og+dzkJ6+YH0fD4HJw8gUKGgvQuNw17BxgzZMP/bEA0=";
+    hash = "sha256-YEcW1yQK6RKDqSstsrpdOqMt972ZagenGDxcJ/gP+SA=";
   };
 
-  buildDate = "2022-10-07T00:00:00+01:00"; # v20.0.0 release date
-  mvnParameters = "-Dmaven.test.skip -Dproject.build.outputTimestamp=${buildDate} -DbuildTimestamp=${buildDate}";
-  mvnHash = selectSystem {
-    x86_64-linux = "sha256-QwxA3lKVkRG5CV2GIwfVFPOj112pHr7bDlZJD6KwrHc=";
-    aarch64-linux = "sha256-cO5nHSvv2saBuAjq47A+GW9vFWEM+ysXyZgI0Oe/F70=";
-  };
+  patches = [
+    # makes the mvnHash platform-independent
+    ./pom-remove-javafx.patch
+
+    # makes sure that maven upgrades don't change the mvnHash
+    ./fix-default-maven-plugin-versions.patch
+  ];
+
+  postPatch = ''
+    # set the build timestamp to $SOURCE_DATE_EPOCH
+    substituteInPlace app/pom.xml \
+        --replace-fail "\''${maven.build.timestamp}" "$(date -d "@$SOURCE_DATE_EPOCH" '+%Y-%m-%d %H:%M:%S')"
+  '';
+
+  mvnParameters = toString [
+    "-Dmaven.test.skip"
+    "-Dproject.build.outputTimestamp=1980-01-01T00:00:02Z"
+  ];
 
-  nativeBuildInputs = [ copyDesktopItems makeWrapper glib wrapGAppsHook ];
+  mvnHash = "sha256-fS7dS2Q4ORThLBwDOzJJnRboNNRmhp0RG6Dae9fl+pw=";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    glib
+    makeWrapper
+    wrapGAppsHook
+  ];
 
   dontWrapGApps = true; # prevent double wrapping
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin $out/share/java $out/share/{${pname},icons/hicolor/128x128/apps}
-    cp app/target/lib/scenebuilder-${version}-SNAPSHOT-all.jar $out/share/java/${pname}.jar
-
-    cp app/src/main/resources/com/oracle/javafx/scenebuilder/app/SB_Logo.png $out/share/icons/hicolor/128x128/apps/scenebuilder.png
+    install -Dm644 app/target/lib/scenebuilder-${version}-SNAPSHOT-all.jar $out/share/scenebuilder/scenebuilder.jar
+    install -Dm644 app/src/main/resources/com/oracle/javafx/scenebuilder/app/SB_Logo.png $out/share/icons/hicolor/128x128/apps/scenebuilder.png
 
     runHook postInstall
   '';
 
   postFixup = ''
-    makeWrapper ${jdk}/bin/java $out/bin/${pname} \
+    makeWrapper ${jdk}/bin/java $out/bin/scenebuilder \
       --add-flags "--add-modules javafx.web,javafx.fxml,javafx.swing,javafx.media" \
       --add-flags "--add-opens=javafx.fxml/javafx.fxml=ALL-UNNAMED" \
-      --add-flags "-cp $out/share/java/${pname}.jar" \
-      --add-flags "com.oracle.javafx.scenebuilder.app.SceneBuilderApp" \
+      --add-flags "-jar $out/share/scenebuilder/scenebuilder.jar" \
       "''${gappsWrapperArgs[@]}"
-    '';
-
-  desktopItems = [ (makeDesktopItem {
-    name = "scenebuilder";
-    exec = "scenebuilder";
-    icon = "scenebuilder";
-    comment = "A visual, drag'n'drop, layout tool for designing JavaFX application user interfaces.";
-    desktopName = "Scene Builder";
-    mimeTypes = [ "application/java" "application/java-vm" "application/java-archive" ];
-    categories = [ "Development" ];
-  }) ];
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "scenebuilder";
+      exec = "scenebuilder";
+      icon = "scenebuilder";
+      comment = "A visual, drag'n'drop, layout tool for designing JavaFX application user interfaces.";
+      desktopName = "Scene Builder";
+      mimeTypes = [ "application/java" "application/java-vm" "application/java-archive" ];
+      categories = [ "Development" ];
+    })
+  ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
+    changelog = "https://github.com/gluonhq/scenebuilder/releases/tag/${src.rev}";
     description = "A visual, drag'n'drop, layout tool for designing JavaFX application user interfaces.";
-    mainProgram = "scenebuilder";
     homepage = "https://gluonhq.com/products/scene-builder/";
+    license = licenses.bsd3;
+    mainProgram = "scenebuilder";
+    maintainers = with maintainers; [ wirew0rm ];
+    platforms = jdk.meta.platforms;
     sourceProvenance = with sourceTypes; [
       fromSource
-      binaryBytecode  # deps
+      binaryBytecode # deps
     ];
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ wirew0rm ];
-    platforms = platforms.all;
   };
 }
 
diff --git a/pkgs/development/tools/scenebuilder/fix-default-maven-plugin-versions.patch b/pkgs/development/tools/scenebuilder/fix-default-maven-plugin-versions.patch
new file mode 100644
index 0000000000000..be5e590694a02
--- /dev/null
+++ b/pkgs/development/tools/scenebuilder/fix-default-maven-plugin-versions.patch
@@ -0,0 +1,60 @@
+diff --git a/pom.xml b/pom.xml
+index 193f7ca..45faa1a 100644
+--- a/pom.xml
++++ b/pom.xml
+@@ -137,6 +137,55 @@
+             </plugins>
+         </pluginManagement>
+         <plugins>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-enforcer-plugin</artifactId>
++                <version>3.3.0</version>
++                <executions>
++                    <execution>
++                        <id>require-all-plugin-versions-to-be-set</id>
++                        <phase>validate</phase>
++                        <goals>
++                            <goal>enforce</goal>
++                        </goals>
++                        <configuration>
++                            <rules>
++                                <requirePluginVersions />
++                            </rules>
++                        </configuration>
++                    </execution>
++                </executions>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-clean-plugin</artifactId>
++                <version>3.3.2</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-install-plugin</artifactId>
++                <version>3.1.1</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-site-plugin</artifactId>
++                <version>4.0.0-M13</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-deploy-plugin</artifactId>
++                <version>3.1.1</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-surefire-plugin</artifactId>
++                <version>3.2.5</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-jar-plugin</artifactId>
++                <version>3.3.0</version>
++            </plugin>
+             <plugin>
+                 <groupId>org.codehaus.mojo</groupId>
+                 <artifactId>build-helper-maven-plugin</artifactId>
diff --git a/pkgs/development/tools/scenebuilder/pom-remove-javafx.patch b/pkgs/development/tools/scenebuilder/pom-remove-javafx.patch
new file mode 100644
index 0000000000000..6c9c9784d0375
--- /dev/null
+++ b/pkgs/development/tools/scenebuilder/pom-remove-javafx.patch
@@ -0,0 +1,28 @@
+diff --git a/kit/pom.xml b/kit/pom.xml
+index 644d36c..e4d91fb 100644
+--- a/kit/pom.xml
++++ b/kit/pom.xml
+@@ -11,23 +11,6 @@
+     </parent>
+ 
+     <dependencies>
+-        <!-- JavaFX -->
+-        <dependency>
+-            <groupId>org.openjfx</groupId>
+-            <artifactId>javafx-fxml</artifactId>
+-            <version>${javafx.version}</version>
+-        </dependency>
+-        <dependency>
+-            <groupId>org.openjfx</groupId>
+-            <artifactId>javafx-web</artifactId>
+-            <version>${javafx.version}</version>
+-        </dependency>
+-        <dependency>
+-            <groupId>org.openjfx</groupId>
+-            <artifactId>javafx-swing</artifactId>
+-            <version>${javafx.version}</version>
+-        </dependency>
+-
+         <!-- Eclipse Aether -->
+         <dependency>
+             <groupId>org.eclipse.aether</groupId>
diff --git a/pkgs/development/tools/sqldef/default.nix b/pkgs/development/tools/sqldef/default.nix
index 695a4c1227c88..47f302a2ac78d 100644
--- a/pkgs/development/tools/sqldef/default.nix
+++ b/pkgs/development/tools/sqldef/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "sqldef";
-  version = "0.17.5";
+  version = "0.17.6";
 
   src = fetchFromGitHub {
     owner = "k0kubun";
     repo = "sqldef";
     rev = "v${version}";
-    hash = "sha256-iEQHrGGXfN/id4aV96MN6WKUl5XGL17u8mlPJKc6cvg=";
+    hash = "sha256-VgPc78xhafRlEUfNMKiYDyWqZVtYDkqwVDQ3BG9r70w=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-8fKJxnjLIWzWsLx/p9tRb/un63/QgJJzMb4/Y4DSZdY=";
+  vendorHash = "sha256-YmjQj116egYhcpJ9Vps1d30bfCY6pAu/mA9MEzXVJb8=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/development/tools/turso-cli/default.nix b/pkgs/development/tools/turso-cli/default.nix
index 84113832cb34d..9e526b8b321be 100644
--- a/pkgs/development/tools/turso-cli/default.nix
+++ b/pkgs/development/tools/turso-cli/default.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "turso-cli";
-  version = "0.90.7";
+  version = "0.92.0";
 
   src = fetchFromGitHub {
     owner = "tursodatabase";
     repo = "turso-cli";
     rev = "v${version}";
-    hash = "sha256-+pd2bRyu1BFhzJ1iGDmBv/DR8oZHC0hGZBgZZIxpaYo=";
+    hash = "sha256-L118k+NOvO9jBqBzPkrx/U+RjgY318b1Q0u5X7uT7i0=";
   };
 
   vendorHash = "sha256-2NjdjB09WYzHjQEl2hMUWN1/xsj/Hlr8lVYU/pkxTqQ=";
diff --git a/pkgs/development/tools/vsce/default.nix b/pkgs/development/tools/vsce/default.nix
index ea3fc3bfa5fc7..a2be7f3abde52 100644
--- a/pkgs/development/tools/vsce/default.nix
+++ b/pkgs/development/tools/vsce/default.nix
@@ -12,16 +12,16 @@
 
 buildNpmPackage rec {
   pname = "vsce";
-  version = "2.25.0";
+  version = "2.26.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vscode-vsce";
     rev = "v${version}";
-    hash = "sha256-HPNKxplSJpo/30vpXu176JMzY3fAzTX/9XPRsYj9x+U=";
+    hash = "sha256-ILu09OerH5XNVN4el3R2GH2LtIzXiQ/ONU+W2pomHRg=";
   };
 
-  npmDepsHash = "sha256-wfgvGWSxV+N9Uh+jEEZCwPEN0yYNmooWXAV9PwWONkM=";
+  npmDepsHash = "sha256-EtzcWeqPy4XVlheBXBpSwxrsHJ678lhTgnYqzIYZn4M=";
 
   postPatch = ''
     substituteInPlace package.json --replace '"version": "0.0.0"' '"version": "${version}"'
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 84caa116eea47..78a69303a3cbc 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGo122Module rec {
   pname = "flyctl";
-  version = "0.2.25";
+  version = "0.2.40";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-yMkTLUM/1P9VrsYaF4m9YyRLV6qz6uMiYlhUN5S58uU=";
+    hash = "sha256-HIJ2EAfNKVlECXHgw2qx5OlWv5davaBrtrSQVsdrKKY=";
   };
 
-  vendorHash = "sha256-TMlJbh9tMRNdeZlem27lgknuJ/YNFkVaWS9BNTTuXic=";
+  vendorHash = "sha256-uA9Sfovz42+JT+AEY7t4dwWpIUgqX8qdGto7LU7qLtY=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/games/gogui/default.nix b/pkgs/games/gogui/default.nix
index 43e1f3397b8fb..50cb29ddb454c 100644
--- a/pkgs/games/gogui/default.nix
+++ b/pkgs/games/gogui/default.nix
@@ -1,48 +1,46 @@
-{ ant
+{ lib
+, stdenv
+, fetchFromGitHub
+, ant
+, jdk
+, jre
 , docbook-xsl-ns
 , docbook_xml_dtd_42
-, fetchFromGitHub
 , imagemagick
-, lib
 , libxslt
+, stripJavaArchivesHook
 , makeWrapper
-, openjdk
-, stdenv
 }:
 
-let
-  version = "1.5.4a";
-in stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gogui";
-  inherit version;
+  version = "1.5.4a";
 
   src = fetchFromGitHub {
     owner = "Remi-Coulom";
     repo = "gogui";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-UFhOk2mAnTtxfwEOHquN64YDCRq7nNUqZAPQf77MEEw=";
   };
 
   nativeBuildInputs = [
-    makeWrapper
     ant
-  ];
-
-  buildInputs = [
+    jdk
     docbook-xsl-ns
     imagemagick
     libxslt
-    openjdk
+    stripJavaArchivesHook
+    makeWrapper
   ];
 
   buildPhase = ''
     runHook preBuild
 
     substituteInPlace doc/manual/xml/book.xml \
-      --replace http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd \
+      --replace-fail http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd \
       ${docbook_xml_dtd_42}/xml/dtd/docbook/docbookx.dtd
     substituteInPlace doc/manual/xml/manpages.xml \
-      --replace http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd \
+      --replace-fail http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd \
       ${docbook_xml_dtd_42}/xml/dtd/docbook/docbookx.dtd
 
     # generate required gui images from svg
@@ -75,21 +73,24 @@ in stdenv.mkDerivation {
     ln -s $out/share/doc/gogui/manual/man $out/share/man/man1
 
     # copy programs
-    mv -vi {bin,lib} $out/
+    mv -vi bin lib $out/
 
     # wrap programs
     for x in $out/bin/*; do
-      wrapProgram $x --prefix PATH ":" ${openjdk}/bin --set GOGUI_JAVA_HOME ${openjdk}
+        wrapProgram $x \
+            --prefix PATH : ${jre}/bin \
+            --set GOGUI_JAVA_HOME ${jre}
     done
 
     runHook postInstall
   '';
 
   meta = {
-    maintainers = [ lib.maintainers.cleverca22 lib.maintainers.omnipotententity];
     description = "A graphical user interface to programs that play the board game Go and support the Go Text Protocol such as GNU Go";
     homepage = "https://github.com/Remi-Coulom/gogui";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "gogui";
+    maintainers = with lib.maintainers; [ cleverca22 omnipotententity ];
     platforms = lib.platforms.unix;
-    license = lib.licenses.gpl3;
   };
-}
+})
diff --git a/pkgs/games/rocksndiamonds/default.nix b/pkgs/games/rocksndiamonds/default.nix
index 6b1d51ab290b3..65f0dd9392f7a 100644
--- a/pkgs/games/rocksndiamonds/default.nix
+++ b/pkgs/games/rocksndiamonds/default.nix
@@ -54,6 +54,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.artsoft.org/rocksndiamonds/";
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ orivej xfix ];
+    maintainers = with maintainers; [ orivej ];
   };
 }
diff --git a/pkgs/games/shattered-pixel-dungeon/rkpd2.nix b/pkgs/games/shattered-pixel-dungeon/rkpd2.nix
index d671e25cc34f6..5f73a825fca42 100644
--- a/pkgs/games/shattered-pixel-dungeon/rkpd2.nix
+++ b/pkgs/games/shattered-pixel-dungeon/rkpd2.nix
@@ -4,13 +4,13 @@
 
 callPackage ./generic.nix rec {
   pname = "rkpd2";
-  version = "2.0.5";
+  version = "2.0.6";
 
   src = fetchFromGitHub {
     owner = "Zrp200";
     repo = "rkpd2";
     rev = "v${version}";
-    hash = "sha256-VVqwgwDuIyRd5MU1/64Xz+8TbIOrXcHufs0XqD/Q4ls=";
+    hash = "sha256-jwH0nEsv3agUCZt5Mhuv1JSeELOKfrsj3cnmAJsV9sM=";
   };
 
   depsHash = "sha256-vihoR0bPh7590sRxeYJ1uuynNRxtRBuiFUrdmsRNUJc=";
diff --git a/pkgs/kde/frameworks/extra-cmake-modules/default.nix b/pkgs/kde/frameworks/extra-cmake-modules/default.nix
index 0a06cf4a87726..b7dc85d277a3c 100644
--- a/pkgs/kde/frameworks/extra-cmake-modules/default.nix
+++ b/pkgs/kde/frameworks/extra-cmake-modules/default.nix
@@ -1,8 +1,16 @@
-{mkKdeDerivation}:
+{ mkKdeDerivation
+, python3
+}:
 mkKdeDerivation {
   pname = "extra-cmake-modules";
 
-  outputs = ["out"];
+  outputs = [ "out" ];
+
+  # Packages that have an Android APK (e.g. KWeather) require Python3 at build time.
+  # See: https://invent.kde.org/frameworks/extra-cmake-modules/-/blob/v6.1.0/modules/ECMAddAndroidApk.cmake?ref_type=tags#L57
+  propagatedNativeBuildInputs = [
+    python3
+  ];
 
   setupHook = ./ecm-hook.sh;
 }
diff --git a/pkgs/kde/frameworks/extra-cmake-modules/ecm-hook.sh b/pkgs/kde/frameworks/extra-cmake-modules/ecm-hook.sh
index 8f34f5f732e63..1f60ba1aed929 100644
--- a/pkgs/kde/frameworks/extra-cmake-modules/ecm-hook.sh
+++ b/pkgs/kde/frameworks/extra-cmake-modules/ecm-hook.sh
@@ -41,7 +41,7 @@ ecmPostHook() {
     cmakeFlags+=" -DKDE_INSTALL_KCONFUPDATEDIR=${!outputBin}/share/kconf_update"
     cmakeFlags+=" -DKDE_INSTALL_KAPPTEMPLATESDIR=${!outputDev}/share/kdevappwizard/templates"
     cmakeFlags+=" -DKDE_INSTALL_KFILETEMPLATESDIR=${!outputDev}/share/kdevfiletemplates/templates"
-    cmakeFlags+=" -DKDE_INSTALL_KXMLGUIDIR=${!outputBin}/share/kxmlgui6"
+    cmakeFlags+=" -DKDE_INSTALL_KXMLGUIDIR=${!outputBin}/share/kxmlgui5"  # Yes, this needs to be 5 and not 6. Don't ask.
     cmakeFlags+=" -DKDE_INSTALL_KNOTIFYRCDIR=${!outputBin}/share/knotifications6"
     cmakeFlags+=" -DKDE_INSTALL_ICONDIR=${!outputBin}/share/icons"
     cmakeFlags+=" -DKDE_INSTALL_LOCALEDIR=${!outputLib}/share/locale"
diff --git a/pkgs/kde/frameworks/solid/default.nix b/pkgs/kde/frameworks/solid/default.nix
index 08419f4b97849..d59d15f16ead3 100644
--- a/pkgs/kde/frameworks/solid/default.nix
+++ b/pkgs/kde/frameworks/solid/default.nix
@@ -1,5 +1,6 @@
 {
   mkKdeDerivation,
+  fetchpatch,
   qttools,
   bison,
   flex,
@@ -8,8 +9,17 @@
 mkKdeDerivation {
   pname = "solid";
 
-  # Also search /run/wrappers for mount/umount
-  patches = [./fix-search-path.patch];
+  patches = [
+    # Also search /run/wrappers for mount/umount
+    ./fix-search-path.patch
+
+    # Backport fix for mounting removable LUKS devices
+    # FIXME: remove in 6.2
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/solid/-/commit/a3b18591ba144fae0cd0cfc087a45c64000d4e51.patch";
+      hash = "sha256-e7+amjOShUSzPb0pAxnAuuh/fbK/YLESqR0co1bs+wg=";
+    })
+  ];
 
   extraNativeBuildInputs = [qttools bison flex];
   extraBuildInputs = [libimobiledevice];
diff --git a/pkgs/os-specific/bsd/freebsd/default.nix b/pkgs/os-specific/bsd/freebsd/default.nix
index 1f321f032516f..b7cf5484c9e94 100644
--- a/pkgs/os-specific/bsd/freebsd/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/default.nix
@@ -25,16 +25,11 @@ in makeScopeWithSplicing' {
       sha256 = "BpHqJfnGOeTE7tkFJBx0Wk8ryalmf4KNTit/Coh026E=";
     };
 
-    # Why do we have splicing and yet do `nativeBuildInputs = with self; ...`?
-    # See note in ../netbsd/default.nix.
-
     compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isFreeBSD) self.compat;
-
     freebsd-lib = import ./lib { inherit version; };
 
-    # Overridden arguments avoid cross package-set splicing issues,
-    # otherwise would just use implicit
-    # `lib.packagesFromDirectoryRecursive` auto-call.
+    # The manual callPackages below should in principle be unnecessary, but are
+    # necessary. See note in ../netbsd/default.nix
 
     compat = self.callPackage ./pkgs/compat/package.nix {
       inherit stdenv;
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 79d46732bd6c2..ff01c2ce62eb6 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -1,1028 +1,133 @@
 { stdenv, lib, stdenvNoCC
 , makeScopeWithSplicing', generateSplicesForMkScope
 , buildPackages
-, bsdSetupHook, makeSetupHook, fetchcvs, groff, mandoc, byacc, flex
-, zlib
-, writeShellScript, writeText, runtimeShell, symlinkJoin
+, fetchcvs
 }:
 
-let
-  inherit (buildPackages.buildPackages) rsync;
-
-  fetchNetBSD = path: version: sha256: fetchcvs {
-    cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
-    module = "src/${path}";
-    inherit sha256;
-    tag = "netbsd-${lib.replaceStrings ["."] ["-"] version}-RELEASE";
-  };
-
-  netbsdSetupHook = makeSetupHook {
-    name = "netbsd-setup-hook";
-  } ./setup-hook.sh;
-
-  defaultMakeFlags = [
-    "MKSOFTFLOAT=${if stdenv.hostPlatform.gcc.float or (stdenv.hostPlatform.parsed.abi.float or "hard") == "soft"
-      then "yes"
-      else "no"}"
-  ];
-
-in makeScopeWithSplicing' {
+makeScopeWithSplicing' {
   otherSplices = generateSplicesForMkScope "netbsd";
-  f = (self: let
-    inherit (self) mkDerivation;
-  in {
-
-  # Why do we have splicing and yet do `nativeBuildInputs = with self; ...`?
-  #
-  # We use `makeScopeWithSplicing'` because this should be used for all
-  # nested package sets which support cross, so the inner `callPackage` works
-  # correctly. But for the inline packages we don't bother to use
-  # `callPackage`.
-  #
-  # We still could have tried to `with` a big spliced packages set, but
-  # splicing is jank and causes a number of bootstrapping infinite recursions
-  # if one is not careful. Pulling deps out of the right package set directly
-  # side-steps splicing entirely and avoids those footguns.
-  #
-  # For non-bootstrap-critical packages, we might as well use `callPackage` for
-  # consistency with everything else, and maybe put in separate files too.
-
-  compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isNetBSD) self.compat;
-
-  mkDerivation = lib.makeOverridable (attrs: let
-    stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
-  in stdenv'.mkDerivation ({
-    pname = "${attrs.pname or (baseNameOf attrs.path)}-netbsd";
-    inherit (attrs) version;
-    src = fetchNetBSD attrs.path attrs.version attrs.sha256;
-
-    extraPaths = [ ];
-
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install tsort lorder buildPackages.mandoc groff statHook rsync
-    ];
-    buildInputs = with self; compatIfNeeded;
-
-    HOST_SH = stdenv'.shell;
-
-    MACHINE_ARCH = {
-      i486 = "i386";
-      i586 = "i386";
-      i686 = "i386";
-    }.${stdenv'.hostPlatform.parsed.cpu.name}
-      or stdenv'.hostPlatform.parsed.cpu.name;
-
-    MACHINE = {
-      x86_64 = "amd64";
-      aarch64 = "evbarm64";
-      i486 = "i386";
-      i586 = "i386";
-      i686 = "i386";
-    }.${stdenv'.hostPlatform.parsed.cpu.name}
-      or stdenv'.hostPlatform.parsed.cpu.name;
-
-    COMPONENT_PATH = attrs.path;
-
-    makeFlags = defaultMakeFlags;
-
-    strictDeps = true;
-
-    meta = with lib; {
-      maintainers = with maintainers; [ matthewbauer qyliss ];
-      platforms = platforms.unix;
-      license = licenses.bsd2;
+  f = (self: lib.packagesFromDirectoryRecursive {
+    callPackage = self.callPackage;
+    directory = ./pkgs;
+  } // (let inherit (self) mkDerivation; in {
+
+    fetchNetBSD = path: version: sha256: fetchcvs {
+      cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
+      module = "src/${path}";
+      inherit sha256;
+      tag = "netbsd-${lib.replaceStrings ["."] ["-"] version}-RELEASE";
     };
 
-  } // lib.optionalAttrs stdenv'.hasCC {
-    # TODO should CC wrapper set this?
-    CPP = "${stdenv'.cc.targetPrefix}cpp";
-  } // lib.optionalAttrs stdenv'.isDarwin {
-    MKRELRO = "no";
-  } // lib.optionalAttrs (stdenv'.cc.isClang or false) {
-    HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-  } // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
-    HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-  } // lib.optionalAttrs (stdenv'.isx86_32) {
-    USE_SSP = "no";
-  } // lib.optionalAttrs (attrs.headersOnly or false) {
-    installPhase = "includesPhase";
-    dontBuild = true;
-  } // attrs // {
-    # Files that use NetBSD-specific macros need to have nbtool_config.h
-    # included ahead of them on non-NetBSD platforms.
-    postPatch = lib.optionalString (!stdenv'.hostPlatform.isNetBSD) ''
-      set +e
-      grep -Zlr "^__RCSID
-      ^__BEGIN_DECLS" $COMPONENT_PATH | xargs -0r grep -FLZ nbtool_config.h |
-          xargs -0tr sed -i '0,/^#/s//#include <nbtool_config.h>\n\0/'
-      set -e
-    '' + attrs.postPatch or "";
-  }));
-
-  ##
-  ## START BOOTSTRAPPING
-  ##
-  makeMinimal = mkDerivation {
-    path = "tools/make";
-    sha256 = "0fh0nrnk18m613m5blrliq2aydciv51qhc0ihsj4k63incwbk90n";
-    version = "9.2";
-
-    buildInputs = with self; [];
-    nativeBuildInputs = with buildPackages.netbsd; [ bsdSetupHook netbsdSetupHook rsync ];
-
-    skipIncludesPhase = true;
-
-    postPatch = ''
-      patchShebangs $COMPONENT_PATH/configure
-      ${self.make.postPatch}
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-
-      sh ./buildmake.sh
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      install -D nbmake $out/bin/nbmake
-      ln -s $out/bin/nbmake $out/bin/make
-      mkdir -p $out/share
-      cp -r $BSDSRCDIR/share/mk $out/share/mk
-
-      runHook postInstall
-    '';
-
-    extraPaths = with self; [ make.src ] ++ make.extraPaths;
-  };
-
-  compat = mkDerivation (let
-    version = "9.2";
-    commonDeps = [ zlib ];
-  in {
-    path = "tools/compat";
-    sha256 = "1vsxg7136nlhc72vpa664vs22874xh7ila95nkmsd8crn3z3cyn0";
-    inherit version;
-
-    setupHooks = [
-      ../../../build-support/setup-hooks/role.bash
-      ./compat-setup-hook.sh
-    ];
-
-    preConfigure = ''
-      make include/.stamp configure nbtool_config.h.in defs.mk.in
-    '';
-
-    configurePlatforms = [ "build" "host" ];
-    configureFlags = [
-      "--cache-file=config.cache"
-    ] ++ lib.optionals stdenv.hostPlatform.isMusl [
-      # We include this header in our musl package only for legacy
-      # compatibility, and compat works fine without it (and having it
-      # know about sys/cdefs.h breaks packages like glib when built
-      # statically).
-      "ac_cv_header_sys_cdefs_h=no"
-    ];
-
-    nativeBuildInputs = with buildPackages.netbsd; commonDeps ++ [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      rsync
-    ];
-
-    buildInputs = with self; commonDeps;
-
-    # temporarily use gnuinstall for bootstrapping
-    # bsdinstall will be built later
-    makeFlags = defaultMakeFlags ++ [
-      "INSTALL=${buildPackages.coreutils}/bin/install"
-      "DATADIR=$(out)/share"
-      # Can't sort object files yet
-      "LORDER=echo"
-      "TSORT=cat"
-      # Can't process man pages yet
-      "MKSHARE=no"
-    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # GNU objcopy produces broken .a libs which won't link into dependers.
-      # Makefiles only invoke `$OBJCOPY -x/-X`, so cctools strip works here.
-      "OBJCOPY=${buildPackages.darwin.cctools-port}/bin/strip"
-    ];
-    RENAME = "-D";
-
-    passthru.tests = { netbsd-install = self.install; };
-
-    patches = [
-      ./compat-cxx-safe-header.patch
-      ./compat-dont-configure-twice.patch
-      ./compat-no-force-native.patch
-    ];
-
-    preInstall = ''
-      makeFlagsArray+=('INSTALL_FILE=''${INSTALL} ''${COPY} ''${PRESERVE} ''${RENAME}')
-      makeFlagsArray+=('INSTALL_DIR=''${INSTALL} -d')
-      makeFlagsArray+=('INSTALL_SYMLINK=''${INSTALL} ''${SYMLINK} ''${RENAME}')
-    '';
-
-    postInstall = ''
-      # why aren't these installed by netbsd?
-      install -D compat_defs.h $out/include/compat_defs.h
-      install -D $BSDSRCDIR/include/cdbw.h $out/include/cdbw.h
-      install -D $BSDSRCDIR/sys/sys/cdbr.h $out/include/cdbr.h
-      install -D $BSDSRCDIR/sys/sys/featuretest.h \
-                 $out/include/sys/featuretest.h
-      install -D $BSDSRCDIR/sys/sys/md5.h $out/include/md5.h
-      install -D $BSDSRCDIR/sys/sys/rmd160.h $out/include/rmd160.h
-      install -D $BSDSRCDIR/sys/sys/sha1.h $out/include/sha1.h
-      install -D $BSDSRCDIR/sys/sys/sha2.h $out/include/sha2.h
-      install -D $BSDSRCDIR/sys/sys/queue.h $out/include/sys/queue.h
-      install -D $BSDSRCDIR/include/vis.h $out/include/vis.h
-      install -D $BSDSRCDIR/include/db.h $out/include/db.h
-      install -D $BSDSRCDIR/include/netconfig.h $out/include/netconfig.h
-      install -D $BSDSRCDIR/include/utmpx.h $out/include/utmpx.h
-      install -D $BSDSRCDIR/include/tzfile.h $out/include/tzfile.h
-      install -D $BSDSRCDIR/sys/sys/tree.h $out/include/sys/tree.h
-      install -D $BSDSRCDIR/include/nl_types.h $out/include/nl_types.h
-      install -D $BSDSRCDIR/include/stringlist.h $out/include/stringlist.h
-
-      # Collapse includes slightly to fix dangling reference
-      install -D $BSDSRCDIR/common/include/rpc/types.h $out/include/rpc/types.h
-      sed -i '1s;^;#include "nbtool_config.h"\n;' $out/include/rpc/types.h
-   '' + lib.optionalString stdenv.isDarwin ''
-      mkdir -p $out/include/ssp
-      touch $out/include/ssp/ssp.h
-   '' + ''
-      mkdir -p $out/lib/pkgconfig
-      substitute ${./libbsd-overlay.pc} $out/lib/pkgconfig/libbsd-overlay.pc \
-        --subst-var-by out $out \
-        --subst-var-by version ${version}
-    '';
-    extraPaths = with self; [ include.src libc.src libutil.src
-      (fetchNetBSD "external/bsd/flex" "9.2" "0h98jpfj7vx5zh7vd7bk6b1hmzgkcb757a8j6d9zgygxxv13v43m")
-      (fetchNetBSD "sys/sys" "9.2" "0zawhw51klaigqqwkx0lzrx3mim2jywrc24cm7c66qsf1im9awgd")
-      (fetchNetBSD "common/include/rpc/types.h" "9.2" "0n2df12mlc3cbc48jxq35yzl1y7ghgpykvy7jnfh898rdhac7m9a")
-    ] ++ libutil.extraPaths ++ _mainLibcExtraPaths;
-  });
-
-  # HACK: to ensure parent directories exist. This emulates GNU
-  # install’s -D option. No alternative seems to exist in BSD install.
-  install = let binstall = writeShellScript "binstall" ''
-    set -eu
-    for last in "$@"; do true; done
-    mkdir -p $(dirname $last)
-    @out@/bin/xinstall "$@"
-  ''; in mkDerivation {
-    path = "usr.bin/xinstall";
-    version = "9.2";
-    sha256 = "1f6pbz3qv1qcrchdxif8p5lbmnwl8b9nq615hsd3cyl4avd5bfqj";
-    extraPaths = with self; [ mtree.src make.src ];
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      mandoc groff rsync
-    ];
-    skipIncludesPhase = true;
-    buildInputs = with self; compatIfNeeded
-      # fts header is needed. glibc already has this header, but musl doesn't,
-      # so make sure pkgsMusl.netbsd.install still builds in case you want to
-      # remove it!
-      ++ [ fts ];
-    installPhase = ''
-      runHook preInstall
-
-      install -D install.1 $out/share/man/man1/install.1
-      install -D xinstall $out/bin/xinstall
-      install -D -m 0550 ${binstall} $out/bin/binstall
-      substituteInPlace $out/bin/binstall --subst-var out
-      ln -s $out/bin/binstall $out/bin/install
-
-      runHook postInstall
-    '';
-    setupHook = ./install-setup-hook.sh;
-  };
-
-  fts = mkDerivation {
-    pname = "fts";
-    path = "include/fts.h";
-    sha256 = "01d4fpxvz1pgzfk5xznz5dcm0x0gdzwcsfm1h3d0xc9kc6hj2q77";
-    version = "9.2";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook rsync
-    ];
-    propagatedBuildInputs = with self; compatIfNeeded;
-    extraPaths = with self; [
-      (fetchNetBSD "lib/libc/gen/fts.c" "9.2" "1a8hmf26242nmv05ipn3ircxb0jqmmi66rh78kkyi9vjwkfl3qn7")
-      (fetchNetBSD "lib/libc/include/namespace.h" "9.2" "0kksr3pdwdc1cplqf5z12ih4cml6l11lqrz91f7hjjm64y7785kc")
-      (fetchNetBSD "lib/libc/gen/fts.3" "9.2" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
-    ];
-    skipIncludesPhase = true;
-    buildPhase = ''
-      "$CC" -c -Iinclude -Ilib/libc/include lib/libc/gen/fts.c \
-          -o lib/libc/gen/fts.o
-      "$AR" -rsc libfts.a lib/libc/gen/fts.o
-    '';
-    installPhase = ''
-      runHook preInstall
-
-      install -D lib/libc/gen/fts.3 $out/share/man/man3/fts.3
-      install -D include/fts.h $out/include/fts.h
-      install -D lib/libc/include/namespace.h $out/include/namespace.h
-      install -D libfts.a $out/lib/libfts.a
-
-      runHook postInstall
-    '';
-    setupHooks = [
-      ../../../build-support/setup-hooks/role.bash
-      ./fts-setup-hook.sh
-    ];
-  };
-
-  # Don't add this to nativeBuildInputs directly.  Use statHook instead.
-  stat = mkDerivation {
-    path = "usr.bin/stat";
-    version = "9.2";
-    sha256 = "18nqwlndfc34qbbgqx5nffil37jfq9aw663ippasfxd2hlyc106x";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff rsync
-    ];
-  };
-
-  # stat isn't in POSIX, and NetBSD stat supports a completely
-  # different range of flags than GNU stat, so including it in PATH
-  # breaks stdenv.  Work around that with a hook that will point
-  # NetBSD's build system and NetBSD stat without including it in
-  # PATH.
-  statHook = makeSetupHook {
-    name = "netbsd-stat-hook";
-  } (writeText "netbsd-stat-hook-impl" ''
-    makeFlagsArray+=(TOOL_STAT=${self.stat}/bin/stat)
-  '');
-
-  tsort = mkDerivation {
-    path = "usr.bin/tsort";
-    version = "9.2";
-    sha256 = "1dqvf9gin29nnq3c4byxc7lfd062pg7m84843zdy6n0z63hnnwiq";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff rsync
-    ];
-  };
-
-  lorder = mkDerivation {
-    path = "usr.bin/lorder";
-    version = "9.2";
-    sha256 = "0rjf9blihhm0n699vr2bg88m4yjhkbxh6fxliaay3wxkgnydjwn2";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff rsync
-    ];
-  };
-
-  ##
-  ## END BOOTSTRAPPING
-  ##
-
-  ##
-  ## START COMMAND LINE TOOLS
-  ##
-  make = mkDerivation {
-    path = "usr.bin/make";
-    sha256 = "0vi73yicbmbp522qzqvd979cx6zm5jakhy77xh73c1kygf8klccs";
-    version = "9.2";
-
-   postPatch = ''
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.doc.mk \
-       --replace '-o ''${DOCOWN}' "" \
-       --replace '-g ''${DOCGRP}' ""
-     for mk in $BSDSRCDIR/share/mk/bsd.inc.mk $BSDSRCDIR/share/mk/bsd.kinc.mk; do
-       substituteInPlace $mk \
-         --replace '-o ''${BINOWN}' "" \
-         --replace '-g ''${BINGRP}' ""
-     done
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.kmodule.mk \
-       --replace '-o ''${KMODULEOWN}' "" \
-       --replace '-g ''${KMODULEGRP}' ""
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
-       --replace '-o ''${LIBOWN}' "" \
-       --replace '-g ''${LIBGRP}' "" \
-       --replace '-o ''${DEBUGOWN}' "" \
-       --replace '-g ''${DEBUGGRP}' ""
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.lua.mk \
-       --replace '-o ''${LIBOWN}' "" \
-       --replace '-g ''${LIBGRP}' ""
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.man.mk \
-       --replace '-o ''${MANOWN}' "" \
-       --replace '-g ''${MANGRP}' ""
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.nls.mk \
-       --replace '-o ''${NLSOWN}' "" \
-       --replace '-g ''${NLSGRP}' ""
-     substituteInPlace $BSDSRCDIR/share/mk/bsd.prog.mk \
-       --replace '-o ''${BINOWN}' "" \
-       --replace '-g ''${BINGRP}' "" \
-       --replace '-o ''${RUMPBINOWN}' "" \
-       --replace '-g ''${RUMPBINGRP}' "" \
-       --replace '-o ''${DEBUGOWN}' "" \
-       --replace '-g ''${DEBUGGRP}' ""
-
-      # make needs this to pick up our sys make files
-      export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
-
-      substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
-        --replace '_INSTRANLIB=''${empty(PRESERVE):?-a "''${RANLIB} -t":}' '_INSTRANLIB='
-      substituteInPlace $BSDSRCDIR/share/mk/bsd.kinc.mk \
-        --replace /bin/rm rm
-    '' + lib.optionalString stdenv.isDarwin ''
-      substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
-        --replace '-Wl,--fatal-warnings' "" \
-        --replace '-Wl,--warn-shared-textrel' ""
-    '';
-    postInstall = ''
-      make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
-    '';
-    extraPaths = [
-      (fetchNetBSD "share/mk" "9.2" "0w9x77cfnm6zwy40slradzi0ip9gz80x6lk7pvnlxzsr2m5ra5sy")
-    ];
-  };
-
-  mtree = mkDerivation {
-    path = "usr.sbin/mtree";
-    version = "9.2";
-    sha256 = "04p7w540vz9npvyb8g8hcf2xa05phn1y88hsyrcz3vwanvpc0yv9";
-    extraPaths = with self; [ mknod.src ];
-  };
-
-  mknod = mkDerivation {
-    path = "sbin/mknod";
-    version = "9.2";
-    sha256 = "1d9369shzwgixz3nph991i8q5vk7hr04py3n9avbfbhzy4gndqs2";
-  };
-
-  getent = mkDerivation {
-    path = "usr.bin/getent";
-    sha256 = "1qngywcmm0y7nl8h3n8brvkxq4jw63szbci3kc1q6a6ndhycbbvr";
-    version = "9.2";
-    patches = [ ./getent.patch ];
-  };
-
-  getconf = mkDerivation {
-    path = "usr.bin/getconf";
-    sha256 = "122vslz4j3h2mfs921nr2s6m078zcj697yrb75rwp2hnw3qz4s8q";
-    version = "9.2";
-  };
-
-  locale = mkDerivation {
-    path = "usr.bin/locale";
-    version = "9.2";
-    sha256 = "0kk6v9k2bygq0wf9gbinliqzqpzs9bgxn0ndyl2wcv3hh2bmsr9p";
-    patches = [ ./locale.patch ];
-    env.NIX_CFLAGS_COMPILE = "-DYESSTR=__YESSTR -DNOSTR=__NOSTR";
-  };
-
-  rpcgen = mkDerivation {
-    path = "usr.bin/rpcgen";
-    version = "9.2";
-    sha256 = "1kfgfx54jg98wbg0d95p0rvf4w0302v8fz724b0bdackdsrd4988";
-  };
-
-  genassym = mkDerivation {
-    path = "usr.bin/genassym";
-    version = "9.2";
-    sha256 = "1acl1dz5kvh9h5806vkz2ap95rdsz7phmynh5i3x5y7agbki030c";
-  };
-
-  gencat = mkDerivation {
-    path = "usr.bin/gencat";
-    version = "9.2";
-    sha256 = "0gd463x1hg36bhr7y0xryb5jyxk0z0g7xvy8rgk82nlbnlnsbbwb";
-  };
-
-  nbperf = mkDerivation {
-    path = "usr.bin/nbperf";
-    version = "9.2";
-    sha256 = "1nxc302vgmjhm3yqdivqyfzslrg0vjpbss44s74rcryrl19mma9r";
-  };
-
-  tic = mkDerivation {
-    path = "tools/tic";
-    version = "9.2";
-    sha256 = "092y7db7k4kh2jq8qc55126r5qqvlb8lq8mhmy5ipbi36hwb4zrz";
-    HOSTPROG = "tic";
-    buildInputs = with self; compatIfNeeded;
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff nbperf rsync
-    ];
-    makeFlags = defaultMakeFlags ++ [ "TOOLDIR=$(out)" ];
-    extraPaths = with self; [
-      libterminfo.src
-      (fetchNetBSD "usr.bin/tic" "9.2" "1mwdfg7yx1g43ss378qsgl5rqhsxskqvsd2mqvrn38qw54i8v5i1")
-      (fetchNetBSD "tools/Makefile.host" "9.2" "15b4ab0n36lqj00j5lz2xs83g7l8isk3wx1wcapbrn66qmzz2sxy")
+    defaultMakeFlags = [
+      "MKSOFTFLOAT=${if stdenv.hostPlatform.gcc.float or (stdenv.hostPlatform.parsed.abi.float or "hard") == "soft"
+        then "yes"
+        else "no"}"
     ];
-  };
 
-  uudecode = mkDerivation {
-    path = "usr.bin/uudecode";
-    version = "9.2";
-    sha256 = "00a3zmh15pg4vx6hz0kaa5mi8d2b1sj4h512d7p6wbvxq6mznwcn";
-    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-DNO_BASE64";
-    NIX_LDFLAGS = lib.optional stdenv.isDarwin "-lresolv";
-  };
+    compatIfNeeded = lib.optional (!stdenvNoCC.hostPlatform.isNetBSD) self.compat;
 
-  cksum = mkDerivation {
-    path = "usr.bin/cksum";
-    version = "9.2";
-    sha256 = "0msfhgyvh5c2jmc6qjnf12c378dhw32ffsl864qz4rdb2b98rfcq";
-    meta.platforms = lib.platforms.netbsd;
-  };
+    # The manual callPackages below should in principle be unnecessary because
+    # they're just selecting arguments that would be selected anyway. However,
+    # if we don't perform these manual calls, we get infinite recursion issues
+    # because of the splices.
 
-  config = mkDerivation {
-    path = "usr.bin/config";
-    version = "9.2";
-    sha256 = "1yz3n4hncdkk6kp595fh2q5lg150vpqg8iw2dccydkyw4y3hgsjj";
-    env.NIX_CFLAGS_COMPILE = toString [ "-DMAKE_BOOTSTRAP" ];
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal install mandoc byacc flex rsync
-    ];
-    buildInputs = with self; compatIfNeeded;
-    extraPaths = with self; [ cksum.src ];
-  };
-  ##
-  ## END COMMAND LINE TOOLS
-  ##
-
-  ##
-  ## START HEADERS
-  ##
-  include = mkDerivation {
-    path = "include";
-    version = "9.2";
-    sha256 = "0nxnmj4c8s3hb9n3fpcmd0zl3l1nmhivqgi9a35sis943qvpgl9h";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff rsync nbperf rpcgen
-    ];
-
-    # The makefiles define INCSDIR per subdirectory, so we have to set
-    # something else on the command line so those definitions aren't
-    # overridden.
-    postPatch = ''
-      find "$BSDSRCDIR" -name Makefile -exec \
-        sed -i -E \
-          -e 's_/usr/include_''${INCSDIR0}_' \
-          {} \;
-    '';
-
-    # multiple header dirs, see above
-    postConfigure = ''
-      makeFlags=''${makeFlags/INCSDIR/INCSDIR0}
-    '';
-
-    extraPaths = with self; [ common ];
-    headersOnly = true;
-    noCC = true;
-    meta.platforms = lib.platforms.netbsd;
-    makeFlags = defaultMakeFlags ++ [ "RPCGEN_CPP=${buildPackages.stdenv.cc.cc}/bin/cpp" ];
-  };
-
-  common = fetchNetBSD "common" "9.2" "1pfylz9r3ap5wnwwbwczbfjb1m5qdyspzbnmxmcdkpzz2zgj64b9";
-
-  sys-headers = mkDerivation {
-    pname = "sys-headers";
-    path = "sys";
-    version = "9.2";
-    sha256 = "03s18q8d9giipf05bx199fajc2qwikji0djz7hw63d2lya6bfnpj";
-
-    # Make the build ignore linker warnings
-    prePatch = ''
-      substituteInPlace sys/conf/Makefile.kern.inc \
-        --replace "-Wa,--fatal-warnings" ""
-    '';
-
-    patches = [
-      # Fix this error when building bootia32.efi and bootx64.efi:
-      # error: PHDR segment not covered by LOAD segment
-      ./no-dynamic-linker.patch
-
-      # multiple header dirs, see above
-      ./sys-headers-incsdir.patch
-    ];
+    mkDerivation = self.callPackage ./pkgs/mkDerivation.nix {
+      inherit stdenv stdenvNoCC;
+      inherit (buildPackages.netbsd) netbsdSetupHook makeMinimal install tsort lorder;
+      inherit (buildPackages) mandoc;
+      inherit (buildPackages.buildPackages) rsync;
 
-    postPatch =
-      ''
-        substituteInPlace sys/arch/i386/stand/efiboot/Makefile.efiboot \
-          --replace "-nocombreloc" "-z nocombreloc"
-      '' +
-      # multiple header dirs, see above
-      self.include.postPatch;
-
-    CONFIG = "GENERIC";
-
-    propagatedBuildInputs = with self; [ include ];
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal install tsort lorder statHook rsync uudecode config genassym
-    ];
-
-    postConfigure = ''
-      pushd arch/$MACHINE/conf
-      config $CONFIG
-      popd
-    ''
-      # multiple header dirs, see above
-      + self.include.postConfigure;
-
-    makeFlags = defaultMakeFlags ++ [ "FIRMWAREDIR=$(out)/libdata/firmware" ];
-    hardeningDisable = [ "pic" ];
-    MKKMOD = "no";
-    env.NIX_CFLAGS_COMPILE = toString [
-      "-Wno-error=array-parameter"
-      "-Wno-error=array-bounds"
-      "-Wa,--no-warn"
-    ];
-
-    postBuild = ''
-      make -C arch/$MACHINE/compile/$CONFIG $makeFlags
-    '';
-
-    postInstall = ''
-      cp arch/$MACHINE/compile/$CONFIG/netbsd $out
-    '';
-
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ common ];
-
-    installPhase = "includesPhase";
-    dontBuild = true;
-    noCC = true;
-  };
-
-  # The full kernel. We do the funny thing of overridding the headers to the
-  # full kernal and not vice versa to avoid infinite recursion -- the headers
-  # come earlier in the bootstrap.
-  sys = self.sys-headers.override {
-    pname = "sys";
-    installPhase = null;
-    noCC = false;
-    dontBuild = false;
-  };
-
-  headers = symlinkJoin {
-    name = "netbsd-headers-9.2";
-    paths = with self; [
-      include
-      sys-headers
-      libpthread-headers
-    ];
-    meta.platforms = lib.platforms.netbsd;
-  };
-  ##
-  ## END HEADERS
-  ##
-
-  ##
-  ## START LIBRARIES
-  ##
-  libarch = mkDerivation {
-    path = "lib/libarch";
-    version = "9.2";
-    sha256 = "6ssenRhuSwp0Jn71ErT0PrEoCJ+cIYRztwdL4QTDZsQ=";
-    meta.platforms = lib.platforms.netbsd;
-  };
-
-  libutil = mkDerivation {
-    path = "lib/libutil";
-    version = "9.2";
-    sha256 = "02gm5a5zhh8qp5r5q5r7x8x6x50ir1i0ncgsnfwh1vnrz6mxbq7z";
-    extraPaths = with self; [ common libc.src sys.src ];
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      byacc install tsort lorder mandoc statHook rsync
-    ];
-    buildInputs = with self; [ headers ];
-    SHLIBINSTALLDIR = "$(out)/lib";
-  };
-
-  libedit = mkDerivation {
-    path = "lib/libedit";
-    version = "9.2";
-    sha256 = "1wqhngraxwqk4jgrf5f18jy195yrp7c06n1gf31pbplq79mg1bcj";
-    buildInputs = with self; [ libterminfo libcurses ];
-    propagatedBuildInputs = with self; compatIfNeeded;
-    SHLIBINSTALLDIR = "$(out)/lib";
-    makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${self.libterminfo}/lib" ];
-    postPatch = ''
-      sed -i '1i #undef bool_t' $COMPONENT_PATH/el.h
-      substituteInPlace $COMPONENT_PATH/config.h \
-        --replace "#define HAVE_STRUCT_DIRENT_D_NAMLEN 1" ""
-      substituteInPlace $COMPONENT_PATH/readline/Makefile --replace /usr/include "$out/include"
-    '';
-    env.NIX_CFLAGS_COMPILE = toString [
-      "-D__noinline="
-      "-D__scanflike(a,b)="
-      "-D__va_list=va_list"
-    ];
-  };
-
-  libterminfo = mkDerivation {
-    path = "lib/libterminfo";
-    version = "9.2";
-    sha256 = "0pq05k3dj0dfsczv07frnnji92mazmy2qqngqbx2zgqc1x251414";
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal install tsort lorder mandoc statHook nbperf tic rsync
-    ];
-    buildInputs = with self; compatIfNeeded;
-    SHLIBINSTALLDIR = "$(out)/lib";
-    postPatch = ''
-      substituteInPlace $COMPONENT_PATH/term.c --replace /usr/share $out/share
-      substituteInPlace $COMPONENT_PATH/setupterm.c \
-        --replace '#include <curses.h>' 'void use_env(bool);'
-    '';
-    postBuild = ''
-      make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share
-    '';
-    postInstall = ''
-      make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share install
-    '';
-    extraPaths = with self; [
-      (fetchNetBSD "share/terminfo" "9.2" "1vh9rl4w8118a9qdpblfxmv1wkpm83rm9gb4rzz5bpm56i6d7kk7")
-    ];
-  };
-
-  libcurses = mkDerivation {
-    path = "lib/libcurses";
-    version = "9.2";
-    sha256 = "0pd0dggl3w4bv5i5h0s1wrc8hr66n4hkv3zlklarwfdhc692fqal";
-    buildInputs = with self; [ libterminfo ];
-    env.NIX_CFLAGS_COMPILE = toString ([
-      "-D__scanflike(a,b)="
-      "-D__va_list=va_list"
-      "-D__warn_references(a,b)="
-    ] ++ lib.optional stdenv.isDarwin "-D__strong_alias(a,b)=");
-    propagatedBuildInputs = with self; compatIfNeeded;
-    MKDOC = "no"; # missing vfontedpr
-    makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${self.libterminfo}/lib" ];
-    postPatch = lib.optionalString (!stdenv.isDarwin) ''
-      substituteInPlace $COMPONENT_PATH/printw.c \
-        --replace "funopen(win, NULL, __winwrite, NULL, NULL)" NULL \
-        --replace "__strong_alias(vwprintw, vw_printw)" 'extern int vwprintw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_printw")));'
-      substituteInPlace $COMPONENT_PATH/scanw.c \
-        --replace "__strong_alias(vwscanw, vw_scanw)" 'extern int vwscanw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_scanw")));'
-    '';
-  };
-
-  column = mkDerivation {
-    path = "usr.bin/column";
-    version = "9.2";
-    sha256 = "0r6b0hjn5ls3j3sv6chibs44fs32yyk2cg8kh70kb4cwajs4ifyl";
-  };
+    };
 
-  libossaudio = mkDerivation {
-    path = "lib/libossaudio";
-    version = "9.2";
-    sha256 = "16l3bfy6dcwqnklvh3x0ps8ld1y504vf57v9rx8f9adzhb797jh0";
-    meta.platforms = lib.platforms.netbsd;
-  };
+    makeMinimal = self.callPackage ./pkgs/makeMinimal.nix {
+      inherit (self) make;
+    };
 
-  librpcsvc = mkDerivation {
-    path = "lib/librpcsvc";
-    version = "9.2";
-    sha256 = "1q34pfiyjbrgrdqm46jwrsqms49ly6z3b0xh1wg331zga900vq5n";
-    makeFlags = defaultMakeFlags ++ [ "INCSDIR=$(out)/include/rpcsvc" ];
-    meta.platforms = lib.platforms.netbsd;
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install tsort lorder rpcgen statHook
-    ];
-  };
+    compat = self.callPackage ./pkgs/compat/package.nix {
+      inherit (buildPackages) coreutils;
+      inherit (buildPackages.darwin) cctools-port;
+      inherit (buildPackages.buildPackages) rsync;
+      inherit (buildPackages.netbsd) makeMinimal;
+      inherit (self) install include libc libutil;
+    };
 
-  librt = mkDerivation {
-    path = "lib/librt";
-    version = "9.2";
-    sha256 = "07f8mpjcqh5kig5z5sp97fg55mc4dz6aa1x5g01nv2pvbmqczxc6";
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ libc.src ] ++ libc.extraPaths;
-    postPatch = ''
-      sed -i 's,/usr\(/include/sys/syscall.h\),${self.headers}\1,g' \
-        $BSDSRCDIR/lib/{libc,librt}/sys/Makefile.inc
-    '';
-  };
+    install = self.callPackage ./pkgs/install/package.nix {
+      inherit (self) fts mtree make compatIfNeeded;
+      inherit (buildPackages.buildPackages) rsync;
+      inherit (buildPackages.netbsd) makeMinimal;
+    };
 
-  libcrypt = mkDerivation {
-    path = "lib/libcrypt";
-    version = "9.2";
-    sha256 = "0siqan1wdqmmhchh2n8w6a8x1abbff8n4yb6jrqxap3hqn8ay54g";
-    SHLIBINSTALLDIR = "$(out)/lib";
-    meta.platforms = lib.platforms.netbsd;
-  };
+    # See note in pkgs/stat/package.nix
+    stat = self.callPackage ./pkgs/stat/package.nix {
+      inherit (buildPackages.netbsd) makeMinimal install;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  libpci = mkDerivation {
-    pname = "libpci";
-    path = "lib/libpci";
-    version = "9.2";
-    sha256 = "+IOEO1Bw3/H3iCp3uk3bwsFZbvCqN5Ciz70irnPl8E8=";
-    env.NIX_CFLAGS_COMPILE = toString [ "-I." ];
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ sys.src ];
-  };
+    # See note in pkgs/stat/hook.nix
+    statHook = self.callPackage ./pkgs/stat/hook.nix {
+      inherit (self) stat;
+    };
 
-  libpthread-headers = mkDerivation {
-    pname = "libpthread-headers";
-    path = "lib/libpthread";
-    version = "9.2";
-    sha256 = "0mlmc31k509dwfmx5s2x010wxjc44mr6y0cbmk30cfipqh8c962h";
-    installPhase = "includesPhase";
-    dontBuild = true;
-    noCC = true;
-    meta.platforms = lib.platforms.netbsd;
-  };
+    tsort = self.callPackage ./pkgs/tsort.nix {
+      inherit (buildPackages.netbsd) makeMinimal install;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  libpthread = self.libpthread-headers.override {
-    pname = "libpthread";
-    installPhase = null;
-    noCC = false;
-    dontBuild = false;
-    buildInputs = with self; [ headers ];
-    SHLIBINSTALLDIR = "$(out)/lib";
-    extraPaths = with self; [ common libc.src librt.src sys.src ];
-  };
+    lorder = self.callPackage ./pkgs/lorder.nix {
+      inherit (buildPackages.netbsd) makeMinimal install;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  libresolv = mkDerivation {
-    path = "lib/libresolv";
-    version = "9.2";
-    sha256 = "1am74s74mf1ynwz3p4ncjkg63f78a1zjm983q166x4sgzps15626";
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ libc.src ];
-  };
+    config = self.callPackage ./pkgs/config.nix {
+      inherit (buildPackages.netbsd) makeMinimal install;
+      inherit (buildPackages.buildPackages) rsync;
+      inherit (self) cksum;
+    };
 
-  libm = mkDerivation {
-    path = "lib/libm";
-    version = "9.2";
-    sha256 = "1apwfr26shdmbqqnmg7hxf7bkfxw44ynqnnnghrww9bnhqdnsy92";
-    SHLIBINSTALLDIR = "$(out)/lib";
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ sys.src ];
-  };
+    include = self.callPackage ./pkgs/include.nix {
+      inherit (buildPackages.netbsd)
+        makeMinimal install nbperf rpcgen;
+      inherit (buildPackages) stdenv;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  i18n_module = mkDerivation {
-    path = "lib/i18n_module";
-    version = "9.2";
-    sha256 = "0w6y5v3binm7gf2kn7y9jja8k18rhnyl55cvvfnfipjqdxvxd9jd";
-    meta.platforms = lib.platforms.netbsd;
-    extraPaths = with self; [ libc.src ];
-  };
+    sys-headers = self.callPackage ./pkgs/sys/headers.nix {
+      inherit (buildPackages.netbsd)
+        makeMinimal install tsort lorder statHook uudecode config genassym;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  csu = mkDerivation {
-    path = "lib/csu";
-    version = "9.2";
-    sha256 = "0al5jfazvhlzn9hvmnrbchx4d0gm282hq5gp4xs2zmj9ycmf6d03";
-    meta.platforms = lib.platforms.netbsd;
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff flex
-      byacc genassym gencat lorder tsort statHook rsync
-    ];
-    buildInputs = with self; [ headers ];
-    extraPaths = with self; [ sys.src ld_elf_so.src ];
-  };
+    libutil = self.callPackage ./pkgs/libutil.nix {
+      inherit (self) libc sys;
+    };
 
-  ld_elf_so = mkDerivation {
-    path  = "libexec/ld.elf_so";
-    version = "9.2";
-    sha256 = "0ia9mqzdljly0vqfwflm5mzz55k7qsr4rw2bzhivky6k30vgirqa";
-    meta.platforms = lib.platforms.netbsd;
-    LIBC_PIC = "${self.libc}/lib/libc_pic.a";
-    # Hack to prevent a symlink being installed here for compatibility.
-    SHLINKINSTALLDIR = "/usr/libexec";
-    USE_FORT = "yes";
-    makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/libexec" "CLIBOBJ=${self.libc}/lib" ];
-    extraPaths = with self; [ libc.src ] ++ libc.extraPaths;
-  };
+    libpthread-headers = self.callPackage ./pkgs/libpthread/headers.nix { };
 
-  _mainLibcExtraPaths = with self; [
-      common i18n_module.src sys.src
-      ld_elf_so.src libpthread.src libm.src libresolv.src
-      librpcsvc.src libutil.src librt.src libcrypt.src
-  ];
+    csu = self.callPackage ./pkgs/csu.nix {
+      inherit (self) headers sys ld_elf_so;
+      inherit (buildPackages.netbsd)
+        netbsdSetupHook
+        makeMinimal
+        install
+        genassym gencat lorder tsort statHook;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-  libc = mkDerivation {
-    path = "lib/libc";
-    version = "9.2";
-    sha256 = "1y9c13igg0kai07sqvf9cm6yqmd8lhfd8hq3q7biilbgs1l99as3";
-    USE_FORT = "yes";
-    MKPROFILE = "no";
-    extraPaths = with self; _mainLibcExtraPaths ++ [
-      (fetchNetBSD "external/bsd/jemalloc" "9.2" "0cq704swa0h2yxv4gc79z2lwxibk9k7pxh3q5qfs7axx3jx3n8kb")
-    ];
-    nativeBuildInputs = with buildPackages.netbsd; [
-      bsdSetupHook netbsdSetupHook
-      makeMinimal
-      install mandoc groff flex
-      byacc genassym gencat lorder tsort statHook rsync rpcgen
+    _mainLibcExtraPaths = with self; [
+        common i18n_module.src sys.src
+        ld_elf_so.src libpthread.src libm.src libresolv.src
+        librpcsvc.src libutil.src librt.src libcrypt.src
     ];
-    buildInputs = with self; [ headers csu ];
-    env.NIX_CFLAGS_COMPILE = "-B${self.csu}/lib -fcommon";
-    meta.platforms = lib.platforms.netbsd;
-    SHLIBINSTALLDIR = "$(out)/lib";
-    MKPICINSTALL = "yes";
-    NLSDIR = "$(out)/share/nls";
-    makeFlags = defaultMakeFlags ++ [ "FILESDIR=$(out)/var/db"];
-    postInstall = ''
-      pushd ${self.headers}
-      find . -type d -exec mkdir -p $out/\{} \;
-      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-      popd
-
-      pushd ${self.csu}
-      find . -type d -exec mkdir -p $out/\{} \;
-      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-      popd
-
-      NIX_CFLAGS_COMPILE+=" -B$out/lib"
-      NIX_CFLAGS_COMPILE+=" -I$out/include"
-      NIX_LDFLAGS+=" -L$out/lib"
-
-      make -C $BSDSRCDIR/lib/libpthread $makeFlags
-      make -C $BSDSRCDIR/lib/libpthread $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libm $makeFlags
-      make -C $BSDSRCDIR/lib/libm $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libresolv $makeFlags
-      make -C $BSDSRCDIR/lib/libresolv $makeFlags install
-
-      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
-      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
 
-      make -C $BSDSRCDIR/lib/i18n_module $makeFlags
-      make -C $BSDSRCDIR/lib/i18n_module $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libutil $makeFlags
-      make -C $BSDSRCDIR/lib/libutil $makeFlags install
-
-      make -C $BSDSRCDIR/lib/librt $makeFlags
-      make -C $BSDSRCDIR/lib/librt $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libcrypt $makeFlags
-      make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
-    '';
-    inherit (self.librt) postPatch;
-  };
-  #
-  # END LIBRARIES
-  #
-
-  #
-  # START MISCELLANEOUS
-  #
-  dict = mkDerivation {
-    path = "share/dict";
-    noCC = true;
-    version = "9.2";
-    sha256 = "0svfc0byk59ri37pyjslv4c4rc7zw396r73mr593i78d39q5g3ad";
-    makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/share" ];
-  };
-
-  misc = mkDerivation {
-    path = "share/misc";
-    noCC = true;
-    version = "9.2";
-    sha256 = "1j2cdssdx6nncv8ffj7f7ybl7m9hadjj8vm8611skqdvxnjg6nbc";
-    makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/share" ];
-  };
-
-  man = mkDerivation {
-    path = "share/man";
-    noCC = true;
-    version = "9.2";
-    sha256 = "1l4lmj4kmg8dl86x94sr45w0xdnkz8dn4zjx0ipgr9bnq98663zl";
-    # man0 generates a man.pdf using ps2pdf, but doesn't install it later,
-    # so we can avoid the dependency on ghostscript
-    postPatch = ''
-      substituteInPlace $COMPONENT_PATH/man0/Makefile --replace "ps2pdf" "echo noop "
-    '';
-    makeFlags = defaultMakeFlags ++ [
-      "FILESDIR=$(out)/share"
-      "MKRUMP=no" # would require to have additional path sys/rump/share/man
-    ];
-  };
-  #
-  # END MISCELLANEOUS
-  #
+    libc = self.callPackage ./pkgs/libc.nix {
+      inherit (self) headers csu librt;
+      inherit (buildPackages.netbsd)
+        netbsdSetupHook
+        makeMinimal
+        install
+        genassym gencat lorder tsort statHook rpcgen;
+      inherit (buildPackages.buildPackages) rsync;
+    };
 
-});
+  }));
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix b/pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix
new file mode 100644
index 0000000000000..a2ec387501ae1
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/cksum.nix
@@ -0,0 +1,8 @@
+{ lib, mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/cksum";
+  version = "9.2";
+  sha256 = "0msfhgyvh5c2jmc6qjnf12c378dhw32ffsl864qz4rdb2b98rfcq";
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/column.nix b/pkgs/os-specific/bsd/netbsd/pkgs/column.nix
new file mode 100644
index 0000000000000..f3cebfa9ab261
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/column.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/column";
+  version = "9.2";
+  sha256 = "0r6b0hjn5ls3j3sv6chibs44fs32yyk2cg8kh70kb4cwajs4ifyl";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/common.nix b/pkgs/os-specific/bsd/netbsd/pkgs/common.nix
new file mode 100644
index 0000000000000..464fc1c9e0c26
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/common.nix
@@ -0,0 +1,3 @@
+{ fetchNetBSD }:
+
+fetchNetBSD "common" "9.2" "1pfylz9r3ap5wnwwbwczbfjb1m5qdyspzbnmxmcdkpzz2zgj64b9"
diff --git a/pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-cxx-safe-header.patch
index 2aaa90b76146b..2aaa90b76146b 100644
--- a/pkgs/os-specific/bsd/netbsd/compat-cxx-safe-header.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-cxx-safe-header.patch
diff --git a/pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-dont-configure-twice.patch
index 2758e256a6168..2758e256a6168 100644
--- a/pkgs/os-specific/bsd/netbsd/compat-dont-configure-twice.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-dont-configure-twice.patch
diff --git a/pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-no-force-native.patch
index 117fb7e042982..117fb7e042982 100644
--- a/pkgs/os-specific/bsd/netbsd/compat-no-force-native.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-no-force-native.patch
diff --git a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-setup-hook.sh
index acd90b7aa2f0e..acd90b7aa2f0e 100644
--- a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/compat-setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/libbsd-overlay.pc b/pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc
index 3aadabe508822..3aadabe508822 100644
--- a/pkgs/os-specific/bsd/netbsd/libbsd-overlay.pc
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/libbsd-overlay.pc
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix
new file mode 100644
index 0000000000000..a1336ad52f6dc
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/compat/package.nix
@@ -0,0 +1,120 @@
+{ lib, mkDerivation, stdenv
+, zlib
+, defaultMakeFlags
+, coreutils
+, cctools-port
+, include, libc, libutil
+, install
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, rsync
+, fetchNetBSD
+, _mainLibcExtraPaths
+}:
+
+mkDerivation (let
+    version = "9.2";
+    commonDeps = [ zlib ];
+  in {
+    path = "tools/compat";
+    sha256 = "1vsxg7136nlhc72vpa664vs22874xh7ila95nkmsd8crn3z3cyn0";
+    inherit version;
+
+    setupHooks = [
+      ../../../../../build-support/setup-hooks/role.bash
+      ./compat-setup-hook.sh
+    ];
+
+    preConfigure = ''
+      make include/.stamp configure nbtool_config.h.in defs.mk.in
+    '';
+
+    configurePlatforms = [ "build" "host" ];
+    configureFlags = [
+      "--cache-file=config.cache"
+    ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+      # We include this header in our musl package only for legacy
+      # compatibility, and compat works fine without it (and having it
+      # know about sys/cdefs.h breaks packages like glib when built
+      # statically).
+      "ac_cv_header_sys_cdefs_h=no"
+    ];
+
+    nativeBuildInputs = commonDeps ++ [
+      bsdSetupHook netbsdSetupHook
+      makeMinimal
+      rsync
+    ];
+
+    buildInputs = commonDeps;
+
+    # temporarily use gnuinstall for bootstrapping
+    # bsdinstall will be built later
+    makeFlags = defaultMakeFlags ++ [
+      "INSTALL=${coreutils}/bin/install"
+      "DATADIR=$(out)/share"
+      # Can't sort object files yet
+      "LORDER=echo"
+      "TSORT=cat"
+      # Can't process man pages yet
+      "MKSHARE=no"
+    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # GNU objcopy produces broken .a libs which won't link into dependers.
+      # Makefiles only invoke `$OBJCOPY -x/-X`, so cctools strip works here.
+      "OBJCOPY=${cctools-port}/bin/strip"
+    ];
+    RENAME = "-D";
+
+    passthru.tests = { netbsd-install = install; };
+
+    patches = [
+      ./compat-cxx-safe-header.patch
+      ./compat-dont-configure-twice.patch
+      ./compat-no-force-native.patch
+    ];
+
+    preInstall = ''
+      makeFlagsArray+=('INSTALL_FILE=''${INSTALL} ''${COPY} ''${PRESERVE} ''${RENAME}')
+      makeFlagsArray+=('INSTALL_DIR=''${INSTALL} -d')
+      makeFlagsArray+=('INSTALL_SYMLINK=''${INSTALL} ''${SYMLINK} ''${RENAME}')
+    '';
+
+    postInstall = ''
+      # why aren't these installed by netbsd?
+      install -D compat_defs.h $out/include/compat_defs.h
+      install -D $BSDSRCDIR/include/cdbw.h $out/include/cdbw.h
+      install -D $BSDSRCDIR/sys/sys/cdbr.h $out/include/cdbr.h
+      install -D $BSDSRCDIR/sys/sys/featuretest.h \
+                 $out/include/sys/featuretest.h
+      install -D $BSDSRCDIR/sys/sys/md5.h $out/include/md5.h
+      install -D $BSDSRCDIR/sys/sys/rmd160.h $out/include/rmd160.h
+      install -D $BSDSRCDIR/sys/sys/sha1.h $out/include/sha1.h
+      install -D $BSDSRCDIR/sys/sys/sha2.h $out/include/sha2.h
+      install -D $BSDSRCDIR/sys/sys/queue.h $out/include/sys/queue.h
+      install -D $BSDSRCDIR/include/vis.h $out/include/vis.h
+      install -D $BSDSRCDIR/include/db.h $out/include/db.h
+      install -D $BSDSRCDIR/include/netconfig.h $out/include/netconfig.h
+      install -D $BSDSRCDIR/include/utmpx.h $out/include/utmpx.h
+      install -D $BSDSRCDIR/include/tzfile.h $out/include/tzfile.h
+      install -D $BSDSRCDIR/sys/sys/tree.h $out/include/sys/tree.h
+      install -D $BSDSRCDIR/include/nl_types.h $out/include/nl_types.h
+      install -D $BSDSRCDIR/include/stringlist.h $out/include/stringlist.h
+
+      # Collapse includes slightly to fix dangling reference
+      install -D $BSDSRCDIR/common/include/rpc/types.h $out/include/rpc/types.h
+      sed -i '1s;^;#include "nbtool_config.h"\n;' $out/include/rpc/types.h
+   '' + lib.optionalString stdenv.isDarwin ''
+      mkdir -p $out/include/ssp
+      touch $out/include/ssp/ssp.h
+   '' + ''
+      mkdir -p $out/lib/pkgconfig
+      substitute ${./libbsd-overlay.pc} $out/lib/pkgconfig/libbsd-overlay.pc \
+        --subst-var-by out $out \
+        --subst-var-by version ${version}
+    '';
+    extraPaths = [ include.src libc.src libutil.src
+      (fetchNetBSD "external/bsd/flex" "9.2" "0h98jpfj7vx5zh7vd7bk6b1hmzgkcb757a8j6d9zgygxxv13v43m")
+      (fetchNetBSD "sys/sys" "9.2" "0zawhw51klaigqqwkx0lzrx3mim2jywrc24cm7c66qsf1im9awgd")
+      (fetchNetBSD "common/include/rpc/types.h" "9.2" "0n2df12mlc3cbc48jxq35yzl1y7ghgpykvy7jnfh898rdhac7m9a")
+    ] ++ libutil.extraPaths ++ _mainLibcExtraPaths;
+  })
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/config.nix b/pkgs/os-specific/bsd/netbsd/pkgs/config.nix
new file mode 100644
index 0000000000000..277d70129e6f7
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/config.nix
@@ -0,0 +1,18 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal, install, mandoc, byacc, flex, rsync
+, compatIfNeeded
+, cksum
+}:
+mkDerivation {
+  path = "usr.bin/config";
+  version = "9.2";
+  sha256 = "1yz3n4hncdkk6kp595fh2q5lg150vpqg8iw2dccydkyw4y3hgsjj";
+  env.NIX_CFLAGS_COMPILE = toString [ "-DMAKE_BOOTSTRAP" ];
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal install mandoc byacc flex rsync
+  ];
+  buildInputs = compatIfNeeded;
+  extraPaths = [ cksum.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix b/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix
new file mode 100644
index 0000000000000..2d13ced6d5ed5
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix
@@ -0,0 +1,24 @@
+{ lib, mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, flex
+, byacc, genassym, gencat, lorder, tsort, statHook, rsync
+, headers
+, sys
+, ld_elf_so
+}:
+
+mkDerivation {
+  path = "lib/csu";
+  version = "9.2";
+  sha256 = "0al5jfazvhlzn9hvmnrbchx4d0gm282hq5gp4xs2zmj9ycmf6d03";
+  meta.platforms = lib.platforms.netbsd;
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff flex
+    byacc genassym gencat lorder tsort statHook rsync
+  ];
+  buildInputs = [ headers ];
+  extraPaths = [ sys.src ld_elf_so.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/dict.nix b/pkgs/os-specific/bsd/netbsd/pkgs/dict.nix
new file mode 100644
index 0000000000000..0d7d026dd21d2
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/dict.nix
@@ -0,0 +1,9 @@
+{ mkDerivation, defaultMakeFlags }:
+
+mkDerivation {
+  path = "share/dict";
+  noCC = true;
+  version = "9.2";
+  sha256 = "0svfc0byk59ri37pyjslv4c4rc7zw396r73mr593i78d39q5g3ad";
+  makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/share" ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/pkgs/fts/fts-setup-hook.sh
index b6cb5aaca05b3..b6cb5aaca05b3 100644
--- a/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/fts/fts-setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix
new file mode 100644
index 0000000000000..0393d36357f6e
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/fts/package.nix
@@ -0,0 +1,41 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook, rsync
+, compatIfNeeded
+, fetchNetBSD
+}:
+
+mkDerivation {
+  pname = "fts";
+  path = "include/fts.h";
+  sha256 = "01d4fpxvz1pgzfk5xznz5dcm0x0gdzwcsfm1h3d0xc9kc6hj2q77";
+  version = "9.2";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook rsync
+  ];
+  propagatedBuildInputs = compatIfNeeded;
+  extraPaths = [
+    (fetchNetBSD "lib/libc/gen/fts.c" "9.2" "1a8hmf26242nmv05ipn3ircxb0jqmmi66rh78kkyi9vjwkfl3qn7")
+    (fetchNetBSD "lib/libc/include/namespace.h" "9.2" "0kksr3pdwdc1cplqf5z12ih4cml6l11lqrz91f7hjjm64y7785kc")
+    (fetchNetBSD "lib/libc/gen/fts.3" "9.2" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
+  ];
+  skipIncludesPhase = true;
+  buildPhase = ''
+    "$CC" -c -Iinclude -Ilib/libc/include lib/libc/gen/fts.c \
+        -o lib/libc/gen/fts.o
+    "$AR" -rsc libfts.a lib/libc/gen/fts.o
+  '';
+  installPhase = ''
+    runHook preInstall
+
+    install -D lib/libc/gen/fts.3 $out/share/man/man3/fts.3
+    install -D include/fts.h $out/include/fts.h
+    install -D lib/libc/include/namespace.h $out/include/namespace.h
+    install -D libfts.a $out/lib/libfts.a
+
+    runHook postInstall
+  '';
+  setupHooks = [
+    ../../../../../build-support/setup-hooks/role.bash
+    ./fts-setup-hook.sh
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix b/pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix
new file mode 100644
index 0000000000000..7f81a77a02dd2
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/genassym.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/genassym";
+  version = "9.2";
+  sha256 = "1acl1dz5kvh9h5806vkz2ap95rdsz7phmynh5i3x5y7agbki030c";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix b/pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix
new file mode 100644
index 0000000000000..411be85e91e2f
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/gencat.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/gencat";
+  version = "9.2";
+  sha256 = "0gd463x1hg36bhr7y0xryb5jyxk0z0g7xvy8rgk82nlbnlnsbbwb";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix b/pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix
new file mode 100644
index 0000000000000..c8483d454b877
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/getconf.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/getconf";
+  sha256 = "122vslz4j3h2mfs921nr2s6m078zcj697yrb75rwp2hnw3qz4s8q";
+  version = "9.2";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/getent.patch b/pkgs/os-specific/bsd/netbsd/pkgs/getent/getent.patch
index 18258b6486186..18258b6486186 100644
--- a/pkgs/os-specific/bsd/netbsd/getent.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/getent/getent.patch
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix
new file mode 100644
index 0000000000000..7a9acb1e0a9e8
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/getent/package.nix
@@ -0,0 +1,8 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/getent";
+  sha256 = "1qngywcmm0y7nl8h3n8brvkxq4jw63szbci3kc1q6a6ndhycbbvr";
+  version = "9.2";
+  patches = [ ./getent.patch ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/headers.nix b/pkgs/os-specific/bsd/netbsd/pkgs/headers.nix
new file mode 100644
index 0000000000000..646e5675130bb
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/headers.nix
@@ -0,0 +1,11 @@
+{ lib, symlinkJoin, include, sys-headers, libpthread-headers }:
+
+symlinkJoin {
+  name = "netbsd-headers-9.2";
+  paths = [
+    include
+    sys-headers
+    libpthread-headers
+  ];
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix b/pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix
new file mode 100644
index 0000000000000..60b091ef0b718
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/i18n_module.nix
@@ -0,0 +1,9 @@
+{ lib, mkDerivation, libc }:
+
+mkDerivation {
+  path = "lib/i18n_module";
+  version = "9.2";
+  sha256 = "0w6y5v3binm7gf2kn7y9jja8k18rhnyl55cvvfnfipjqdxvxd9jd";
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ libc.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/include.nix b/pkgs/os-specific/bsd/netbsd/pkgs/include.nix
new file mode 100644
index 0000000000000..1ecdec90ae095
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/include.nix
@@ -0,0 +1,40 @@
+{ lib, mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, rsync, nbperf, rpcgen
+, common
+, defaultMakeFlags
+, stdenv
+}:
+
+mkDerivation {
+  path = "include";
+  version = "9.2";
+  sha256 = "0nxnmj4c8s3hb9n3fpcmd0zl3l1nmhivqgi9a35sis943qvpgl9h";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff rsync nbperf rpcgen
+  ];
+
+  # The makefiles define INCSDIR per subdirectory, so we have to set
+  # something else on the command line so those definitions aren't
+  # overridden.
+  postPatch = ''
+    find "$BSDSRCDIR" -name Makefile -exec \
+      sed -i -E \
+        -e 's_/usr/include_''${INCSDIR0}_' \
+        {} \;
+  '';
+
+  # multiple header dirs, see above
+  postConfigure = ''
+    makeFlags=''${makeFlags/INCSDIR/INCSDIR0}
+  '';
+
+  extraPaths = [ common ];
+  headersOnly = true;
+  noCC = true;
+  meta.platforms = lib.platforms.netbsd;
+  makeFlags = defaultMakeFlags ++ [ "RPCGEN_CPP=${stdenv.cc.cc}/bin/cpp" ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/install-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/pkgs/install/install-setup-hook.sh
index 4bfd4d785fac4..4bfd4d785fac4 100644
--- a/pkgs/os-specific/bsd/netbsd/install-setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/install/install-setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix
new file mode 100644
index 0000000000000..991517ac2d486
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/install/package.nix
@@ -0,0 +1,49 @@
+{ mkDerivation
+, writeShellScript
+, mtree, make
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, mandoc, groff, rsync
+, compatIfNeeded, fts
+
+}:
+
+# HACK: to ensure parent directories exist. This emulates GNU
+# install’s -D option. No alternative seems to exist in BSD install.
+let
+  binstall = writeShellScript "binstall" ''
+    set -eu
+    for last in "$@"; do true; done
+    mkdir -p $(dirname $last)
+    @out@/bin/xinstall "$@"
+  '';
+in
+  mkDerivation {
+    path = "usr.bin/xinstall";
+    version = "9.2";
+    sha256 = "1f6pbz3qv1qcrchdxif8p5lbmnwl8b9nq615hsd3cyl4avd5bfqj";
+    extraPaths = [ mtree.src make.src ];
+    nativeBuildInputs = [
+      bsdSetupHook netbsdSetupHook
+      makeMinimal
+      mandoc groff rsync
+    ];
+    skipIncludesPhase = true;
+    buildInputs = compatIfNeeded
+      # fts header is needed. glibc already has this header, but musl doesn't,
+      # so make sure pkgsMusl.netbsd.install still builds in case you want to
+      # remove it!
+      ++ [ fts ];
+    installPhase = ''
+      runHook preInstall
+
+      install -D install.1 $out/share/man/man1/install.1
+      install -D xinstall $out/bin/xinstall
+      install -D -m 0550 ${binstall} $out/bin/binstall
+      substituteInPlace $out/bin/binstall --subst-var out
+      ln -s $out/bin/binstall $out/bin/install
+
+      runHook postInstall
+    '';
+    setupHook = ./install-setup-hook.sh;
+  }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix b/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix
new file mode 100644
index 0000000000000..1496ad6a0e884
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix
@@ -0,0 +1,18 @@
+{ lib
+, mkDerivation
+, libc
+, defaultMakeFlags
+}:
+
+mkDerivation {
+  path  = "libexec/ld.elf_so";
+  version = "9.2";
+  sha256 = "0ia9mqzdljly0vqfwflm5mzz55k7qsr4rw2bzhivky6k30vgirqa";
+  meta.platforms = lib.platforms.netbsd;
+  LIBC_PIC = "${libc}/lib/libc_pic.a";
+  # Hack to prevent a symlink being installed here for compatibility.
+  SHLINKINSTALLDIR = "/usr/libexec";
+  USE_FORT = "yes";
+  makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/libexec" "CLIBOBJ=${libc}/lib" ];
+  extraPaths = [ libc.src ] ++ libc.extraPaths;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix
new file mode 100644
index 0000000000000..93ea02f8a17c1
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libarch.nix
@@ -0,0 +1,8 @@
+{ lib, mkDerivation }:
+
+mkDerivation {
+  path = "lib/libarch";
+  version = "9.2";
+  sha256 = "6ssenRhuSwp0Jn71ErT0PrEoCJ+cIYRztwdL4QTDZsQ=";
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
new file mode 100644
index 0000000000000..ebc01a11668a6
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
@@ -0,0 +1,76 @@
+{ lib
+, mkDerivation
+, defaultMakeFlags
+, _mainLibcExtraPaths
+, fetchNetBSD
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, flex
+, byacc, genassym, gencat, lorder, tsort, statHook, rsync, rpcgen
+, csu, headers
+, librt
+}:
+
+mkDerivation {
+  path = "lib/libc";
+  version = "9.2";
+  sha256 = "1y9c13igg0kai07sqvf9cm6yqmd8lhfd8hq3q7biilbgs1l99as3";
+  USE_FORT = "yes";
+  MKPROFILE = "no";
+  extraPaths = _mainLibcExtraPaths ++ [
+    (fetchNetBSD "external/bsd/jemalloc" "9.2" "0cq704swa0h2yxv4gc79z2lwxibk9k7pxh3q5qfs7axx3jx3n8kb")
+  ];
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff flex
+    byacc genassym gencat lorder tsort statHook rsync rpcgen
+  ];
+  buildInputs = [ headers csu ];
+  env.NIX_CFLAGS_COMPILE = "-B${csu}/lib -fcommon";
+  meta.platforms = lib.platforms.netbsd;
+  SHLIBINSTALLDIR = "$(out)/lib";
+  MKPICINSTALL = "yes";
+  NLSDIR = "$(out)/share/nls";
+  makeFlags = defaultMakeFlags ++ [ "FILESDIR=$(out)/var/db"];
+  postInstall = ''
+    pushd ${headers}
+    find . -type d -exec mkdir -p $out/\{} \;
+    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+    popd
+
+    pushd ${csu}
+    find . -type d -exec mkdir -p $out/\{} \;
+    find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
+    popd
+
+    NIX_CFLAGS_COMPILE+=" -B$out/lib"
+    NIX_CFLAGS_COMPILE+=" -I$out/include"
+    NIX_LDFLAGS+=" -L$out/lib"
+
+    make -C $BSDSRCDIR/lib/libpthread $makeFlags
+    make -C $BSDSRCDIR/lib/libpthread $makeFlags install
+
+    make -C $BSDSRCDIR/lib/libm $makeFlags
+    make -C $BSDSRCDIR/lib/libm $makeFlags install
+
+    make -C $BSDSRCDIR/lib/libresolv $makeFlags
+    make -C $BSDSRCDIR/lib/libresolv $makeFlags install
+
+    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
+    make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
+
+    make -C $BSDSRCDIR/lib/i18n_module $makeFlags
+    make -C $BSDSRCDIR/lib/i18n_module $makeFlags install
+
+    make -C $BSDSRCDIR/lib/libutil $makeFlags
+    make -C $BSDSRCDIR/lib/libutil $makeFlags install
+
+    make -C $BSDSRCDIR/lib/librt $makeFlags
+    make -C $BSDSRCDIR/lib/librt $makeFlags install
+
+    make -C $BSDSRCDIR/lib/libcrypt $makeFlags
+    make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
+  '';
+  inherit (librt) postPatch;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix
new file mode 100644
index 0000000000000..c5f9deff589c4
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libcrypt.nix
@@ -0,0 +1,9 @@
+{ lib, mkDerivation }:
+
+mkDerivation {
+  path = "lib/libcrypt";
+  version = "9.2";
+  sha256 = "0siqan1wdqmmhchh2n8w6a8x1abbff8n4yb6jrqxap3hqn8ay54g";
+  SHLIBINSTALLDIR = "$(out)/lib";
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix
new file mode 100644
index 0000000000000..2409879640a90
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libcurses.nix
@@ -0,0 +1,27 @@
+{ lib, mkDerivation, stdenv
+, libterminfo
+, compatIfNeeded
+, defaultMakeFlags
+}:
+
+mkDerivation {
+  path = "lib/libcurses";
+  version = "9.2";
+  sha256 = "0pd0dggl3w4bv5i5h0s1wrc8hr66n4hkv3zlklarwfdhc692fqal";
+  buildInputs = [ libterminfo ];
+  env.NIX_CFLAGS_COMPILE = toString ([
+    "-D__scanflike(a,b)="
+    "-D__va_list=va_list"
+    "-D__warn_references(a,b)="
+  ] ++ lib.optional stdenv.isDarwin "-D__strong_alias(a,b)=");
+  propagatedBuildInputs = compatIfNeeded;
+  MKDOC = "no"; # missing vfontedpr
+  makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${libterminfo}/lib" ];
+  postPatch = lib.optionalString (!stdenv.isDarwin) ''
+    substituteInPlace $COMPONENT_PATH/printw.c \
+      --replace "funopen(win, NULL, __winwrite, NULL, NULL)" NULL \
+      --replace "__strong_alias(vwprintw, vw_printw)" 'extern int vwprintw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_printw")));'
+    substituteInPlace $COMPONENT_PATH/scanw.c \
+      --replace "__strong_alias(vwscanw, vw_scanw)" 'extern int vwscanw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_scanw")));'
+  '';
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix
new file mode 100644
index 0000000000000..eb734f34c3d49
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libedit.nix
@@ -0,0 +1,26 @@
+{ lib, mkDerivation
+, libterminfo, libcurses
+, compatIfNeeded
+, defaultMakeFlags
+}:
+
+mkDerivation {
+    path = "lib/libedit";
+    version = "9.2";
+    sha256 = "1wqhngraxwqk4jgrf5f18jy195yrp7c06n1gf31pbplq79mg1bcj";
+    buildInputs = [ libterminfo libcurses ];
+    propagatedBuildInputs = compatIfNeeded;
+    SHLIBINSTALLDIR = "$(out)/lib";
+    makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${libterminfo}/lib" ];
+    postPatch = ''
+      sed -i '1i #undef bool_t' $COMPONENT_PATH/el.h
+      substituteInPlace $COMPONENT_PATH/config.h \
+        --replace "#define HAVE_STRUCT_DIRENT_D_NAMLEN 1" ""
+      substituteInPlace $COMPONENT_PATH/readline/Makefile --replace /usr/include "$out/include"
+    '';
+    env.NIX_CFLAGS_COMPILE = toString [
+      "-D__noinline="
+      "-D__scanflike(a,b)="
+      "-D__va_list=va_list"
+    ];
+  }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libm.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libm.nix
new file mode 100644
index 0000000000000..86990088adf28
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libm.nix
@@ -0,0 +1,10 @@
+{ lib, mkDerivation, sys }:
+
+mkDerivation {
+  path = "lib/libm";
+  version = "9.2";
+  sha256 = "1apwfr26shdmbqqnmg7hxf7bkfxw44ynqnnnghrww9bnhqdnsy92";
+  SHLIBINSTALLDIR = "$(out)/lib";
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ sys.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix
new file mode 100644
index 0000000000000..51bbc216e2046
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libossaudio.nix
@@ -0,0 +1,8 @@
+{ lib, mkDerivation }:
+
+mkDerivation {
+  path = "lib/libossaudio";
+  version = "9.2";
+  sha256 = "16l3bfy6dcwqnklvh3x0ps8ld1y504vf57v9rx8f9adzhb797jh0";
+  meta.platforms = lib.platforms.netbsd;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix
new file mode 100644
index 0000000000000..21ca0f62fd4e4
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpci.nix
@@ -0,0 +1,11 @@
+{ lib, mkDerivation, sys }:
+
+mkDerivation {
+  pname = "libpci";
+  path = "lib/libpci";
+  version = "9.2";
+  sha256 = "+IOEO1Bw3/H3iCp3uk3bwsFZbvCqN5Ciz70irnPl8E8=";
+  env.NIX_CFLAGS_COMPILE = toString [ "-I." ];
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ sys.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix
new file mode 100644
index 0000000000000..485a12837bcb4
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/base.nix
@@ -0,0 +1,6 @@
+{
+  path = "lib/libpthread";
+  version = "9.2";
+  sha256 = "0mlmc31k509dwfmx5s2x010wxjc44mr6y0cbmk30cfipqh8c962h";
+}
+
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix
new file mode 100644
index 0000000000000..3896562501fc5
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/headers.nix
@@ -0,0 +1,9 @@
+{ lib, mkDerivation }:
+
+mkDerivation (import ./base.nix // {
+  pname = "libpthread-headers";
+  installPhase = "includesPhase";
+  dontBuild = true;
+  noCC = true;
+  meta.platforms = lib.platforms.netbsd;
+})
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix
new file mode 100644
index 0000000000000..c2a0d407718e9
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libpthread/package.nix
@@ -0,0 +1,15 @@
+{ lib, mkDerivation
+, headers
+, common, libc, librt, sys
+}:
+
+mkDerivation (import ./base.nix // {
+  pname = "libpthread";
+  installPhase = null;
+  noCC = false;
+  dontBuild = false;
+  buildInputs = [ headers ];
+  SHLIBINSTALLDIR = "$(out)/lib";
+  extraPaths = [ common libc.src librt.src sys.src ];
+  meta.platforms = lib.platforms.netbsd;
+})
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix
new file mode 100644
index 0000000000000..2427592e4aa9a
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libresolv.nix
@@ -0,0 +1,9 @@
+{ lib, mkDerivation, libc }:
+
+mkDerivation {
+  path = "lib/libresolv";
+  version = "9.2";
+  sha256 = "1am74s74mf1ynwz3p4ncjkg63f78a1zjm983q166x4sgzps15626";
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ libc.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix
new file mode 100644
index 0000000000000..87524339e268f
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/librpcsvc.nix
@@ -0,0 +1,21 @@
+{ lib
+, mkDerivation
+, defaultMakeFlags
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, tsort, lorder, rpcgen, statHook
+}:
+
+mkDerivation {
+  path = "lib/librpcsvc";
+  version = "9.2";
+  sha256 = "1q34pfiyjbrgrdqm46jwrsqms49ly6z3b0xh1wg331zga900vq5n";
+  makeFlags = defaultMakeFlags ++ [ "INCSDIR=$(out)/include/rpcsvc" ];
+  meta.platforms = lib.platforms.netbsd;
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install tsort lorder rpcgen statHook
+  ];
+}
+
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix b/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix
new file mode 100644
index 0000000000000..2ffe0787004a5
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix
@@ -0,0 +1,13 @@
+{ lib, mkDerivation, libc, headers }:
+
+mkDerivation {
+  path = "lib/librt";
+  version = "9.2";
+  sha256 = "07f8mpjcqh5kig5z5sp97fg55mc4dz6aa1x5g01nv2pvbmqczxc6";
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ libc.src ] ++ libc.extraPaths;
+  postPatch = ''
+    sed -i 's,/usr\(/include/sys/syscall.h\),${headers}\1,g' \
+      $BSDSRCDIR/lib/{libc,librt}/sys/Makefile.inc
+  '';
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix
new file mode 100644
index 0000000000000..b9268cc7ba333
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libterminfo.nix
@@ -0,0 +1,32 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal, install, tsort, lorder, mandoc, statHook, nbperf, tic, rsync
+, compatIfNeeded
+, fetchNetBSD
+}:
+
+mkDerivation {
+  path = "lib/libterminfo";
+  version = "9.2";
+  sha256 = "0pq05k3dj0dfsczv07frnnji92mazmy2qqngqbx2zgqc1x251414";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal install tsort lorder mandoc statHook nbperf tic rsync
+  ];
+  buildInputs = compatIfNeeded;
+  SHLIBINSTALLDIR = "$(out)/lib";
+  postPatch = ''
+    substituteInPlace $COMPONENT_PATH/term.c --replace /usr/share $out/share
+    substituteInPlace $COMPONENT_PATH/setupterm.c \
+      --replace '#include <curses.h>' 'void use_env(bool);'
+  '';
+  postBuild = ''
+    make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share
+  '';
+  postInstall = ''
+    make -C $BSDSRCDIR/share/terminfo $makeFlags BINDIR=$out/share install
+  '';
+  extraPaths = [
+    (fetchNetBSD "share/terminfo" "9.2" "1vh9rl4w8118a9qdpblfxmv1wkpm83rm9gb4rzz5bpm56i6d7kk7")
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix
new file mode 100644
index 0000000000000..4aaf8f0e7ab63
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libutil.nix
@@ -0,0 +1,21 @@
+{ mkDerivation
+, common, libc, sys
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, byacc, install, tsort, lorder, mandoc, statHook, rsync
+, headers
+}:
+
+mkDerivation {
+  path = "lib/libutil";
+  version = "9.2";
+  sha256 = "02gm5a5zhh8qp5r5q5r7x8x6x50ir1i0ncgsnfwh1vnrz6mxbq7z";
+  extraPaths = [ common libc.src sys.src ];
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    byacc install tsort lorder mandoc statHook rsync
+  ];
+  buildInputs = [ headers ];
+  SHLIBINSTALLDIR = "$(out)/lib";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/locale.patch b/pkgs/os-specific/bsd/netbsd/pkgs/locale/locale.patch
index 4b7f478552879..4b7f478552879 100644
--- a/pkgs/os-specific/bsd/netbsd/locale.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/locale/locale.patch
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix
new file mode 100644
index 0000000000000..3c61e8517b35b
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/locale/package.nix
@@ -0,0 +1,9 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/locale";
+  version = "9.2";
+  sha256 = "0kk6v9k2bygq0wf9gbinliqzqpzs9bgxn0ndyl2wcv3hh2bmsr9p";
+  patches = [ ./locale.patch ];
+  env.NIX_CFLAGS_COMPILE = "-DYESSTR=__YESSTR -DNOSTR=__NOSTR";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix b/pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix
new file mode 100644
index 0000000000000..d3109601382a0
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/lorder.nix
@@ -0,0 +1,16 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, rsync
+}:
+
+mkDerivation {
+  path = "usr.bin/lorder";
+  version = "9.2";
+  sha256 = "0rjf9blihhm0n699vr2bg88m4yjhkbxh6fxliaay3wxkgnydjwn2";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff rsync
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/make.nix b/pkgs/os-specific/bsd/netbsd/pkgs/make.nix
new file mode 100644
index 0000000000000..dcd80ef004678
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/make.nix
@@ -0,0 +1,60 @@
+{ lib, mkDerivation, fetchNetBSD, stdenv }:
+
+mkDerivation {
+  path = "usr.bin/make";
+  sha256 = "0vi73yicbmbp522qzqvd979cx6zm5jakhy77xh73c1kygf8klccs";
+  version = "9.2";
+
+ postPatch = ''
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.doc.mk \
+     --replace '-o ''${DOCOWN}' "" \
+     --replace '-g ''${DOCGRP}' ""
+   for mk in $BSDSRCDIR/share/mk/bsd.inc.mk $BSDSRCDIR/share/mk/bsd.kinc.mk; do
+     substituteInPlace $mk \
+       --replace '-o ''${BINOWN}' "" \
+       --replace '-g ''${BINGRP}' ""
+   done
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.kmodule.mk \
+     --replace '-o ''${KMODULEOWN}' "" \
+     --replace '-g ''${KMODULEGRP}' ""
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
+     --replace '-o ''${LIBOWN}' "" \
+     --replace '-g ''${LIBGRP}' "" \
+     --replace '-o ''${DEBUGOWN}' "" \
+     --replace '-g ''${DEBUGGRP}' ""
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.lua.mk \
+     --replace '-o ''${LIBOWN}' "" \
+     --replace '-g ''${LIBGRP}' ""
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.man.mk \
+     --replace '-o ''${MANOWN}' "" \
+     --replace '-g ''${MANGRP}' ""
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.nls.mk \
+     --replace '-o ''${NLSOWN}' "" \
+     --replace '-g ''${NLSGRP}' ""
+   substituteInPlace $BSDSRCDIR/share/mk/bsd.prog.mk \
+     --replace '-o ''${BINOWN}' "" \
+     --replace '-g ''${BINGRP}' "" \
+     --replace '-o ''${RUMPBINOWN}' "" \
+     --replace '-g ''${RUMPBINGRP}' "" \
+     --replace '-o ''${DEBUGOWN}' "" \
+     --replace '-g ''${DEBUGGRP}' ""
+
+    # make needs this to pick up our sys make files
+    export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
+
+    substituteInPlace $BSDSRCDIR/share/mk/bsd.lib.mk \
+      --replace '_INSTRANLIB=''${empty(PRESERVE):?-a "''${RANLIB} -t":}' '_INSTRANLIB='
+    substituteInPlace $BSDSRCDIR/share/mk/bsd.kinc.mk \
+      --replace /bin/rm rm
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace $BSDSRCDIR/share/mk/bsd.sys.mk \
+      --replace '-Wl,--fatal-warnings' "" \
+      --replace '-Wl,--warn-shared-textrel' ""
+  '';
+  postInstall = ''
+    make -C $BSDSRCDIR/share/mk FILESDIR=$out/share/mk install
+  '';
+  extraPaths = [
+    (fetchNetBSD "share/mk" "9.2" "0w9x77cfnm6zwy40slradzi0ip9gz80x6lk7pvnlxzsr2m5ra5sy")
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix b/pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix
new file mode 100644
index 0000000000000..18655b3bf863e
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/makeMinimal.nix
@@ -0,0 +1,43 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook, rsync
+, make
+}:
+
+mkDerivation {
+  path = "tools/make";
+  sha256 = "0fh0nrnk18m613m5blrliq2aydciv51qhc0ihsj4k63incwbk90n";
+  version = "9.2";
+
+  buildInputs = [];
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook rsync
+  ];
+
+  skipIncludesPhase = true;
+
+  postPatch = ''
+    patchShebangs $COMPONENT_PATH/configure
+    ${make.postPatch}
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    sh ./buildmake.sh
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D nbmake $out/bin/nbmake
+    ln -s $out/bin/nbmake $out/bin/make
+    mkdir -p $out/share
+    cp -r $BSDSRCDIR/share/mk $out/share/mk
+
+    runHook postInstall
+  '';
+
+  extraPaths = [ make.src ] ++ make.extraPaths;
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/man.nix b/pkgs/os-specific/bsd/netbsd/pkgs/man.nix
new file mode 100644
index 0000000000000..bce5bcee66946
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/man.nix
@@ -0,0 +1,17 @@
+{ mkDerivation, defaultMakeFlags }:
+
+mkDerivation {
+  path = "share/man";
+  noCC = true;
+  version = "9.2";
+  sha256 = "1l4lmj4kmg8dl86x94sr45w0xdnkz8dn4zjx0ipgr9bnq98663zl";
+  # man0 generates a man.pdf using ps2pdf, but doesn't install it later,
+  # so we can avoid the dependency on ghostscript
+  postPatch = ''
+    substituteInPlace $COMPONENT_PATH/man0/Makefile --replace "ps2pdf" "echo noop "
+  '';
+  makeFlags = defaultMakeFlags ++ [
+    "FILESDIR=$(out)/share"
+    "MKRUMP=no" # would require to have additional path sys/rump/share/man
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/misc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/misc.nix
new file mode 100644
index 0000000000000..7f96f4d1495ad
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/misc.nix
@@ -0,0 +1,9 @@
+{ mkDerivation, defaultMakeFlags }:
+
+mkDerivation {
+  path = "share/misc";
+  noCC = true;
+  version = "9.2";
+  sha256 = "1j2cdssdx6nncv8ffj7f7ybl7m9hadjj8vm8611skqdvxnjg6nbc";
+  makeFlags = defaultMakeFlags ++ [ "BINDIR=$(out)/share" ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix
new file mode 100644
index 0000000000000..82e8889f6cf4d
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix
@@ -0,0 +1,82 @@
+{ lib
+, stdenvNoCC, stdenv
+, fetchNetBSD
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, tsort, lorder
+, mandoc, groff, statHook, rsync
+, compatIfNeeded
+, defaultMakeFlags
+}:
+
+lib.makeOverridable (attrs: let
+  stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
+in stdenv'.mkDerivation ({
+  pname = "${attrs.pname or (baseNameOf attrs.path)}-netbsd";
+  inherit (attrs) version;
+  src = fetchNetBSD attrs.path attrs.version attrs.sha256;
+
+  extraPaths = [ ];
+
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install tsort lorder mandoc groff statHook rsync
+  ];
+  buildInputs = compatIfNeeded;
+
+  HOST_SH = stdenv'.shell;
+
+  MACHINE_ARCH = {
+    i486 = "i386";
+    i586 = "i386";
+    i686 = "i386";
+  }.${stdenv'.hostPlatform.parsed.cpu.name}
+    or stdenv'.hostPlatform.parsed.cpu.name;
+
+  MACHINE = {
+    x86_64 = "amd64";
+    aarch64 = "evbarm64";
+    i486 = "i386";
+    i586 = "i386";
+    i686 = "i386";
+  }.${stdenv'.hostPlatform.parsed.cpu.name}
+    or stdenv'.hostPlatform.parsed.cpu.name;
+
+  COMPONENT_PATH = attrs.path;
+
+  makeFlags = defaultMakeFlags;
+
+  strictDeps = true;
+
+  meta = with lib; {
+    maintainers = with maintainers; [ matthewbauer qyliss ];
+    platforms = platforms.unix;
+    license = licenses.bsd2;
+  };
+
+} // lib.optionalAttrs stdenv'.hasCC {
+  # TODO should CC wrapper set this?
+  CPP = "${stdenv'.cc.targetPrefix}cpp";
+} // lib.optionalAttrs stdenv'.isDarwin {
+  MKRELRO = "no";
+} // lib.optionalAttrs (stdenv'.cc.isClang or false) {
+  HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+} // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
+  HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
+} // lib.optionalAttrs (stdenv'.isx86_32) {
+  USE_SSP = "no";
+} // lib.optionalAttrs (attrs.headersOnly or false) {
+  installPhase = "includesPhase";
+  dontBuild = true;
+} // attrs // {
+  # Files that use NetBSD-specific macros need to have nbtool_config.h
+  # included ahead of them on non-NetBSD platforms.
+  postPatch = lib.optionalString (!stdenv'.hostPlatform.isNetBSD) ''
+    set +e
+    grep -Zlr "^__RCSID
+    ^__BEGIN_DECLS" $COMPONENT_PATH | xargs -0r grep -FLZ nbtool_config.h |
+        xargs -0tr sed -i '0,/^#/s//#include <nbtool_config.h>\n\0/'
+    set -e
+  '' + attrs.postPatch or "";
+}))
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix b/pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix
new file mode 100644
index 0000000000000..5c4c172e40a7d
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/mknod.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "sbin/mknod";
+  version = "9.2";
+  sha256 = "1d9369shzwgixz3nph991i8q5vk7hr04py3n9avbfbhzy4gndqs2";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix b/pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix
new file mode 100644
index 0000000000000..723da3ad891bc
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/mtree.nix
@@ -0,0 +1,8 @@
+{ mkDerivation, mknod }:
+
+mkDerivation {
+  path = "usr.sbin/mtree";
+  version = "9.2";
+  sha256 = "04p7w540vz9npvyb8g8hcf2xa05phn1y88hsyrcz3vwanvpc0yv9";
+  extraPaths = [ mknod.src ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix b/pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix
new file mode 100644
index 0000000000000..02ce7cf6ce5eb
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/nbperf.nix
@@ -0,0 +1,8 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/nbperf";
+  version = "9.2";
+  sha256 = "1nxc302vgmjhm3yqdivqyfzslrg0vjpbss44s74rcryrl19mma9r";
+}
+
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix
new file mode 100644
index 0000000000000..e80571f2bf9a2
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/package.nix
@@ -0,0 +1,5 @@
+{ makeSetupHook }:
+
+makeSetupHook {
+    name = "netbsd-setup-hook";
+  } ./setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/setup-hook.sh b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh
index fa8b19e7d8ce4..fa8b19e7d8ce4 100644
--- a/pkgs/os-specific/bsd/netbsd/setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/netbsdSetupHook/setup-hook.sh
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix b/pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix
new file mode 100644
index 0000000000000..b1482d4dff112
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/rpcgen.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  path = "usr.bin/rpcgen";
+  version = "9.2";
+  sha256 = "1kfgfx54jg98wbg0d95p0rvf4w0302v8fz724b0bdackdsrd4988";
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix b/pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix
new file mode 100644
index 0000000000000..78186f55cd455
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/stat/hook.nix
@@ -0,0 +1,14 @@
+{ makeSetupHook, writeText, stat }:
+
+# stat isn't in POSIX, and NetBSD stat supports a completely
+# different range of flags than GNU stat, so including it in PATH
+# breaks stdenv.  Work around that with a hook that will point
+# NetBSD's build system and NetBSD stat without including it in
+# PATH.
+
+makeSetupHook {
+  name = "netbsd-stat-hook";
+} (writeText "netbsd-stat-hook-impl" ''
+  makeFlagsArray+=(TOOL_STAT=${stat}/bin/stat)
+'')
+
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix
new file mode 100644
index 0000000000000..fa4d5cb3e21f6
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/stat/package.nix
@@ -0,0 +1,19 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, rsync
+}:
+
+# Don't add this to nativeBuildInputs directly.
+# Use statHook instead. See note in stat/hook.nix
+
+mkDerivation {
+  path = "usr.bin/stat";
+  version = "9.2";
+  sha256 = "18nqwlndfc34qbbgqx5nffil37jfq9aw663ippasfxd2hlyc106x";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff rsync
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix b/pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix
new file mode 100644
index 0000000000000..ba458ef5c712f
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/base.nix
@@ -0,0 +1,72 @@
+{ lib, mkDerivation
+, include
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal, install, tsort, lorder, statHook, rsync, uudecode, config, genassym
+, defaultMakeFlags
+, common
+}:
+{
+  path = "sys";
+  version = "9.2";
+  sha256 = "03s18q8d9giipf05bx199fajc2qwikji0djz7hw63d2lya6bfnpj";
+
+  # Make the build ignore linker warnings
+  prePatch = ''
+    substituteInPlace sys/conf/Makefile.kern.inc \
+      --replace "-Wa,--fatal-warnings" ""
+  '';
+
+  patches = [
+    # Fix this error when building bootia32.efi and bootx64.efi:
+    # error: PHDR segment not covered by LOAD segment
+    ./no-dynamic-linker.patch
+
+    # multiple header dirs, see above
+    ./sys-headers-incsdir.patch
+  ];
+
+  postPatch =
+    ''
+      substituteInPlace sys/arch/i386/stand/efiboot/Makefile.efiboot \
+        --replace "-nocombreloc" "-z nocombreloc"
+    '' +
+    # multiple header dirs, see above
+    include.postPatch;
+
+  CONFIG = "GENERIC";
+
+  propagatedBuildInputs = [ include ];
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal install tsort lorder statHook rsync uudecode config genassym
+  ];
+
+  postConfigure = ''
+    pushd arch/$MACHINE/conf
+    config $CONFIG
+    popd
+  ''
+    # multiple header dirs, see above
+    + include.postConfigure;
+
+  makeFlags = defaultMakeFlags ++ [ "FIRMWAREDIR=$(out)/libdata/firmware" ];
+  hardeningDisable = [ "pic" ];
+  MKKMOD = "no";
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=array-parameter"
+    "-Wno-error=array-bounds"
+    "-Wa,--no-warn"
+  ];
+
+  postBuild = ''
+    make -C arch/$MACHINE/compile/$CONFIG $makeFlags
+  '';
+
+  postInstall = ''
+    cp arch/$MACHINE/compile/$CONFIG/netbsd $out
+  '';
+
+  meta.platforms = lib.platforms.netbsd;
+  extraPaths = [ common ];
+
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix b/pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix
new file mode 100644
index 0000000000000..a3f20d772a3e7
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/headers.nix
@@ -0,0 +1,21 @@
+{ lib, mkDerivation
+, include
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal, install, tsort, lorder, statHook, rsync, uudecode, config, genassym
+, defaultMakeFlags
+, common
+}:
+let
+  base = import ./base.nix {
+    inherit
+      lib mkDerivation include bsdSetupHook netbsdSetupHook makeMinimal install
+      tsort lorder statHook rsync uudecode config genassym defaultMakeFlags
+      common;
+  };
+in
+  mkDerivation (base // {
+    pname = "sys-headers";
+    installPhase = "includesPhase";
+    dontBuild = true;
+    noCC = true;
+  })
diff --git a/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch b/pkgs/os-specific/bsd/netbsd/pkgs/sys/no-dynamic-linker.patch
index b3e9f3c88a13c..b3e9f3c88a13c 100644
--- a/pkgs/os-specific/bsd/netbsd/no-dynamic-linker.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/no-dynamic-linker.patch
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix b/pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix
new file mode 100644
index 0000000000000..87031a50346ea
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/package.nix
@@ -0,0 +1,21 @@
+{ lib, mkDerivation
+, include
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal, install, tsort, lorder, statHook, rsync, uudecode, config, genassym
+, defaultMakeFlags
+, common
+}:
+let
+  base = import ./base.nix {
+    inherit
+      lib mkDerivation include bsdSetupHook netbsdSetupHook makeMinimal install
+      tsort lorder statHook rsync uudecode config genassym defaultMakeFlags
+      common;
+  };
+in
+  mkDerivation (base // {
+    pname = "sys";
+    installPhase = null;
+    noCC = false;
+    dontBuild = false;
+  })
diff --git a/pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch b/pkgs/os-specific/bsd/netbsd/pkgs/sys/sys-headers-incsdir.patch
index 5cfb2a54c8db2..5cfb2a54c8db2 100644
--- a/pkgs/os-specific/bsd/netbsd/sys-headers-incsdir.patch
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/sys/sys-headers-incsdir.patch
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/tic.nix b/pkgs/os-specific/bsd/netbsd/pkgs/tic.nix
new file mode 100644
index 0000000000000..2a7e3644b6be9
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/tic.nix
@@ -0,0 +1,28 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, nbperf, rsync
+, compatIfNeeded
+, defaultMakeFlags
+, libterminfo
+, fetchNetBSD
+}:
+
+mkDerivation {
+  path = "tools/tic";
+  version = "9.2";
+  sha256 = "092y7db7k4kh2jq8qc55126r5qqvlb8lq8mhmy5ipbi36hwb4zrz";
+  HOSTPROG = "tic";
+  buildInputs = compatIfNeeded;
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff nbperf rsync
+  ];
+  makeFlags = defaultMakeFlags ++ [ "TOOLDIR=$(out)" ];
+  extraPaths = [
+    libterminfo.src
+    (fetchNetBSD "usr.bin/tic" "9.2" "1mwdfg7yx1g43ss378qsgl5rqhsxskqvsd2mqvrn38qw54i8v5i1")
+    (fetchNetBSD "tools/Makefile.host" "9.2" "15b4ab0n36lqj00j5lz2xs83g7l8isk3wx1wcapbrn66qmzz2sxy")
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix b/pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix
new file mode 100644
index 0000000000000..334eccc64c551
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/tsort.nix
@@ -0,0 +1,16 @@
+{ mkDerivation
+, bsdSetupHook, netbsdSetupHook
+, makeMinimal
+, install, mandoc, groff, rsync
+}:
+
+mkDerivation {
+  path = "usr.bin/tsort";
+  version = "9.2";
+  sha256 = "1dqvf9gin29nnq3c4byxc7lfd062pg7m84843zdy6n0z63hnnwiq";
+  nativeBuildInputs = [
+    bsdSetupHook netbsdSetupHook
+    makeMinimal
+    install mandoc groff rsync
+  ];
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix b/pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix
new file mode 100644
index 0000000000000..dac9674f9d6f3
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/uudecode.nix
@@ -0,0 +1,10 @@
+{ lib, mkDerivation, stdenv }:
+
+mkDerivation {
+  path = "usr.bin/uudecode";
+  version = "9.2";
+  sha256 = "00a3zmh15pg4vx6hz0kaa5mi8d2b1sj4h512d7p6wbvxq6mznwcn";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isLinux "-DNO_BASE64";
+  NIX_LDFLAGS = lib.optional stdenv.isDarwin "-lresolv";
+}
+
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index ffeb82d9b41bf..33fa7663f46dd 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -167,6 +167,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ TethysSvensson qyliss ];
     platforms = platforms.linux;
-    priority = 10;
+    priority = 15; # below systemd (halt, init, poweroff, reboot) and coreutils
   };
 }
diff --git a/pkgs/os-specific/linux/dbus-broker/default.nix b/pkgs/os-specific/linux/dbus-broker/default.nix
index 5180917623e93..784024f8754d0 100644
--- a/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -40,13 +40,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbus-broker";
-  version = "35";
+  version = "36";
 
   src = fetchFromGitHub {
     owner = "bus1";
     repo = "dbus-broker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Qwi9X5jXHiQ3TOWefzv/p7x8/JkQW1QgdYji5SpLej0=";
+    hash = "sha256-5dAMKjybqrHG57vArbtWEPR/svSj2ION75JrjvnnpVM=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/dbus-broker/disable-test.patch b/pkgs/os-specific/linux/dbus-broker/disable-test.patch
index 487967aea8406..14faf1907cc20 100644
--- a/pkgs/os-specific/linux/dbus-broker/disable-test.patch
+++ b/pkgs/os-specific/linux/dbus-broker/disable-test.patch
@@ -1,11 +1,14 @@
---- b/src/meson.build
-+++ a/src/meson.build
-@@ -196,9 +195,6 @@
- test_fdlist = executable('test-fdlist', ['util/test-fdlist.c'], dependencies: dep_bus)
- test('Utility File-Desciptor Lists', test_fdlist)
-
--test_fs = executable('test-fs', ['util/test-fs.c'], dependencies: dep_bus)
--test('File System Helpers', test_fs)
+diff --git a/src/meson.build b/src/meson.build
+index 4b9bc71..221ed5c 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -202,9 +202,6 @@ test('Error Handling', test_error, suite: 'unit')
+ test_fdlist = executable('test-fdlist', sources: ['util/test-fdlist.c'], kwargs: test_kwargs)
+ test('Utility File-Desciptor Lists', test_fdlist, suite: 'unit')
+ 
+-test_fs = executable('test-fs', sources: ['util/test-fs.c'], kwargs: test_kwargs)
+-test('File System Helpers', test_fs, suite: 'unit')
 -
- test_match = executable('test-match', ['bus/test-match.c'], dependencies: dep_bus)
- test('D-Bus Match Handling', test_match)
+ test_match = executable('test-match', sources: ['bus/test-match.c'], kwargs: test_kwargs)
+ test('D-Bus Match Handling', test_match, suite: 'unit')
+ 
diff --git a/pkgs/os-specific/linux/earlyoom/default.nix b/pkgs/os-specific/linux/earlyoom/default.nix
deleted file mode 100644
index d1d95b4d3f959..0000000000000
--- a/pkgs/os-specific/linux/earlyoom/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, pandoc, installShellFiles, withManpage ? false, nixosTests }:
-
-stdenv.mkDerivation rec {
-  pname = "earlyoom";
-  version = "1.7";
-
-  src = fetchFromGitHub {
-    owner = "rfjakob";
-    repo = "earlyoom";
-    rev = "v${version}";
-    sha256 = "sha256-8YcT1TTlAet7F1U9Ginda4IApNqkudegOXqm8rnRGfc=";
-  };
-
-  nativeBuildInputs = lib.optionals withManpage [ pandoc installShellFiles ];
-
-  patches = [ ./fix-dbus-path.patch ];
-
-  makeFlags = [ "VERSION=${version}" ];
-
-  installPhase = ''
-    install -D earlyoom $out/bin/earlyoom
-  '' + lib.optionalString withManpage ''
-    installManPage earlyoom.1
-  '';
-
-  passthru.tests = {
-    inherit (nixosTests) earlyoom;
-  };
-
-  meta = with lib; {
-    description = "Early OOM Daemon for Linux";
-    mainProgram = "earlyoom";
-    homepage = "https://github.com/rfjakob/earlyoom";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [];
-  };
-}
diff --git a/pkgs/os-specific/linux/fw-ectool/default.nix b/pkgs/os-specific/linux/fw-ectool/default.nix
index 1d23411f3eefc..a73cc1896ecdc 100644
--- a/pkgs/os-specific/linux/fw-ectool/default.nix
+++ b/pkgs/os-specific/linux/fw-ectool/default.nix
@@ -1,43 +1,38 @@
 { stdenv
 , lib
-, fetchFromGitLab
-, cmake
+, fetchFromGitHub
 , pkg-config
-, libusb1
-, libftdi1
+, hostname
 }:
 
 stdenv.mkDerivation {
   pname = "fw-ectool";
-  version = "0-unstable-2023-12-15";
+  version = "unstable-2022-12-03";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.howett.net";
+  src = fetchFromGitHub {
     owner = "DHowett";
-    repo = "ectool";
-    rev = "3ebe7b8b713b2ebfe2ce92d48fd8d044276b2879";
-    hash = "sha256-s6PrFPAL+XJAENqLw5oJqFmAf11tHOJ8h3F5l3pOlZ4=";
+    repo = "fw-ectool";
+    rev = "54c140399bbc3e6a3dce6c9f842727c4128367be";
+    hash = "sha256-2teJFz4zcA+USpbVPXMEIHLdmMLem8ik7YrmrSxr/n0=";
   };
 
   nativeBuildInputs = [
-    cmake
     pkg-config
+    hostname
   ];
 
-  buildInputs = [
-    libusb1
-    libftdi1
-  ];
+  buildPhase = ''
+    patchShebangs util
+    make out=out utils
+  '';
 
   installPhase = ''
-    runHook preInstall
-    install -Dm555 src/ectool "$out/bin/ectool"
-    runHook postInstall
+    install -D out/util/ectool $out/bin/ectool
   '';
 
   meta = with lib; {
     description = "EC-Tool adjusted for usage with framework embedded controller";
-    homepage = "https://gitlab.howett.net/DHowett/ectool";
+    homepage = "https://github.com/DHowett/framework-ec";
     license = licenses.bsd3;
     maintainers = [ maintainers.mkg20001 ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index f4a250d4a84c8..e686e06804197 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "24.09.28717.12";
+  version = "24.13.29138.7";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    hash = "sha256-RzXV6icenMcQxmOfKA8Tpb6FigLXz3ZyoL0n16+jFRc=";
+    hash = "sha256-AMIuA1AMrSX0xpdGSfye8iUJTk5s9HDiRy9Yy3kZss8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/os-specific/linux/lenovo-legion/app.nix b/pkgs/os-specific/linux/lenovo-legion/app.nix
index 6d6c604b1c054..eeccf301ee95b 100644
--- a/pkgs/os-specific/linux/lenovo-legion/app.nix
+++ b/pkgs/os-specific/linux/lenovo-legion/app.nix
@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "lenovo-legion-app";
-  version = "0.0.9";
+  version = "0.0.12";
 
   src = fetchFromGitHub {
     owner = "johnfanv2";
     repo = "LenovoLegionLinux";
     rev = "v${version}-prerelease";
-    hash = "sha256-PQdxfDfW3sn0wWjmsPoAt3HZ43PS3Tyez3/0KEVVZQg=";
+    hash = "sha256-BNrRv9EBmNINQbAw+BzVxKl/XoDgH1tsNZHJxfSpNoU=";
   };
 
   sourceRoot = "${src.name}/python/legion_linux";
@@ -17,6 +17,7 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     pyqt5
+    pyqt6
     argcomplete
     pyyaml
     darkdetect
@@ -26,13 +27,13 @@ python3.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace ./setup.cfg \
-      --replace "_VERSION" "${version}"
+      --replace-fail "_VERSION" "${version}"
     substituteInPlace ../../extra/service/fancurve-set \
-      --replace "FOLDER=/etc/legion_linux/" "FOLDER=$out/share/legion_linux"
+      --replace-fail "FOLDER=/etc/legion_linux/" "FOLDER=$out/share/legion_linux"
     substituteInPlace ./legion_linux/legion.py \
-      --replace "/etc/legion_linux" "$out/share/legion_linux"
-    substituteInPlace ./legion_linux/legion_gui{,_user}.desktop \
-      --replace "Icon=/usr/share/pixmaps/legion_logo.png" "Icon=legion_logo"
+      --replace-fail "/etc/legion_linux" "$out/share/legion_linux"
+    substituteInPlace ./legion_linux/legion_gui.desktop \
+      --replace-fail "Icon=/usr/share/pixmaps/legion_logo.png" "Icon=legion_logo"
   '';
 
   dontWrapQtApps = true;
diff --git a/pkgs/os-specific/linux/mwprocapture/default.nix b/pkgs/os-specific/linux/mwprocapture/default.nix
index a90a8716cca92..2b4628762f105 100644
--- a/pkgs/os-specific/linux/mwprocapture/default.nix
+++ b/pkgs/os-specific/linux/mwprocapture/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://www.magewell.com/files/drivers/ProCaptureForLinux_${subVersion}.tar.gz";
-    sha256 = "sha256-HOVAR9auc8ulENPLoI0scdCMZoSbDYkTaCLgZoFG7eU=";
+    sha256 = "sha256-a2cU7PYQh1KR5eeMhMNx2Sc3HHd7QvCG9+BoJyVPp1Y=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 30a1e4dd8b6f0..67733922f0c02 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -793,7 +793,13 @@ if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" =
     else
         cmd+=("$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration")
 
-        if [[ ! -f "${cmd[-1]}" ]]; then
+        if [ -z "$targetHost" ]; then
+            specialisationExists=$(test -f "${cmd[-1]}")
+        else
+            specialisationExists=$(targetHostCmd test -f "${cmd[-1]}")
+        fi
+
+        if ! $specialisationExists; then
             log "error: specialisation not found: $specialisation"
             exit 1
         fi
diff --git a/pkgs/os-specific/linux/r8125/default.nix b/pkgs/os-specific/linux/r8125/default.nix
index 1c261355954ad..9b5210350bdd2 100644
--- a/pkgs/os-specific/linux/r8125/default.nix
+++ b/pkgs/os-specific/linux/r8125/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "r8125";
   # On update please verify (using `diff -r`) that the source matches the
   # realtek version.
-  version = "9.012.03";
+  version = "9.013.02";
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "louistakepillz";
     repo = "r8125";
     rev = version;
-    sha256 = "sha256-+CrxvKB96QOcOo87McZOt/XUhriTtTV8jTQgpBG3ejs=";
+    sha256 = "sha256-i45xKF5WVN+nNhpD6HWZHvGgxuaD/YhMHERqW8/bC5Y=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
index 0ee191e868957..c21f8ea8a644b 100644
--- a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "azure-dcap-client";
-  version = "1.12.1";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = pname;
     rev = version;
-    hash = "sha256-q0dI4WdA1ue4sw+QfSherh31Ldf9gnhoft66o3E9gnU=";
+    hash = "sha256-zTDaICsSPXctgFRCZBiZwXV9dLk2pFL9kp5a8FkiTZA=";
   };
 
   patches = [
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Interfaces between SGX SDKs and the Azure Attestation SGX Certification Cache";
     homepage = "https://github.com/microsoft/azure-dcap-client";
-    maintainers = with maintainers; [ trundle veehaitch ];
+    maintainers = with maintainers; [ phlip9 trundle veehaitch ];
     platforms = [ "x86_64-linux" ];
     license = [ licenses.mit ];
   };
diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix
index 22e52b6ec9fdb..42e00071d8101 100644
--- a/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -14,7 +14,7 @@
 , debug ? false
 }:
 stdenv.mkDerivation rec {
-  inherit (sgx-sdk) version versionTag src;
+  inherit (sgx-sdk) patches src version versionTag;
   pname = "sgx-psw";
 
   postUnpack =
@@ -24,16 +24,16 @@ stdenv.mkDerivation rec {
       # attestation quotes, and do platform certification.
       ae.prebuilt = fetchurl {
         url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/prebuilt_ae_${versionTag}.tar.gz";
-        hash = "sha256-IckW4p1XWkWCDCErXyTtnKYKeAUaCrp5iAMsRBMjLX0=";
+        hash = "sha256-IGV9VEwY/cQBV4Vz2sps4JgRweWRl/l08ocb9P4SH8Q=";
       };
       # Also include the Data Center Attestation Primitives (DCAP) platform
       # enclaves.
       dcap = rec {
-        version = "1.18";
+        version = "1.20";
         filename = "prebuilt_dcap_${version}.tar.gz";
         prebuilt = fetchurl {
           url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}";
-          hash = "sha256-9ceys7ozOEienug+9MTZ6dw3nx7VBfxLNiwhZYv4SzY=";
+          hash = "sha256-nPsI89KSBA3cSNTMWyktZP5dkf+BwL3NZ4MuUf6G98o=";
         };
       };
     in
@@ -181,7 +181,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Intel SGX Architectural Enclave Service Manager";
     homepage = "https://github.com/intel/linux-sgx";
-    maintainers = with maintainers; [ veehaitch citadelcore ];
+    maintainers = with maintainers; [ phlip9 veehaitch citadelcore ];
     platforms = [ "x86_64-linux" ];
     license = with licenses; [ bsd3 ];
   };
diff --git a/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch b/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch
new file mode 100644
index 0000000000000..019f58927152a
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch
@@ -0,0 +1,26 @@
+diff --git a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
+index aee499e9..13fa89d4 100644
+--- a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
++++ b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
+@@ -105,7 +105,7 @@ bool BundleResourceContainer::GetStat(int index,
+                    const_cast<mz_zip_archive*>(&m_ZipArchive), index)
+                    ? true
+                    : false;
+-    stat.modifiedTime = zipStat.m_time;
++    stat.modifiedTime = 0;
+     stat.crc32 = zipStat.m_crc32;
+     // This will limit the size info from uint64 to uint32 on 32-bit
+     // architectures. We don't care because we assume resources > 2GB
+diff --git a/external/CppMicroServices/third_party/miniz.c b/external/CppMicroServices/third_party/miniz.c
+index 6b0ebd7a..fa2aebca 100644
+--- a/external/CppMicroServices/third_party/miniz.c
++++ b/external/CppMicroServices/third_party/miniz.c
+@@ -170,7 +170,7 @@
+ // If MINIZ_NO_TIME is specified then the ZIP archive functions will not be able to get the current time, or
+ // get/set file times, and the C run-time funcs that get/set times won't be called.
+ // The current downside is the times written to your archives will be from 1979.
+-//#define MINIZ_NO_TIME
++#define MINIZ_NO_TIME
+
+ // Define MINIZ_NO_ARCHIVE_APIS to disable all ZIP archive API's.
+ //#define MINIZ_NO_ARCHIVE_APIS
diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix
index 2570406a7112e..67489ee3c07c4 100644
--- a/pkgs/os-specific/linux/sgx/sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoconf
 , automake
 , binutils
@@ -27,15 +26,15 @@
 stdenv.mkDerivation rec {
   pname = "sgx-sdk";
   # Version as given in se_version.h
-  version = "2.21.100.1";
+  version = "2.23.100.2";
   # Version as used in the Git tag
-  versionTag = "2.21";
+  versionTag = "2.23";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-sgx";
     rev = "sgx_${versionTag}";
-    hash = "sha256-Yo2G0H0XUI2p9W7lDRLkFHw2t8X1220brGohQJ0r2WY=";
+    hash = "sha256-i+fE6xKiuljG8LY8TIHgrW15DVpdp46bZdNo/BjgT/I=";
     fetchSubmodules = true;
   };
 
@@ -46,39 +45,28 @@ stdenv.mkDerivation rec {
   '';
 
   patches = [
-    # Fix missing pthread_compat.h, see https://github.com/intel/linux-sgx/pull/784
-    (fetchpatch {
-      url = "https://github.com/intel/linux-sgx/commit/254b58f922a6bd49c308a4f47f05f525305bd760.patch";
-      sha256 = "sha256-sHU++K7NJ+PdITx3y0PwstA9MVh10rj2vrLn01N9F4w=";
-    })
+    # There's a `make preparation` step that downloads some prebuilt binaries
+    # and applies some patches to the in-repo git submodules. This patch removes
+    # the parts that download things, since we can't do that inside the sandbox.
+    ./disable-downloads.patch
+
+    # This patch disable mtime in bundled zip file for reproducible builds.
+    #
+    # Context: The `aesm_service` binary depends on a vendored library called
+    # `CppMicroServices`. At build time, this lib creates and then bundles
+    # service resources into a zip file and then embeds this zip into the
+    # binary. Without changes, the `aesm_service` will be different after every
+    # build because the embedded zip file contents have different modified times.
+    ./cppmicroservices-no-mtime.patch
   ];
 
-  # There's a `make preparation` step that downloads some prebuilt binaries and
-  # applies some patches to the in-repo git submodules. We can't just run it,
-  # since it downloads things, so this step just extracts the patching steps.
   postPatch = ''
     patchShebangs linux/installer/bin/build-installpkg.sh \
       linux/installer/common/sdk/createTarball.sh \
       linux/installer/common/sdk/install.sh \
       external/sgx-emm/create_symlink.sh
 
-    echo "Running 'make preparation' but without download steps"
-
-    # Seems to download something. Build currently uses ipp-crypto and not
-    # sgxssl so probably not an issue.
-    # $ ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
-
-    pushd external/openmp/openmp_code
-      git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 \
-        || git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
-    popd
-
-    pushd external/protobuf/protobuf_code
-      git apply ../sgx_protobuf.patch >/dev/null 2>&1 \
-        || git apply ../sgx_protobuf.patch --check -R
-    popd
-
-    ./external/sgx-emm/create_symlink.sh
+    make preparation
   '';
 
   # We need `cmake` as a build input but don't use it to kick off the build phase
@@ -300,7 +288,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Intel SGX SDK for Linux built with IPP Crypto Library";
     homepage = "https://github.com/intel/linux-sgx";
-    maintainers = with maintainers; [ sbellem arturcygan veehaitch ];
+    maintainers = with maintainers; [ phlip9 sbellem arturcygan veehaitch ];
     platforms = [ "x86_64-linux" ];
     license = with licenses; [ bsd3 ];
   };
diff --git a/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch
new file mode 100644
index 0000000000000..bdf9b9f9136e9
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch
@@ -0,0 +1,26 @@
+diff --git a/Makefile b/Makefile
+index 32433051..2e480efb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -50,8 +50,8 @@ tips:
+ preparation:
+ # As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip.
+ # Only enable the download from git
+-	git submodule update --init --recursive
+-	./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
++	# git submodule update --init --recursive
++	# ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
+ 	cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 ||  git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
+ 	cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 ||  git apply ../sgx_protobuf.patch --check -R
+ 	./external/sgx-emm/create_symlink.sh
+@@ -59,8 +59,8 @@ preparation:
+ 	cd external/cbor && cp -r libcbor sgx_libcbor
+ 	cd external/cbor/libcbor && git apply ../raw_cbor.patch >/dev/null 2>&1 || git apply ../raw_cbor.patch --check -R
+ 	cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R
+-	./download_prebuilt.sh
+-	./external/dcap_source/QuoteGeneration/download_prebuilt.sh
++	# ./download_prebuilt.sh
++	# ./external/dcap_source/QuoteGeneration/download_prebuilt.sh
+ 
+ psw:
+ 	$(MAKE) -C psw/ USE_OPT_LIBS=$(USE_OPT_LIBS)
diff --git a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
index 5a4c941a22b99..c72a0c5285164 100644
--- a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
@@ -8,13 +8,13 @@
 }:
 gcc11Stdenv.mkDerivation rec {
   pname = "ipp-crypto";
-  version = "2021.9.0";
+  version = "2021.10.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipp-crypto";
     rev = "ippcp_${version}";
-    hash = "sha256-+ITnxyrkDQp4xRa+PVzXdYsSkI5sMNwQGfGU+lFJ6co=";
+    hash = "sha256-DfXsJ+4XqyjCD+79LUD53Cx8D46o1a4fAZa2UxGI1Xg=";
   };
 
   cmakeFlags = [ "-DARCH=intel64" ] ++ extraCmakeFlags;
diff --git a/pkgs/os-specific/linux/sgx/ssl/default.nix b/pkgs/os-specific/linux/sgx/ssl/default.nix
index 9d1905e09d1f7..94d7e20b21c41 100644
--- a/pkgs/os-specific/linux/sgx/ssl/default.nix
+++ b/pkgs/os-specific/linux/sgx/ssl/default.nix
@@ -1,8 +1,8 @@
 { stdenv
+, callPackage
 , fetchFromGitHub
 , fetchurl
 , lib
-, openssl
 , perl
 , sgx-sdk
 , which
@@ -10,7 +10,7 @@
 }:
 let
   sgxVersion = sgx-sdk.versionTag;
-  opensslVersion = "1.1.1u";
+  opensslVersion = "3.0.12";
 in
 stdenv.mkDerivation {
   pname = "sgx-ssl" + lib.optionalString debug "-debug";
@@ -19,15 +19,15 @@ stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "intel";
     repo = "intel-sgx-ssl";
-    rev = "lin_${sgxVersion}_${opensslVersion}";
-    hash = "sha256-zbXEQz72VUPqnGrboX6oXliaLpbcos7tV6K9lX+zleg=";
+    rev = "3.0_Rev2";
+    hash = "sha256-dmLyaG6v+skjSa0KxLAfIfSBOxp9grrI7ds6WdGPe0I=";
   };
 
   postUnpack =
     let
       opensslSourceArchive = fetchurl {
         url = "https://www.openssl.org/source/openssl-${opensslVersion}.tar.gz";
-        hash = "sha256-4vjYS1I+7NBse+diaDA3AwD7zBU4a/UULXJ1j2lj68Y=";
+        hash = "sha256-+Tyejt3l6RZhGd4xdV/Ie0qjSGNmL2fd/LoU0La2m2E=";
       };
     in
     ''
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
   postPatch = ''
     patchShebangs Linux/build_openssl.sh
 
-    # Run the test in the `installCheckPhase`, not the `buildPhase`
+    # Skip the tests. Build and run separately (see below).
     substituteInPlace Linux/sgx/Makefile \
       --replace '$(MAKE) -C $(TEST_DIR) all' \
                 'bash -c "true"'
@@ -46,7 +46,6 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     perl
     sgx-sdk
-    stdenv.cc.libc
     which
   ];
 
@@ -60,21 +59,22 @@ stdenv.mkDerivation {
     "DESTDIR=$(out)"
   ];
 
-  # Build the test app
-  doInstallCheck = true;
-  installCheckTarget = "test";
-  installCheckFlags = [
-    "SGX_MODE=SIM"
-    "-j 1" # Makefile doesn't support multiple jobs
-  ];
-  nativeInstallCheckInputs = [
-    openssl
-  ];
+  # These tests build on any x86_64-linux but BOTH SIM and HW will only _run_ on
+  # real Intel hardware. Split these out so OfBorg doesn't choke on this pkg.
+  #
+  # ```
+  # nix run .#sgx-ssl.tests.HW
+  # nix run .#sgx-ssl.tests.SIM
+  # ```
+  passthru.tests = {
+    HW = callPackage ./tests.nix { sgxMode = "HW"; inherit opensslVersion; };
+    SIM = callPackage ./tests.nix { sgxMode = "SIM"; inherit opensslVersion; };
+  };
 
   meta = with lib; {
     description = "Cryptographic library for Intel SGX enclave applications based on OpenSSL";
     homepage = "https://github.com/intel/intel-sgx-ssl";
-    maintainers = with maintainers; [ trundle veehaitch ];
+    maintainers = with maintainers; [ phlip9 trundle veehaitch ];
     platforms = [ "x86_64-linux" ];
     license = [ licenses.bsd3 licenses.openssl ];
   };
diff --git a/pkgs/os-specific/linux/sgx/ssl/tests.nix b/pkgs/os-specific/linux/sgx/ssl/tests.nix
new file mode 100644
index 0000000000000..d9357ba043102
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/ssl/tests.nix
@@ -0,0 +1,95 @@
+# This package _builds_ (but doesn't run!) the sgx-ssl test enclave + harness.
+# The whole package effectively does:
+#
+# ```
+# SGX_MODE=${sgxMode} make -C Linux/sgx/test_app
+# cp Linux/sgx/{TestApp,TestEnclave.signed.so} $out/bin
+# ```
+#
+# OfBorg fails to run these tests since they require real Intel HW. That
+# includes the simulation mode! The tests appears to do something fancy with
+# cpuid and exception trap handlers that make them very non-portable.
+#
+# These tests are split out from the parent pkg since recompiling the parent
+# takes like 30 min : )
+
+{ lib
+, openssl
+, sgx-psw
+, sgx-sdk
+, sgx-ssl
+, stdenv
+, which
+, opensslVersion ? throw "required parameter"
+, sgxMode ? throw "required parameter" # "SIM" or "HW"
+}:
+stdenv.mkDerivation {
+  inherit (sgx-ssl) postPatch src version;
+  pname = sgx-ssl.pname + "-tests-${sgxMode}";
+
+  postUnpack = sgx-ssl.postUnpack + ''
+    sourceRootAbs=$(readlink -e $sourceRoot)
+    packageDir=$sourceRootAbs/Linux/package
+
+    # Do the inverse of 'make install' and symlink built artifacts back into
+    # '$src/Linux/package/' to avoid work.
+    mkdir $packageDir/lib $packageDir/lib64
+    ln -s ${lib.getLib sgx-ssl}/lib/* $packageDir/lib/
+    ln -s ${lib.getLib sgx-ssl}/lib64/* $packageDir/lib64/
+    ln -sf ${lib.getDev sgx-ssl}/include/* $packageDir/include/
+
+    # test_app needs some internal openssl headers.
+    # See: tail end of 'Linux/build_openssl.sh'
+    tar -C $sourceRootAbs/openssl_source -xf $sourceRootAbs/openssl_source/openssl-${opensslVersion}.tar.gz
+    echo '#define OPENSSL_VERSION_STR "${opensslVersion}"' > $sourceRootAbs/Linux/sgx/osslverstr.h
+    ln -s $sourceRootAbs/openssl_source/openssl-${opensslVersion}/include/crypto $sourceRootAbs/Linux/sgx/test_app/enclave/
+    ln -s $sourceRootAbs/openssl_source/openssl-${opensslVersion}/include/internal $sourceRootAbs/Linux/sgx/test_app/enclave/
+  '';
+
+  nativeBuildInputs = [
+    openssl.bin
+    sgx-sdk
+    which
+  ];
+
+  preBuild = ''
+    # Need to regerate the edl header
+    make -C Linux/sgx/libsgx_tsgxssl sgx_tsgxssl_t.c
+  '';
+
+  makeFlags = [
+    "-C Linux/sgx/test_app"
+    "SGX_MODE=${sgxMode}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # Enclaves can't be stripped after signing.
+    install -Dm 755 Linux/sgx/test_app/TestEnclave.signed.so -t $TMPDIR/enclaves
+
+    install -Dm 755 Linux/sgx/test_app/TestApp -t $out/bin
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    # Move the enclaves where they actually belong.
+    mv $TMPDIR/enclaves/*.signed.so* $out/bin/
+
+    # HW SGX must runs against sgx-psw, not sgx-sdk.
+    if [[ "${sgxMode}" == "HW" ]]; then
+      patchelf \
+        --set-rpath "$( \
+          patchelf --print-rpath $out/bin/TestApp \
+            | sed 's|${lib.getLib sgx-sdk}|${lib.getLib sgx-psw}|' \
+        )" \
+        $out/bin/TestApp
+    fi
+  '';
+
+  meta = {
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "TestApp";
+  };
+}
diff --git a/pkgs/servers/aeron/default.nix b/pkgs/servers/aeron/default.nix
index 84e7d44447882..2addc87feaa8e 100644
--- a/pkgs/servers/aeron/default.nix
+++ b/pkgs/servers/aeron/default.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "aeron";
-  version = "1.43.0";
+  version = "1.44.1";
   groupId = "io.aeron";
 
   aeronAll_1_40_0 = fetchMavenArtifact {
@@ -53,8 +53,22 @@ let
     hash = "sha512-a/ti4Kd8WwzOzDGMgdYk0pxsu8vRA4kRD9cm4D3S+r6xc/rL8ECHVoogOMDeabDd1EYSIbx/sKE01BJOW7BVsg==";
   };
 
-  aeronAll = aeronAll_1_43_0;
-  aeronSamples = aeronSamples_1_43_0;
+  aeronAll_1_44_1 = fetchMavenArtifact {
+    inherit groupId;
+    artifactId = "aeron-all";
+    version = "1.44.1";
+    hash = "sha256-O80bWp7F6mRh3me1znzpfFfFEpvvMVjL4PrAt7+3Fq0=";
+  };
+
+  aeronSamples_1_44_1 = fetchMavenArtifact {
+    inherit groupId;
+    version = "1.44.1";
+    artifactId = "aeron-samples";
+    hash = "sha256-ZSuTed45BRzr4JJuGeXghUgEifv/FpnCzTNJWa+nwjo=";
+  };
+
+  aeronAll = aeronAll_1_44_1;
+  aeronSamples = aeronSamples_1_44_1;
 
 in stdenv.mkDerivation {
 
diff --git a/pkgs/servers/deconz/default.nix b/pkgs/servers/deconz/default.nix
index 7f5d60b153f81..110048f9de285 100644
--- a/pkgs/servers/deconz/default.nix
+++ b/pkgs/servers/deconz/default.nix
@@ -16,16 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "deconz";
-  version = "2.23.00";
+  version = "2.26.3";
 
   src = fetchurl {
     url = "https://deconz.dresden-elektronik.de/ubuntu/beta/deconz-${version}-qt5.deb";
-    sha256 = "sha256-TMftm1fz8c8ndSyA3HUd7JWT0DINxvbdUSDrmVMwmws=";
-  };
-
-  devsrc = fetchurl {
-    url = "https://deconz.dresden-elektronik.de/ubuntu/beta/deconz-dev-${version}.deb";
-    sha256 = "sha256-uW5iF3rvFlowFhMBVDTOHkJ2K4LBgAxxC79tXpMhy5U=";
+    sha256 = "sha256-BE/apFPutNdhlS1NWRHdVcVrt/16aFfZ6zRcjphIlZA=";
   };
 
   nativeBuildInputs = [ dpkg autoPatchelfHook makeWrapper wrapQtAppsHook ];
@@ -36,7 +31,6 @@ stdenv.mkDerivation rec {
     runHook preUnpack
 
     dpkg -x $src ./deconz-src
-    dpkg -x $devsrc ./deconz-devsrc
 
     runHook postUnpack
   '';
@@ -46,7 +40,6 @@ stdenv.mkDerivation rec {
 
     mkdir -p "$out"
     cp -r deconz-src/* "$out"
-    cp -r deconz-devsrc/* "$out"
 
     # Flatten /usr and manually merge lib/ and usr/lib/, since mv refuses to.
     mv "$out/lib" "$out/orig_lib"
diff --git a/pkgs/servers/dns/trust-dns/default.nix b/pkgs/servers/dns/trust-dns/default.nix
index f330081893858..fa8fcc88261af 100644
--- a/pkgs/servers/dns/trust-dns/default.nix
+++ b/pkgs/servers/dns/trust-dns/default.nix
@@ -13,9 +13,9 @@ rustPlatform.buildRustPackage rec {
     owner = "hickory-dns";
     repo = "hickory-dns";
     rev = "v${version}";
-    hash = "sha256-+vZnozPsORe7nK6jL/yt/wp2qjwBTqyxZYz+cXaKNFk=";
+    hash = "sha256-szq21RuRmkhAfHlzhGQYpwjiIRkavFCPETOt+6TxhP4=";
   };
-  cargoHash = "sha256-VLpl6eMOstD0FsuPeHngKQitv1jcb+0dx2pc8ic3Cf4=";
+  cargoHash = "sha256-zGn5vHwsHgpkgOr30QiyScqnfXjH55LQIVtxoUUox64=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/elasticmq-server-bin/default.nix b/pkgs/servers/elasticmq-server-bin/default.nix
index 9da82d41996f2..395ac3609514e 100644
--- a/pkgs/servers/elasticmq-server-bin/default.nix
+++ b/pkgs/servers/elasticmq-server-bin/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "elasticmq-server";
-  version = "1.5.8";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://s3-eu-west-1.amazonaws.com/softwaremill-public/${finalAttrs.pname}-${finalAttrs.version}.jar";
-    sha256 = "sha256-7E1fkMPPwPUEZUL/VqTX0DSdL5mUlSlf7lDE1jNb3Ns=";
+    sha256 = "sha256-h71YX8mP9iB92gK+QQD/xl1JLZwKspAwE6D3wq+SOkU=";
   };
 
   # don't do anything?
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 33b56ccb134a8..d8da6b345eb46 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2024.4.2";
+  version = "2024.4.3";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
@@ -97,7 +97,8 @@
       airtouch4pyapi
     ];
     "airtouch5" = ps: with ps; [
-    ]; # missing inputs: airtouch5py
+      airtouch5py
+    ];
     "airvisual" = ps: with ps; [
       pyairvisual
     ];
@@ -162,7 +163,8 @@
       sqlalchemy
     ];
     "analytics_insights" = ps: with ps; [
-    ]; # missing inputs: python-homeassistant-analytics
+      python-homeassistant-analytics
+    ];
     "android_ip_webcam" = ps: with ps; [
       pydroid-ipcam
     ];
@@ -5956,6 +5958,7 @@
     "ambiclimate"
     "ambient_station"
     "analytics"
+    "analytics_insights"
     "android_ip_webcam"
     "androidtv"
     "androidtv_remote"
diff --git a/pkgs/servers/home-assistant/custom-components/better_thermostat/default.nix b/pkgs/servers/home-assistant/custom-components/better_thermostat/default.nix
index d61d1850e13b8..5557e11761dfd 100644
--- a/pkgs/servers/home-assistant/custom-components/better_thermostat/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/better_thermostat/default.nix
@@ -3,13 +3,13 @@
 buildHomeAssistantComponent rec {
   owner = "KartoffelToby";
   domain = "better_thermostat";
-  version = "1.5.0-beta7";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "KartoffelToby";
     repo = "better_thermostat";
     rev = "refs/tags/${version}";
-    hash = "sha256-bJURpeBgoxXGR7C9MY/gmNY7OFvBxrJKz2cA61b5hNo=";
+    hash = "sha256-noo96Uks+MHtTbwIoU5gnekp/IwMry0U18X4I1qe4LQ=";
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/home-assistant/custom-components/miele/default.nix b/pkgs/servers/home-assistant/custom-components/miele/default.nix
index 71624f674b4d7..3ebdc6283c035 100644
--- a/pkgs/servers/home-assistant/custom-components/miele/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/miele/default.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "astrandb";
   domain = "miele";
-  version = "0.1.19";
+  version = "2024.3.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     rev = "refs/tags/v${version}";
-    hash = "sha256-od7DV10/rkIw9eFMsTRw4bMmhQo9BAmw2rCbKKySeIk=";
+    hash = "sha256-J9n4PFcd87L301B2YktrLcxp5Vu1HwDeCYnrMEJ0+TA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index cc42a6b90582f..e3bec47d25a80 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -526,7 +526,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2024.4.2";
+  hassVersion = "2024.4.3";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -544,13 +544,13 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-V6qvpPrhfSLINH99hYkAjvG8pfIN8AXGO3HuwiKgMPo=";
+    hash = "sha256-jHt4cWi1JxUs2XKf0N9gqsYj5XZK7TXwgj7WPZ7dmEA=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZtTlLRDSXKUz+ZA+UctFL+d3wdKrcPdeROIUhS35qWU=";
+    hash = "sha256-sj3usdXUl/wNElO3OgGx6dsBqn9+h9zq/AC3Zdn379M=";
   };
 
   nativeBuildInputs = with python.pkgs; [
@@ -559,6 +559,7 @@ in python.pkgs.buildPythonApplication rec {
   ];
 
   pythonRelaxDeps = [
+    "aiohttp"
     "attrs"
     "bcrypt"
     "ciso8601"
@@ -566,6 +567,7 @@ in python.pkgs.buildPythonApplication rec {
     "hass-nabucasa"
     "httpx"
     "orjson"
+    "pillow"
     "pyopenssl"
     "typing-extensions"
     "urllib3"
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 4b95c1cb86886..afa2c53ca3f7f 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20240404.1";
+  version = "20240404.2";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-Vuk/e+wn8Cbko7tbjLIbclhdj3R+BdHzu4OSsBUAOcU=";
+    hash = "sha256-xCpQHzfXXt9aOWWVGYtt9NYws//ZPjI/owXBQafb31k=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index b70aa8ed3d230..f8e4e49b13ff0 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2024.4.2";
+  version = "2024.4.3";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-qt7NBbjjeiNcHOM6wKI7Y3+L579xBQJD48hU89BB+ss=";
+    hash = "sha256-uFQQNcRfo4m3GnfCbAe4yjdphkpqnhpqVr1EZP3bqVM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix
index 50067d7dd6220..7e58f50fa1c64 100644
--- a/pkgs/servers/http/envoy/default.nix
+++ b/pkgs/servers/http/envoy/default.nix
@@ -25,15 +25,15 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.27.3";
-    rev = "0fd81ee7ffcd7cfc864094b24dc9b5c3ade89ff2";
-    hash = "sha256-WNyyUw3517oKqMd1sJMk9CiLa/V7UrhwlRS+AWNNOOo=";
+    version = "1.27.5";
+    rev = "be4f1cfd31c79fc05651efa2f88429b3c03d1d9e";
+    hash = "sha256-+sjNqq91YfyW83aq/8WoSo7Jl5QZUmtWtsajnLLMgDc=";
   };
 
   # these need to be updated for any changes to fetchAttrs
   depsHash = {
-    x86_64-linux = "sha256-wTGHfeFkCuijPdX//lT5GPspaxZsxzBHJffH1tpVM2w=";
-    aarch64-linux = "sha256-9/Wem+Gk/7bFeMNFC4J3mdTm3mrNmyMxiu5oadQcovU=";
+    x86_64-linux = "sha256-4XJgPfNEPmbvAZMLlQcnIaoGzaFtyhsuEshdEjLh0OY=";
+    aarch64-linux = "sha256-85HLiK+xX/tabazh97J4fWk5KYc7kynbxj/g8HCGTD4=";
   }.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 in
 buildBazelPackage {
@@ -179,8 +179,13 @@ buildBazelPackage {
     #       |         ^
     "--define=tcmalloc=disabled"
   ]);
+
   bazelFetchFlags = [
     "--define=wasm=${wasmRuntime}"
+
+    # https://github.com/bazelbuild/rules_go/issues/3844
+    "--repo_env=GOPROXY=https://proxy.golang.org,direct"
+    "--repo_env=GOSUMDB=sum.golang.org"
   ];
 
   passthru.tests = {
@@ -197,6 +202,5 @@ buildBazelPackage {
     license = licenses.asl20;
     maintainers = with maintainers; [ lukegb ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
-    knownVulnerabilities = [ "CVE-2024-30255" ];
   };
 }
diff --git a/pkgs/servers/hylafaxplus/default.nix b/pkgs/servers/hylafaxplus/default.nix
index 278f0b4c5260a..246ad636ceb4c 100644
--- a/pkgs/servers/hylafaxplus/default.nix
+++ b/pkgs/servers/hylafaxplus/default.nix
@@ -32,8 +32,8 @@
 let
 
   pname = "hylafaxplus";
-  version = "7.0.7";
-  hash = "sha512-nUvt+M0HBYN+MsGskuuDt1j0nI5Dk8MbfK/OVxP2FCDby3eiDg0eDtcpIxlOe4o0klko07zDRIb06zqh8ABuKA==";
+  version = "7.0.8";
+  hash = "sha512-6wTLVcaHpASy+2i+jeoJ1cM2aLgI5vznGrLd4NCkLHiOxlfCh/ASRaj2Nxt9ZZ5NN/deEwf9tNSZ7MkFZHVsqA==";
 
   configSite = substituteAll {
     name = "${pname}-config.site";
diff --git a/pkgs/servers/hylafaxplus/libtiff-4.patch b/pkgs/servers/hylafaxplus/libtiff-4.patch
index e00d94b5a979b..d7284e2428651 100644
--- a/pkgs/servers/hylafaxplus/libtiff-4.patch
+++ b/pkgs/servers/hylafaxplus/libtiff-4.patch
@@ -1,11 +1,11 @@
 https://bugs.gentoo.org/706154
 --- a/configure
 +++ b/configure
-@@ -2583,7 +2583,7 @@ EOF
+@@ -2584,7 +2584,7 @@ EOF
  				echo '#define TIFFSTRIPBYTECOUNTS uint32_t'
  				echo '#define TIFFVERSION TIFF_VERSION'
  				echo '#define TIFFHEADER TIFFHeader';;
--		4.[012345])	tiff_runlen_t="uint32_t"
+-		4.[0123456])	tiff_runlen_t="uint32_t"
 +		4.[0-9])	tiff_runlen_t="uint32_t"
  				tiff_offset_t="uint64_t"
  				echo '#define TIFFSTRIPBYTECOUNTS uint64_t'
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index 8b6623200eba2..22d482d1bc64a 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -2,16 +2,16 @@
 
 perlPackages.buildPerlPackage rec {
   pname = "SpamAssassin";
-  version = "4.0.0";
-  rulesRev = "r1905950";
+  version = "4.0.1";
+  rulesRev = "r1916528";
 
   src = fetchurl {
     url = "mirror://apache/spamassassin/source/Mail-${pname}-${version}.tar.bz2";
-    hash = "sha256-5aoXBQowvHK6qGr9xgSMrepNHsLsxh14dxegWbgxnog=";
+    hash = "sha256-l3XtdVnoPsPmwD7bK+j/x/FcxAX7E+hcFI6wvxkXIag=";
   };
   defaultRulesSrc = fetchurl {
     url = "mirror://apache/spamassassin/source/Mail-${pname}-rules-${version}.${rulesRev}.tgz";
-    hash = "sha256-rk/7uRfrx/76ckD8W7UVHdpmP45AWRYa18m0Lu0brG0=";
+    hash = "sha256-OB6t/H5RPl9zU4m3gXPeWvRx89Bv5quPEpY0pmRLS/Q=";
   };
 
   patches = [
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 671eb4c108a84..411c609369b94 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -21,16 +21,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2024-04-06T05-26-02Z";
+  version = "2024-04-18T19-09-19Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    hash = "sha256-6ThzAPpLKzhHAXYW6EC6aiyVRvI0nJ2a4Q2GvLpg3wo=";
+    hash = "sha256-yfVB9CTNg/Vv2j3q3vMU2rwtT6R1laA9MNhcpUKSg2U=";
   };
 
-  vendorHash = "sha256-JJfLeKoMBQ1/Q2xF6n9VD3khaiLB1ZLNl9HaQl9eKb8=";
+  vendorHash = "sha256-FMLxXwB1lSzV8C+tJZYhZHJbaKQ3xDhtHfc68ZIJFyw=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/misc/irrd/default.nix b/pkgs/servers/misc/irrd/default.nix
index e6cc723ab4dc0..c2ce5bed86e0b 100644
--- a/pkgs/servers/misc/irrd/default.nix
+++ b/pkgs/servers/misc/irrd/default.nix
@@ -16,7 +16,7 @@ let
       sqlalchemy = prev.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
         version = "1.3.24";
         src = fetchPypi {
-          inherit (oldAttrs) pname;
+          pname = "SQLAlchemy";
           inherit version;
           hash = "sha256-67t3fL+TEjWbiXv4G6ANrg9ctp+6KhgmXcwYpvXvdRk=";
         };
@@ -157,6 +157,7 @@ py.pkgs.buildPythonPackage rec {
     license = licenses.mit;
     homepage = "https://github.com/irrdnet/irrd";
     maintainers = teams.wdz.members;
+    broken = true; # last successful build 2023-10-21
   };
 }
 
diff --git a/pkgs/servers/monitoring/prometheus/fastly-exporter.nix b/pkgs/servers/monitoring/prometheus/fastly-exporter.nix
index ba2d5217e3440..5a52027bc5d1a 100644
--- a/pkgs/servers/monitoring/prometheus/fastly-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/fastly-exporter.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "fastly-exporter";
-  version = "7.6.1";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "fastly-exporter";
     rev = "v${version}";
-    hash = "sha256-JUbjWAJ70iq0RCr6U2thbtZ3nmCic9wGtSf2ArRy4uA=";
+    hash = "sha256-3XIw9Sq7aQ6bs7kY0fYP3UGfJeq80gB2vXX69EEOtl4=";
   };
 
-  vendorHash = "sha256-lEaMhJL/sKNOXx0W+QHMG4QUUE6Pc4AqulhgyCMQQNY=";
+  vendorHash = "sha256-kiP9nL/fVnekIf1ABAbSNebszcrj/xkFw9NcuBr/wKQ=";
 
   passthru.tests = {
     inherit (nixosTests.prometheus-exporters) fastly;
diff --git a/pkgs/servers/monitoring/prometheus/nats-exporter.nix b/pkgs/servers/monitoring/prometheus/nats-exporter.nix
index b9b4fcc71f43a..fc8d360fc97a8 100644
--- a/pkgs/servers/monitoring/prometheus/nats-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/nats-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "prometheus-nats-exporter";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Zg4zmb0tvu7JPv9XS5Qd5o/ClnODSPz36isjUbFM1ec=";
+    sha256 = "sha256-siucc55qi1SS2R07xgxh25CWYjxncUqvzxo0XoIPyOo=";
   };
 
-  vendorHash = "sha256-VygRE6YviSSIYpMbTEPndR6WUmLAZDwgvuJcwBuizck=";
+  vendorHash = "sha256-vRUPLKxwVTt3t8UpsSH4yMCIShpYhYI6j7AEmlyOADs=";
 
   preCheck = ''
     # Fix `insecure algorithm SHA1-RSA` problem
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index d6cb49b2eaf86..af56a220feaa2 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.58.0";
+  version = "1.59.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-tZ09vQBFUWw2l6OYwT/bXhBEMOTSl5r/Hu732msPGkg=";
+    sha256 = "sha256-/nfAB4h5VvAzuludQ7Zx3OoJThyyD5nS6B5pOSbQYFs=";
   };
 
-  vendorHash = "sha256-32EjLEPeFsihdG83ru4SSf03F2XJGD8+tbO9ANaI1hs=";
+  vendorHash = "sha256-Nns8hpKwxL1GQfjVt9+rnmjGjmdm2TB+8wob7ze4RrI=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/servers/monitoring/unpoller/default.nix b/pkgs/servers/monitoring/unpoller/default.nix
index 5ce7d27d86f92..5cae8fbc7982b 100644
--- a/pkgs/servers/monitoring/unpoller/default.nix
+++ b/pkgs/servers/monitoring/unpoller/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "unpoller";
-  version = "2.11.1";
+  version = "2.11.2";
 
   src = fetchFromGitHub {
     owner = "unpoller";
     repo = "unpoller";
     rev = "v${version}";
-    hash = "sha256-ZCNXwq0kSfXOqF7QktHg1Yw7gqUXkccCgLIs7GTZnuw=";
+    hash = "sha256-/X2hCtF38X0twHsHSjpf23Mdz9aK43z3jhWbfkUo0kQ=";
   };
 
-  vendorHash = "sha256-VK0ekEBHn0O41MgxhuPzueF6FazKiipL0OQRVPco3uk=";
+  vendorHash = "sha256-d7kkdiGMT3bN1dfNo8m+zp3VY8kaZM2BWO3B3iAdUQY=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/servers/nosql/influxdb2/cli.nix b/pkgs/servers/nosql/influxdb2/cli.nix
index 0627afed10512..5583014c2a3ea 100644
--- a/pkgs/servers/nosql/influxdb2/cli.nix
+++ b/pkgs/servers/nosql/influxdb2/cli.nix
@@ -4,13 +4,13 @@
 }:
 
 let
-  version = "2.7.4";
+  version = "2.7.5";
 
   src = fetchFromGitHub {
     owner = "influxdata";
     repo = "influx-cli";
     rev = "v${version}";
-    sha256 = "sha256-g/3hakOTRjRA6DU0DT5A+ChUF6ED/sdg3p4ZB5nbbU0=";
+    sha256 = "sha256-0Gyoy9T5pA+40k8kKybWBMtOfpKZxw3Vvp4ZB4ptcJs=";
   };
 
 in buildGoModule {
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index 5b5af73e1805e..9e2488e3b7bc4 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.40.1.8227-c0dd5a73e";
+  version = "1.40.2.8395-c67dce28e";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "16gc8fwb29x3l9s263xs9c7nb0i1rzgaps2wlx0cil8bs2a9izz8";
+    sha256 = "sha256-ZJqbE9pgflqFVjiDqCED6K5KBk6KHSbkIQllF06jJVQ=";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "03sx5fvwy2njpfh7k4xvkqscrxnafdvzh42g4hsn2hqxp0bqkl51";
+    sha256 = "sha256-gYRhQIf6RaXgFTaigFW1yJ7ndxRmOP6oJSNnr8o0EBM=";
   };
 
   outputs = [ "out" "basedb" ];
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index 39063ca20860c..0d8f6a22a3e47 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.22.8";
+  version = "0.22.9";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-D9kxi/+e56/DREoT14EozAB4Z5X4QgmkhoD/sw1VAeY=";
+    hash = "sha256-0VzhjiNLAwZNi84ud/l00rWIFV4qPTXY7jZQB/pMD6A=";
   };
 
-  vendorHash = "sha256-5zO0C/+tVVOgV7TH6eC1Sjh6W8AKannU4e0+OITk4XY=";
+  vendorHash = "sha256-/SPJr2x3o1KkV8NgciBFC6zwDNUKmFQBWjEHO2CRgZ4=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/readarr/default.nix b/pkgs/servers/readarr/default.nix
index 912db6f5ec3b1..de407700bccd6 100644
--- a/pkgs/servers/readarr/default.nix
+++ b/pkgs/servers/readarr/default.nix
@@ -8,13 +8,13 @@ let
     x86_64-darwin = "x64";
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash = {
-    x64-linux_hash = "sha256-Oq8kxHfVG34qiBOOgsXy/qblrKbndrNAMzyDLMcwko0=";
-    arm64-linux_hash = "sha256-0IOyLZwWBJQ1c+IOLuI6TXLSPNNaWLMbuBXOOmn5PlI=";
-    x64-osx_hash = "sha256-Q+qgmrko7DoUTW3B8NDWi7Rw80GYLaKyK/fq7y6eq7Q=";
+    x64-linux_hash = "sha256-heduuPx0lnbkB1c4tgbDO9wsGnyAzTPyW0ZEvYFwjd0=";
+    arm64-linux_hash = "sha256-vfy0pVIacnf0lW1VwUolbE/P+aBB9uQsm3enhGkjgXg=";
+    x64-osx_hash = "sha256-JW+9PRW1Wu+wu+QPh7INXkq87oRSuoOqNEqj0P2Stto=";
   }."${arch}-${os}_hash";
 in stdenv.mkDerivation rec {
   pname = "readarr";
-  version = "0.3.22.2499";
+  version = "0.3.23.2506";
 
   src = fetchurl {
     url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/search/qdrant/1.7.4-CVE-2024-3078.patch b/pkgs/servers/search/qdrant/1.7.4-CVE-2024-3078.patch
new file mode 100644
index 0000000000000..b12b438342878
--- /dev/null
+++ b/pkgs/servers/search/qdrant/1.7.4-CVE-2024-3078.patch
@@ -0,0 +1,142 @@
+Based on upstream 3ab5172e9c8f14fa1f7b24e7147eac74e2412b62 with minor
+adjustments to apply to 1.7.4
+
+diff --git a/lib/collection/src/collection/snapshots.rs b/lib/collection/src/collection/snapshots.rs
+index e5a8be9c..ca48fb9e 100644
+--- a/lib/collection/src/collection/snapshots.rs
++++ b/lib/collection/src/collection/snapshots.rs
+@@ -241,35 +241,35 @@ impl Collection {
+             .await
+     }
+ 
++    /// Get full file path for a collection snapshot by name
++    ///
++    /// This enforces the file to be inside the snapshots directory
+     pub async fn get_snapshot_path(&self, snapshot_name: &str) -> CollectionResult<PathBuf> {
+-        let snapshot_path = self.snapshots_path.join(snapshot_name);
+-
+-        let absolute_snapshot_path =
+-            snapshot_path
+-                .canonicalize()
+-                .map_err(|_| CollectionError::NotFound {
+-                    what: format!("Snapshot {snapshot_name}"),
+-                })?;
+-
+-        let absolute_snapshot_dir =
+-            self.snapshots_path
+-                .canonicalize()
+-                .map_err(|_| CollectionError::NotFound {
+-                    what: format!("Snapshot directory: {}", self.snapshots_path.display()),
+-                })?;
++        let absolute_snapshot_dir = self.snapshots_path.canonicalize().map_err(|_| {
++            CollectionError::not_found(format!(
++                "Snapshot directory: {}",
++                self.snapshots_path.display()
++            ))
++        })?;
++
++        let absolute_snapshot_path = absolute_snapshot_dir
++            .join(snapshot_name)
++            .canonicalize()
++            .map_err(|_| CollectionError::not_found(format!("Snapshot {snapshot_name}")))?;
+ 
+         if !absolute_snapshot_path.starts_with(absolute_snapshot_dir) {
+-            return Err(CollectionError::NotFound {
+-                what: format!("Snapshot {snapshot_name}"),
+-            });
++            return Err(CollectionError::not_found(format!(
++                "Snapshot {snapshot_name}"
++            )));
+         }
+ 
+-        if !snapshot_path.exists() {
+-            return Err(CollectionError::NotFound {
+-                what: format!("Snapshot {snapshot_name}"),
+-            });
++        if !absolute_snapshot_path.exists() {
++            return Err(CollectionError::not_found(format!(
++                "Snapshot {snapshot_name}"
++            )));
+         }
+-        Ok(snapshot_path)
++
++        Ok(absolute_snapshot_path)
+     }
+ 
+     pub async fn list_shard_snapshots(
+diff --git a/lib/collection/src/operations/types.rs b/lib/collection/src/operations/types.rs
+index afc38d0f..63eae16e 100644
+--- a/lib/collection/src/operations/types.rs
++++ b/lib/collection/src/operations/types.rs
+@@ -906,6 +906,10 @@ impl CollectionError {
+         CollectionError::BadInput { description }
+     }
+ 
++    pub fn not_found(what: impl Into<String>) -> CollectionError {
++        CollectionError::NotFound { what: what.into() }
++    }
++
+     pub fn bad_request(description: String) -> CollectionError {
+         CollectionError::BadRequest { description }
+     }
+diff --git a/lib/storage/src/content_manager/errors.rs b/lib/storage/src/content_manager/errors.rs
+index 1ad8d413..4528e485 100644
+--- a/lib/storage/src/content_manager/errors.rs
++++ b/lib/storage/src/content_manager/errors.rs
+@@ -46,6 +46,12 @@ impl StorageError {
+         }
+     }
+ 
++    pub fn not_found(description: impl Into<String>) -> StorageError {
++        StorageError::NotFound {
++            description: description.into(),
++        }
++    }
++
+     /// Used to override the `description` field of the resulting `StorageError`
+     pub fn from_inconsistent_shard_failure(
+         err: CollectionError,
+diff --git a/lib/storage/src/content_manager/snapshots/mod.rs b/lib/storage/src/content_manager/snapshots/mod.rs
+index 8a417377..9965006a 100644
+--- a/lib/storage/src/content_manager/snapshots/mod.rs
++++ b/lib/storage/src/content_manager/snapshots/mod.rs
+@@ -24,17 +24,33 @@ pub struct SnapshotConfig {
+     pub collections_aliases: HashMap<String, String>,
+ }
+ 
++/// Get full file path for a full snapshot by name
++///
++/// This enforces the file to be inside the snapshots directory
+ pub async fn get_full_snapshot_path(
+     toc: &TableOfContent,
+     snapshot_name: &str,
+ ) -> Result<PathBuf, StorageError> {
+-    let snapshot_path = Path::new(toc.snapshots_path()).join(snapshot_name);
+-    if !snapshot_path.exists() {
+-        return Err(StorageError::NotFound {
+-            description: format!("Full storage snapshot {snapshot_name} not found"),
+-        });
++    let snapshots_path = toc.snapshots_path();
++
++    let absolute_snapshot_dir = Path::new(snapshots_path)
++        .canonicalize()
++        .map_err(|_| StorageError::not_found(format!("Snapshot directory: {snapshots_path}")))?;
++
++    let absolute_snapshot_path = absolute_snapshot_dir
++        .join(snapshot_name)
++        .canonicalize()
++        .map_err(|_| StorageError::not_found(format!("Snapshot {snapshot_name}")))?;
++
++    if !absolute_snapshot_path.starts_with(absolute_snapshot_dir) {
++        return Err(StorageError::not_found(format!("Snapshot {snapshot_name}")));
+     }
+-    Ok(snapshot_path)
++
++    if !absolute_snapshot_path.exists() {
++        return Err(StorageError::not_found(format!("Snapshot {snapshot_name}")));
++    }
++
++    Ok(absolute_snapshot_path)
+ }
+ 
+ pub async fn do_delete_full_snapshot(
diff --git a/pkgs/servers/search/qdrant/default.nix b/pkgs/servers/search/qdrant/default.nix
index eb6fc6c71943b..801887103ec4f 100644
--- a/pkgs/servers/search/qdrant/default.nix
+++ b/pkgs/servers/search/qdrant/default.nix
@@ -22,6 +22,10 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-BgsLmE50mGmB5fcUjov8wcAHRTKMYaoyoXjSUyIddlc=";
   };
 
+  patches = [
+    ./1.7.4-CVE-2024-3078.patch
+  ];
+
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
diff --git a/pkgs/servers/search/weaviate/default.nix b/pkgs/servers/search/weaviate/default.nix
index 9f814dd68e2a5..02d3d61ea0f88 100644
--- a/pkgs/servers/search/weaviate/default.nix
+++ b/pkgs/servers/search/weaviate/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "weaviate";
-  version = "1.24.8";
+  version = "1.24.9";
 
   src = fetchFromGitHub {
     owner = "weaviate";
     repo = "weaviate";
     rev = "v${version}";
-    hash = "sha256-OydGohfsS2/Wb9uuFP+6IogmfiWMFLBIEdooFJwS3TU=";
+    hash = "sha256-fIOTk+h39LHUBWYvGiP2Vzhmcy0xjqprECOzzC3TvQM=";
   };
 
-  vendorHash = "sha256-DMzwIxtF267C2OLyVdZ6CrCz44sy6ZeKL2qh8AkhS2I=";
+  vendorHash = "sha256-f7LskkQbsPwNmrzLTze0C66y++7Vqtb15tjW142TQmE=";
 
   subPackages = [ "cmd/weaviate-server" ];
 
diff --git a/pkgs/servers/sql/dolt/default.nix b/pkgs/servers/sql/dolt/default.nix
index e0c08ef2d9876..b749d71d1223f 100644
--- a/pkgs/servers/sql/dolt/default.nix
+++ b/pkgs/servers/sql/dolt/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "dolt";
-  version = "1.35.8";
+  version = "1.35.10";
 
   src = fetchFromGitHub {
     owner = "dolthub";
     repo = "dolt";
     rev = "v${version}";
-    sha256 = "sha256-JpRJbAxu6Bz47vJ/DB3QpUZk2LcGHe/vUVpzbnsG+FI=";
+    sha256 = "sha256-VTScVd9GHbwHGZDGquld05zP6CrvqfdfhRO9GHH2zHA=";
   };
 
   modRoot = "./go";
   subPackages = [ "cmd/dolt" ];
-  vendorHash = "sha256-Hk9ILvK9b/3Eh7D6NQT7W6ZCW0J3unuALqy/po46cm8=";
+  vendorHash = "sha256-4lmwDD9LKTATA8vJiWaWaWueIoSFrfW+C0O5uCh3TJw=";
   proxyVendor = true;
   doCheck = false;
 
diff --git a/pkgs/servers/sql/postgresql/ext/lantern.nix b/pkgs/servers/sql/postgresql/ext/lantern.nix
index 63e78c8a22215..75c321571e052 100644
--- a/pkgs/servers/sql/postgresql/ext/lantern.nix
+++ b/pkgs/servers/sql/postgresql/ext/lantern.nix
@@ -7,7 +7,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "lantern";
+  pname = "postgresql-lantern";
   version = "0.2.4";
 
   src = fetchFromGitHub {
diff --git a/pkgs/servers/sunshine/default.nix b/pkgs/servers/sunshine/default.nix
index 7d43eff483e8c..d4ad28ca4361d 100644
--- a/pkgs/servers/sunshine/default.nix
+++ b/pkgs/servers/sunshine/default.nix
@@ -5,6 +5,7 @@
 , autoAddDriverRunpath
 , makeWrapper
 , buildNpmPackage
+, nixosTests
 , cmake
 , avahi
 , libevdev
@@ -185,7 +186,10 @@ stdenv'.mkDerivation rec {
     install -Dm644 ../packaging/linux/${pname}.desktop $out/share/applications/${pname}.desktop
   '';
 
-  passthru.updateScript = ./updater.sh;
+  passthru = {
+    tests.sunshine = nixosTests.sunshine;
+    updateScript = ./updater.sh;
+  };
 
   meta = with lib; {
     description = "Sunshine is a Game stream host for Moonlight";
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 98a24d2b909d7..695e91d978944 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -12,7 +12,7 @@
 }:
 
 let
-  version = "1.64.1";
+  version = "1.64.2";
 in
 buildGoModule {
   pname = "tailscale";
@@ -22,7 +22,7 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-4GA31P0UIUI33AMDSVweaEDflPtCV5ZHCqyIcXShTj0=";
+    hash = "sha256-DS7C/G1Nj9gIjYwXaEeCLbtH9HbB0tRoJBDjZc/nq5g=";
   };
   vendorHash = "sha256-pYeHqYd2cCOVQlD1r2lh//KC+732H0lj1fPDBr+W8qA=";
 
diff --git a/pkgs/servers/web-apps/changedetection-io/default.nix b/pkgs/servers/web-apps/changedetection-io/default.nix
index 1d45e156096ce..c3c9c8116addd 100644
--- a/pkgs/servers/web-apps/changedetection-io/default.nix
+++ b/pkgs/servers/web-apps/changedetection-io/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "changedetection-io";
-  version = "0.45.17";
+  version = "0.45.20";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dgtlmoon";
     repo = "changedetection.io";
-    rev = version;
-    hash = "sha256-3LaNZourDjFjdSh5+hwc2l2DRMEI/rbfyksFD9uUebg=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-wnJz/yVOSBTgOfGxmrO4JXifZxoTk8bjqGKqKsbwXAI=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index ca9483ab0c20e..a76a05fd05174 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -4158,11 +4158,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgserver = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, openssl, libX11, libXau, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xorg-server";
-    version = "21.1.12";
+    version = "21.1.13";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/xserver/xorg-server-21.1.12.tar.xz";
-      sha256 = "03x954bygi6sdynk5yy3yvsfhg6i9gjhisn3x9jxvk5mw4mnw08y";
+      url = "mirror://xorg/individual/xserver/xorg-server-21.1.13.tar.xz";
+      sha256 = "033lvjihidc68v08izrr63va8jhkfmzcjg0d6rm26wizjkah4nml";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index ce0d9105bea52..53836294211ef 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -218,4 +218,4 @@ mirror://xorg/individual/util/lndir-1.0.4.tar.xz
 mirror://xorg/individual/util/makedepend-1.0.9.tar.xz
 mirror://xorg/individual/util/util-macros-1.20.0.tar.xz
 mirror://xorg/individual/util/xorg-cf-files-1.0.8.tar.xz
-mirror://xorg/individual/xserver/xorg-server-21.1.12.tar.xz
+mirror://xorg/individual/xserver/xorg-server-21.1.13.tar.xz
diff --git a/pkgs/shells/bash/bash-completion/default.nix b/pkgs/shells/bash/bash-completion/default.nix
index 933fe08a61ed3..80f5ffeff9519 100644
--- a/pkgs/shells/bash/bash-completion/default.nix
+++ b/pkgs/shells/bash/bash-completion/default.nix
@@ -69,6 +69,6 @@ stdenv.mkDerivation rec {
     description = "Programmable completion for the bash shell";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = [ maintainers.xfix ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/shells/hishtory/default.nix b/pkgs/shells/hishtory/default.nix
index 051fed0074cc3..b5bc4ce70539e 100644
--- a/pkgs/shells/hishtory/default.nix
+++ b/pkgs/shells/hishtory/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "hishtory";
-  version = "0.290";
+  version = "0.291";
 
   src = fetchFromGitHub {
     owner = "ddworken";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zFBq1BHj0w+ubKAnyL+Asd5vykM2Vpg2va0jxY2vwUk=";
+    hash = "sha256-pBUe0iwzv9Yv9/wmqIjZrDkjBYbARL+A8fhUZJnHRaQ=";
   };
 
   vendorHash = "sha256-qw4whXAX8y0x7IWnpZHT45XTQ82CdoWPDnoQhr20cII=";
diff --git a/pkgs/tools/admin/balena-cli/default.nix b/pkgs/tools/admin/balena-cli/default.nix
index cc4674bcd2c9b..0229c81953780 100644
--- a/pkgs/tools/admin/balena-cli/default.nix
+++ b/pkgs/tools/admin/balena-cli/default.nix
@@ -18,16 +18,16 @@ let
   };
 in buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "18.1.9";
+  version = "18.2.0";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-yf4QkuFt5Fpegyru05S79Q3hFaLc45unxrk+SJzwWg0=";
+    hash = "sha256-8T+6j2wIsCn27I7V6u5bXIjjbkU2soGI3rBfIzb4IxY=";
   };
 
-  npmDepsHash = "sha256-lTaKW5Tsw9df0bd/chr8nSL2PROp1sSs+fuMr3Cz+a4=";
+  npmDepsHash = "sha256-XTCdrb5qwyaSnxjJOGOvpn22YsoS4WNXRwFTjPXzf5U=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/tools/admin/pulumi-packages/base.nix b/pkgs/tools/admin/pulumi-packages/base.nix
index 8327e41dcd5f2..5f5857f1a1fd2 100644
--- a/pkgs/tools/admin/pulumi-packages/base.nix
+++ b/pkgs/tools/admin/pulumi-packages/base.nix
@@ -10,9 +10,10 @@ let
     , vendorHash
     , cmd
     , extraLdflags
+    , env
     , ...
     }@args: buildGoModule (rec {
-      inherit pname src vendorHash version;
+      inherit pname src vendorHash version env;
 
       sourceRoot = "${src.name}/provider";
 
@@ -88,6 +89,7 @@ in
 , cmdGen
 , cmdRes
 , extraLdflags
+, env ? { }
 , meta
 , fetchSubmodules ? false
 , ...
@@ -99,14 +101,14 @@ let
   };
 
   pulumi-gen = mkBasePackage rec {
-    inherit src version vendorHash extraLdflags;
+    inherit src version vendorHash extraLdflags env;
 
     cmd = cmdGen;
     pname = cmdGen;
   };
 in
 mkBasePackage ({
-  inherit meta src version vendorHash extraLdflags;
+  inherit meta src version vendorHash extraLdflags env;
 
   pname = repo;
 
diff --git a/pkgs/tools/admin/pulumi-packages/default.nix b/pkgs/tools/admin/pulumi-packages/default.nix
index 5aed6b1717833..9e232a1f45bf4 100644
--- a/pkgs/tools/admin/pulumi-packages/default.nix
+++ b/pkgs/tools/admin/pulumi-packages/default.nix
@@ -11,4 +11,5 @@ in
   pulumi-language-nodejs = callPackage ./pulumi-language-nodejs.nix { };
   pulumi-language-python = callPackage ./pulumi-language-python.nix { };
   pulumi-random = callPackage' ./pulumi-random.nix { };
+  pulumi-yandex-unofficial = callPackage' ./pulumi-yandex-unofficial.nix { };
 }
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-yandex-unofficial.nix b/pkgs/tools/admin/pulumi-packages/pulumi-yandex-unofficial.nix
new file mode 100644
index 0000000000000..52079fbda066e
--- /dev/null
+++ b/pkgs/tools/admin/pulumi-packages/pulumi-yandex-unofficial.nix
@@ -0,0 +1,27 @@
+{ lib
+, mkPulumiPackage
+}:
+# Note that we are not using https://github.com/pulumi/pulumi-yandex because
+# it has been archived in 2022.
+mkPulumiPackage rec {
+  owner = "Regrau";
+  repo = "pulumi-yandex";
+  version = "0.98.0";
+  rev = "v${version}";
+  hash = "sha256-Olwl4JNrJUiJaGha7ZT0Qb0+6hRKxOOy06eKMJfYf0I=";
+  vendorHash = "sha256-8mu0msSq59f5GZNo7YIGuNTYealGyEL9kwk0jCcSO68=";
+  cmdGen = "pulumi-tfgen-yandex";
+  cmdRes = "pulumi-resource-yandex";
+  extraLdflags = [
+    "-X github.com/regrau/${repo}/provider/pkg/version.Version=v${version}"
+  ];
+  __darwinAllowLocalNetworking = true;
+  env.GOWORK = "off";
+  meta = with lib; {
+    description = "Unofficial Yandex Cloud Resource Provider";
+    homepage = "https://github.com/Regrau/pulumi-yandex";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ tie veehaitch trundle ];
+    mainProgram = cmdRes;
+  };
+}
diff --git a/pkgs/tools/audio/beets/builtin-plugins.nix b/pkgs/tools/audio/beets/builtin-plugins.nix
index c6ae24dc6906e..6b89f74795a8b 100644
--- a/pkgs/tools/audio/beets/builtin-plugins.nix
+++ b/pkgs/tools/audio/beets/builtin-plugins.nix
@@ -136,4 +136,7 @@
   autobpm = {
     testPaths = [ ];
   };
+  listenbrainz = {
+    testPaths = [ ];
+  };
 }
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 7631d106654db..513470b0ffd16 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -85,12 +85,12 @@ in lib.makeExtensible (self: {
 
   beets-unstable = callPackage ./common.nix {
     inherit python3Packages;
-    version = "unstable-2023-10-26";
+    version = "unstable-2024-03-16";
     src = fetchFromGitHub {
       owner = "beetbox";
       repo = "beets";
-      rev = "6655760732100f5387fad2d2890c015ee5039981";
-      hash = "sha256-Nz9BHtacYpJMLmB3f9WFg6GvMa+BuUhiNbJ9cyannek=";
+      rev = "b09806e0df8f01b9155017d3693764ae7beedcd5";
+      hash = "sha256-jE6nZLOEFufqclT6p1zK7dW+vt69q2ulaRsUldL7cSQ=";
     };
     extraPatches = [
       # Bash completion fix for Nix
diff --git a/pkgs/tools/audio/yabridge/default.nix b/pkgs/tools/audio/yabridge/default.nix
index 57534b93a6ff6..05982bc10e83a 100644
--- a/pkgs/tools/audio/yabridge/default.nix
+++ b/pkgs/tools/audio/yabridge/default.nix
@@ -98,6 +98,7 @@ multiStdenv.mkDerivation (finalAttrs: {
     # Hard code bitbridge & runtime dependencies
     (substituteAll {
       src = ./hardcode-dependencies.patch;
+      libdbus = dbus.lib;
       libxcb32 = pkgsi686Linux.xorg.libxcb;
       inherit wine;
     })
@@ -148,10 +149,11 @@ multiStdenv.mkDerivation (finalAttrs: {
 
   # Hard code wine path in wrapper scripts generated by winegcc
   postFixup = ''
-    for exe in "$out"/bin/*.exe; do
-      substituteInPlace "$exe" \
-        --replace 'WINELOADER="wine"' 'WINELOADER="${wine}/bin/wine"'
-    done
+    substituteInPlace "$out/bin/yabridge-host-32.exe" \
+      --replace 'WINELOADER="wine"' 'WINELOADER="${wine}/bin/wine"'
+
+    substituteInPlace "$out/bin/yabridge-host.exe" \
+      --replace 'WINELOADER="wine"' 'WINELOADER="${wine}/bin/wine64"'
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/tools/audio/yabridge/hardcode-dependencies.patch b/pkgs/tools/audio/yabridge/hardcode-dependencies.patch
index bd9e08bc6cf3e..d33bdf30eed23 100644
--- a/pkgs/tools/audio/yabridge/hardcode-dependencies.patch
+++ b/pkgs/tools/audio/yabridge/hardcode-dependencies.patch
@@ -11,6 +11,21 @@ index c602c5ad..a52e20a1 100644
  endif
  
  # These are all headers-only libraries, and thus won't require separate 32-bit
+diff --git a/src/common/notifications.cpp b/src/common/notifications.cpp
+index 66e08527..685c54af 100644
+--- a/src/common/notifications.cpp
++++ b/src/common/notifications.cpp
+@@ -29,8 +29,8 @@
+ #include "process.h"
+ #include "utils.h"
+ 
+-constexpr char libdbus_library_name[] = "libdbus-1.so.3";
+-constexpr char libdbus_library_fallback_name[] = "libdbus-1.so";
++constexpr char libdbus_library_name[] = "@libdbus@/lib/libdbus-1.so.3";
++constexpr char libdbus_library_fallback_name[] = "@libdbus@/lib/libdbus-1.so";
+ 
+ std::atomic<void*> libdbus_handle = nullptr;
+ std::mutex libdbus_mutex;
 diff --git a/src/plugin/utils.cpp b/src/plugin/utils.cpp
 index 82db99a5..491f005d 100644
 --- a/src/plugin/utils.cpp
diff --git a/pkgs/tools/backup/borgbackup/default.nix b/pkgs/tools/backup/borgbackup/default.nix
index d7853d0506f64..778f5a5aad9f5 100644
--- a/pkgs/tools/backup/borgbackup/default.nix
+++ b/pkgs/tools/backup/borgbackup/default.nix
@@ -2,54 +2,46 @@
 , stdenv
 , acl
 , e2fsprogs
+, fetchFromGitHub
 , libb2
 , lz4
 , openssh
 , openssl
-, python3Packages
+, python3
 , xxHash
 , zstd
 , installShellFiles
 , nixosTests
-, fetchPypi
 }:
 
 let
-  python = python3Packages.python.override {
-    packageOverrides = self: super: {
-      msgpack = super.msgpack.overrideAttrs (oldAttrs: rec {
-        version ="1.0.4";
-
-        src = fetchPypi {
-          pname = "msgpack";
-          inherit version;
-          hash = "sha256-9dhpwY8DAgLrQS8Iso0q/upVPWYTruieIA16yn7wH18=";
-        };
-      });
-    };
-  };
+  python = python3;
 in
 python.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
-  version = "1.2.7";
-  format = "pyproject";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-9j8oozg8BBlxzsh7BhyjmoFbX9RF2ySqgXLKxBfZQRo=";
+  version = "1.2.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "borgbackup";
+    repo = "borg";
+    rev = "refs/tags/${version}";
+    hash = "sha256-+FHqOVuHlY9QUjCrYVnrMBZPMFH9Z2U7eZ6eUSINSrw=";
   };
 
   postPatch = ''
     # sandbox does not support setuid/setgid/sticky bits
     substituteInPlace src/borg/testsuite/archiver.py \
-      --replace "0o4755" "0o0755"
+      --replace-fail "0o4755" "0o0755"
   '';
 
-  nativeBuildInputs = with python.pkgs; [
+  build-system = with python.pkgs; [
     cython
     setuptools-scm
     pkgconfig
+  ];
 
+  nativeBuildInputs = with python.pkgs; [
     # docs
     sphinxHook
     guzzle-sphinx-theme
@@ -70,7 +62,7 @@ python.pkgs.buildPythonApplication rec {
     acl
   ];
 
-  propagatedBuildInputs = with python.pkgs; [
+  dependencies = with python.pkgs; [
     msgpack
     packaging
     (if stdenv.isLinux then pyfuse3 else llfuse)
@@ -130,7 +122,7 @@ python.pkgs.buildPythonApplication rec {
   outputs = [ "out" "doc" "man" ];
 
   meta = with lib; {
-    changelog = "https://github.com/borgbackup/borg/blob/${version}/docs/changes.rst";
+    changelog = "https://github.com/borgbackup/borg/blob/${src.rev}/docs/changes.rst";
     description = "Deduplicating archiver with compression and encryption";
     homepage = "https://www.borgbackup.org";
     license = licenses.bsd3;
diff --git a/pkgs/tools/backup/borgmatic/default.nix b/pkgs/tools/backup/borgmatic/default.nix
index 0268fae6a185a..1845ea99def96 100644
--- a/pkgs/tools/backup/borgmatic/default.nix
+++ b/pkgs/tools/backup/borgmatic/default.nix
@@ -13,11 +13,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "borgmatic";
-  version = "1.8.9";
+  version = "1.8.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-YfDV2BJzi2DVi/eoWg3KeqmJjUv5+TrLpYdF8R7YuPY=";
+    sha256 = "sha256-hR2q49gCD9BZsk+jQ90EfKkkq7mX9qAO+gRsvdnuDec=";
   };
 
   nativeCheckInputs = with python3Packages; [ flexmock pytestCheckHook pytest-cov ] ++ passthru.optional-dependencies.apprise;
diff --git a/pkgs/tools/backup/zfs-replicate/default.nix b/pkgs/tools/backup/zfs-replicate/default.nix
index c5a4d2f0317f2..1ae5c0de79fa3 100644
--- a/pkgs/tools/backup/zfs-replicate/default.nix
+++ b/pkgs/tools/backup/zfs-replicate/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonApplication rec {
   pname = "zfs_replicate";
-  version = "3.2.12";
+  version = "3.2.13";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Pyn/ehXVb5knHS1A/MFTYE0t+IVgtBe1dAnYdaHutyk=";
+    hash = "sha256-Xmg33bqs3gQJWqkCNiWYUem3o6XsxpfbHIVvLs/2D94=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/backup/zfsbackup/default.nix b/pkgs/tools/backup/zfsbackup/default.nix
index d0f8972434a82..12bc55a543977 100644
--- a/pkgs/tools/backup/zfsbackup/default.nix
+++ b/pkgs/tools/backup/zfsbackup/default.nix
@@ -26,7 +26,7 @@ buildGoModule rec {
     description = "Backup ZFS snapshots to cloud storage such as Google, Amazon, Azure, etc";
     homepage = "https://github.com/someone1/zfsbackup-go";
     license = licenses.mit;
-    maintainers = with maintainers; [ xfix ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
     mainProgram = "zfsbackup-go";
   };
diff --git a/pkgs/tools/compression/flips/default.nix b/pkgs/tools/compression/flips/default.nix
index 6ee1c03cabce5..e061459ece269 100644
--- a/pkgs/tools/compression/flips/default.nix
+++ b/pkgs/tools/compression/flips/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     description = "A patcher for IPS and BPS files";
     homepage = "https://github.com/Alcaro/Flips";
     license = licenses.gpl3Plus;
-    maintainers = [ maintainers.xfix ];
+    maintainers = [ ];
     platforms = platforms.linux;
     mainProgram = "flips";
   };
diff --git a/pkgs/tools/filesystems/mount-zip/default.nix b/pkgs/tools/filesystems/mount-zip/default.nix
index 362ca4e2743e3..8bff2e4fb47e1 100644
--- a/pkgs/tools/filesystems/mount-zip/default.nix
+++ b/pkgs/tools/filesystems/mount-zip/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mount-zip";
-  version = "1.0.13";
+  version = "1.0.14";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mount-zip";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/iPq/v7ap5livYR5tA90JiaGxQfR9VG+FONECeCFdOQ=";
+    hash = "sha256-S2snseC9JAjYRberL2/CyRQTcZQ8GtGQNU3WuTqSRl4=";
   };
 
   nativeBuildInputs = [ boost gcc icu pandoc pkg-config ];
diff --git a/pkgs/tools/filesystems/stratis-cli/default.nix b/pkgs/tools/filesystems/stratis-cli/default.nix
index 4c27b888bbaab..4de51f0ff8d3d 100644
--- a/pkgs/tools/filesystems/stratis-cli/default.nix
+++ b/pkgs/tools/filesystems/stratis-cli/default.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "stratis-cli";
-  version = "3.6.0";
+  version = "3.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stratis-storage";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-mLmjMofdr0U+Bfnkde7lJqPXkd1ICPYdlcsOm2nOcQA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-f2Bjv7Z7+FZejS5plUGKTlGUixgF2pGN1SeszTDh4Ko=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index aeb51d66bf6f0..4af2e3be53719 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -4,29 +4,26 @@
 , boehmgc, libGLU, libGL, mesa, ncurses, readline, gsl, libsigsegv
 , python3, qtbase, qtsvg, boost
 , zlib, perl, curl
-, texliveSmall, texinfo
+, texinfo
+, texlive
+, texliveSmall
 , darwin
 }:
 
-stdenv.mkDerivation rec {
-  version = "2.88";
+stdenv.mkDerivation (finalAttrs: {
+  version = "2.89";
   pname = "asymptote";
 
   outputs = [ "out" "man" "info" "doc" "tex" ];
 
   src = fetchurl {
-    url = "mirror://sourceforge/asymptote/${version}/asymptote-${version}.src.tgz";
-    hash = "sha256-DecadD+m7pORuH3Sdcs/5M3vUbN6rhSkFoNN0Soq9bs=";
+    url = "mirror://sourceforge/asymptote/${finalAttrs.version}/asymptote-${finalAttrs.version}.src.tgz";
+    hash = "sha256-9k5itO5PhfGnhkDE8eim+Y6R9U7ayrGXJ8fKvpSlf1s=";
   };
 
-  patches = [
-    (fetchpatch {
-      # partial fix for macOS XDR/V3D support (LDFLAGS change seems like an unrelated bugfix)
-      name = "restore-LDFLAGS-dont-look-for-tirpc-under-MacOS.patch";
-      url = "https://github.com/vectorgraphics/asymptote/commit/7e17096b22d18d133d1bc5916b6e32c0cb24ad10.patch";
-      hash = "sha256-olCFzqfZwWOAjqlB5lDPXYRHU9i3VQNgoR0cO5TmW98=";
-    })
-  ];
+  # override with TeX Live containers to avoid building sty, docs from source
+  texContainer = null;
+  texdocContainer = null;
 
   nativeBuildInputs = [
     autoreconfHook
@@ -37,13 +34,13 @@ stdenv.mkDerivation rec {
     wrapQtAppsHook
     cmake
     pkg-config
-  ];
+  ] ++ lib.optional (finalAttrs.texContainer == null || finalAttrs.texdocContainer == null)
+    (texliveSmall.withPackages (ps: with ps; [ epsf cm-super ps.texinfo media9 ocgx2 collection-latexextra ]));
 
   buildInputs = [
     ghostscriptX imagemagick fftw eigen
     boehmgc ncurses readline gsl libsigsegv
     zlib perl curl qtbase qtsvg boost
-    (texliveSmall.withPackages (ps: with ps; [ epsf cm-super ps.texinfo media9 ocgx2 collection-latexextra ]))
     (python3.withPackages (ps: with ps; [ cson numpy pyqt5 ]))
   ] ++ lib.optionals stdenv.isLinux [ libtirpc ];
 
@@ -57,12 +54,25 @@ stdenv.mkDerivation rec {
 
   dontWrapQtApps = true;
 
-  # Do not build $tex/ls-R which will be generated by texlive.combine
+  # do not build $tex/ls-R which will be generated by texlive.withPackages
+  # do not build and install sty and docs, if provided by tex/texdoc texlive containers
+  # (this is an optimisation to make texliveMedium and texliveFull independent of texliveSmall)
   preConfigure = ''
     HOME=$TMP
     substituteInPlace Makefile.in \
-      --replace-fail 'install: install-notexhash install-texhash' 'install: install-notexhash install-asy'
-    prependToVar configureFlags "--with-latex=$tex/tex/latex" "--with-context=$tex/tex/context/third"
+      --replace-fail ' install-texhash' '''
+    if [[ -n $texContainer ]] ; then
+      sed -i Makefile.in -e '/(\(latex\|context\)dir)/d'
+      substituteInPlace Makefile.in \
+        --replace-fail 'asy sty' 'asy'
+    else
+      prependToVar configureFlags "--with-latex=$tex/tex/latex" "--with-context=$tex/tex/context/third"
+    fi
+    if [[ -n $texdocContainer ]] ; then
+      substituteInPlace Makefile.in \
+        --replace-fail ' install-man' ''' \
+        --replace-fail 'docdir = $(DESTDIR)@docdir@' 'docdir = $(TMP)/doc'
+    fi
   '';
 
   # do not use bundled libgc.so
@@ -76,12 +86,36 @@ stdenv.mkDerivation rec {
     rm "$out"/bin/xasy
     makeQtWrapper "$out"/share/asymptote/GUI/xasy.py "$out"/bin/xasy --prefix PATH : "$out"/bin
 
-    mv "$info"/share/info/asymptote/*.info "$info"/share/info/
-    sed -i -e 's|(asymptote/asymptote)|(asymptote)|' "$info"/share/info/asymptote.info
-    rmdir "$info"/share/info/asymptote
-    rm -f "$info"/share/info/dir
+    if [[ -z $texdocContainer ]] ; then
+      mv "$info"/share/info/asymptote/*.info "$info"/share/info/
+      sed -i -e 's|(asymptote/asymptote)|(asymptote)|' "$info"/share/info/asymptote.info
+      rmdir "$info"/share/info/asymptote
+      rm -f "$info"/share/info/dir
+    fi
+    install -Dt $out/share/emacs/site-lisp/${finalAttrs.pname} $out/share/asymptote/*.el
+  '';
+
+  # fixupPhase crashes if the outputs are not directories
+  preFixup = ''
+    if [[ -n $texContainer ]] ; then
+      mkdir -p "$tex"
+    fi
+    if [[ -n $texdocContainer ]] ; then
+      mkdir -p "$doc" "$man" "$info"
+    fi
+  '';
 
-    install -Dt $out/share/emacs/site-lisp/${pname} $out/share/asymptote/*.el
+  postFixup = ''
+    if [[ -n $texContainer ]] ; then
+      rmdir "$tex"
+      ln -s "$texContainer" "$tex"
+    fi
+    if [[ -n $texdocContainer ]] ; then
+      mkdir -p "$man/share" "$info/share"
+      ln -s "$texdocContainer" "$doc/share"
+      ln -s "$texdocContainer/doc/man" "$man/share"
+      ln -s "$texdocContainer/doc/info" "$info/share"
+    fi
   '';
 
   dontUseCmakeConfigure = true;
@@ -98,4 +132,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.raskin ];
     platforms = platforms.linux ++ platforms.darwin;
   };
-}
+})
diff --git a/pkgs/tools/misc/broadlink-cli/default.nix b/pkgs/tools/misc/broadlink-cli/default.nix
index 087b56c9d1a3a..c9438ff3583f3 100644
--- a/pkgs/tools/misc/broadlink-cli/default.nix
+++ b/pkgs/tools/misc/broadlink-cli/default.nix
@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "broadlink-cli";
-  version = "0.18.3";
+  version = "0.19.0";
 
   # the tools are available as part of the source distribution from GH but
   # not pypi, so we have to fetch them here.
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
     owner  = "mjg59";
     repo   = "python-broadlink";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-8bSlMA5Nb3hqpVMeHlgb8AkKt5JrfEiyKjobxRBdmNM=";
+    sha256 = "sha256-fqhi4K8Ceh8Rs0ExteCfAuVfEamFjMCjCFm6DRAJDmI=";
   };
 
   format = "other";
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 69f25a35c7397..580d01376eb87 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -79,11 +79,11 @@
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python3.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "263";
+  version = "265";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-tKGPit8rPn/fMdEWP3cC93qakU5d7mBeRiKNQT3DBJ4=";
+    hash = "sha256-YE81R8lTOM3wmv/GIaIBqUq2O6UvnUaHjuXZ00yDU8U=";
   };
 
   outputs = [
diff --git a/pkgs/tools/misc/leanify/default.nix b/pkgs/tools/misc/leanify/default.nix
index a8a7625bcbecd..86aef217e1100 100644
--- a/pkgs/tools/misc/leanify/default.nix
+++ b/pkgs/tools/misc/leanify/default.nix
@@ -6,19 +6,20 @@
 
 stdenv.mkDerivation rec {
   pname = "leanify";
-  version = "unstable-2023-10-19";
+  version = "unstable-2023-12-17";
 
   src = fetchFromGitHub {
     owner = "JayXon";
     repo = "Leanify";
-    rev = "5511415b02a7669f5fe9b454e5705e8328ab0359";
-    hash = "sha256-eOp/SOynh0HUz62Ki5ADRk7FjQY0Gh55ydVnO0MCXAA=";
+    rev = "9daa4303cdc03f6b90b72c369e6377c6beb75c39";
+    hash = "sha256-fLazKCQnOT3bN3Kz25Q80RLk54EU5U6HCf6kPLcXn9c=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace Makefile \
-      --replace "-flto" "" \
-      --replace "lib/LZMA/Alloc.o" "lib/LZMA/CpuArch.o lib/LZMA/Alloc.o"
+      --replace-fail "-flto" "" \
+      --replace-fail "lib/LZMA/Alloc.o" "lib/LZMA/CpuArch.o lib/LZMA/Alloc.o" \
+      --replace-quiet "-Werror" ""
   '';
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
diff --git a/pkgs/tools/misc/markdown-anki-decks/default.nix b/pkgs/tools/misc/markdown-anki-decks/default.nix
index 082bdf5a5f98a..3632bc2ff6053 100644
--- a/pkgs/tools/misc/markdown-anki-decks/default.nix
+++ b/pkgs/tools/misc/markdown-anki-decks/default.nix
@@ -6,18 +6,23 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "markdown-anki-decks";
   version = "1.1.1";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-SvKjjE629OwxWsPo2egGf2K6GzlWAYYStarHhA4Ex0w=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'typer = "^0.4.0"' 'typer = "*"'
+  '';
+
+  build-system = with python3.pkgs; [
     poetry-core
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     beautifulsoup4
     genanki
     markdown
@@ -25,11 +30,6 @@ python3.pkgs.buildPythonApplication rec {
     typer
   ] ++ typer.optional-dependencies.all;
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'typer = "^0.4.0"' 'typer = "*"'
-  '';
-
   # No tests available on Pypi and there is only a failing version assertion test in the repo.
   doCheck = false;
 
@@ -40,6 +40,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "Tool to convert Markdown files into Anki Decks";
     homepage = "https://github.com/lukesmurray/markdown-anki-decks";
+    changelog = "https://github.com/lukesmurray/markdown-anki-decks/blob/${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
     platforms = platforms.unix;
diff --git a/pkgs/tools/misc/phrase-cli/default.nix b/pkgs/tools/misc/phrase-cli/default.nix
index e780f451040b4..c06b1d386768d 100644
--- a/pkgs/tools/misc/phrase-cli/default.nix
+++ b/pkgs/tools/misc/phrase-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "phrase-cli";
-  version = "2.23.2";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = version;
-    sha256 = "sha256-CzDkIFlStfCJpF82pqD8hTxbjH9Nu+0/uygTR0xxxV4=";
+    sha256 = "sha256-i1gf/xTdZaseUiu70i0Yh+DZlRoJjKYG1Q+D7uUyMl8=";
   };
 
-  vendorHash = "sha256-r07nHJqFWHAMTkmQmy0/jK7N/lDzpnHqmuGTG1FTUiI=";
+  vendorHash = "sha256-+UjUk2Uf4ESHkUSM9X+a3fBF05cVsQ4JwPn93hbELLs=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];
 
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index f8565e8642319..1dc464fe36464 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.8.3";
+  version = "5.8.4";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-qLB0HJXH99t/rfsbed3NHgcy8ZGB4K+HjPjhCZ0pM6Q=";
+    sha256 = "sha256-VTg+GDyPAxyxXP9VgKi63LhBKhuVx6rPWc9o/fRmHho=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
diff --git a/pkgs/tools/misc/shelldap/default.nix b/pkgs/tools/misc/shelldap/default.nix
index 045c5732c3e09..09901368c8701 100644
--- a/pkgs/tools/misc/shelldap/default.nix
+++ b/pkgs/tools/misc/shelldap/default.nix
@@ -1,6 +1,8 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , perlPackages
+, shortenPerlShebang
 }:
 
 perlPackages.buildPerlPackage rec {
@@ -26,6 +28,8 @@ perlPackages.buildPerlPackage rec {
     YAMLSyck
   ];
 
+  nativeBuildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
+
   prePatch = ''
     touch Makefile.PL
   '';
@@ -33,7 +37,11 @@ perlPackages.buildPerlPackage rec {
   installPhase = ''
     runHook preInstall
     install -Dm555 -t $out/bin shelldap
-    runHook preInstall
+    runHook postInstall
+  '';
+
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    shortenPerlShebang $out/bin/shelldap
   '';
 
   # no make target 'test', not tests provided by source
diff --git a/pkgs/tools/misc/tbls/default.nix b/pkgs/tools/misc/tbls/default.nix
index 4672adfc97c9d..067c40aab8db8 100644
--- a/pkgs/tools/misc/tbls/default.nix
+++ b/pkgs/tools/misc/tbls/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.73.3";
+  version = "1.74.0";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     rev = "v${version}";
-    hash = "sha256-mAGEJ+FISPRrIz3dWwuf9EYbTNdaMj7tbHgthSYBiIU=";
+    hash = "sha256-diMg47aZvMpVtvSbg1nA2Sva7JnEBfh8ZU9AHcz+xno=";
   };
 
-  vendorHash = "sha256-oMGAsVRSyndCJ3QXfrI02XrsOXkzljTNro6ygal6mDk=";
+  vendorHash = "sha256-UbMR3yTabGSUqT30T81R/fGnWI4Mz7/utCjZ5Fq0MWU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/upterm/default.nix b/pkgs/tools/misc/upterm/default.nix
index 135fa5dcec692..1cd4d1d606bf4 100644
--- a/pkgs/tools/misc/upterm/default.nix
+++ b/pkgs/tools/misc/upterm/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "upterm";
-  version = "0.13.2";
+  version = "0.13.3";
 
   src = fetchFromGitHub {
     owner = "owenthereal";
     repo = "upterm";
     rev = "v${version}";
-    hash = "sha256-GpD8OUZWN2myADHjpIBUzu2adkE9eFLENxpybX+k9Zg=";
+    hash = "sha256-VGLQ0NtXHIBKyTjW+7rPbmRdhcY9CMUYAnUu3qbqv9A=";
   };
 
-  vendorHash = "sha256-Rh3xgxaCPj9CbiNy8AycuCPvD/HCiLohcdiCQwPduDM=";
+  vendorHash = "sha256-rbdYXRxnkl0v+bICSusGiyxb5TIGREiKuylycV3dcx4=";
 
   subPackages = [ "cmd/upterm" "cmd/uptermd" ];
 
diff --git a/pkgs/tools/misc/vtm/default.nix b/pkgs/tools/misc/vtm/default.nix
index 2e0434a2a6e41..e1bc945772616 100644
--- a/pkgs/tools/misc/vtm/default.nix
+++ b/pkgs/tools/misc/vtm/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vtm";
-  version = "0.9.77";
+  version = "0.9.78";
 
   src = fetchFromGitHub {
     owner = "netxs-group";
     repo = "vtm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-usY8JvoTtGfA8nnl6w7r1sft8F/19fHeSl9kMWM60i4=";
+    hash = "sha256-sYRBx60G/3ErBDeUJWPEaWD51B23nBseB2wDE4Tn2NA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/calendar-cli/default.nix b/pkgs/tools/networking/calendar-cli/default.nix
index 45b3afbf895e2..7cac9f4ae0f32 100644
--- a/pkgs/tools/networking/calendar-cli/default.nix
+++ b/pkgs/tools/networking/calendar-cli/default.nix
@@ -7,6 +7,7 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "calendar-cli";
   version = "1.0.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tobixen";
@@ -15,7 +16,11 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-w35ySLnfxXZR/a7BrPLYqXs2kqkuYhh5PcgNxJqjDtE=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [
+    setuptools
+  ];
+
+  dependencies = with python3.pkgs; [
     icalendar
     caldav
     pytz
@@ -36,6 +41,7 @@ python3.pkgs.buildPythonApplication rec {
     description = "Simple command-line CalDav client";
     homepage = "https://github.com/tobixen/calendar-cli";
     license = licenses.gpl3Plus;
+    mainProgram = "calendar-cli";
     maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/tools/networking/ddns-go/default.nix b/pkgs/tools/networking/ddns-go/default.nix
index 725468e1e6b30..2207fa5baae42 100644
--- a/pkgs/tools/networking/ddns-go/default.nix
+++ b/pkgs/tools/networking/ddns-go/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ddns-go";
-  version = "6.3.2";
+  version = "6.3.3";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-efuz27N/culO5vxgWKXawD+yqxjDsAr0Hpv2I9YQePs=";
+    hash = "sha256-LsJAuEVJy4jTvFEOgbH6ZiiqbMoGXuMNDhHx4phwd5k=";
   };
 
   vendorHash = "sha256-ckgX+gftWJROe/RpxjuBmXSDxW/PlCOIkrx+erxCP40=";
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 8b2dff9e462b7..e9f010e89dd31 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.67.0";
+  version = "0.70.0";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = "dnsproxy";
     rev = "v${version}";
-    hash = "sha256-CqEvGE1MSll+khEFvH8Y0q4XyxbTjwNRr9h9FKf5Kfs=";
+    hash = "sha256-kXIUcTT3LGhKeUVlq/hDvO6/y/mQNIFBhJLSe1F89EI=";
   };
 
-  vendorHash = "sha256-AZQl70NJwE6lVMO/G1RG1NIfXK1SbYWh4/wAIi4Ac5o=";
+  vendorHash = "sha256-ECi6NciA5oyUyVaVlON4mAPKoWQSDvgV0uwk5MGYjy4=";
 
   ldflags = [ "-s" "-w" "-X" "github.com/AdguardTeam/dnsproxy/internal/version.version=${version}" ];
 
diff --git a/pkgs/tools/networking/getmail6/default.nix b/pkgs/tools/networking/getmail6/default.nix
index cf3d5402898e7..7f758527d1c92 100644
--- a/pkgs/tools/networking/getmail6/default.nix
+++ b/pkgs/tools/networking/getmail6/default.nix
@@ -5,17 +5,20 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "getmail6";
-  version = "6.18.13";
-
-  format = "setuptools";
+  version = "6.18.14";
+  pyproject = true;
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "getmail6";
+    repo = "getmail6";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cyX+3LsXqBpAvaOPVpT4EuPzqJm9kki1uNTG+7k3Q28=";
+    hash = "sha256-NcUGIddbIjwMyE/6fR8lqs90/chzqROQDftF/cNkxOs=";
   };
 
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
   # needs a Docker setup
   doCheck = false;
 
diff --git a/pkgs/tools/networking/juicity/default.nix b/pkgs/tools/networking/juicity/default.nix
index 3278a5a45b605..5ced17c74824a 100644
--- a/pkgs/tools/networking/juicity/default.nix
+++ b/pkgs/tools/networking/juicity/default.nix
@@ -4,13 +4,13 @@
 }:
 buildGoModule rec {
   pname = "juicity";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "juicity";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-rwGtAystB9rUE2jVij4YdBr4T8bVlVLtNaBmSZQ/39A=";
+    hash = "sha256-JC4VGM7aY+fYo0F9yAkgTbZA56ztyeoIx9PARlBjkh4=";
   };
 
   vendorHash = "sha256-SM5ZrTtuqenPsGjphkCM9JHzucw0/qBmevD+3/kyF6k=";
diff --git a/pkgs/tools/networking/knock/package.nix b/pkgs/tools/networking/knock/package.nix
index b9879859722a6..1197bec808cff 100644
--- a/pkgs/tools/networking/knock/package.nix
+++ b/pkgs/tools/networking/knock/package.nix
@@ -1,6 +1,6 @@
 { lib
 , buildGoModule
-, fetchFromGitHub
+, fetchFromGitea
 , installShellFiles
 }:
 
@@ -8,11 +8,12 @@ buildGoModule rec {
   pname = "knock";
   version = "0.0.2";
 
-  src = fetchFromGitHub {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
     owner = "nat-418";
     repo ="knock";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-VXrWphfBDGDNsz4iuUdwwd46oqnmhJ9i3TtzMqHoSJk=";
+    rev = "v${version}";
+    hash = "sha256-K+L4F4bTERQSqISAmfyps/U5GJ2N0FdJ3RmpiUmt4uA=";
   };
 
   vendorHash = "sha256-wkSXdIgfkHbVJYsgm/hLAeKA9geof92U3mzSzt7eJE8=";
@@ -27,9 +28,9 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "A simple CLI network reachability tester";
-    homepage = "https://github.com/nat-418/knock";
+    homepage = "https://codeberg.org/nat-418/knock";
     license = licenses.bsd0;
-    changelog = "https://github.com/nat-418/knock/blob/${version}/CHANGELOG.md";
+    changelog = "https://codeberg.org/nat-418/knock/raw/branch/trunk/CHANGELOG.md";
     maintainers = with maintainers; [ nat-418 ];
   };
 }
diff --git a/pkgs/tools/networking/maubot/default.nix b/pkgs/tools/networking/maubot/default.nix
index acee6f1dedb3b..7794395180db1 100644
--- a/pkgs/tools/networking/maubot/default.nix
+++ b/pkgs/tools/networking/maubot/default.nix
@@ -59,6 +59,7 @@ let
     ];
 
     propagatedBuildInputs = with python.pkgs; [
+      setuptools
       # requirements.txt
       mautrix
       aiohttp
diff --git a/pkgs/tools/networking/maubot/plugins/generated.json b/pkgs/tools/networking/maubot/plugins/generated.json
index 555de6c05821c..7051bf3e5b508 100644
--- a/pkgs/tools/networking/maubot/plugins/generated.json
+++ b/pkgs/tools/networking/maubot/plugins/generated.json
@@ -1,37 +1,4 @@
 {
-  "URLDownload": {
-    "attrs": {
-      "meta": {
-        "changelog": "https://codeberg.org/LukeLR/matrix-url-download/releases",
-        "description": "A plugin for the maubot bot framework implementing URL downloads in matrix rooms.",
-        "downloadPage": "https://codeberg.org/LukeLR/matrix-url-download/releases",
-        "homepage": "https://codeberg.org/LukeLR/matrix-url-download"
-      }
-    },
-    "gitea": {
-      "domain": "codeberg.org",
-      "hash": "sha256-JLYhoQKxsYO46mqRJZEcWTHck6bli6itYGu8ZPbxyjg=",
-      "owner": "LukeLR",
-      "repo": "matrix-url-download",
-      "rev": "3a006d98faa6950edab1a45b7a8c6a6d7d908bff"
-    },
-    "manifest": {
-      "config": true,
-      "database": true,
-      "database_type": "asyncpg",
-      "extra_files": [
-        "base-config.yaml"
-      ],
-      "id": "de.lukelr.urldownload",
-      "license": "LGPL-3.0-only",
-      "main_class": "URLDownloadBot",
-      "maubot": "0.1.0",
-      "modules": [
-        "urldownload"
-      ],
-      "version": "0.0.3"
-    }
-  },
   "activity-tracker": {
     "attrs": {
       "meta": {
@@ -312,10 +279,10 @@
       }
     },
     "github": {
-      "hash": "sha256-iRo4oFOOXgISALFskPZUonV4cBn7HmBACdi5uhgQq8o=",
+      "hash": "sha256-XOhjSrgbVUwMO6/v/Znoc5l/k2n6Zi42Ydhv9/vyX7E=",
       "owner": "williamkray",
       "repo": "maubot-chatgpt",
-      "rev": "f3974dc3818da170a3f1e091359d31f3140245e0"
+      "rev": "d313920165f8fca7a04314a73bb1dca30c67d9f5"
     },
     "manifest": {
       "config": true,
@@ -329,7 +296,7 @@
       "modules": [
         "gpt"
       ],
-      "version": "0.0.9"
+      "version": "0.0.10"
     }
   },
   "choose": {
@@ -955,7 +922,7 @@
   "ldap-ad-inviterbot": {
     "attrs": {
       "meta": {
-        "changelog": "https://github.com/SAPUCC/inviterbot/blob/v0.1.5/CHANGELOG.md",
+        "changelog": "https://github.com/SAPUCC/inviterbot/blob/v0.1.6/CHANGELOG.md",
         "description": "A plugin to sync users from Microsoft Azure AD and LDAP into matrix rooms. (Membership, Power-Levels)",
         "downloadPage": "https://github.com/SAPUCC/inviterbot/releases",
         "homepage": "https://github.com/SAPUCC/inviterbot",
@@ -963,10 +930,10 @@
       }
     },
     "github": {
-      "hash": "sha256-Ve420Mfa+Ikxp0P/8b6rZIu54VOfKhH3sWDNNMClj9E=",
+      "hash": "sha256-vnSOYdIbUnR9O6pCYO+TdA2qBbgrrc9RaomdWuVKW8o=",
       "owner": "SAPUCC",
       "repo": "inviterbot",
-      "rev": "v0.1.5"
+      "rev": "v0.1.6"
     },
     "manifest": {
       "config": true,
@@ -984,7 +951,7 @@
       "modules": [
         "inviter"
       ],
-      "version": "0.1.5"
+      "version": "0.1.6"
     }
   },
   "local-stt": {
@@ -1139,6 +1106,36 @@
       "version": "0.1.0"
     }
   },
+  "openai-translate": {
+    "attrs": {
+      "meta": {
+        "changelog": "https://github.com/tcpipuk/maubot-openai-translate/releases",
+        "description": "Translate messages using OpenAI's GPT API",
+        "downloadPage": "https://github.com/tcpipuk/maubot-openai-translate/releases",
+        "homepage": "https://github.com/tcpipuk/maubot-openai-translate"
+      }
+    },
+    "github": {
+      "hash": "sha256-+aDQF/hW66M25zsvIsjNt7K2l32rV1g3fPrb45XdHVU=",
+      "owner": "tcpipuk",
+      "repo": "maubot-openai-translate",
+      "rev": "v0.3.0"
+    },
+    "manifest": {
+      "config": true,
+      "extra_files": [
+        "base-config.yaml"
+      ],
+      "id": "xyz.maubot.openaitranslate",
+      "license": "AGPL-3.0-or-later",
+      "main_class": "OpenAITranslate",
+      "maubot": "0.1.0",
+      "modules": [
+        "openaitranslate"
+      ],
+      "version": "0.3.0"
+    }
+  },
   "ovgumensabot": {
     "attrs": {
       "meta": {
@@ -1324,6 +1321,35 @@
       "version": "0.3.6"
     }
   },
+  "reacjibot": {
+    "attrs": {
+      "meta": {
+        "changelog": "https://github.com/ajkessel/reacjibot/releases",
+        "description": "Allows users to define emoji-reactions that cause messages to be cross-posted to arbitrary rooms",
+        "downloadPage": "https://github.com/ajkessel/reacjibot/releases",
+        "homepage": "https://github.com/ajkessel/reacjibot"
+      }
+    },
+    "github": {
+      "hash": "sha256-GfroQ7iaBfN8WClORrkYccPHq8FsKupZtYKJvHGZg1o=",
+      "owner": "ajkessel",
+      "repo": "reacjibot",
+      "rev": "v0.7.4"
+    },
+    "manifest": {
+      "extra_files": [
+        "base-config.yaml"
+      ],
+      "id": "org.rosi-kessel.reacjibot",
+      "license": "MIT",
+      "main_class": "ReacjiBot",
+      "maubot": "0.1.0",
+      "modules": [
+        "reacjibot"
+      ],
+      "version": "0.7.4"
+    }
+  },
   "reactbot": {
     "attrs": {
       "meta": {
@@ -1801,6 +1827,32 @@
       "version": "0.1.0.6"
     }
   },
+  "timer": {
+    "attrs": {
+      "meta": {
+        "changelog": "https://github.com/pedantic-git/maubot-timer/releases",
+        "description": "Start a countdown timer for the specified number of seconds",
+        "downloadPage": "https://github.com/pedantic-git/maubot-timer/releases",
+        "homepage": "https://github.com/pedantic-git/maubot-timer"
+      }
+    },
+    "github": {
+      "hash": "sha256-cAS/4092O6d4ok8T2dbpvvgzpejQUPYM6mBtSvUaUpw=",
+      "owner": "pedantic-git",
+      "repo": "maubot-timer",
+      "rev": "ff656142feb018f33290113ca09facf0a45eab6e"
+    },
+    "manifest": {
+      "id": "mx.quinn.timer",
+      "license": "MIT",
+      "main_class": "Timer",
+      "maubot": "0.1.0",
+      "modules": [
+        "timer"
+      ],
+      "version": "1.0.0"
+    }
+  },
   "tmdb": {
     "attrs": {
       "meta": {
@@ -2032,6 +2084,39 @@
       "version": "1.0.2"
     }
   },
+  "urldownload": {
+    "attrs": {
+      "meta": {
+        "changelog": "https://codeberg.org/LukeLR/matrix-url-download/releases",
+        "description": "A plugin for the maubot bot framework implementing URL downloads in matrix rooms.",
+        "downloadPage": "https://codeberg.org/LukeLR/matrix-url-download/releases",
+        "homepage": "https://codeberg.org/LukeLR/matrix-url-download"
+      }
+    },
+    "gitea": {
+      "domain": "codeberg.org",
+      "hash": "sha256-JLYhoQKxsYO46mqRJZEcWTHck6bli6itYGu8ZPbxyjg=",
+      "owner": "LukeLR",
+      "repo": "matrix-url-download",
+      "rev": "3a006d98faa6950edab1a45b7a8c6a6d7d908bff"
+    },
+    "manifest": {
+      "config": true,
+      "database": true,
+      "database_type": "asyncpg",
+      "extra_files": [
+        "base-config.yaml"
+      ],
+      "id": "de.lukelr.urldownload",
+      "license": "LGPL-3.0-only",
+      "main_class": "URLDownloadBot",
+      "maubot": "0.1.0",
+      "modules": [
+        "urldownload"
+      ],
+      "version": "0.0.3"
+    }
+  },
   "urlpreview": {
     "attrs": {
       "meta": {
diff --git a/pkgs/tools/networking/maubot/plugins/update.py b/pkgs/tools/networking/maubot/plugins/update.py
index a430753870fb9..d787f1f250952 100755
--- a/pkgs/tools/networking/maubot/plugins/update.py
+++ b/pkgs/tools/networking/maubot/plugins/update.py
@@ -31,7 +31,7 @@ def process_repo(path: str, official: bool):
     origurl = repourl
     if '/' in name or ' ' in name:
         name = os.path.split(path)[-1].removesuffix('.yaml')
-    name = name.replace('_', '-')
+    name = name.replace('_', '-').lower()
     if name in PLUGINS.keys():
         raise ValueError(f'Duplicate plugin {name}, refusing to continue')
     repodir = os.path.join(TMP, 'maubot-plugins', name)
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index 9e27fd8e3f93b..3b09ddf5694d6 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2024-03-30T15-29-52Z";
+  version = "2024-04-18T16-45-29Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-xt/WDQFE4uw/eno8RSIjxgjpahjbJVMMOapleuv5avE=";
+    sha256 = "sha256-aEhkk1nB8CGzuZfD8a62RwzcvF2HZTm1LPfb13c6x9Q=";
   };
 
-  vendorHash = "sha256-RwhkR3uQreSO1tq8R7ip7CY7E88MRa151HV8rT68YdQ=";
+  vendorHash = "sha256-qb4gR//8UzJAJ5WthfyxYwhR3YCwUGxfy8aRMW2MXks=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/networking/ockam/default.nix b/pkgs/tools/networking/ockam/default.nix
index 2d477923dde80..c191efbff6e1a 100644
--- a/pkgs/tools/networking/ockam/default.nix
+++ b/pkgs/tools/networking/ockam/default.nix
@@ -7,6 +7,7 @@
 , pkg-config
 , openssl
 , dbus
+, AppKit
 , Security
 }:
 
@@ -21,43 +22,23 @@ rustPlatform.buildRustPackage {
     owner = "build-trust";
     repo = pname;
     rev = "ockam_v${version}";
-    hash = "sha256-qHvgqK8K6F69m511VbNcSNFVe/tKpf8uonsBIOz3uKA=";
+    hash = "sha256-WXkprfA7DY3ZKCtTkVYMqYxyhLbfXPbXhYd0Oj5mJ+w=";
   };
 
-  cargoHash = "sha256-1MCiC808VNg5SoHxomJ9WWJ1Pj0IrLky6nshHfK2Fpg=";
+  cargoHash = "sha256-TLNV+6n9J9rhf8Lck0HK+ZNPDDh8C+M+MLbIWBS8cO0=";
   nativeBuildInputs = [ git pkg-config ];
   buildInputs = [ openssl dbus ]
-    ++ lib.optionals stdenv.isDarwin [ Security ];
+    ++ lib.optionals stdenv.isDarwin [ AppKit Security ];
 
   passthru.updateScript = nix-update-script { };
 
   # too many tests fail for now
   doCheck = false;
-  # checkFlags = [
-  #   # tries to make a network access
-  #   "--skip=tests::curl_http_ockam"
-  #   "--skip=medium_file_transfer"
-  #   "--skip=medium_file_transfer_large_chunks"
-  #   "--skip=medium_file_transfer_small_chunks"
-  #   "--skip=tiny_file_transfer"
-  #   "--skip=tiny_file_transfer_small_chunks"
-  #   # tries to do IO
-  #   "--skip=cli_state::tests::integration"
-  #   "--skip=cli_state::tests::test_create_default_identity_state"
-  #   "--skip=cli_state::tests::test_create_named_identity_state"
-  #   "--skip=kafka::integration_test::test::producer__flow_with_mock_kafka__content_encryption_and_decryption"
-  #   "--skip=kafka::portal_worker::test::kafka_portal_worker__metadata_exchange__response_changed"
-  #   "--skip=full_flow"
-  #   "--skip=run::parser::tests::detect_circular_dependency"
-  #   "--skip=run::parser::tests::test_parse_config_with_depends_on"
-  #   "--skip=util::tests::test_process_multi_addr"
-  # ];
 
   meta = with lib; {
     description = "Orchestrate end-to-end encryption, cryptographic identities, mutual authentication, and authorization policies between distributed applications – at massive scale";
     homepage = "https://github.com/build-trust/ockam";
     license = licenses.mpl20;
     maintainers = with maintainers; [ happysalada ];
-    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/openapi-generator-cli/default.nix b/pkgs/tools/networking/openapi-generator-cli/default.nix
index 4ae4325abf150..215d2466d4c82 100644
--- a/pkgs/tools/networking/openapi-generator-cli/default.nix
+++ b/pkgs/tools/networking/openapi-generator-cli/default.nix
@@ -1,7 +1,7 @@
 { callPackage, lib, stdenv, fetchurl, jre, makeWrapper }:
 
 let this = stdenv.mkDerivation (finalAttrs: {
-  version = "7.4.0";
+  version = "7.5.0";
   pname = "openapi-generator-cli";
 
   jarfilename = "${finalAttrs.pname}-${finalAttrs.version}.jar";
@@ -12,7 +12,7 @@ let this = stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://maven/org/openapitools/${finalAttrs.pname}/${finalAttrs.version}/${finalAttrs.jarfilename}";
-    sha256 = "sha256-5CdpqY/vVjS+4Pkh5LkHhqazKSqhH+jS+EwEWsQ1qyk=";
+    sha256 = "sha256-R+u9G+3a99++5SPnuHYjxuwbHUKWD74V9srS9kJsab8=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index 25829872b8aea..4f1885c2d7f2a 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.18.2";
+  version = "1.18.3";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    hash = "sha256-wbbh4IpAla3I/xgmiuzy9E9npS/PUtRFCZS4dl7JYRQ=";
+    hash = "sha256-eqN6Qwq+ofQ9Ed7Viz+DoJQkVTvUTo1U5rVqO1YDp2w=";
   };
 
-  cargoHash = "sha256-TPW+dic9KdtGXGlcEi7YAmt442ZJRifumnrmcX8+unM=";
+  cargoHash = "sha256-yJ2Ql6Fo2KaZRmvRB0C14fEcVwbBbsUlcqT3vFKHn58=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/nix/nixci/default.nix b/pkgs/tools/nix/nixci/default.nix
index bc78b3aab59a5..dbbc7ae1cc4f4 100644
--- a/pkgs/tools/nix/nixci/default.nix
+++ b/pkgs/tools/nix/nixci/default.nix
@@ -6,23 +6,31 @@
 , openssl
 , pkg-config
 , Security
+, SystemConfiguration
+, IOKit
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nixci";
-  version = "0.2.0";
+  version = "0.4.0";
 
   src = fetchCrate {
     inherit version;
     pname = "nixci";
-    hash = "sha256-Q3V/JL64xkIj0X0NSMRTjRAP3PJC9ouj3CmEscVWdns=";
+    hash = "sha256-JC1LUny8UKflANlcx6Hcgx39CRry+ossnp/RQK36oaI=";
   };
 
-  cargoHash = "sha256-tjk91AaPsMLfXYB2o1HTTxb6Qr3l8BABPStrKEGvbtM=";
+  cargoHash = "sha256-pYPzM7QlQ2EXwrvuXMa1qs0m7cmumh1iPesgJZ0H2kg=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libiconv openssl ]
-    ++ lib.optionals stdenv.isDarwin [ Security ];
+
+  buildInputs = lib.optionals stdenv.isLinux [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    IOKit
+    Security
+    SystemConfiguration
+  ];
 
   # The rust program expects an environment (at build time) that points to the
   # devour-flake flake.
@@ -37,7 +45,7 @@ rustPlatform.buildRustPackage rec {
     description = "Define and build CI for Nix projects anywhere";
     homepage = "https://github.com/srid/nixci";
     license = licenses.agpl3Only;
-    maintainers = with maintainers; [ srid ];
+    maintainers = with maintainers; [ srid shivaraj-bh ];
     mainProgram = "nixci";
   };
 }
diff --git a/pkgs/tools/package-management/disnix/DisnixWebService/default.nix b/pkgs/tools/package-management/disnix/DisnixWebService/default.nix
index 38aa1c2e261df..752af3a432253 100644
--- a/pkgs/tools/package-management/disnix/DisnixWebService/default.nix
+++ b/pkgs/tools/package-management/disnix/DisnixWebService/default.nix
@@ -1,13 +1,13 @@
-{lib, stdenv, fetchFromGitHub, fetchpatch, apacheAnt, jdk, axis2, dbus_java }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, ant, jdk, xmlstarlet, axis2, dbus_java }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "DisnixWebService";
   version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "svanderburg";
     repo = "DisnixWebService";
-    rev = "refs/tags/DisnixWebService-${version}";
+    rev = "DisnixWebService-${finalAttrs.version}";
     hash = "sha256-zcYr2Ytx4pevSthTQLpnQ330wDxN9dWsZA20jbO6PxQ=";
   };
 
@@ -20,26 +20,47 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [ apacheAnt jdk ];
-  PREFIX = "\${env.out}";
-  AXIS2_LIB = "${axis2}/lib";
-  AXIS2_WEBAPP = "${axis2}/webapps/axis2";
-  DBUS_JAVA_LIB = "${dbus_java}/share/java";
+  nativeBuildInputs = [
+    ant
+    jdk
+    xmlstarlet
+  ];
+
+  env = {
+    PREFIX = "\${env.out}";
+    AXIS2_LIB = "${axis2}/lib";
+    AXIS2_WEBAPP = "${axis2}/webapps/axis2";
+    DBUS_JAVA_LIB = "${dbus_java}/share/java";
+  };
+
   prePatch = ''
+    # add modificationtime="0" to the <jar> and <war> tasks to achieve reproducibility
+    xmlstarlet ed -L -a "//jar|//war" -t attr -n "modificationtime" -v "0" build.xml
+
     sed -i -e "s|#JAVA_HOME=|JAVA_HOME=${jdk}|" \
        -e "s|#AXIS2_LIB=|AXIS2_LIB=${axis2}/lib|" \
         scripts/disnix-soap-client
   '';
-  buildPhase = "ant";
-  installPhase = "ant install";
+
+  buildPhase = ''
+    runHook preBuild
+    ant
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    ant install
+    runHook postIntall
+  '';
 
   meta = {
     description = "A SOAP interface and client for Disnix";
     mainProgram = "disnix-soap-client";
     homepage = "https://github.com/svanderburg/DisnixWebService";
-    changelog = "https://github.com/svanderburg/DisnixWebService/blob/DisnixWebService-${version}/NEWS.txt";
+    changelog = "https://github.com/svanderburg/DisnixWebService/blob/${finalAttrs.src.rev}/NEWS.txt";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.sander ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/tools/security/afl/README.md b/pkgs/tools/security/afl/README.md
deleted file mode 100644
index 180cad6bc4ca6..0000000000000
--- a/pkgs/tools/security/afl/README.md
+++ /dev/null
@@ -1,19 +0,0 @@
-Updating the QEMU patches
-=========================
-
-When updating to the latest American Fuzzy Lop, make sure to check for
-any new patches to qemu for binary fuzzing support:
-
-https://github.com/google/AFL/tree/master/qemu_mode
-
-Be sure to check the build script and make sure it's also using the
-right QEMU version and options in `qemu.nix`:
-
-https://github.com/google/AFL/blob/master/qemu_mode/build_qemu_support.sh
-
-`afl-config.h`, `afl-types.h`, and `afl-qemu-cpu-inl.h` are part of
-the afl source code, and copied from `config.h`, `types.h` and
-`afl-qemu-cpu-inl.h` appropriately. These files and the QEMU patches
-need to be slightly adjusted to fix their `#include`s (the patches
-try to otherwise include files like `../../config.h` which causes the
-build to fail).
diff --git a/pkgs/tools/security/afl/default.nix b/pkgs/tools/security/afl/default.nix
deleted file mode 100644
index ccdbd78716d96..0000000000000
--- a/pkgs/tools/security/afl/default.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, callPackage, makeWrapper
-, clang, llvm, which, libcgroup
-}:
-
-let
-  afl-qemu = callPackage ./qemu.nix { inherit afl; };
-  qemu-exe-name = if stdenv.hostPlatform.system == "x86_64-linux" then "qemu-x86_64"
-    else if stdenv.hostPlatform.system == "i686-linux" then "qemu-i386"
-    else throw "afl: no support for ${stdenv.hostPlatform.system}!";
-  afl = stdenv.mkDerivation rec {
-    pname = "afl";
-    version = "2.57b";
-
-    src = fetchFromGitHub {
-      owner = "google";
-      repo = pname;
-      rev = "v${version}";
-      sha256 = "0fqj3g6ds1f21kxz7m9mc1fspi9r4jg9jcmi60inwxijrc5ncvr6";
-    };
-    enableParallelBuilding = true;
-
-    # Note: libcgroup isn't needed for building, just for the afl-cgroup
-    # script.
-    nativeBuildInputs = [ makeWrapper which llvm.dev ];
-    buildInputs = [ llvm ];
-
-    makeFlags = [ "PREFIX=$(out)" ];
-    postBuild = ''
-      make -C llvm_mode $makeFlags -j$NIX_BUILD_CORES
-    '';
-    postInstall = ''
-      # Install the custom QEMU emulator for binary blob fuzzing.
-      cp ${afl-qemu}/bin/${qemu-exe-name} $out/bin/afl-qemu-trace
-
-      # Install the cgroups wrapper for asan-based fuzzing.
-      cp experimental/asan_cgroups/limit_memory.sh $out/bin/afl-cgroup
-      chmod +x $out/bin/afl-cgroup
-      substituteInPlace $out/bin/afl-cgroup \
-        --replace "cgcreate" "${libcgroup}/bin/cgcreate" \
-        --replace "cgexec"   "${libcgroup}/bin/cgexec" \
-        --replace "cgdelete" "${libcgroup}/bin/cgdelete"
-
-      # Patch shebangs before wrapping
-      patchShebangs $out/bin
-
-      # Wrap afl-clang-fast(++) with a *different* AFL_PATH, because it
-      # has totally different semantics in that case(?) - and also set a
-      # proper AFL_CC and AFL_CXX so we don't pick up the wrong one out
-      # of $PATH.
-      # first though we need to replace the afl-clang-fast++ symlink with
-      # a real copy to prevent wrapProgram skipping the symlink and confusing
-      # nix's cc wrapper
-      rm $out/bin/afl-clang-fast++
-      cp $out/bin/afl-clang-fast $out/bin/afl-clang-fast++
-      for x in $out/bin/afl-clang-fast $out/bin/afl-clang-fast++; do
-        wrapProgram $x \
-          --prefix AFL_PATH : "$out/lib/afl" \
-          --run 'export AFL_CC=''${AFL_CC:-${clang}/bin/clang} AFL_CXX=''${AFL_CXX:-${clang}/bin/clang++}'
-      done
-    '';
-
-    passthru.qemu = afl-qemu;
-
-    meta = {
-      description = "Powerful fuzzer via genetic algorithms and instrumentation";
-      longDescription = ''
-        American fuzzy lop is a fuzzer that employs a novel type of
-        compile-time instrumentation and genetic algorithms to
-        automatically discover clean, interesting test cases that
-        trigger new internal states in the targeted binary. This
-        substantially improves the functional coverage for the fuzzed
-        code. The compact synthesized corpora produced by the tool are
-        also useful for seeding other, more labor or resource-intensive
-        testing regimes down the road.
-      '';
-      homepage    = "https://lcamtuf.coredump.cx/afl/";
-      license     = lib.licenses.asl20;
-      platforms   = ["x86_64-linux" "i686-linux"];
-      maintainers = with lib.maintainers; [ thoughtpolice ris ];
-    };
-  };
-in afl
diff --git a/pkgs/tools/security/afl/libdislocator.nix b/pkgs/tools/security/afl/libdislocator.nix
deleted file mode 100644
index 1030ffaf9eb85..0000000000000
--- a/pkgs/tools/security/afl/libdislocator.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, stdenv, afl}:
-
-stdenv.mkDerivation {
-  version = lib.getVersion afl;
-  pname = "libdislocator";
-
-  src = afl.src;
-  sourceRoot = "${afl.src.name}/libdislocator";
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  preInstall = ''
-    mkdir -p $out/lib/afl
-  '';
-  postInstall = ''
-    mkdir $out/bin
-    cat > $out/bin/get-libdislocator-so <<END
-    #!${stdenv.shell}
-    echo $out/lib/afl/libdislocator.so
-    END
-    chmod +x $out/bin/get-libdislocator-so
-  '';
-
-  meta = with lib; {
-    homepage = "https://lcamtuf.coredump.cx/afl/";
-    description = ''
-      Drop-in replacement for the libc allocator which improves
-      the odds of bumping into heap-related security bugs in
-      several ways.
-    '';
-    mainProgram = "get-libdislocator-so";
-    license = lib.licenses.asl20;
-    maintainers = with maintainers; [ ris ];
-  };
-}
diff --git a/pkgs/tools/security/afl/qemu-patches/no-etc-install.patch b/pkgs/tools/security/afl/qemu-patches/no-etc-install.patch
deleted file mode 100644
index 5dfbfd780f1ca..0000000000000
--- a/pkgs/tools/security/afl/qemu-patches/no-etc-install.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/Makefile b/Makefile
-index d6b9dc1..ce7c493 100644
---- a/Makefile
-+++ b/Makefile
-@@ -601,7 +601,7 @@ install-localstatedir:
- endif
- 
- 
--install: all $(if $(BUILD_DOCS),install-doc) install-datadir install-localstatedir
-+install: all $(if $(BUILD_DOCS),install-doc) install-datadir
- ifneq ($(TOOLS),)
- 	$(call install-prog,$(subst qemu-ga,qemu-ga$(EXESUF),$(TOOLS)),$(DESTDIR)$(bindir))
- endif
diff --git a/pkgs/tools/security/afl/qemu-patches/syscall-glibc2_30.diff b/pkgs/tools/security/afl/qemu-patches/syscall-glibc2_30.diff
deleted file mode 100644
index aa2950bf157c7..0000000000000
--- a/pkgs/tools/security/afl/qemu-patches/syscall-glibc2_30.diff
+++ /dev/null
@@ -1,51 +0,0 @@
---- qemu-2.10.0-clean/linux-user/syscall.c	2020-03-12 18:47:47.898592169 +0100
-+++ qemu-2.10.0/linux-user/syscall.c	2020-03-13 09:13:42.461809699 +0100
-@@ -34,6 +34,7 @@
- #include <sys/resource.h>
- #include <sys/swap.h>
- #include <linux/capability.h>
-+#include <linux/sockios.h> // https://lkml.org/lkml/2019/6/3/988
- #include <sched.h>
- #include <sys/timex.h>
- #ifdef __ia64__
-@@ -256,7 +257,9 @@ static type name (type1 arg1,type2 arg2,
- #endif
- 
- #ifdef __NR_gettid
--_syscall0(int, gettid)
-+// taken from https://patchwork.kernel.org/patch/10862231/
-+#define __NR_sys_gettid __NR_gettid
-+_syscall0(int, sys_gettid)
- #else
- /* This is a replacement for the host gettid() and must return a host
-    errno. */
-@@ -6219,7 +6222,7 @@ static void *clone_func(void *arg)
-     cpu = ENV_GET_CPU(env);
-     thread_cpu = cpu;
-     ts = (TaskState *)cpu->opaque;
--    info->tid = gettid();
-+    info->tid = sys_gettid();
-     task_settid(ts);
-     if (info->child_tidptr)
-         put_user_u32(info->tid, info->child_tidptr);
-@@ -6363,9 +6366,9 @@ static int do_fork(CPUArchState *env, un
-                mapping.  We can't repeat the spinlock hack used above because
-                the child process gets its own copy of the lock.  */
-             if (flags & CLONE_CHILD_SETTID)
--                put_user_u32(gettid(), child_tidptr);
-+                put_user_u32(sys_gettid(), child_tidptr);
-             if (flags & CLONE_PARENT_SETTID)
--                put_user_u32(gettid(), parent_tidptr);
-+                put_user_u32(sys_gettid(), parent_tidptr);
-             ts = (TaskState *)cpu->opaque;
-             if (flags & CLONE_SETTLS)
-                 cpu_set_tls (env, newtls);
-@@ -11402,7 +11405,7 @@ abi_long do_syscall(void *cpu_env, int n
-         break;
- #endif
-     case TARGET_NR_gettid:
--        ret = get_errno(gettid());
-+        ret = get_errno(sys_gettid());
-         break;
- #ifdef TARGET_NR_readahead
-     case TARGET_NR_readahead:
diff --git a/pkgs/tools/security/afl/qemu.nix b/pkgs/tools/security/afl/qemu.nix
deleted file mode 100644
index 845d9fa3e6f15..0000000000000
--- a/pkgs/tools/security/afl/qemu.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{ lib, stdenv, fetchurl, afl, python2, zlib, pkg-config, glib, perl
-, texinfo, libuuid, flex, bison, pixman, autoconf
-}:
-
-let
-  cpuTarget = if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux-user"
-    else if stdenv.hostPlatform.system == "i686-linux" then "i386-linux-user"
-    else throw "afl: no support for ${stdenv.hostPlatform.system}!";
-in
-stdenv.mkDerivation rec {
-  pname = "afl-qemu";
-  version = "2.10.0";
-
-  srcs = [
-    (fetchurl {
-      url = "https://download.qemu.org/qemu-${version}.tar.bz2";
-      sha256 = "0j3dfxzrzdp1w21k21fjvmakzc6lcha1rsclaicwqvbf63hkk7vy";
-    })
-    afl.src
-  ];
-
-  sourceRoot = "qemu-${version}";
-
-  postUnpack = ''
-    cp ${afl.src.name}/types.h $sourceRoot/afl-types.h
-    substitute ${afl.src.name}/config.h $sourceRoot/afl-config.h \
-      --replace "types.h" "afl-types.h"
-    substitute ${afl.src.name}/qemu_mode/patches/afl-qemu-cpu-inl.h $sourceRoot/afl-qemu-cpu-inl.h \
-      --replace "../../config.h" "afl-config.h"
-    substituteInPlace ${afl.src.name}/qemu_mode/patches/cpu-exec.diff \
-      --replace "../patches/afl-qemu-cpu-inl.h" "afl-qemu-cpu-inl.h"
-  '';
-
-  nativeBuildInputs = [
-    python2 perl pkg-config flex bison autoconf texinfo
-  ];
-
-  buildInputs = [
-    zlib glib pixman libuuid
-  ];
-
-  enableParallelBuilding = true;
-
-  patches = [
-    # patches extracted from afl source
-    "../${afl.src.name}/qemu_mode/patches/cpu-exec.diff"
-    "../${afl.src.name}/qemu_mode/patches/elfload.diff"
-    "../${afl.src.name}/qemu_mode/patches/syscall.diff"
-    "../${afl.src.name}/qemu_mode/patches/configure.diff"
-    "../${afl.src.name}/qemu_mode/patches/memfd.diff"
-    # nix-specific patches to make installation more well-behaved
-    ./qemu-patches/no-etc-install.patch
-    # patch for fixing qemu build on glibc >= 2.30
-    ./qemu-patches/syscall-glibc2_30.diff
-  ];
-
-  configureFlags =
-    [ "--disable-system"
-      "--enable-linux-user"
-      "--disable-gtk"
-      "--disable-sdl"
-      "--disable-vnc"
-      "--disable-kvm"
-      "--target-list=${cpuTarget}"
-      "--enable-pie"
-      "--sysconfdir=/etc"
-      "--localstatedir=/var"
-    ];
-
-  meta = with lib; {
-    homepage = "https://www.qemu.org/";
-    description = "Fork of QEMU with AFL instrumentation support";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ thoughtpolice ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 8efface2051a5..20bc244781a4d 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-04-16";
+  version = "2024-04-22";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     rev = "refs/tags/${version}";
-    hash = "sha256-ExtWNve7YGkr6JHjzw39FJZwSNFLEJNurEn5uWwSlbY=";
+    hash = "sha256-lWWAZwoUFA54uy0qo4H5+MgSv7tYJOerU9X3Or+AhSg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/keepwn/default.nix b/pkgs/tools/security/keepwn/default.nix
index 1d9c740960f32..9c878f37fd0c8 100644
--- a/pkgs/tools/security/keepwn/default.nix
+++ b/pkgs/tools/security/keepwn/default.nix
@@ -1,26 +1,25 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, python3
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "keepwn";
-  version = "0.3";
+  version = "0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Orange-Cyberdefense";
     repo = "KeePwn";
     rev = "refs/tags/${version}";
-    hash = "sha256-haKWuoTtyC9vIise+gznruHEwMIDz1W6euihLLKnSdc=";
+    hash = "sha256-AkqBC65XrMt4V5KgzLepnQoqpdvbrtWLY3DmVuy8Zck=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     chardet
     impacket
     lxml
@@ -37,16 +36,14 @@ python3.pkgs.buildPythonApplication rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "keepwn"
-  ];
+  pythonImportsCheck = [ "keepwn" ];
 
   meta = with lib; {
     description = "Tool to automate KeePass discovery and secret extraction";
-    mainProgram = "keepwn";
     homepage = "https://github.com/Orange-Cyberdefense/KeePwn";
     changelog = "https://github.com/Orange-Cyberdefense/KeePwn/releases/tag/${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "keepwn";
   };
 }
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index a5b308981a8c5..2adc7f605c817 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.3"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.5"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 1f700eb547616..1496f83026256 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 3855e135a14eec07e12f3d26416713a691b3c149
-  ref: refs/tags/6.4.3
+  revision: 6dfd13e04c9e9763b485a5b7d6e85d97632a8edf
+  ref: refs/tags/6.4.5
   specs:
-    metasploit-framework (6.4.3)
+    metasploit-framework (6.4.5)
       actionpack (~> 7.0.0)
       activerecord (~> 7.0.0)
       activesupport (~> 7.0.0)
@@ -135,29 +135,29 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.3.0)
-    aws-partitions (1.895.0)
-    aws-sdk-core (3.191.3)
+    aws-partitions (1.916.0)
+    aws-sdk-core (3.192.1)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.8)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-ec2 (1.440.0)
+    aws-sdk-ec2 (1.450.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-ec2instanceconnect (1.37.0)
+    aws-sdk-ec2instanceconnect (1.38.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-iam (1.94.0)
+    aws-sdk-iam (1.96.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-kms (1.77.0)
+    aws-sdk-kms (1.79.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.143.0)
-      aws-sdk-core (~> 3, >= 3.191.0)
+    aws-sdk-s3 (1.147.0)
+      aws-sdk-core (~> 3, >= 3.192.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.8)
-    aws-sdk-ssm (1.165.0)
+    aws-sdk-ssm (1.166.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
     aws-sigv4 (1.8.0)
@@ -165,7 +165,7 @@ GEM
     base64 (0.2.0)
     bcrypt (3.1.20)
     bcrypt_pbkdf (1.1.0)
-    bigdecimal (3.1.6)
+    bigdecimal (3.1.7)
     bindata (2.4.15)
     bootsnap (1.18.3)
       msgpack (~> 1.2)
@@ -177,7 +177,7 @@ GEM
     crass (1.0.6)
     daemons (1.4.1)
     date (3.3.4)
-    dnsruby (1.70.0)
+    dnsruby (1.72.1)
       simpleidn (~> 0.2.1)
     domain_name (0.6.20240107)
     ed25519 (1.3.0)
@@ -191,13 +191,13 @@ GEM
       eventmachine (>= 1.0.0.beta.4)
     erubi (1.12.0)
     eventmachine (1.2.7)
-    faker (3.2.3)
+    faker (3.3.1)
       i18n (>= 1.8.11, < 2)
     faraday (2.9.0)
       faraday-net_http (>= 2.0, < 3.2)
     faraday-net_http (3.1.0)
       net-http
-    faraday-retry (2.2.0)
+    faraday-retry (2.2.1)
       faraday (~> 2.0)
     faye-websocket (0.11.3)
       eventmachine (>= 0.12.0)
@@ -218,7 +218,7 @@ GEM
       domain_name (~> 0.5)
     http_parser.rb (0.8.0)
     httpclient (2.8.3)
-    i18n (1.14.1)
+    i18n (1.14.4)
       concurrent-ruby (~> 1.0)
     io-console (0.7.2)
     irb (1.7.4)
@@ -226,7 +226,7 @@ GEM
     jmespath (1.6.2)
     jsobfu (0.4.2)
       rkelly-remix
-    json (2.7.1)
+    json (2.7.2)
     little-plugger (1.1.4)
     logging (2.3.1)
       little-plugger (~> 1.1)
@@ -240,7 +240,7 @@ GEM
       activesupport (~> 7.0)
       railties (~> 7.0)
       zeitwerk
-    metasploit-credential (6.0.8)
+    metasploit-credential (6.0.9)
       metasploit-concern
       metasploit-model
       metasploit_data_models (>= 5.0.0)
@@ -266,9 +266,9 @@ GEM
       recog
       webrick
     metasploit_payloads-mettle (1.0.26)
-    method_source (1.0.0)
-    mini_portile2 (2.8.5)
-    minitest (5.22.2)
+    method_source (1.1.0)
+    mini_portile2 (2.8.6)
+    minitest (5.22.3)
     mqtt (0.6.0)
     msgpack (1.6.1)
     multi_json (1.15.0)
@@ -283,12 +283,12 @@ GEM
     net-ldap (0.19.0)
     net-protocol (0.2.2)
       timeout
-    net-smtp (0.4.0.1)
+    net-smtp (0.5.0)
       net-protocol
-    net-ssh (7.2.1)
+    net-ssh (7.2.3)
     network_interface (0.0.4)
     nexpose (7.3.0)
-    nio4r (2.7.0)
+    nio4r (2.7.1)
     nokogiri (1.14.5)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
@@ -311,11 +311,11 @@ GEM
       ruby-rc4
       ttfunk
     pg (1.5.6)
-    public_suffix (5.0.4)
+    public_suffix (5.0.5)
     puma (6.4.2)
       nio4r (~> 2.0)
     racc (1.7.3)
-    rack (2.2.8.1)
+    rack (2.2.9)
     rack-protection (3.2.0)
       base64 (>= 0.1.0)
       rack (~> 2.2, >= 2.2.4)
@@ -335,14 +335,14 @@ GEM
       rake (>= 12.2)
       thor (~> 1.0)
       zeitwerk (~> 2.5)
-    rake (13.1.0)
+    rake (13.2.1)
     rasn1 (0.13.0)
       strptime (~> 0.2.5)
     rb-readline (0.5.5)
-    recog (3.1.4)
+    recog (3.1.5)
       nokogiri
     redcarpet (3.6.0)
-    reline (0.4.3)
+    reline (0.5.2)
       io-console (~> 0.5)
     rex-arch (0.1.15)
       rex-text
@@ -382,14 +382,14 @@ GEM
       metasm
       rex-core
       rex-text
-    rex-socket (0.1.56)
+    rex-socket (0.1.57)
       rex-core
     rex-sslscan (0.1.10)
       rex-core
       rex-socket
       rex-text
     rex-struct2 (0.1.4)
-    rex-text (0.2.56)
+    rex-text (0.2.57)
     rex-zip (0.1.5)
       rex-text
     rexml (3.2.6)
@@ -398,7 +398,7 @@ GEM
     ruby-mysql (4.1.0)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.5)
-    ruby_smb (3.3.4)
+    ruby_smb (3.3.5)
       bindata (= 2.4.15)
       openssl-ccm
       openssl-cmac
@@ -416,7 +416,7 @@ GEM
       rack (~> 2.2, >= 2.2.4)
       rack-protection (= 3.2.0)
       tilt (~> 2.0)
-    sqlite3 (1.7.2)
+    sqlite3 (2.0.0)
       mini_portile2 (~> 2.8.0)
     sshkey (3.0.0)
     strptime (0.2.5)
@@ -428,7 +428,8 @@ GEM
     thor (1.3.1)
     tilt (2.3.0)
     timeout (0.4.1)
-    ttfunk (1.7.0)
+    ttfunk (1.8.0)
+      bigdecimal (~> 3.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     tzinfo-data (1.2024.1)
@@ -469,4 +470,4 @@ DEPENDENCIES
   metasploit-framework!
 
 BUNDLED WITH
-   2.5.6
+   2.4.13
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index b0f8748635328..1026323587d66 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.4.3";
+  version = "6.4.5";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-3FCTKiZ9vTmguGXRrfWGlUVVEKrV8uWMPeSF9zRz+UE=";
+    hash = "sha256-KmELKjbWjhHmyj8IlL5U2yNHwtpc8qX5ZAT1PcIJOd8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 7d83382e6a79c..fbf6bb89b8a3f 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,80 +104,80 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "018hh97dcj3nd80jb1cf63fxk6h8gc4rrq118bv9npnw5ahd5pv8";
+      sha256 = "1gilrh9fb1576xm2ah0l6d33qkiabz55zpq004qqia9xavl43ylz";
       type = "gem";
     };
-    version = "1.895.0";
+    version = "1.916.0";
   };
   aws-sdk-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "088nq8yz9n4p7pnhjwp9nbxlkj7jwchpkzvnl4nybfb1dkvk4dns";
+      sha256 = "1hp8rxk9wl3kmb7xabcz5hbcv7kzsvsx0wyib2fsg9d42kz149n0";
       type = "gem";
     };
-    version = "3.191.3";
+    version = "3.192.1";
   };
   aws-sdk-ec2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kcsfkpfqx96ax1slvl4lq61cdasaki6hddi22ja1zyc1ak4x9dg";
+      sha256 = "101jjqf912jwca119v86i4inlkf2gldmmhgdm2rdk5hqrwl4yrf4";
       type = "gem";
     };
-    version = "1.440.0";
+    version = "1.450.0";
   };
   aws-sdk-ec2instanceconnect = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hd4xdhf6b2bvfb4h9fc0c96vwz30cmdhra3r7zpdllhz7d1hh5q";
+      sha256 = "1mhqk2s8klp8djibrhgmh9lz9nr4rh1yy7y6c86if55r07i1912c";
       type = "gem";
     };
-    version = "1.37.0";
+    version = "1.38.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ymb6lnkmhi98lwk402msanr7i012k82pvspd2rd66aq0vdql9rd";
+      sha256 = "0zcvkal9ahwr84pz1cb3y9ylx3f74m4kgs4n160dfzf51b8m917l";
       type = "gem";
     };
-    version = "1.94.0";
+    version = "1.96.0";
   };
   aws-sdk-kms = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gbxms3daszl4mk89swjrpq3fqgm9lg0wl65yjfp0nfz8jm4jyqf";
+      sha256 = "1cb0006xf5isq5drdwkvd6xz20886x3rzcj5qyly7g8gql5lc8aw";
       type = "gem";
     };
-    version = "1.77.0";
+    version = "1.79.0";
   };
   aws-sdk-s3 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1safbxycz517m2v981z8kbmdiqx9jypl093ia0mcrskkgh4fyb3s";
+      sha256 = "0ibw2v56k8v2sw92cyliprq1xxfyavnd60yl6ach3f4qbp156xrn";
       type = "gem";
     };
-    version = "1.143.0";
+    version = "1.147.0";
   };
   aws-sdk-ssm = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wbizrm7spkwx6rnwmwbxyg16mpkn3hllxz8aj7v2dlplzkwksb6";
+      sha256 = "0drad0zka0kjayiy971vcl5dfp6j37wgga4xncya8w8xsrknh9s8";
       type = "gem";
     };
-    version = "1.165.0";
+    version = "1.166.0";
   };
   aws-sigv4 = {
     groups = ["default"];
@@ -224,10 +224,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00db5v09k1z3539g1zrk7vkjrln9967k08adh6qx33ng97a2gg5w";
+      sha256 = "0cq1c29zbkcxgdihqisirhcw76xc768z2zpd5vbccpq0l1lv76g7";
       type = "gem";
     };
-    version = "3.1.6";
+    version = "3.1.7";
   };
   bindata = {
     groups = ["default"];
@@ -334,10 +334,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17bjlic4ac9980vas3pgnhi5lkisq28vd730bhcg8jdh8xcp6r48";
+      sha256 = "1qpa5d8i6ay25grwb9d6x47jdn5c8vykhg02m8rgpmc3hci4mbsb";
       type = "gem";
     };
-    version = "1.70.0";
+    version = "1.72.1";
   };
   domain_name = {
     groups = ["default"];
@@ -404,10 +404,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rrwh78515yqljh09wjxfsb64siqd8qgp4hv57syajhza5x8vbzz";
+      sha256 = "0isxcqv4xkw7hrdf89mga6zsi4alban16xyw84bkqvbsr859nax4";
       type = "gem";
     };
-    version = "3.2.3";
+    version = "3.3.1";
   };
   faraday = {
     groups = ["default"];
@@ -434,10 +434,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ia19zgni6cw96rvsr0s004vjs9m2r6la4s00zcff36xaia4m0l0";
+      sha256 = "023ncwlagnf2irx2ckyj1pg1f1x436jgr4a5y45mih298p8zwij1";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.2.1";
   };
   faye-websocket = {
     groups = ["default"];
@@ -554,10 +554,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qaamqsh5f3szhcakkak8ikxlzxqnv49n2p7504hcz2l0f4nj0wx";
+      sha256 = "0lbm33fpb3w06wd2231sg58dwlwgjsvym93m548ajvl6s3mfvpn7";
       type = "gem";
     };
-    version = "1.14.1";
+    version = "1.14.4";
   };
   io-console = {
     groups = ["default"];
@@ -604,10 +604,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r9jmjhg2ly3l736flk7r2al47b5c8cayh0gqkq0yhjqzc9a6zhq";
+      sha256 = "0b4qsi8gay7ncmigr0pnbxyb17y3h8kavdyhsh7nrlqwr35vb60q";
       type = "gem";
     };
-    version = "2.7.1";
+    version = "2.7.2";
   };
   little-plugger = {
     groups = ["default"];
@@ -664,22 +664,22 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0v1bylci121psqg669lgxpp6d965m4xxmg1djvmy0srcys8dvp5n";
+      sha256 = "06zkgwwhzmazi263l61zwml6mkbyjkwc4lshalm9rbhj3agnsm22";
       type = "gem";
     };
-    version = "6.0.8";
+    version = "6.0.9";
   };
   metasploit-framework = {
     groups = ["default"];
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "3855e135a14eec07e12f3d26416713a691b3c149";
-      sha256 = "0hgrfcsgg1g47n6fbwnmm885aicmhvssvlb5p2h3kgbx4qm96l6w";
+      rev = "6dfd13e04c9e9763b485a5b7d6e85d97632a8edf";
+      sha256 = "1prr1713vx84ckwsbwjwvb14f8yvajz9821zrbk133nn6qm0nq9a";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.3";
+    version = "6.4.5";
   };
   metasploit-model = {
     groups = ["default"];
@@ -726,30 +726,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pnyh44qycnf9mzi1j6fywd5fkskv3x7nmsqrrws0rjn5dd4ayfp";
+      sha256 = "1igmc3sq9ay90f8xjvfnswd1dybj1s3fi0dwd53inwsvqk4h24qq";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.1.0";
   };
   mini_portile2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kl9c3kdchjabrihdqfmcplk3lq4cw1rr9f378y6q22qwy5dndvs";
+      sha256 = "149r94xi6b3jbp6bv72f8383b95ndn0p5sxnq11gs1j9jadv0ajf";
       type = "gem";
     };
-    version = "2.8.5";
+    version = "2.8.6";
   };
   minitest = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0667vf0zglacry87nkcl3ns8421aydvz71vfa3g3yjhiq8zh19f5";
+      sha256 = "07lq26b86giy3ha3fhrywk9r1ajhc2pm2mzj657jnpnbj1i6g17a";
       type = "gem";
     };
-    version = "5.22.2";
+    version = "5.22.3";
   };
   mqtt = {
     groups = ["default"];
@@ -846,20 +846,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0csspzqrg7s2v2wdp6vqqs1rra6w5ilpgnps5h52ig6rp7x2i389";
+      sha256 = "0amlhz8fhnjfmsiqcjajip57ici2xhw089x7zqyhpk51drg43h2z";
       type = "gem";
     };
-    version = "0.4.0.1";
+    version = "0.5.0";
   };
   net-ssh = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i01340c4i144vvn3x54lc2rb77ch829qipl1rh6rqwm3yxzml9w";
+      sha256 = "0sqbq5aks9xxnldbd2hy20ypnd59zcra98ql0r7jjc26s5rgc18n";
       type = "gem";
     };
-    version = "7.2.1";
+    version = "7.2.3";
   };
   network_interface = {
     groups = ["default"];
@@ -886,10 +886,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xkjz56qc7hl7zy7i7bhiyw5pl85wwjsa4p70rj6s958xj2sd1lm";
+      sha256 = "15iwbiij52x6jhdbl0rkcldnhfndmsy0sbnsygkr9vhskfqrp72m";
       type = "gem";
     };
-    version = "2.7.0";
+    version = "2.7.1";
   };
   nokogiri = {
     dependencies = ["mini_portile2" "racc"];
@@ -1007,10 +1007,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1bni4qjrsh2q49pnmmd6if4iv3ak36bd2cckrs6npl111n769k9m";
+      sha256 = "14y4vzjwf5gp0mqgs880kis0k7n2biq8i6ci6q2n315kichl1hvj";
       type = "gem";
     };
-    version = "5.0.4";
+    version = "5.0.5";
   };
   puma = {
     groups = ["default"];
@@ -1037,10 +1037,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10mpk0hl6hnv324fp1pfimi2nw9acj0z4gyhrph36qg84pk1s4m7";
+      sha256 = "0hj0rkw2z9r1lcg2wlrcld2n3phwrcgqcp7qd1g9a7hwgalh2qzx";
       type = "gem";
     };
-    version = "2.2.8.1";
+    version = "2.2.9";
   };
   rack-protection = {
     groups = ["default"];
@@ -1097,10 +1097,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ilr853hawi09626axx0mps4rkkmxcs54mapz9jnqvpnlwd3wsmy";
+      sha256 = "17850wcwkgi30p7yqh60960ypn7yibacjjha0av78zaxwvd3ijs6";
       type = "gem";
     };
-    version = "13.1.0";
+    version = "13.2.1";
   };
   rasn1 = {
     groups = ["default"];
@@ -1127,10 +1127,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1a9m9ngmcgvgzg8m8ahdhjvfm65k6hp8r7dqmrsh3zcphim4x71k";
+      sha256 = "179h412g435dwzzswma0incss8mhw4qgcabbhyij1fbc9ch1y1zx";
       type = "gem";
     };
-    version = "3.1.4";
+    version = "3.1.5";
   };
   redcarpet = {
     groups = ["default"];
@@ -1147,10 +1147,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zx7sdh11p4z77c3f9ka6f065mgl6xwbamnsq4rrgwk310qhn41n";
+      sha256 = "0xwf7i2kvgaxbpdqqkncv9dpfhlj55shig4sdzgy7kgbfj09mm03";
       type = "gem";
     };
-    version = "0.4.3";
+    version = "0.5.2";
   };
   rex-arch = {
     groups = ["default"];
@@ -1287,10 +1287,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vd9gfhyplwg2y55jk1c6nfsin733dy831x8zx78cp2lxp07s0p7";
+      sha256 = "1qmj5pya6ssghi3dfdmrykkbazhqlhq86ahwijdvrfr2q3g76p86";
       type = "gem";
     };
-    version = "0.1.56";
+    version = "0.1.57";
   };
   rex-sslscan = {
     groups = ["default"];
@@ -1317,10 +1317,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "108x7k7x0ghc1zzqwbmja1f81b1wnllpda2rzbkws9ckvqx0cayf";
+      sha256 = "08wrqy8sgncsn6kcplw7bl6c2bmyj9fza7x77wrlwh1gza7pcjk4";
       type = "gem";
     };
-    version = "0.2.56";
+    version = "0.2.57";
   };
   rex-zip = {
     groups = ["default"];
@@ -1397,10 +1397,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wcbglknz86qf7sbsns84a35a0vvfn9cn1cbhf9ycjwh6nqxhcim";
+      sha256 = "0fwk5hqaph37apa5zf1mg2n2wd5lkz3sgwl0f4ndhkv1vfxbb2ys";
       type = "gem";
     };
-    version = "3.3.4";
+    version = "3.3.5";
   };
   rubyntlm = {
     groups = ["default"];
@@ -1457,10 +1457,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "137xkh8jnk3xyajvzmn2390yzs13hnb37jylr0sm02d3zrshf18n";
+      sha256 = "01sfiwn60czgpabfr7xq8dk3qkc17ai3z7d4yfwanq1zw6mf927n";
       type = "gem";
     };
-    version = "1.7.2";
+    version = "2.0.0";
   };
   sshkey = {
     groups = ["default"];
@@ -1537,10 +1537,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15iaxz9iak5643bq2bc0jkbjv8w2zn649lxgvh5wg48q9d4blw13";
+      sha256 = "1ji0kn8jkf1rpskv3ijzxvqwixg4p6sk8kg0vmwyjinci7jcgjx7";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "1.8.0";
   };
   tzinfo = {
     groups = ["default"];
diff --git a/pkgs/tools/security/osv-scanner/default.nix b/pkgs/tools/security/osv-scanner/default.nix
index e51ce66ad0240..70393cb9aad8c 100644
--- a/pkgs/tools/security/osv-scanner/default.nix
+++ b/pkgs/tools/security/osv-scanner/default.nix
@@ -4,18 +4,19 @@
 , testers
 , osv-scanner
 }:
+
 buildGoModule rec {
   pname = "osv-scanner";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-JlTD8el4hXVYI76+cxGNemkUu0n2QxCqisr6R9aPqdI=";
+    repo = "osv-scanner";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UE6iCvv/ByODZX+FoLvIw+EeyISWFkHb4xK5L33w1hU=";
   };
 
-  vendorHash = "sha256-J5qLs4EirBOfjnLv8eQBSd9w9nzpxBW5GS28CgQMsN8=";
+  vendorHash = "sha256-c/Wjhpa7upSRMaU+rheGF9dbvK0MQe3ZmPLpR5bRiUI=";
 
   subPackages = [
     "cmd/osv-scanner"
@@ -24,9 +25,9 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/google/osv-scanner/internal/version.OSVVersion=${version}"
-    "-X main.commit=n/a"
-    "-X main.date=1970-01-01T00:00:00Z"
+    "-X=github.com/google/osv-scanner/internal/version.OSVVersion=${version}"
+    "-X=main.commit=n/a"
+    "-X=main.date=1970-01-01T00:00:00Z"
   ];
 
   # Tests require network connectivity to query https://api.osv.dev.
diff --git a/pkgs/tools/security/pwdsafety/default.nix b/pkgs/tools/security/pwdsafety/default.nix
index e713d7e014ab5..53bb59aa1ef24 100644
--- a/pkgs/tools/security/pwdsafety/default.nix
+++ b/pkgs/tools/security/pwdsafety/default.nix
@@ -1,26 +1,33 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:
 
 buildGoModule rec {
   pname = "pwdsafety";
-  version = "0.3";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "edoardottt";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-ryMLiehJVZhQ3ZQf4/g7ILeJri78A6z5jfell0pD9E8=";
+    repo = "pwdsafety";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cKxTcfNjvwcDEw0Z1b50A4u0DUYXlGMMfGWJLPaSkcw=";
   };
 
-  vendorHash = "sha256-b+tWTQUyYDzY2O28hwy5vI6b6S889TCiVh7hQhw/KAc=";
+  vendorHash = "sha256-RoRq9JZ8lOMtAluz8TB2RRuDEWFOBtWVhz21aTkXXy4=";
+
+  ldflags = [
+    "-w"
+    "-s"
+  ];
 
   meta = with lib; {
     description = "Command line tool checking password safety";
-    mainProgram = "cmd";
     homepage = "https://github.com/edoardottt/pwdsafety";
+    changelog = "https://github.com/edoardottt/pwdsafety/releases/tag/v${version}";
     license = with licenses; [ gpl3Plus ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "pwdsafety";
   };
 }
diff --git a/pkgs/tools/security/rbw/default.nix b/pkgs/tools/security/rbw/default.nix
index 22efd33c6abe1..929282d51276f 100644
--- a/pkgs/tools/security/rbw/default.nix
+++ b/pkgs/tools/security/rbw/default.nix
@@ -25,14 +25,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rbw";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchzip {
     url = "https://git.tozt.net/rbw/snapshot/rbw-${version}.tar.gz";
-    sha256 = "sha256-NjMH99rmJYbCxDdc7e0iOFoslSrIuwIBxuHxADp0Ks4=";
+    hash = "sha256-uJ1QLEaab/Vb5GiAmbwjve3Y/3SM2XbNTRTvl2vPDYc=";
   };
 
-  cargoHash = "sha256-AH35v61FgUQe9BwDgVnXwoVTSQduxeMbXWy4ga3WU3k=";
+  cargoHash = "sha256-tDgkANbUmNLe3us+05gD9IS0f+RTQBXTGvuz2cr2zYY=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/security/snow/default.nix b/pkgs/tools/security/snow/default.nix
index dbea144cb1ba6..5e7cb013a4edc 100644
--- a/pkgs/tools/security/snow/default.nix
+++ b/pkgs/tools/security/snow/default.nix
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "0r9q45y55z4i0askkxmxrx0jr1620ypd870vz0hx2a6n9skimdy0";
   };
 
-  makeFlags = [ "CFLAGS=-O2" ];
+  preBuild = ''
+    makeFlagsArray+=(CFLAGS="-O2 -std=c89")
+  '';
 
   installPhase = ''
     install -Dm755 snow -t $out/bin
diff --git a/pkgs/tools/security/step-cli/default.nix b/pkgs/tools/security/step-cli/default.nix
index 2afbec7f9069d..0b7271b5b67a2 100644
--- a/pkgs/tools/security/step-cli/default.nix
+++ b/pkgs/tools/security/step-cli/default.nix
@@ -32,7 +32,7 @@ buildGoModule rec {
     homepage = "https://smallstep.com/cli/";
     changelog = "https://github.com/smallstep/cli/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
-    maintainers = with maintainers; [ xfix ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux ++ platforms.darwin;
     mainProgram = "step";
   };
diff --git a/pkgs/tools/system/gdu/default.nix b/pkgs/tools/system/gdu/default.nix
index 9e84f2d8edfe4..19389acd4e143 100644
--- a/pkgs/tools/system/gdu/default.nix
+++ b/pkgs/tools/system/gdu/default.nix
@@ -1,28 +1,27 @@
-{ lib
-, stdenv
-, buildGoModule
-, fetchFromGitHub
-, installShellFiles
-, testers
-, gdu
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  testers,
+  gdu,
 }:
 
 buildGoModule rec {
   pname = "gdu";
-  version = "5.27.0";
+  version = "5.28.0";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = "gdu";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hQyvYLegGimYTRz0J/2tmaC6N4LfjB1ivWgN29DwNhA=";
+    hash = "sha256-HfWJVO62UeKE513fq1PaXyaldmrnQ/Fh5bXWSa0xGls=";
   };
 
-  vendorHash = "sha256-weNcJjofI7Aoy0Eya0KprXHAn7aTA0rQJYrJ4+t65hI=";
+  vendorHash = "sha256-SlVJDb24txy7DPsL0cG7LeGUjngXaUQ1SusgBfgf4PE=";
 
-  nativeBuildInputs = [
-    installShellFiles
-  ];
+  nativeBuildInputs = [ installShellFiles ];
 
   ldflags = [
     "-s"
@@ -41,9 +40,7 @@ buildGoModule rec {
 
   doCheck = !stdenv.isDarwin;
 
-  passthru.tests.version = testers.testVersion {
-    package = gdu;
-  };
+  passthru.tests.version = testers.testVersion { package = gdu; };
 
   meta = with lib; {
     description = "Disk usage analyzer with console interface";
@@ -55,7 +52,10 @@ buildGoModule rec {
     homepage = "https://github.com/dundee/gdu";
     changelog = "https://github.com/dundee/gdu/releases/tag/v${version}";
     license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab zowoq ];
+    maintainers = with maintainers; [
+      fab
+      zowoq
+    ];
     mainProgram = "gdu";
   };
 }
diff --git a/pkgs/tools/text/goawk/default.nix b/pkgs/tools/text/goawk/default.nix
index 2ed24f93d4d75..4d84d133775e3 100644
--- a/pkgs/tools/text/goawk/default.nix
+++ b/pkgs/tools/text/goawk/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "goawk";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "benhoyt";
     repo = "goawk";
     rev = "v${version}";
-    hash = "sha256-EJf5Qv5ICJJdGNcRQ7v/ANyxx2j9d9NsZJnzIBrwam4=";
+    hash = "sha256-KB9N345xkgsPfI4DQYFag7qSdFv/JSU18YG8IPFrcQA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/text/ov/default.nix b/pkgs/tools/text/ov/default.nix
index d74d4bc061826..e0ccf023a5ae7 100644
--- a/pkgs/tools/text/ov/default.nix
+++ b/pkgs/tools/text/ov/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "ov";
-  version = "0.33.3";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "ov";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dKAZ8rcm1J3jRfOyLz74YuVv0hZ3iWXR1slBTu5CtYU=";
+    hash = "sha256-2Qk94xaDD+O8jO7Pq1MUWieEjUlVLxYxMMcsrEUwP4M=";
   };
 
-  vendorHash = "sha256-6Ik//r6JJ2n9lXr6JZ6BGIIL7yXXray+flEwQ0IKyA4=";
+  vendorHash = "sha256-USMDIgB4LhI4kzSg2kkCXfbN9t49WEg0fUtAcZkngac=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 9fa3c12ccc88a..5bb73a50f9e64 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -1,11 +1,18 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, makeBinaryWrapper
+, runCommand
+, symlinkJoin
+, vale
+, valeStyles
+}:
 
 buildGoModule rec {
   pname = "vale";
   version = "3.4.1";
 
   subPackages = [ "cmd/vale" ];
-  outputs = [ "out" "data" ];
 
   src = fetchFromGitHub {
     owner = "errata-ai";
@@ -16,18 +23,29 @@ buildGoModule rec {
 
   vendorHash = "sha256-HMzFLSmO6sBDNU89UoIvHcPPd3ubpti2ii4sFMKUDmI=";
 
-  postInstall = ''
-    mkdir -p $data/share/vale
-    cp -r testdata/styles $data/share/vale
-  '';
-
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   # Tests require network access
   doCheck = false;
 
+  passthru.withStyles = selector: symlinkJoin {
+    name = "vale-with-styles-${vale.version}";
+    paths = [ vale ] ++ selector valeStyles;
+    nativeBuildInputs = [ makeBinaryWrapper ];
+    postBuild = ''
+      wrapProgram "$out/bin/vale" \
+        --set VALE_STYLES_PATH "$out/share/vale/styles/"
+    '';
+  };
+
   meta = with lib; {
     description = "A syntax-aware linter for prose built with speed and extensibility in mind";
+    longDescription = ''
+      Vale in Nixpkgs offers the helper `.withStyles` allow you to install it
+      predefined styles:
+
+          vale.withStyles (s: [ s.alex s.google ])
+    '';
     homepage = "https://vale.sh/";
     changelog = "https://github.com/errata-ai/vale/releases/tag/v${version}";
     mainProgram = "vale";
diff --git a/pkgs/tools/text/vale/styles.nix b/pkgs/tools/text/vale/styles.nix
new file mode 100644
index 0000000000000..f2513289a5488
--- /dev/null
+++ b/pkgs/tools/text/vale/styles.nix
@@ -0,0 +1,144 @@
+{ lib, stdenvNoCC, fetchFromGitHub, fetchzip, nix-update-script }:
+
+let
+  buildStyle =
+    { name
+    , stylePath ? name
+    , ...
+    }@args:
+    stdenvNoCC.mkDerivation ({
+      pname = "vale-style-${lib.toLower name}";
+
+      dontConfigure = true;
+      dontBuild = true;
+      doCheck = false;
+      dontFixup = true;
+
+      installPhase = ''
+        runHook preInstall
+        mkdir -p $out/share/vale/styles
+        cp -R ${stylePath} "$out/share/vale/styles/${name}"
+        runHook postInstall
+      '';
+
+      passthru.updateScript = nix-update-script { };
+
+      meta = {
+        platforms = lib.platforms.all;
+        maintainers = with lib.maintainers; [ katexochen ];
+      } // (args.meta or { });
+    } // removeAttrs args [ "meta" "name" ]);
+in
+{
+  alex = buildStyle rec {
+    name = "alex";
+    version = "0.2.1";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "alex";
+      rev = "v${version}";
+      hash = "sha256-xNF7se2FwKgNe5KYx/zvGWpIwBsBADYGH4JV1lUww+Q=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of the guidelines enforced by the alex linter";
+      homepage = "https://github.com/errata-ai/alex";
+      license = lib.licenses.mit;
+    };
+  };
+
+  google = buildStyle rec {
+    name = "Google";
+    version = "0.6.0";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "Google";
+      rev = "v${version}";
+      hash = "sha256-TQS/hgS6tEWPSuZpEbX65MdYSE/+HJVcnzIuQbhIG2M=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of the Google Developer Documentation Style Guide";
+      homepage = "https://github.com/errata-ai/Google";
+      license = lib.licenses.mit;
+    };
+  };
+
+  joblint = buildStyle rec {
+    name = "Joblint";
+    version = "0.4.1";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "Joblint";
+      rev = "v${version}";
+      hash = "sha256-zRz5ThOg5RLTZj3dYPe0PDvOF5DjO31lduSpi2Us87U=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of the Joblint linter";
+      homepage = "https://github.com/errata-ai/Joblint";
+      license = lib.licenses.mit;
+    };
+  };
+
+  microsoft = buildStyle rec {
+    name = "Microsoft";
+    version = "0.14.0";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "Microsoft";
+      rev = "v${version}";
+      hash = "sha256-22rGNLZOsWYQ+H3CcM2b1zOXV3kNPcgYqDpaCg1iv9o=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of the Microsoft Writing Style Guide";
+      homepage = "https://github.com/errata-ai/Microsoft";
+      license = lib.licenses.mit;
+    };
+  };
+
+  proselint = buildStyle rec {
+    name = "proselint";
+    version = "0.3.3";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "proselint";
+      rev = "v${version}";
+      hash = "sha256-faeWr1bRhnKsycJY89WqnRv8qIowUmz3EQvDyjtl63w=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of Python's proselint linter";
+      homepage = "https://github.com/errata-ai/proselint";
+      license = lib.licenses.bsd3;
+    };
+  };
+
+  readability = buildStyle rec {
+    name = "Readability";
+    version = "0.1.1";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "readability";
+      rev = "v${version}";
+      hash = "sha256-5Y9v8QsZjC2w3/pGIcL5nBdhpogyJznO5IFa0s8VOOI=";
+    };
+    meta = {
+      description = "Vale-compatible implementations of many popular \"readability\" metrics";
+      homepage = "https://github.com/errata-ai/readability";
+      license = lib.licenses.mit;
+    };
+  };
+
+  write-good = buildStyle rec {
+    name = "write-good";
+    version = "0.4.0";
+    src = fetchFromGitHub {
+      owner = "errata-ai";
+      repo = "write-good";
+      rev = "v${version}";
+      hash = "sha256-KQzY6MeHV/owPVmUAfzGUO0HmFPkD7wdQqOvBkipwP8=";
+    };
+    meta = {
+      description = "A Vale-compatible implementation of the write-good linter";
+      homepage = "https://github.com/errata-ai/write-good";
+      license = lib.licenses.mit;
+    };
+  };
+}
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 06449d8ff1c53..af810aa51d316 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -8,7 +8,7 @@
 , makeWrapper, shortenPerlShebang, useFixedHashes, asymptote
 , biber-ms
 , tlpdb
-}:
+}@args:
 
 # Useful resource covering build options:
 # http://tug.org/texlive/doc/tlbuild.html
@@ -420,7 +420,28 @@ pygmentex = python3Packages.buildPythonApplication rec {
   };
 };
 
-inherit asymptote;
+asymptote = args.asymptote.overrideAttrs (finalAttrs: prevAttrs: {
+  version = texlive.pkgs.asymptote.version;
+
+  # keep local src and patches even if duplicated in the top level asymptote
+  # so that top level updates do not break texlive
+  src = fetchurl {
+    url = "mirror://sourceforge/asymptote/${finalAttrs.version}/asymptote-${finalAttrs.version}.src.tgz";
+    hash = "sha256-DecadD+m7pORuH3Sdcs/5M3vUbN6rhSkFoNN0Soq9bs=";
+  };
+
+  texContainer = texlive.pkgs.asymptote.tex;
+  texdocContainer = texlive.pkgs.asymptote.texdoc;
+
+  patches = [
+    (fetchpatch {
+      # partial fix for macOS XDR/V3D support (LDFLAGS change seems like an unrelated bugfix)
+      name = "restore-LDFLAGS-dont-look-for-tirpc-under-MacOS.patch";
+      url = "https://github.com/vectorgraphics/asymptote/commit/7e17096b22d18d133d1bc5916b6e32c0cb24ad10.patch";
+      hash = "sha256-olCFzqfZwWOAjqlB5lDPXYRHU9i3VQNgoR0cO5TmW98=";
+    })
+  ];
+});
 
 inherit biber;
 inherit biber-ms;
@@ -499,23 +520,23 @@ xindy = stdenv.mkDerivation {
   postPatch = ''
     substituteInPlace xindy-*/user-commands/xindy.in \
       --replace-fail "our \$clisp = ( \$is_windows ? 'clisp.exe' : 'clisp' ) ;" \
-                     "our \$clisp = '$(type -P clisp)';"
+                     "our \$clisp = '$(type -P clisp)';" \
+      --replace-fail 'die "$cmd: Cannot locate xindy modules directory";' \
+                     '$modules_dir = "${texlive.pkgs.xindy.tex}/xindy/modules"; die "$cmd: Cannot locate xindy modules directory" unless -d $modules_dir;'
   '';
 
   nativeBuildInputs = [
     pkg-config perl
-    (texlive.combine { inherit (texlive) scheme-basic cyrillic ec; })
   ];
   buildInputs = [ clisp libiconv perl ];
 
-  configureFlags = [ "--with-clisp-runtime=system" "--disable-xindy-docs" ];
+  configureFlags = [ "--with-clisp-runtime=system" "--disable-xindy-docs" "--disable-xindy-rules" ];
 
   preInstall = ''mkdir -p "$out/bin" '';
   # fixup various file-location errors of: lib/xindy/{xindy.mem,modules/}
   postInstall = ''
     mkdir -p "$out/lib/xindy"
     mv "$out"/{bin/xindy.mem,lib/xindy/}
-    ln -s ../../share/texmf-dist/xindy/modules "$out/lib/xindy/"
   '';
 };
 
diff --git a/pkgs/tools/typesetting/tex/texpresso/default.nix b/pkgs/tools/typesetting/tex/texpresso/default.nix
index ccbc43a1c6151..e2e244ceda69d 100644
--- a/pkgs/tools/typesetting/tex/texpresso/default.nix
+++ b/pkgs/tools/typesetting/tex/texpresso/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "texpresso";
-  version = "0-unstable-2024-04-08";
+  version = "0-unstable-2024-04-18";
 
   nativeBuildInputs = [
     makeWrapper
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "let-def";
     repo = "texpresso";
-    rev = "9db77502f238c75ef03ce94f34cc5170d0b2a833";
-    hash = "sha256-YK4+GqjBjKui4J7YkNyeF1GyquMQMLMhp9o5u4Z8Bmc=";
+    rev = "62b2b5913420d92bb2863d9c92ac2072f7aaa5f9";
+    hash = "sha256-kVGRuFVkJvQfl1bEjBU0pyx+SB+k5yI9C6XFiKZRpLQ=";
   };
 
   buildFlags = [ "texpresso" ];
diff --git a/pkgs/tools/video/lux/default.nix b/pkgs/tools/video/lux/default.nix
index ecd0ae17c558b..7d1c969959a6f 100644
--- a/pkgs/tools/video/lux/default.nix
+++ b/pkgs/tools/video/lux/default.nix
@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "lux";
-  version = "0.23.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "iawia002";
     repo = "lux";
     rev = "v${version}";
-    hash = "sha256-lZrsrBO3sAn4wAMMgxrVwky7HmKxnQQcLe1POYTAmoE=";
+    hash = "sha256-FwHoxTcEr0u7GPSdl1A8gsx9GCb9QuD/5ospaPOxZrI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
-  vendorHash = "sha256-1VZFKDoSuSUmYw7g6SwB/dXnFaw7+cGHKfgT96HaI/o=";
+  vendorHash = "sha256-RCZzcycUKqJgwBZZQBD1UEZCZCitpiqNpD51oKm6IvI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/virtualization/cri-tools/default.nix b/pkgs/tools/virtualization/cri-tools/default.nix
index 70991742e789d..f59e0d2730eb5 100644
--- a/pkgs/tools/virtualization/cri-tools/default.nix
+++ b/pkgs/tools/virtualization/cri-tools/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cri-tools";
-  version = "1.29.0";
+  version = "1.30.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-64vjN0tm6P+nXjrNPeTviXOQdibuH7YbQm/LjYLxatM=";
+    hash = "sha256-MuyXcdV29sLn9Vt0WE31nXtY9ofjEC0b5zSrmGXR0mw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/wayland/clipman/default.nix b/pkgs/tools/wayland/clipman/default.nix
index b1641d16051a7..a00c9cc58dec6 100644
--- a/pkgs/tools/wayland/clipman/default.nix
+++ b/pkgs/tools/wayland/clipman/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "clipman";
-  version = "1.6.3";
+  version = "1.6.4";
 
   src = fetchFromGitHub {
     owner = "chmouel";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-htMApyGuDCjQR+2pgi6KPk+K+GbO63fJWFxl9GW8yfg=";
+    sha256 = "sha256-kuW74iUVLfIUWf3gaKM7IuMU1nfpU9SbSsfeZDbYGhY=";
   };
 
-  vendorHash = "sha256-Z/sVCJz/igPDdeczC6pemLub6X6z4ZGlBwBmRsEnXKI=";
+  vendorHash = "sha256-I1RWyjyOfppGi+Z5nvAei5zEvl0eQctcH8NP0MYSTbg=";
 
   outputs = [ "out" "man" ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c8a80540f9e82..f879d9ca98f07 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -61,6 +61,7 @@ mapAliases ({
   adtool = throw "'adtool' has been removed, as it was broken and unmaintained";
   advcpmv = throw "'advcpmv' has been removed, as it is not being actively maintained and break recent coreutils."; # Added 2024-03-29
   aether = throw "aether has been removed from nixpkgs; upstream unmaintained, security issues"; # Added 2023-10-03
+  afl = throw "afl has been removed as the upstream project was archived. Consider using 'aflplusplus'"; # Added 2024-04-21
   airfield = throw "airfield has been removed due to being unmaintained"; # Added 2023-05-19
   alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream"; # Added 2023-07-28
   alsa-project = throw "alsa-project was removed and its sub-attributes were promoted to top-level."; # Added 2023-11-12
@@ -413,6 +414,7 @@ mapAliases ({
 
   gitter = throw "gitter has been removed since the client has been abandoned by upstream with the backend migration to Matrix"; # Added 2023-09-18
   glide = throw "'glide' has been removed as it is unmaintained, please use Go modules instead"; # Added 2023-12-26
+  glfw-wayland = glfw; # Added 2024-04-19
   gmailieer = lieer; # Added 2020-04-19
   gmic-qt-krita = throw "gmic-qt-krita was removed as it's no longer supported upstream."; # Converted to throw 2023-02-02
   gnatboot11 = gnat-bootstrap11;
@@ -1290,6 +1292,7 @@ mapAliases ({
   virtmanager-qt = throw "'virtmanager-qt' has been renamed to/replaced by 'virt-manager-qt'"; # Converted to throw 2023-09-10
   vivaldi-widevine = throw "'vivaldi-widevine' has been renamed to/replaced by 'widevine-cdm'"; # Added 2023-02-25
   vkBasalt = vkbasalt; # Added 2022-11-22
+  vkdt-wayland = vkdt; # Added 2024-04-19
   vsmtp = throw "'vsmtp' has been removed, upstream gone"; # Added 2023-12-18
   vte_290 = throw "'vte_290' has been renamed to/replaced by 'vte'"; # Added 2023-01-05
   varnish72 = throw "varnish 7.2 is EOL. Either use the LTS or upgrade."; # Added 2023-10-09
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bf1320fe2b137..9c0846d71df7e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1612,10 +1612,6 @@ with pkgs;
 
   afio = callPackage ../tools/archivers/afio { };
 
-  afl = callPackage ../tools/security/afl {
-    stdenv = clangStdenv;
-  };
-
   honggfuzz = callPackage ../tools/security/honggfuzz {
     clang = clang_16;
     llvm = llvm_16;
@@ -1630,7 +1626,7 @@ with pkgs;
 
   ledfx = callPackage ../applications/audio/ledfx { };
 
-  libdislocator = callPackage ../tools/security/afl/libdislocator.nix { };
+  libdislocator = callPackage ../tools/security/aflplusplus/libdislocator.nix { };
 
   afpfs-ng = callPackage ../tools/filesystems/afpfs-ng { };
 
@@ -2750,12 +2746,6 @@ with pkgs;
     description = mame.meta.description + " (tools only)";
   } (lib.getOutput "tools" mame);
 
-  mednafen = callPackage ../applications/emulators/mednafen { };
-
-  mednafen-server = callPackage ../applications/emulators/mednafen/server.nix { };
-
-  mednaffe = callPackage ../applications/emulators/mednaffe { };
-
   melonDS = libsForQt5.callPackage ../applications/emulators/melonDS { };
 
   mgba = libsForQt5.callPackage ../applications/emulators/mgba { };
@@ -5130,8 +5120,6 @@ with pkgs;
 
   earlybird = callPackage ../tools/security/earlybird { };
 
-  earlyoom = callPackage ../os-specific/linux/earlyoom { };
-
   easyabc = callPackage ../applications/audio/easyabc { };
 
   easycrypt = callPackage ../applications/science/logic/easycrypt {
@@ -5543,7 +5531,11 @@ with pkgs;
 
   grobi = callPackage ../tools/X11/grobi { };
 
-  gscan2pdf = callPackage ../applications/graphics/gscan2pdf { };
+  gscan2pdf = callPackage ../applications/graphics/gscan2pdf {
+    # needs this fork of libtiff, because original libtiff
+    # stopped packaging required tools with version 4.6
+    libtiff = libtiff_t;
+  };
 
   gsctl = callPackage ../applications/misc/gsctl { };
 
@@ -6091,7 +6083,7 @@ with pkgs;
 
 
   ockam = callPackage ../tools/networking/ockam {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) AppKit Security;
   };
 
   odoo = callPackage ../applications/finance/odoo { };
@@ -6675,7 +6667,7 @@ with pkgs;
   cdrkit = callPackage ../tools/cd-dvd/cdrkit { };
 
   cdrtools = callPackage ../tools/cd-dvd/cdrtools {
-    stdenv = if stdenv.isDarwin then overrideLibcxx llvmPackages_14.stdenv else stdenv;
+    stdenv = if stdenv.isDarwin then llvmPackages_14.stdenv else stdenv;
     inherit (darwin.apple_sdk.frameworks) Carbon IOKit;
   };
 
@@ -9167,8 +9159,9 @@ with pkgs;
   hybridreverb2 = callPackage ../applications/audio/hybridreverb2 { };
 
   hylafaxplus = callPackage ../servers/hylafaxplus {
-    # libtiff >= 4.6 dropped many executables needed by hylafaxplus
-    libtiff = libtiff_4_5;
+    # needs this fork of libtiff, because original libtiff
+    # stopped packaging required tools with version 4.6
+    libtiff = libtiff_t;
   };
 
   hyphen = callPackage ../development/libraries/hyphen { };
@@ -14407,8 +14400,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  wireproxy = callPackage ../tools/networking/wireproxy { };
-
   wiringpi = callPackage ../os-specific/linux/wiringpi { };
 
   wg-friendly-peer-names = callPackage ../tools/networking/wg-friendly-peer-names { };
@@ -21129,9 +21120,6 @@ with pkgs;
   };
 
   glfw = glfw3;
-  glfw-wayland = glfw.override {
-    waylandSupport = true;
-  };
   glfw-wayland-minecraft = callPackage ../development/libraries/glfw/3.x-wayland-minecraft.nix {};
   glfw2 = callPackage ../development/libraries/glfw/2.x.nix { };
   glfw3 = callPackage ../development/libraries/glfw/3.x.nix {
@@ -21892,7 +21880,7 @@ with pkgs;
   lerc = callPackage ../development/libraries/lerc { };
 
   lib2geom = callPackage ../development/libraries/lib2geom {
-    stdenv = if stdenv.cc.isClang then overrideLibcxx llvmPackages_13.stdenv else stdenv;
+    stdenv = if stdenv.cc.isClang then llvmPackages_13.stdenv else stdenv;
   };
 
   lib3ds = callPackage ../development/libraries/lib3ds { };
@@ -23034,8 +23022,14 @@ with pkgs;
 
   libtifiles2 = callPackage ../development/libraries/libtifiles2 { };
 
-  libtiff = callPackage ../development/libraries/libtiff { };
-  libtiff_4_5 = callPackage ../development/libraries/libtiff/4.5.nix { };
+  inherit
+    ({
+      libtiff = callPackage ../development/libraries/libtiff { };
+      libtiff_t = callPackage ../development/libraries/libtiff/libtiff_t.nix { };
+    })
+    libtiff
+    libtiff_t
+    ;
 
   libtiger = callPackage ../development/libraries/libtiger { };
 
@@ -24077,16 +24071,7 @@ with pkgs;
 
   pylode = callPackage ../misc/pylode { };
 
-  python-qt = (callPackage ../development/libraries/python-qt {
-    python = python3;
-    inherit (builtins.mapAttrs (_: pkg: pkg.override (previousArgs: lib.optionalAttrs (previousArgs ? stdenv) { stdenv = gcc12Stdenv; })) qt5)
-      qmake qttools qtwebengine qtxmlpatterns;
-    stdenv = gcc12Stdenv;
-  })
-  .overrideAttrs(previousAttrs: {
-    NIX_CFLAGS_COMPILE = "-w";
-    meta = previousAttrs.meta // { broken = true; };
-  });
+  python-qt = libsForQt5.callPackage ../development/libraries/python-qt { };
 
   pyotherside = libsForQt5.callPackage ../development/libraries/pyotherside { };
 
@@ -24708,6 +24693,8 @@ with pkgs;
   streamlink = callPackage ../applications/video/streamlink { };
   streamlink-twitch-gui-bin = callPackage ../applications/video/streamlink-twitch-gui/bin.nix { };
 
+  structuresynth = libsForQt5.callPackage ../development/libraries/structuresynth { };
+
   sub-batch = callPackage ../applications/video/sub-batch { };
 
   subdl = callPackage ../applications/video/subdl { };
@@ -24913,16 +24900,9 @@ with pkgs;
 
   ucommon = callPackage ../development/libraries/ucommon { };
 
-  v8 = callPackage ../development/libraries/v8 (
-    let
-      stdenv' = if stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc.cc) "16"
-        then overrideLibcxx llvmPackages_15.stdenv
-        else stdenv;
-    in
-    {
-      stdenv = if stdenv'.isDarwin then overrideSDK stdenv' "11.0" else stdenv';
-    }
-  );
+  v8 = callPackage ../development/libraries/v8 {
+    stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
+  };
 
   intel-vaapi-driver = callPackage ../development/libraries/intel-vaapi-driver { };
 
@@ -24932,6 +24912,8 @@ with pkgs;
 
   vale = callPackage ../tools/text/vale { };
 
+  valeStyles = recurseIntoAttrs (callPackages ../tools/text/vale/styles.nix { });
+
   valhalla = callPackage ../development/libraries/valhalla {
     boost = boost.override { enablePython = true; python = python3; };
     protobuf = protobuf_21.override {
@@ -24969,8 +24951,6 @@ with pkgs;
 
   vkdt = callPackage ../applications/graphics/vkdt { };
 
-  vkdt-wayland = callPackage ../applications/graphics/vkdt { glfw = glfw-wayland; };
-
   vlock = callPackage ../misc/screensavers/vlock { };
 
   virtualpg = callPackage ../development/libraries/virtualpg { };
@@ -25239,6 +25219,10 @@ with pkgs;
   zig_0_11 = darwin.apple_sdk_11_0.callPackage ../development/compilers/zig/0.11.nix {
     llvmPackages = llvmPackages_16;
   };
+  # requires a newer Apple SDK
+  zig_0_12 = darwin.apple_sdk_11_0.callPackage ../development/compilers/zig/0.12.nix {
+    llvmPackages = llvmPackages_17;
+  };
   zig = zig_0_11;
 
   zig-shell-completions = callPackage ../development/compilers/zig/shell-completions.nix { };
@@ -28782,6 +28766,23 @@ with pkgs;
 
   spacx-gtk-theme = callPackage ../data/themes/gtk-theme-framework { theme = "spacx"; };
 
+  inherit
+    ({
+      gruppled-black-cursors = callPackage ../data/icons/gruppled-cursors { theme = "gruppled_black"; };
+      gruppled-black-lite-cursors = callPackage ../data/icons/gruppled-lite-cursors {
+        theme = "gruppled_black_lite";
+      };
+      gruppled-white-cursors = callPackage ../data/icons/gruppled-cursors { theme = "gruppled_white"; };
+      gruppled-white-lite-cursors = callPackage ../data/icons/gruppled-lite-cursors {
+        theme = "gruppled_white_lite";
+      };
+    })
+    gruppled-black-cursors
+    gruppled-black-lite-cursors
+    gruppled-white-cursors
+    gruppled-white-lite-cursors
+    ;
+
   gruvbox-dark-icons-gtk = callPackage ../data/icons/gruvbox-dark-icons-gtk {
     inherit (plasma5Packages) breeze-icons;
   };
@@ -30334,9 +30335,7 @@ with pkgs;
 
   csound-manual = callPackage ../applications/audio/csound/csound-manual { };
 
-  csound-qt = libsForQt5.callPackage ../applications/audio/csound/csound-qt {
-    python = python3;
-  };
+  csound-qt = libsForQt5.callPackage ../applications/audio/csound/csound-qt { };
 
   codeblocks = callPackage ../applications/editors/codeblocks { };
   codeblocksFull = codeblocks.override { contribPlugins = true; };
@@ -34619,7 +34618,7 @@ with pkgs;
 
   maestral = with python3Packages; toPythonApplication maestral;
 
-  maestral-gui = qt6.callPackage ../applications/networking/maestral-qt { };
+  maestral-gui = qt6Packages.callPackage ../applications/networking/maestral-qt { };
 
   maestro = callPackage ../development/mobile/maestro { };
 
@@ -39985,7 +39984,7 @@ with pkgs;
   alejandra = callPackage ../tools/nix/alejandra { };
 
   nixci = callPackage ../tools/nix/nixci {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration IOKit;
   };
 
   nixfmt-classic = haskellPackages.nixfmt.bin;
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index 0f1c92be89bc3..17df40fa0fb16 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -34,9 +34,6 @@ pkgs.releaseTools.sourceTarball {
 
   requiredSystemFeatures = [ "big-parallel" ]; # 1 thread but ~36G RAM (!) see #227945
 
-  nixpkgs-basic-release-checks = import ./nixpkgs-basic-release-checks.nix
-   { inherit nix pkgs nixpkgs supportedSystems; };
-
   dontBuild = false;
 
   doCheck = true;
diff --git a/pkgs/top-level/nixpkgs-basic-release-checks.nix b/pkgs/top-level/nixpkgs-basic-release-checks.nix
index 4acdab996787a..ea18890903281 100644
--- a/pkgs/top-level/nixpkgs-basic-release-checks.nix
+++ b/pkgs/top-level/nixpkgs-basic-release-checks.nix
@@ -1,9 +1,9 @@
-{ supportedSystems, nixpkgs, pkgs, nix }:
+{ supportedSystems, nixpkgs, pkgs }:
 
 pkgs.runCommand "nixpkgs-release-checks"
   {
     src = nixpkgs;
-    buildInputs = [ nix ];
+    buildInputs = [ pkgs.nix ];
     requiredSystemFeatures = [ "big-parallel" ]; # 1 thread but ~10G RAM; see #227945
   }
   ''
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 529e893894cf0..f379917ca0da1 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -830,16 +830,6 @@ let
       ppx_bap = callPackage ../development/ocaml-modules/ppx_bap { };
     })).overrideScope liftJaneStreet;
 
-    janeStreet_0_9_0 = import ../development/ocaml-modules/janestreet/old.nix {
-      self = self.janeStreet_0_9_0;
-      super = self // {
-        janePackage = callPackage ../development/ocaml-modules/janestreet/janePackage.nix {
-          defaultVersion = "0.9.0";
-        };
-      };
-      inherit (pkgs) stdenv lib openssl;
-    };
-
     javalib = callPackage ../development/ocaml-modules/javalib { };
 
     jingoo = callPackage ../development/ocaml-modules/jingoo { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 4a4a5addeac02..4f0c0d4219cf0 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -57,6 +57,7 @@ mapAliases ({
   Babel = babel; # added 2022-05-06
   backports_csv = throw "backports_csv has been removed, since we no longer need to backport to python2"; # added 2023-07-28
   backports_functools_lru_cache = throw "backports_functools_lru_cache has been removed, since we no longer need to backport to python3.2"; # added 2023-07-28
+  backports_shutil_get_terminal_size = backports-shutil-get-terminal-size; # added 2024-04-21
   backports_tempfile = throw "backports_tempfile has been removed, since we no longer need to backport to python3.3"; # added 2023-07-28
   backports_unittest-mock = throw "backports_unittest-mock has been removed, since we no longer need to backport to python3.2"; # added 2023-07-28
   backports_weakref = throw "backports_weakref has been removed, since we no longer need to backport to python3.3"; # added 2023-07-28
@@ -476,6 +477,7 @@ mapAliases ({
   smpp_pdu = smpp-pdu; # added 2024-03-05
   somecomfort = throw "somecomfort was removed because Home Assistant switched to aiosomecomfort"; # added 2023-02-01
   sorl_thumbnail = sorl-thumbnail; # added 2023-11-12
+  spacy_models = spacy-models; # added 2024-04-21
   SPARQLWrapper = sparqlwrapper;
   spark_parser = spark-parser; # added 2024-01-07
   sphinx-jquery = sphinxcontrib-jquery; # added 2023-02-24
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2ccfa2087a5fd..8a990c83f6d82 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -467,6 +467,8 @@ self: super: with self; {
 
   airtouch4pyapi = callPackage ../development/python-modules/airtouch4pyapi { };
 
+  airtouch5py = callPackage ../development/python-modules/airtouch5py { };
+
   ajpy = callPackage ../development/python-modules/ajpy { };
 
   ajsonrpc = callPackage ../development/python-modules/ajsonrpc { };
@@ -815,7 +817,7 @@ self: super: with self; {
 
   aspy-refactor-imports = callPackage ../development/python-modules/aspy-refactor-imports { };
 
-  aspy-yaml = callPackage ../development/python-modules/aspy.yaml { };
+  aspy-yaml = callPackage ../development/python-modules/aspy-yaml { };
 
   assay = callPackage ../development/python-modules/assay { };
 
@@ -1352,7 +1354,7 @@ self: super: with self; {
 
   backports-entry-points-selectable = callPackage ../development/python-modules/backports-entry-points-selectable { };
 
-  backports_shutil_get_terminal_size = callPackage ../development/python-modules/backports_shutil_get_terminal_size { };
+  backports-shutil-get-terminal-size = callPackage ../development/python-modules/backports-shutil-get-terminal-size { };
 
   backports-shutil-which = callPackage ../development/python-modules/backports-shutil-which { };
 
@@ -1782,6 +1784,8 @@ self: super: with self; {
 
   btsocket = callPackage ../development/python-modules/btsocket { };
 
+  bubop = callPackage ../development/python-modules/bubop { };
+
   bucketstore = callPackage ../development/python-modules/bucketstore { };
 
   bugsnag = callPackage ../development/python-modules/bugsnag { };
@@ -5905,6 +5909,8 @@ self: super: with self; {
 
   itanium-demangler = callPackage ../development/python-modules/itanium-demangler { };
 
+  item-synchronizer = callPackage ../development/python-modules/item-synchronizer { };
+
   itemadapter = callPackage ../development/python-modules/itemadapter { };
 
   itemdb = callPackage ../development/python-modules/itemdb { };
@@ -9673,6 +9679,8 @@ self: super: with self; {
 
   pypemicro = callPackage ../development/python-modules/pypemicro { };
 
+  pymeshlab = toPythonModule (pkgs.libsForQt5.callPackage ../applications/graphics/pymeshlab { });
+
   pyprecice = callPackage ../development/python-modules/pyprecice { };
 
   pyprobables = callPackage ../development/python-modules/pyprobables { };
@@ -11543,6 +11551,8 @@ self: super: with self; {
       setuptools sip;
   };
 
+  pyqtdarktheme = callPackage ../development/python-modules/pyqtdarktheme { };
+
   pyqtdatavisualization = pkgs.libsForQt5.callPackage ../development/python-modules/pyqtdatavisualization {
     inherit (self) buildPythonPackage pyqt5 pyqt-builder python pythonOlder
       setuptools sip;
@@ -12277,6 +12287,8 @@ self: super: with self; {
 
   python-hglib = callPackage ../development/python-modules/python-hglib { };
 
+  python-homeassistant-analytics = callPackage ../development/python-modules/python-homeassistant-analytics { };
+
   python-homewizard-energy = callPackage ../development/python-modules/python-homewizard-energy { };
 
   python-hosts = callPackage ../development/python-modules/python-hosts { };
@@ -13950,7 +13962,7 @@ self: super: with self; {
 
   smpplib = callPackage ../development/python-modules/smpplib { };
 
-  smpp-pdu = callPackage ../development/python-modules/smpp.pdu { };
+  smpp-pdu = callPackage ../development/python-modules/smpp-pdu { };
 
   smtpdfix = callPackage ../development/python-modules/smtpdfix { };
 
@@ -14086,7 +14098,7 @@ self: super: with self; {
 
   spacy-lookups-data = callPackage ../development/python-modules/spacy/lookups-data.nix { };
 
-  spacy_models = callPackage ../development/python-modules/spacy/models.nix {
+  spacy-models = callPackage ../development/python-modules/spacy/models.nix {
       inherit (pkgs) jq;
   };
 
@@ -14675,6 +14687,8 @@ self: super: with self; {
 
   taskw = callPackage ../development/python-modules/taskw { };
 
+  taskw-ng = callPackage ../development/python-modules/taskw-ng { };
+
   tatsu = callPackage ../development/python-modules/tatsu { };
 
   taxi = callPackage ../development/python-modules/taxi { };
@@ -14913,7 +14927,7 @@ self: super: with self; {
   textacy = callPackage ../development/python-modules/textacy { };
 
   textnets = callPackage ../development/python-modules/textnets {
-    en_core_web_sm = spacy_models.en_core_web_sm;
+    en_core_web_sm = spacy-models.en_core_web_sm;
   };
 
   texttable = callPackage ../development/python-modules/texttable { };
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index e8ede387b4c2d..2da2d7d64675c 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -80,6 +80,8 @@ let
   nonPackageJobs =
     { tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease supportedSystems; };
 
+      release-checks = import ./nixpkgs-basic-release-checks.nix { inherit pkgs nixpkgs supportedSystems; };
+
       metrics = import ./metrics.nix { inherit pkgs nixpkgs; };
 
       manual = import ../../doc { inherit pkgs nixpkgs; };
@@ -91,6 +93,7 @@ let
           meta.description = "Release-critical builds for the Nixpkgs darwin channel";
           constituents =
             [ jobs.tarball
+              jobs.release-checks
               jobs.cabal2nix.x86_64-darwin
               jobs.ghc.x86_64-darwin
               jobs.git.x86_64-darwin
@@ -140,6 +143,7 @@ let
           meta.description = "Release-critical builds for the Nixpkgs unstable channel";
           constituents =
             [ jobs.tarball
+              jobs.release-checks
               jobs.metrics
               jobs.manual
               jobs.lib-tests