about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.git-blame-ignore-revs3
-rw-r--r--.github/workflows/check-nix-format.yml1
-rw-r--r--doc/README.md2
-rw-r--r--doc/build-helpers/special/fhs-environments.section.md2
-rw-r--r--doc/languages-frameworks/gnome.section.md32
-rw-r--r--lib/systems/doubles.nix2
-rw-r--r--lib/systems/examples.nix2
-rw-r--r--lib/systems/parse.nix6
-rw-r--r--lib/tests/systems.nix6
-rw-r--r--maintainers/maintainer-list.nix24
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md52
-rw-r--r--nixos/modules/config/no-x-libs.nix2
-rw-r--r--nixos/modules/hardware/openrazer.nix64
-rw-r--r--nixos/modules/services/databases/postgresql.nix35
-rw-r--r--nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix14
-rw-r--r--nixos/modules/services/home-automation/ebusd.nix24
-rw-r--r--nixos/modules/services/logging/logrotate.nix2
-rw-r--r--nixos/modules/services/mail/mailman.nix11
-rw-r--r--nixos/modules/services/security/vault.nix4
-rw-r--r--nixos/modules/services/web-servers/nginx/default.nix3
-rw-r--r--nixos/modules/services/x11/desktop-managers/cinnamon.nix1
-rw-r--r--nixos/modules/services/x11/desktop-managers/gnome.nix4
-rw-r--r--nixos/modules/virtualisation/incus.nix17
-rw-r--r--nixos/tests/installed-tests/default.nix2
-rw-r--r--nixos/tests/installed-tests/gnome-photos.nix2
-rw-r--r--nixos/tests/libreswan.nix6
-rw-r--r--nixos/tests/openssh.nix38
-rw-r--r--nixos/tests/postgresql-jit.nix15
-rw-r--r--nixos/tests/postgresql-wal-receiver.nix202
-rw-r--r--nixos/tests/ssh-keys.nix12
-rw-r--r--pkgs/applications/accessibility/dasher/default.nix4
-rw-r--r--pkgs/applications/accessibility/mousetweaks/default.nix4
-rw-r--r--pkgs/applications/accessibility/squeekboard/default.nix4
-rw-r--r--pkgs/applications/audio/ario/default.nix4
-rw-r--r--pkgs/applications/audio/audacity/default.nix4
-rw-r--r--pkgs/applications/audio/audio-recorder/default.nix4
-rw-r--r--pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix4
-rw-r--r--pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix4
-rw-r--r--pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix8
-rw-r--r--pkgs/applications/audio/buzztrax/default.nix4
-rw-r--r--pkgs/applications/audio/deadbeef/default.nix4
-rw-r--r--pkgs/applications/audio/denemo/default.nix4
-rw-r--r--pkgs/applications/audio/easyabc/default.nix4
-rw-r--r--pkgs/applications/audio/easytag/default.nix6
-rw-r--r--pkgs/applications/audio/exaile/default.nix4
-rw-r--r--pkgs/applications/audio/gmpc/default.nix4
-rw-r--r--pkgs/applications/audio/gnome-podcasts/default.nix2
-rw-r--r--pkgs/applications/audio/goodvibes/default.nix4
-rw-r--r--pkgs/applications/audio/gpodder/default.nix4
-rw-r--r--pkgs/applications/audio/gspeech/default.nix4
-rw-r--r--pkgs/applications/audio/gst123/default.nix4
-rw-r--r--pkgs/applications/audio/guitarix/default.nix4
-rw-r--r--pkgs/applications/audio/hivelytracker/default.nix4
-rw-r--r--pkgs/applications/audio/hushboard/default.nix4
-rw-r--r--pkgs/applications/audio/indicator-sound-switcher/default.nix4
-rw-r--r--pkgs/applications/audio/lingot/default.nix4
-rw-r--r--pkgs/applications/audio/lollypop/default.nix6
-rw-r--r--pkgs/applications/audio/lyrebird/default.nix4
-rw-r--r--pkgs/applications/audio/mpdevil/default.nix6
-rw-r--r--pkgs/applications/audio/musescore/default.nix5
-rw-r--r--pkgs/applications/audio/muso/default.nix4
-rw-r--r--pkgs/applications/audio/paprefs/default.nix4
-rw-r--r--pkgs/applications/audio/pavucontrol/default.nix4
-rw-r--r--pkgs/applications/audio/pithos/default.nix4
-rw-r--r--pkgs/applications/audio/praat/default.nix4
-rw-r--r--pkgs/applications/audio/pulseeffects-legacy/default.nix4
-rw-r--r--pkgs/applications/audio/quodlibet/default.nix4
-rw-r--r--pkgs/applications/audio/radiotray-ng/default.nix4
-rw-r--r--pkgs/applications/audio/rhythmbox/default.nix6
-rw-r--r--pkgs/applications/audio/sfxr/default.nix4
-rw-r--r--pkgs/applications/audio/sonata/default.nix4
-rw-r--r--pkgs/applications/audio/sonic-pi/default.nix4
-rw-r--r--pkgs/applications/audio/sound-juicer/default.nix6
-rw-r--r--pkgs/applications/audio/soundconverter/default.nix4
-rw-r--r--pkgs/applications/audio/spek/default.nix4
-rw-r--r--pkgs/applications/audio/spotify/linux.nix4
-rw-r--r--pkgs/applications/audio/sublime-music/default.nix4
-rw-r--r--pkgs/applications/audio/transcribe/default.nix4
-rw-r--r--pkgs/applications/audio/tuner/default.nix4
-rw-r--r--pkgs/applications/audio/vcv-rack/default.nix4
-rw-r--r--pkgs/applications/audio/vocal/default.nix4
-rw-r--r--pkgs/applications/audio/ymuse/default.nix4
-rw-r--r--pkgs/applications/audio/zrythm/default.nix103
-rw-r--r--pkgs/applications/backup/deja-dup/default.nix2
-rw-r--r--pkgs/applications/backup/timeshift/wrapper.nix4
-rw-r--r--pkgs/applications/blockchains/lnd/default.nix6
-rw-r--r--pkgs/applications/blockchains/ton/default.nix6
-rw-r--r--pkgs/applications/display-managers/greetd/gtkgreet.nix4
-rw-r--r--pkgs/applications/display-managers/lightdm-enso-os-greeter/default.nix4
-rw-r--r--pkgs/applications/display-managers/lightdm-mini-greeter/default.nix4
-rw-r--r--pkgs/applications/display-managers/lightdm-slick-greeter/default.nix4
-rw-r--r--pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix4
-rw-r--r--pkgs/applications/display-managers/lightdm/gtk-greeter.nix6
-rw-r--r--pkgs/applications/editors/apostrophe/default.nix4
-rw-r--r--pkgs/applications/editors/bluefish/default.nix4
-rw-r--r--pkgs/applications/editors/bluej/default.nix4
-rw-r--r--pkgs/applications/editors/codeblocks/default.nix4
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/manual-packages/tree-sitter-langs/default.nix3
-rw-r--r--pkgs/applications/editors/emacs/make-emacs.nix4
-rw-r--r--pkgs/applications/editors/formiko/default.nix4
-rw-r--r--pkgs/applications/editors/geany/default.nix4
-rw-r--r--pkgs/applications/editors/gedit/default.nix4
-rw-r--r--pkgs/applications/editors/gnome-builder/default.nix13
-rw-r--r--pkgs/applications/editors/gnome-inform7/default.nix8
-rw-r--r--pkgs/applications/editors/gnome-latex/default.nix4
-rw-r--r--pkgs/applications/editors/gobby/default.nix4
-rw-r--r--pkgs/applications/editors/greenfoot/default.nix4
-rw-r--r--pkgs/applications/editors/l3afpad/default.nix4
-rw-r--r--pkgs/applications/editors/lapce/default.nix4
-rw-r--r--pkgs/applications/editors/lifeograph/default.nix4
-rw-r--r--pkgs/applications/editors/marker/default.nix4
-rw-r--r--pkgs/applications/editors/mindforger/default.nix4
-rw-r--r--pkgs/applications/editors/neovim/utils.nix2
-rw-r--r--pkgs/applications/editors/pinegrow/default.nix4
-rw-r--r--pkgs/applications/editors/pulsar/default.nix4
-rw-r--r--pkgs/applications/editors/sublime/3/common.nix4
-rw-r--r--pkgs/applications/editors/sublime/4/common.nix4
-rw-r--r--pkgs/applications/editors/texmaker/default.nix4
-rw-r--r--pkgs/applications/editors/thiefmd/default.nix4
-rw-r--r--pkgs/applications/editors/tijolo/default.nix4
-rw-r--r--pkgs/applications/editors/vim/full.nix4
-rw-r--r--pkgs/applications/editors/vim/plugins/build-vim-plugin.nix3
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix6
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-utils.nix1
-rw-r--r--pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix33
-rw-r--r--pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix21
-rw-r--r--pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/rescript-editor-analysis.nix22
-rw-r--r--pkgs/applications/editors/vscode/extensions/contextmapper.context-mapper-vscode-extension/default.nix19
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix38
-rw-r--r--pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix6
-rw-r--r--pkgs/applications/editors/vscode/extensions/jebbs.plantuml/default.nix20
-rw-r--r--pkgs/applications/editors/vscode/extensions/language-packs.nix8
-rw-r--r--pkgs/applications/editors/vscode/extensions/mktplcExtRefToFetchArgs.nix9
-rw-r--r--pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix185
-rw-r--r--pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix113
-rw-r--r--pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix82
-rw-r--r--pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix7
-rw-r--r--pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix13
-rw-r--r--pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix31
-rw-r--r--pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix6
-rw-r--r--pkgs/applications/editors/vscode/extensions/reditorsupport.r/default.nix42
-rw-r--r--pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix71
-rw-r--r--pkgs/applications/editors/vscode/extensions/sumneko.lua/default.nix7
-rw-r--r--pkgs/applications/editors/vscode/extensions/updateSettings.nix54
-rw-r--r--pkgs/applications/editors/vscode/extensions/updateSettingsTest.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix71
-rw-r--r--pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/lldb.nix20
-rw-r--r--pkgs/applications/editors/vscode/extensions/vscode-utils.nix211
-rw-r--r--pkgs/applications/editors/vscode/extensions/vscodeEnv.nix103
-rw-r--r--pkgs/applications/editors/vscode/extensions/vscodeEnvTest.nix24
-rw-r--r--pkgs/applications/editors/vscode/extensions/vscodeExts2nix.nix36
-rw-r--r--pkgs/applications/editors/vscode/extensions/vscodeWithConfiguration.nix75
-rw-r--r--pkgs/applications/editors/vscode/generic.nix2
-rw-r--r--pkgs/applications/editors/xed-editor/default.nix4
-rw-r--r--pkgs/applications/emulators/bsnes/ares/default.nix4
-rw-r--r--pkgs/applications/emulators/bsnes/bsnes-hd/default.nix4
-rw-r--r--pkgs/applications/emulators/cemu/default.nix4
-rw-r--r--pkgs/applications/emulators/desmume/default.nix4
-rw-r--r--pkgs/applications/emulators/fuse-emulator/default.nix4
-rw-r--r--pkgs/applications/emulators/pcem/default.nix4
-rw-r--r--pkgs/applications/emulators/pcsxr/default.nix4
-rw-r--r--pkgs/applications/emulators/ruffle/default.nix4
-rw-r--r--pkgs/applications/emulators/sameboy/default.nix6
-rw-r--r--pkgs/applications/emulators/vice/default.nix4
-rw-r--r--pkgs/applications/file-managers/krusader/default.nix4
-rw-r--r--pkgs/applications/file-managers/pcmanfm/default.nix4
-rw-r--r--pkgs/applications/file-managers/spacefm/default.nix4
-rw-r--r--pkgs/applications/gis/grass/default.nix4
-rw-r--r--pkgs/applications/gis/qgis/unwrapped-ltr.nix4
-rw-r--r--pkgs/applications/gis/qgis/unwrapped.nix4
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix4
-rw-r--r--pkgs/applications/graphics/akira/default.nix4
-rw-r--r--pkgs/applications/graphics/avocode/default.nix4
-rw-r--r--pkgs/applications/graphics/ciano/default.nix4
-rw-r--r--pkgs/applications/graphics/cloudcompare/default.nix4
-rw-r--r--pkgs/applications/graphics/darktable/default.nix4
-rw-r--r--pkgs/applications/graphics/dia/default.nix4
-rw-r--r--pkgs/applications/graphics/drawing/default.nix4
-rw-r--r--pkgs/applications/graphics/figma-linux/default.nix4
-rw-r--r--pkgs/applications/graphics/fondo/default.nix4
-rw-r--r--pkgs/applications/graphics/gcolor3/default.nix4
-rw-r--r--pkgs/applications/graphics/geeqie/default.nix4
-rw-r--r--pkgs/applications/graphics/gnome-photos/default.nix6
-rw-r--r--pkgs/applications/graphics/goxel/default.nix4
-rw-r--r--pkgs/applications/graphics/gscan2pdf/default.nix4
-rw-r--r--pkgs/applications/graphics/gscreenshot/default.nix6
-rw-r--r--pkgs/applications/graphics/gthumb/default.nix6
-rw-r--r--pkgs/applications/graphics/hugin/default.nix4
-rw-r--r--pkgs/applications/graphics/icon-library/default.nix6
-rw-r--r--pkgs/applications/graphics/ideogram/default.nix4
-rw-r--r--pkgs/applications/graphics/imagej/default.nix4
-rw-r--r--pkgs/applications/graphics/inkscape/default.nix4
-rw-r--r--pkgs/applications/graphics/inkscape/extensions/textext/default.nix4
-rw-r--r--pkgs/applications/graphics/kgraphviewer/default.nix4
-rw-r--r--pkgs/applications/graphics/komorebi/default.nix4
-rw-r--r--pkgs/applications/graphics/kphotoalbum/default.nix4
-rw-r--r--pkgs/applications/graphics/mypaint/default.nix4
-rw-r--r--pkgs/applications/graphics/ocrfeeder/default.nix6
-rw-r--r--pkgs/applications/graphics/oculante/default.nix4
-rw-r--r--pkgs/applications/graphics/openscad/default.nix4
-rw-r--r--pkgs/applications/graphics/pencil/default.nix4
-rw-r--r--pkgs/applications/graphics/pick-colour-picker/default.nix4
-rw-r--r--pkgs/applications/graphics/pinta/default.nix4
-rw-r--r--pkgs/applications/graphics/pizarra/default.nix4
-rw-r--r--pkgs/applications/graphics/processing/default.nix4
-rw-r--r--pkgs/applications/graphics/rawtherapee/default.nix4
-rw-r--r--pkgs/applications/graphics/shotwell/default.nix10
-rw-r--r--pkgs/applications/graphics/shutter/default.nix4
-rw-r--r--pkgs/applications/graphics/snapshot/default.nix4
-rw-r--r--pkgs/applications/graphics/solvespace/default.nix4
-rw-r--r--pkgs/applications/graphics/synfigstudio/default.nix4
-rw-r--r--pkgs/applications/graphics/tev/default.nix4
-rw-r--r--pkgs/applications/graphics/xournalpp/default.nix4
-rw-r--r--pkgs/applications/graphics/xpano/default.nix4
-rw-r--r--pkgs/applications/graphics/yed/default.nix6
-rw-r--r--pkgs/applications/kde/audiotube.nix4
-rw-r--r--pkgs/applications/kde/kasts.nix4
-rw-r--r--pkgs/applications/kde/kdenlive/default.nix4
-rw-r--r--pkgs/applications/kde/partitionmanager/default.nix4
-rw-r--r--pkgs/applications/kde/plasmatube/default.nix4
-rw-r--r--pkgs/applications/kde/skanlite.nix4
-rw-r--r--pkgs/applications/kde/spectacle.nix4
-rw-r--r--pkgs/applications/misc/1password-gui/linux.nix4
-rw-r--r--pkgs/applications/misc/almanah/default.nix6
-rw-r--r--pkgs/applications/misc/appeditor/default.nix4
-rw-r--r--pkgs/applications/misc/auto-multiple-choice/default.nix4
-rw-r--r--pkgs/applications/misc/avizo/default.nix4
-rw-r--r--pkgs/applications/misc/bambu-studio/default.nix4
-rw-r--r--pkgs/applications/misc/barrier/default.nix4
-rw-r--r--pkgs/applications/misc/bleachbit/default.nix4
-rw-r--r--pkgs/applications/misc/break-time/default.nix4
-rw-r--r--pkgs/applications/misc/caerbannog/default.nix4
-rw-r--r--pkgs/applications/misc/calibre/default.nix4
-rw-r--r--pkgs/applications/misc/cbatticon/default.nix4
-rw-r--r--pkgs/applications/misc/cherrytree/default.nix4
-rw-r--r--pkgs/applications/misc/cipher/default.nix4
-rw-r--r--pkgs/applications/misc/clipit/default.nix4
-rw-r--r--pkgs/applications/misc/cobang/default.nix4
-rw-r--r--pkgs/applications/misc/diffuse/default.nix4
-rw-r--r--pkgs/applications/misc/dockbarx/default.nix4
-rw-r--r--pkgs/applications/misc/fbmenugen/default.nix4
-rw-r--r--pkgs/applications/misc/feedbackd/default.nix4
-rw-r--r--pkgs/applications/misc/findex/default.nix4
-rw-r--r--pkgs/applications/misc/fluxboxlauncher/default.nix4
-rw-r--r--pkgs/applications/misc/font-manager/default.nix4
-rw-r--r--pkgs/applications/misc/fontfinder/default.nix4
-rw-r--r--pkgs/applications/misc/formatter/default.nix4
-rw-r--r--pkgs/applications/misc/foxtrotgps/default.nix4
-rw-r--r--pkgs/applications/misc/gImageReader/default.nix4
-rw-r--r--pkgs/applications/misc/gcstar/default.nix4
-rw-r--r--pkgs/applications/misc/genxword/default.nix4
-rw-r--r--pkgs/applications/misc/gkrellm/default.nix4
-rw-r--r--pkgs/applications/misc/glom/default.nix4
-rw-r--r--pkgs/applications/misc/gmtp/default.nix4
-rw-r--r--pkgs/applications/misc/gnome-multi-writer/default.nix6
-rw-r--r--pkgs/applications/misc/gnome-recipes/default.nix6
-rw-r--r--pkgs/applications/misc/gnome-tecla/default.nix4
-rw-r--r--pkgs/applications/misc/gnome-usage/default.nix4
-rw-r--r--pkgs/applications/misc/goldendict-ng/default.nix4
-rw-r--r--pkgs/applications/misc/goldendict/default.nix4
-rw-r--r--pkgs/applications/misc/gpx-viewer/default.nix4
-rw-r--r--pkgs/applications/misc/gramps/default.nix4
-rw-r--r--pkgs/applications/misc/grsync/default.nix4
-rw-r--r--pkgs/applications/misc/gum/default.nix6
-rw-r--r--pkgs/applications/misc/gummi/default.nix4
-rw-r--r--pkgs/applications/misc/hamster/default.nix4
-rw-r--r--pkgs/applications/misc/holochain-launcher/default.nix4
-rw-r--r--pkgs/applications/misc/input-leap/default.nix4
-rw-r--r--pkgs/applications/misc/keepassxc/default.nix4
-rw-r--r--pkgs/applications/misc/keeweb/default.nix4
-rw-r--r--pkgs/applications/misc/keymapp/default.nix4
-rw-r--r--pkgs/applications/misc/keystore-explorer/default.nix4
-rw-r--r--pkgs/applications/misc/klipperscreen/default.nix4
-rw-r--r--pkgs/applications/misc/krename/default.nix4
-rw-r--r--pkgs/applications/misc/kupfer/default.nix4
-rw-r--r--pkgs/applications/misc/lutris/default.nix4
-rw-r--r--pkgs/applications/misc/mako/default.nix4
-rw-r--r--pkgs/applications/misc/maliit-keyboard/default.nix4
-rw-r--r--pkgs/applications/misc/markets/default.nix4
-rw-r--r--pkgs/applications/misc/meerk40t/default.nix4
-rw-r--r--pkgs/applications/misc/minder/default.nix4
-rw-r--r--pkgs/applications/misc/minigalaxy/default.nix4
-rw-r--r--pkgs/applications/misc/mysql-workbench/default.nix4
-rw-r--r--pkgs/applications/misc/notifymuch/default.nix4
-rw-r--r--pkgs/applications/misc/ns-usbloader/default.nix4
-rw-r--r--pkgs/applications/misc/numberstation/default.nix4
-rw-r--r--pkgs/applications/misc/nwg-bar/default.nix4
-rw-r--r--pkgs/applications/misc/nwg-displays/default.nix4
-rw-r--r--pkgs/applications/misc/nwg-dock-hyprland/default.nix4
-rw-r--r--pkgs/applications/misc/nwg-menu/default.nix4
-rw-r--r--pkgs/applications/misc/nwg-panel/default.nix6
-rw-r--r--pkgs/applications/misc/nwg-wrapper/default.nix4
-rw-r--r--pkgs/applications/misc/onboard/default.nix4
-rw-r--r--pkgs/applications/misc/openlp/default.nix4
-rw-r--r--pkgs/applications/misc/orca/fix-paths.patch88
-rw-r--r--pkgs/applications/misc/otpclient/default.nix4
-rw-r--r--pkgs/applications/misc/oversteer/default.nix4
-rw-r--r--pkgs/applications/misc/pattypan/default.nix4
-rw-r--r--pkgs/applications/misc/pdf-quench/default.nix4
-rw-r--r--pkgs/applications/misc/pdfarranger/default.nix6
-rw-r--r--pkgs/applications/misc/pdfpc/default.nix4
-rw-r--r--pkgs/applications/misc/pdfsam-basic/default.nix4
-rw-r--r--pkgs/applications/misc/pdfslicer/default.nix4
-rw-r--r--pkgs/applications/misc/phoc/default.nix4
-rw-r--r--pkgs/applications/misc/plank/default.nix4
-rw-r--r--pkgs/applications/misc/playonlinux/default.nix4
-rw-r--r--pkgs/applications/misc/polar-bookshelf/default.nix4
-rw-r--r--pkgs/applications/misc/polar-bookshelf1/default.nix4
-rw-r--r--pkgs/applications/misc/polychromatic/default.nix4
-rw-r--r--pkgs/applications/misc/premid/default.nix4
-rw-r--r--pkgs/applications/misc/printrun/default.nix4
-rw-r--r--pkgs/applications/misc/prusa-slicer/default.nix4
-rw-r--r--pkgs/applications/misc/pytrainer/default.nix4
-rw-r--r--pkgs/applications/misc/qcad/default.nix4
-rw-r--r--pkgs/applications/misc/qtpass/default.nix3
-rw-r--r--pkgs/applications/misc/redshift/default.nix4
-rw-r--r--pkgs/applications/misc/regextester/default.nix4
-rw-r--r--pkgs/applications/misc/remontoire/default.nix4
-rw-r--r--pkgs/applications/misc/rofi-top/default.nix4
-rw-r--r--pkgs/applications/misc/rofi/wrapper.nix4
-rw-r--r--pkgs/applications/misc/rootbar/default.nix4
-rw-r--r--pkgs/applications/misc/safeeyes/default.nix4
-rw-r--r--pkgs/applications/misc/sequeler/default.nix4
-rw-r--r--pkgs/applications/misc/shipments/default.nix4
-rw-r--r--pkgs/applications/misc/siglo/default.nix4
-rw-r--r--pkgs/applications/misc/skytemple/default.nix4
-rw-r--r--pkgs/applications/misc/slic3r/default.nix4
-rw-r--r--pkgs/applications/misc/snapmaker-luban/default.nix4
-rw-r--r--pkgs/applications/misc/snapper-gui/default.nix4
-rw-r--r--pkgs/applications/misc/solaar/default.nix4
-rw-r--r--pkgs/applications/misc/sticky/default.nix4
-rw-r--r--pkgs/applications/misc/streamdeck-ui/default.nix4
-rw-r--r--pkgs/applications/misc/survex/default.nix4
-rw-r--r--pkgs/applications/misc/swappy/default.nix4
-rw-r--r--pkgs/applications/misc/swaynotificationcenter/default.nix4
-rw-r--r--pkgs/applications/misc/swaysettings/default.nix4
-rw-r--r--pkgs/applications/misc/system76-keyboard-configurator/default.nix4
-rw-r--r--pkgs/applications/misc/themechanger/default.nix4
-rw-r--r--pkgs/applications/misc/tint2/default.nix4
-rw-r--r--pkgs/applications/misc/tuhi/default.nix4
-rw-r--r--pkgs/applications/misc/udiskie/default.nix4
-rw-r--r--pkgs/applications/misc/ulauncher/default.nix4
-rw-r--r--pkgs/applications/misc/upwork/default.nix4
-rw-r--r--pkgs/applications/misc/variety/default.nix4
-rw-r--r--pkgs/applications/misc/veracrypt/default.nix4
-rw-r--r--pkgs/applications/misc/viking/default.nix4
-rw-r--r--pkgs/applications/misc/volnoti/default.nix4
-rw-r--r--pkgs/applications/misc/waypaper/default.nix4
-rw-r--r--pkgs/applications/misc/wofi/default.nix4
-rw-r--r--pkgs/applications/misc/workrave/default.nix4
-rw-r--r--pkgs/applications/misc/xautoclick/default.nix4
-rw-r--r--pkgs/applications/misc/xdgmenumaker/default.nix4
-rw-r--r--pkgs/applications/misc/xiphos/default.nix4
-rw-r--r--pkgs/applications/misc/xneur/default.nix4
-rw-r--r--pkgs/applications/misc/xpad/default.nix4
-rw-r--r--pkgs/applications/misc/zathura/core/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/badwolf/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/brave/make-brave.nix4
-rw-r--r--pkgs/applications/networking/browsers/castor/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix44
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.nix6
-rw-r--r--pkgs/applications/networking/browsers/eolie/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/ephemeral/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox-bin/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix4
-rw-r--r--pkgs/applications/networking/browsers/luakit/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/midori/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/mullvad-browser/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/netsurf/browser.nix4
-rw-r--r--pkgs/applications/networking/browsers/nyxt/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/opera/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/palemoon/bin.nix4
-rw-r--r--pkgs/applications/networking/browsers/surf/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/tor-browser/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/vimb/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/yandex-browser/default.nix4
-rw-r--r--pkgs/applications/networking/calls/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kn/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/temporal/default.nix6
-rw-r--r--pkgs/applications/networking/dropbox/cli.nix4
-rw-r--r--pkgs/applications/networking/feedreaders/gnome-feeds/default.nix4
-rw-r--r--pkgs/applications/networking/feedreaders/rssguard/default.nix4
-rw-r--r--pkgs/applications/networking/ftp/filezilla/default.nix4
-rw-r--r--pkgs/applications/networking/ftp/taxi/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/alfaview/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/armcord/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/coyim/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/linux.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/feishu/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/franz/generic.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/gajim/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/mikutter/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/qq/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/vk-messenger/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix20
-rw-r--r--pkgs/applications/networking/instant-messengers/wire-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/irc/srain/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/astroid/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/ayatana-webmail/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/balsa/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/bluemail/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/bubblemail/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/claws-mail/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/evolution/evolution/default.nix10
-rw-r--r--pkgs/applications/networking/mailreaders/mailnag/default.nix6
-rw-r--r--pkgs/applications/networking/mailreaders/mailspring/linux.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix4
-rw-r--r--pkgs/applications/networking/newsreaders/liferea/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/deluge/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/gnunet/gtk.nix4
-rw-r--r--pkgs/applications/networking/p2p/qbittorrent/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/transmission/4.nix4
-rw-r--r--pkgs/applications/networking/p2p/transmission/default.nix4
-rw-r--r--pkgs/applications/networking/protonvpn-gui/default.nix4
-rw-r--r--pkgs/applications/networking/protonvpn-gui/legacy.nix4
-rw-r--r--pkgs/applications/networking/remote/anydesk/default.nix18
-rw-r--r--pkgs/applications/networking/remote/citrix-workspace/generic.nix4
-rw-r--r--pkgs/applications/networking/remote/freerdp/3.nix209
-rw-r--r--pkgs/applications/networking/remote/freerdp/default.nix4
-rw-r--r--pkgs/applications/networking/remote/nice-dcv-client/default.nix4
-rw-r--r--pkgs/applications/networking/remote/remmina/default.nix4
-rw-r--r--pkgs/applications/networking/remote/rustdesk/default.nix4
-rw-r--r--pkgs/applications/networking/sniffers/wireshark/default.nix4
-rw-r--r--pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch12
-rw-r--r--pkgs/applications/networking/sync/rsync/default.nix12
-rw-r--r--pkgs/applications/networking/sync/rsync/rsync-fortified-strlcpy-fix.patch49
-rw-r--r--pkgs/applications/networking/termius/default.nix4
-rw-r--r--pkgs/applications/networking/upnp-router-control/default.nix4
-rw-r--r--pkgs/applications/networking/weather/meteo/default.nix4
-rw-r--r--pkgs/applications/networking/yaup/default.nix4
-rw-r--r--pkgs/applications/office/abiword/default.nix4
-rw-r--r--pkgs/applications/office/agenda/default.nix4
-rw-r--r--pkgs/applications/office/autokey/default.nix4
-rw-r--r--pkgs/applications/office/banana-accounting/default.nix4
-rw-r--r--pkgs/applications/office/beamerpresenter/default.nix4
-rw-r--r--pkgs/applications/office/bookworm/default.nix4
-rw-r--r--pkgs/applications/office/gnote/default.nix8
-rw-r--r--pkgs/applications/office/gnucash/default.nix8
-rw-r--r--pkgs/applications/office/gnumeric/default.nix4
-rw-r--r--pkgs/applications/office/grisbi/default.nix4
-rw-r--r--pkgs/applications/office/gtg/default.nix6
-rw-r--r--pkgs/applications/office/homebank/default.nix4
-rw-r--r--pkgs/applications/office/jabref/default.nix4
-rw-r--r--pkgs/applications/office/jameica/default.nix4
-rw-r--r--pkgs/applications/office/libreoffice/wrapper.nix2
-rw-r--r--pkgs/applications/office/mmex/default.nix4
-rw-r--r--pkgs/applications/office/notes-up/default.nix4
-rw-r--r--pkgs/applications/office/osmo/default.nix4
-rw-r--r--pkgs/applications/office/paperwork/paperwork-gtk.nix4
-rw-r--r--pkgs/applications/office/pinpoint/default.nix2
-rw-r--r--pkgs/applications/office/planify/default.nix4
-rw-r--r--pkgs/applications/office/planner/default.nix2
-rw-r--r--pkgs/applications/office/portfolio/default.nix4
-rw-r--r--pkgs/applications/office/pympress/default.nix4
-rw-r--r--pkgs/applications/office/spice-up/default.nix4
-rw-r--r--pkgs/applications/office/ticktick/default.nix4
-rw-r--r--pkgs/applications/office/timeline/default.nix4
-rw-r--r--pkgs/applications/office/timeular/default.nix4
-rw-r--r--pkgs/applications/office/treesheets/default.nix4
-rw-r--r--pkgs/applications/office/trilium/desktop.nix4
-rw-r--r--pkgs/applications/office/tryton/default.nix4
-rw-r--r--pkgs/applications/office/zim/default.nix4
-rw-r--r--pkgs/applications/office/zotero/default.nix4
-rw-r--r--pkgs/applications/office/zotero/zotero_7.nix4
-rw-r--r--pkgs/applications/radio/chirp/default.nix4
-rw-r--r--pkgs/applications/radio/cqrlog/default.nix4
-rw-r--r--pkgs/applications/radio/gnuradio/wrapper.nix4
-rw-r--r--pkgs/applications/radio/gqrx/default.nix4
-rw-r--r--pkgs/applications/radio/gridtracker/default.nix4
-rw-r--r--pkgs/applications/radio/grig/default.nix4
-rw-r--r--pkgs/applications/radio/tqsl/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/gpredict/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/phd2/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/siril/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/stellarium/default.nix4
-rw-r--r--pkgs/applications/science/biology/igv/default.nix8
-rw-r--r--pkgs/applications/science/biology/jbrowse/default.nix2
-rw-r--r--pkgs/applications/science/biology/last/default.nix4
-rw-r--r--pkgs/applications/science/chemistry/chemtool/default.nix4
-rw-r--r--pkgs/applications/science/electronics/gtkwave/default.nix8
-rw-r--r--pkgs/applications/science/electronics/horizon-eda/default.nix4
-rw-r--r--pkgs/applications/science/electronics/kicad/default.nix4
-rw-r--r--pkgs/applications/science/electronics/openboardview/default.nix4
-rw-r--r--pkgs/applications/science/logic/coq/default.nix4
-rw-r--r--pkgs/applications/science/logic/tlaplus/toolbox.nix4
-rw-r--r--pkgs/applications/science/logic/why3/default.nix4
-rw-r--r--pkgs/applications/science/math/nasc/default.nix4
-rw-r--r--pkgs/applications/science/math/qalculate-gtk/default.nix4
-rw-r--r--pkgs/applications/science/math/rofi-calc/default.nix4
-rw-r--r--pkgs/applications/science/math/wxmaxima/default.nix4
-rw-r--r--pkgs/applications/science/medicine/xmedcon/default.nix4
-rw-r--r--pkgs/applications/science/misc/root/default.nix25
-rw-r--r--pkgs/applications/science/physics/crystfel/default.nix54
-rw-r--r--pkgs/applications/science/physics/crystfel/gui-path-issue.patch27
-rw-r--r--pkgs/applications/science/physics/crystfel/link-to-argp-standalone-if-needed.patch18
-rw-r--r--pkgs/applications/science/physics/xnec2c/default.nix4
-rw-r--r--pkgs/applications/science/robotics/betaflight-configurator/default.nix4
-rw-r--r--pkgs/applications/science/robotics/emuflight-configurator/default.nix4
-rw-r--r--pkgs/applications/science/robotics/inav-configurator/default.nix4
-rw-r--r--pkgs/applications/system/monitor/default.nix4
-rw-r--r--pkgs/applications/system/thumbdrives/default.nix4
-rw-r--r--pkgs/applications/terminal-emulators/gnome-console/default.nix4
-rw-r--r--pkgs/applications/terminal-emulators/guake/default.nix4
-rw-r--r--pkgs/applications/terminal-emulators/lxterminal/default.nix4
-rw-r--r--pkgs/applications/terminal-emulators/mlterm/default.nix4
-rw-r--r--pkgs/applications/terminal-emulators/terminator/default.nix4
-rw-r--r--pkgs/applications/terminal-emulators/termite/default.nix4
-rw-r--r--pkgs/applications/version-management/deepgit/default.nix4
-rw-r--r--pkgs/applications/version-management/gerrit/default.nix4
-rw-r--r--pkgs/applications/version-management/gitkraken/default.nix4
-rw-r--r--pkgs/applications/version-management/meld/default.nix4
-rw-r--r--pkgs/applications/version-management/sublime-merge/common.nix4
-rw-r--r--pkgs/applications/video/bombono/default.nix4
-rw-r--r--pkgs/applications/video/byzanz/default.nix4
-rw-r--r--pkgs/applications/video/devede/default.nix4
-rw-r--r--pkgs/applications/video/dvdstyler/default.nix4
-rw-r--r--pkgs/applications/video/entangle/default.nix4
-rw-r--r--pkgs/applications/video/flowblade/default.nix4
-rw-r--r--pkgs/applications/video/gnome-mplayer/default.nix4
-rw-r--r--pkgs/applications/video/gnomecast/default.nix4
-rw-r--r--pkgs/applications/video/gpu-screen-recorder/gpu-screen-recorder-gtk.nix4
-rw-r--r--pkgs/applications/video/handbrake/default.nix4
-rw-r--r--pkgs/applications/video/hypnotix/default.nix4
-rw-r--r--pkgs/applications/video/imagination/default.nix4
-rw-r--r--pkgs/applications/video/jellyfin-mpv-shim/default.nix4
-rw-r--r--pkgs/applications/video/kazam/default.nix4
-rw-r--r--pkgs/applications/video/mpv/scripts/default.nix2
-rw-r--r--pkgs/applications/video/mpv/scripts/mpv-cheatsheet.nix8
-rw-r--r--pkgs/applications/video/mpv/scripts/mpv-slicing.nix34
-rw-r--r--pkgs/applications/video/mpv/scripts/videoclip.nix40
-rw-r--r--pkgs/applications/video/obs-studio/default.nix4
-rw-r--r--pkgs/applications/video/obs-studio/plugins/obs-webkitgtk.nix4
-rw-r--r--pkgs/applications/video/openshot-qt/default.nix4
-rw-r--r--pkgs/applications/video/peek/default.nix4
-rw-r--r--pkgs/applications/video/pipe-viewer/default.nix6
-rw-r--r--pkgs/applications/video/pitivi/default.nix4
-rw-r--r--pkgs/applications/video/plex-mpv-shim/default.nix4
-rw-r--r--pkgs/applications/video/recapp/default.nix4
-rw-r--r--pkgs/applications/video/rtabmap/default.nix4
-rw-r--r--pkgs/applications/video/screenkey/default.nix6
-rw-r--r--pkgs/applications/video/streamlink-twitch-gui/bin.nix4
-rw-r--r--pkgs/applications/video/subtitleeditor/default.nix4
-rw-r--r--pkgs/applications/video/tartube/default.nix4
-rw-r--r--pkgs/applications/video/timelens/default.nix4
-rw-r--r--pkgs/applications/video/vdr/softhddevice/default.nix4
-rw-r--r--pkgs/applications/video/xplayer/default.nix4
-rw-r--r--pkgs/applications/virtualization/conmon-rs/default.nix6
-rw-r--r--pkgs/applications/virtualization/conmon/default.nix6
-rw-r--r--pkgs/applications/virtualization/docker/compose.nix6
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix4
-rw-r--r--pkgs/applications/virtualization/quickgui/default.nix37
-rw-r--r--pkgs/applications/virtualization/virt-manager/default.nix4
-rw-r--r--pkgs/applications/virtualization/virt-viewer/default.nix4
-rw-r--r--pkgs/applications/window-managers/wayfire/wcm.nix4
-rwxr-xr-xpkgs/build-support/fetchgit/nix-prefetch-git2
-rw-r--r--pkgs/build-support/fetchgit/tests.nix7
-rw-r--r--pkgs/build-support/flutter/default.nix4
-rw-r--r--pkgs/build-support/rust/hooks/cargo-build-hook.sh9
-rw-r--r--pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix16
-rw-r--r--pkgs/by-name/ae/aegisub/package.nix4
-rw-r--r--pkgs/by-name/ag/ags/package.nix4
-rw-r--r--pkgs/by-name/al/alsa-ucm-conf/package.nix17
-rw-r--r--pkgs/by-name/am/am2rlauncher/package.nix4
-rw-r--r--pkgs/by-name/an/annotator/package.nix4
-rw-r--r--pkgs/by-name/an/ansel/package.nix4
-rw-r--r--pkgs/by-name/an/anyrun/package.nix4
-rw-r--r--pkgs/by-name/an/anytype/package.nix4
-rw-r--r--pkgs/by-name/ap/apt/package.nix4
-rw-r--r--pkgs/by-name/ap/apvlv/package.nix4
-rw-r--r--pkgs/by-name/ay/ayatana-indicator-datetime/package.nix4
-rw-r--r--pkgs/by-name/ay/ayatana-indicator-messages/package.nix8
-rw-r--r--pkgs/by-name/ay/ayatana-indicator-session/package.nix4
-rw-r--r--pkgs/by-name/bi/biglybt/package.nix4
-rw-r--r--pkgs/by-name/bo/boehmgc/package.nix8
-rw-r--r--pkgs/by-name/bu/bustle/package.nix61
-rw-r--r--pkgs/by-name/bu/buttermanager/package.nix4
-rw-r--r--pkgs/by-name/cl/clamtk/package.nix4
-rw-r--r--pkgs/by-name/cl/clash-verge/package.nix4
-rw-r--r--pkgs/by-name/cm/cmake/package.nix4
-rw-r--r--pkgs/by-name/co/connman-gtk/package.nix4
-rw-r--r--pkgs/by-name/co/connman-notify/package.nix4
-rw-r--r--pkgs/by-name/cp/cpu-x/package.nix4
-rw-r--r--pkgs/by-name/cr/cryptor/package.nix4
-rw-r--r--pkgs/by-name/di/digikam/package.nix4
-rw-r--r--pkgs/by-name/di/discover-overlay/package.nix5
-rw-r--r--pkgs/by-name/di/displaycal/package.nix4
-rw-r--r--pkgs/by-name/dm/dmarc-report-converter/package.nix4
-rw-r--r--pkgs/by-name/do/dorion/package.nix4
-rw-r--r--pkgs/by-name/du/dune3d/package.nix4
-rw-r--r--pkgs/by-name/ed/eduvpn-client/package.nix4
-rw-r--r--pkgs/by-name/ew/eww/package.nix4
-rw-r--r--pkgs/by-name/fi/firefoxpwa/Cargo.lock1298
-rw-r--r--pkgs/by-name/fi/firefoxpwa/package.nix12
-rw-r--r--pkgs/by-name/fo/forge-sparks/package.nix16
-rw-r--r--pkgs/by-name/fr/fragments/package.nix (renamed from pkgs/applications/networking/p2p/fragments/default.nix)27
-rw-r--r--pkgs/by-name/fr/freecad/package.nix4
-rw-r--r--pkgs/by-name/fr/freefilesync/package.nix4
-rw-r--r--pkgs/by-name/fr/fretboard/package.nix22
-rw-r--r--pkgs/by-name/fw/fwupd/package.nix2
-rw-r--r--pkgs/by-name/ge/gema/package.nix36
-rw-r--r--pkgs/by-name/ge/germinal/package.nix4
-rw-r--r--pkgs/by-name/gh/ghciwatch/package.nix40
-rw-r--r--pkgs/by-name/gi/github-desktop/package.nix4
-rw-r--r--pkgs/by-name/gl/glycin-loaders/fix-glycin-paths.patch35
-rw-r--r--pkgs/by-name/gl/glycin-loaders/package.nix10
-rw-r--r--pkgs/by-name/gm/gmetronome/package.nix4
-rw-r--r--pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix48
-rw-r--r--pkgs/by-name/gp/gpscorrelate/package.nix4
-rw-r--r--pkgs/by-name/gp/gpt4all/package.nix9
-rw-r--r--pkgs/by-name/gt/gtimelog/package.nix4
-rw-r--r--pkgs/by-name/gt/gtkhash/package.nix4
-rw-r--r--pkgs/by-name/ho/hoppscotch/package.nix8
-rw-r--r--pkgs/by-name/ir/ironbar/package.nix4
-rw-r--r--pkgs/by-name/je/jetbrains-toolbox/package.nix4
-rw-r--r--pkgs/by-name/ke/keydb/package.nix16
-rw-r--r--pkgs/by-name/ko/konbucase/package.nix4
-rw-r--r--pkgs/by-name/ko/koodo-reader/package.nix4
-rw-r--r--pkgs/by-name/ko/kor/package.nix6
-rw-r--r--pkgs/by-name/la/labwc-gtktheme/package.nix4
-rw-r--r--pkgs/by-name/la/labwc-tweaks-gtk/package.nix4
-rw-r--r--pkgs/by-name/la/lager/package.nix17
-rw-r--r--pkgs/by-name/li/libation/package.nix4
-rw-r--r--pkgs/by-name/li/libcpuid/package.nix4
-rw-r--r--pkgs/by-name/li/libiff/package.nix34
-rw-r--r--pkgs/by-name/li/libilbm/package.nix38
-rw-r--r--pkgs/by-name/li/libmsgraph/package.nix73
-rw-r--r--pkgs/by-name/li/live555/package.nix7
-rw-r--r--pkgs/by-name/ll/llama-cpp/package.nix13
-rw-r--r--pkgs/by-name/lo/lorem/package.nix24
-rw-r--r--pkgs/by-name/lo/loupe/package.nix10
-rw-r--r--pkgs/by-name/lu/lunar-client/package.nix4
-rw-r--r--pkgs/by-name/mc/mcomix/package.nix4
-rw-r--r--pkgs/by-name/me/mednaffe/package.nix4
-rw-r--r--pkgs/by-name/me/menulibre/package.nix4
-rw-r--r--pkgs/by-name/mg/mgba/package.nix4
-rw-r--r--pkgs/by-name/my/myxer/package.nix4
-rw-r--r--pkgs/by-name/ne/nestopia-ue/package.nix4
-rw-r--r--pkgs/by-name/no/normcap/package.nix4
-rw-r--r--pkgs/by-name/nw/nwg-drawer/package.nix4
-rw-r--r--pkgs/by-name/nw/nwg-hello/package.nix4
-rw-r--r--pkgs/by-name/ol/olvid/package.nix4
-rw-r--r--pkgs/by-name/on/onedriver/package.nix4
-rw-r--r--pkgs/by-name/on/onlyoffice-bin/package.nix4
-rw-r--r--pkgs/by-name/on/onlyoffice-bin_latest/package.nix4
-rw-r--r--pkgs/by-name/op/openscad-unstable/package.nix4
-rw-r--r--pkgs/by-name/op/openswitcher/package.nix4
-rw-r--r--pkgs/by-name/or/orca/fix-paths.patch75
-rw-r--r--pkgs/by-name/or/orca/package.nix (renamed from pkgs/applications/misc/orca/default.nix)37
-rw-r--r--pkgs/by-name/pa/pablodraw/package.nix4
-rw-r--r--pkgs/by-name/pa/paper-clip/package.nix4
-rw-r--r--pkgs/by-name/pa/paper-plane/package.nix4
-rw-r--r--pkgs/by-name/pa/papers/Cargo.lock1251
-rw-r--r--pkgs/by-name/pa/papers/package.nix133
-rw-r--r--pkgs/by-name/pg/pgmoneta/package.nix4
-rw-r--r--pkgs/by-name/ph/photocollage/package.nix4
-rw-r--r--pkgs/by-name/pi/pinact/package.nix6
-rw-r--r--pkgs/by-name/pl/plasticity/package.nix4
-rw-r--r--pkgs/by-name/po/popcorntime/package.nix4
-rw-r--r--pkgs/by-name/po/pot/package.nix4
-rw-r--r--pkgs/by-name/po/powersupply/package.nix4
-rw-r--r--pkgs/by-name/pu/puppet-bolt/package.nix6
-rw-r--r--pkgs/by-name/pw/pw3270/package.nix4
-rw-r--r--pkgs/by-name/qu/quark-goldleaf/package.nix4
-rw-r--r--pkgs/by-name/rm/rmenu/package.nix4
-rw-r--r--pkgs/by-name/ro/roxterm/package.nix4
-rw-r--r--pkgs/by-name/sa/satellite/package.nix4
-rw-r--r--pkgs/by-name/sc/scotch/package.nix (renamed from pkgs/applications/science/math/scotch/default.nix)42
-rw-r--r--pkgs/by-name/sh/shell-gpt/package.nix51
-rw-r--r--pkgs/by-name/si/silverbullet/package.nix4
-rw-r--r--pkgs/by-name/sm/smartgithg/package.nix4
-rw-r--r--pkgs/by-name/sn/snes9x/package.nix4
-rw-r--r--pkgs/by-name/sn/snippetexpandergui/package.nix4
-rw-r--r--pkgs/by-name/sn/snippetexpanderx/package.nix4
-rw-r--r--pkgs/by-name/sp/spotube/package.nix4
-rw-r--r--pkgs/by-name/sq/squirreldisk/package.nix4
-rw-r--r--pkgs/by-name/su/surrealdb/package.nix8
-rw-r--r--pkgs/by-name/sw/sway-easyfocus/package.nix4
-rw-r--r--pkgs/by-name/sw/sway/package.nix4
-rw-r--r--pkgs/by-name/sw/swayosd/package.nix4
-rw-r--r--pkgs/by-name/sw/switcheroo/package.nix8
-rw-r--r--pkgs/by-name/sy/syslogng/package.nix14
-rw-r--r--pkgs/by-name/te/textsnatcher/package.nix4
-rw-r--r--pkgs/by-name/th/themix-gui/package.nix4
-rw-r--r--pkgs/by-name/ti/tilix/package.nix4
-rw-r--r--pkgs/by-name/tr/treedome/package.nix4
-rw-r--r--pkgs/by-name/uh/uhttpmock_1_0/package.nix56
-rw-r--r--pkgs/by-name/un/unciv/package.nix4
-rw-r--r--pkgs/by-name/un/unison/package.nix4
-rw-r--r--pkgs/by-name/va/vaults/package.nix4
-rw-r--r--pkgs/by-name/vl/vlc/package.nix4
-rw-r--r--pkgs/by-name/wa/waybar/package.nix4
-rw-r--r--pkgs/by-name/wa/waycheck/package.nix4
-rw-r--r--pkgs/by-name/wh/whistle/package.nix6
-rw-r--r--pkgs/by-name/xc/xclicker/package.nix4
-rw-r--r--pkgs/by-name/xe/xemu/package.nix4
-rw-r--r--pkgs/by-name/ye/yesplaymusic/package.nix4
-rw-r--r--pkgs/by-name/ze/zed-editor/Cargo.lock119
-rw-r--r--pkgs/by-name/ze/zed-editor/package.nix4
-rw-r--r--pkgs/data/documentation/gnome-user-docs/default.nix4
-rw-r--r--pkgs/data/fonts/cascadia-code/default.nix6
-rw-r--r--pkgs/data/themes/matcha/default.nix4
-rw-r--r--pkgs/data/themes/whitesur/default.nix14
-rw-r--r--pkgs/desktops/budgie/budgie-control-center/default.nix4
-rw-r--r--pkgs/desktops/budgie/budgie-desktop-view/default.nix4
-rw-r--r--pkgs/desktops/budgie/budgie-desktop/default.nix4
-rw-r--r--pkgs/desktops/budgie/budgie-desktop/wrapper.nix4
-rw-r--r--pkgs/desktops/budgie/budgie-gsettings-overrides/default.nix3
-rw-r--r--pkgs/desktops/budgie/budgie-screensaver/default.nix4
-rw-r--r--pkgs/desktops/budgie/magpie/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/bulky/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-common/default.nix31
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-control-center/default.nix8
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-desktop/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-menus/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-session/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/muffin/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/nemo/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/pix/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/warpinator/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/xapp/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/xreader/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/xviewer/default.nix4
-rw-r--r--pkgs/desktops/deepin/core/dde-control-center/default.nix4
-rw-r--r--pkgs/desktops/deepin/core/dde-dock/default.nix4
-rw-r--r--pkgs/desktops/deepin/core/dde-file-manager/default.nix4
-rw-r--r--pkgs/desktops/deepin/core/dde-session-shell/default.nix4
-rw-r--r--pkgs/desktops/deepin/go-package/dde-api/default.nix4
-rw-r--r--pkgs/desktops/deepin/go-package/dde-daemon/default.nix4
-rw-r--r--pkgs/desktops/deepin/go-package/startdde/default.nix4
-rw-r--r--pkgs/desktops/enlightenment/rage/default.nix4
-rw-r--r--pkgs/desktops/gnome/apps/accerciser/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/cheese/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/file-roller/default.nix20
-rw-r--r--pkgs/desktops/gnome/apps/ghex/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gnome-boxes/default.nix14
-rw-r--r--pkgs/desktops/gnome/apps/gnome-calendar/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gnome-characters/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gnome-clocks/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gnome-connections/default.nix10
-rw-r--r--pkgs/desktops/gnome/apps/gnome-logs/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gnome-maps/default.nix22
-rw-r--r--pkgs/desktops/gnome/apps/gnome-music/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gnome-nettool/default.nix4
-rw-r--r--pkgs/desktops/gnome/apps/gnome-notes/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gnome-power-manager/default.nix4
-rw-r--r--pkgs/desktops/gnome/apps/gnome-sound-recorder/default.nix2
-rw-r--r--pkgs/desktops/gnome/apps/gnome-text-editor/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gnome-weather/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/polari/default.nix13
-rw-r--r--pkgs/desktops/gnome/apps/seahorse/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/vinagre/default.nix10
-rw-r--r--pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/baobab/default.nix6
-rw-r--r--pkgs/desktops/gnome/core/caribou/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/dconf-editor/default.nix6
-rw-r--r--pkgs/desktops/gnome/core/eog/default.nix6
-rw-r--r--pkgs/desktops/gnome/core/epiphany/default.nix6
-rw-r--r--pkgs/desktops/gnome/core/evince/default.nix10
-rw-r--r--pkgs/desktops/gnome/core/evolution-data-server/default.nix14
-rw-r--r--pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch38
-rw-r--r--pkgs/desktops/gnome/core/gdm/default.nix8
-rw-r--r--pkgs/desktops/gnome/core/gdm/fix-paths.patch20
-rw-r--r--pkgs/desktops/gnome/core/gnome-backgrounds/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-bluetooth/1.0/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-bluetooth/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-calculator/default.nix8
-rw-r--r--pkgs/desktops/gnome/core/gnome-color-manager/default.nix1
-rw-r--r--pkgs/desktops/gnome/core/gnome-contacts/default.nix8
-rw-r--r--pkgs/desktops/gnome/core/gnome-control-center/default.nix17
-rw-r--r--pkgs/desktops/gnome/core/gnome-control-center/paths.patch49
-rw-r--r--pkgs/desktops/gnome/core/gnome-dictionary/default.nix10
-rw-r--r--pkgs/desktops/gnome/core/gnome-disk-utility/default.nix10
-rw-r--r--pkgs/desktops/gnome/core/gnome-font-viewer/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-initial-setup/default.nix10
-rw-r--r--pkgs/desktops/gnome/core/gnome-keyring/default.nix11
-rw-r--r--pkgs/desktops/gnome/core/gnome-online-miners/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix25
-rw-r--r--pkgs/desktops/gnome/core/gnome-screenshot/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-session/ctl.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-session/default.nix9
-rw-r--r--pkgs/desktops/gnome/core/gnome-settings-daemon/43/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix8
-rw-r--r--pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-shell/default.nix19
-rw-r--r--pkgs/desktops/gnome/core/gnome-shell/fix-paths.patch13
-rw-r--r--pkgs/desktops/gnome/core/gnome-shell/greeter-logo-size.patch8
-rw-r--r--pkgs/desktops/gnome/core/gnome-software/default.nix18
-rw-r--r--pkgs/desktops/gnome/core/gnome-system-monitor/default.nix22
-rw-r--r--pkgs/desktops/gnome/core/gnome-terminal/default.nix10
-rw-r--r--pkgs/desktops/gnome/core/gnome-tour/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gucharmap/default.nix6
-rw-r--r--pkgs/desktops/gnome/core/mutter/43/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/mutter/default.nix10
-rw-r--r--pkgs/desktops/gnome/core/nautilus/default.nix8
-rw-r--r--pkgs/desktops/gnome/core/nautilus/extension_dir.patch2
-rw-r--r--pkgs/desktops/gnome/core/rygel/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/simple-scan/default.nix16
-rw-r--r--pkgs/desktops/gnome/core/sushi/default.nix8
-rw-r--r--pkgs/desktops/gnome/core/totem/default.nix6
-rw-r--r--pkgs/desktops/gnome/core/yelp-xsl/default.nix2
-rw-r--r--pkgs/desktops/gnome/core/yelp/default.nix6
-rw-r--r--pkgs/desktops/gnome/devtools/devhelp/default.nix6
-rw-r--r--pkgs/desktops/gnome/extensions/default.nix2
-rw-r--r--pkgs/desktops/gnome/extensions/extensionOverrides.nix6
-rw-r--r--pkgs/desktops/gnome/extensions/gsconnect/default.nix4
-rw-r--r--pkgs/desktops/gnome/games/aisleriot/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/atomix/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/five-or-more/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/four-in-a-row/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/gnome-2048/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/gnome-chess/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/gnome-klotski/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/gnome-mahjongg/default.nix2
-rw-r--r--pkgs/desktops/gnome/games/gnome-mines/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/gnome-nibbles/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/gnome-robots/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/gnome-sudoku/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/gnome-taquin/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/gnome-tetravex/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/hitori/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/iagno/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/lightsoff/default.nix10
-rw-r--r--pkgs/desktops/gnome/games/quadrapassel/default.nix6
-rw-r--r--pkgs/desktops/gnome/games/swell-foop/default.nix31
-rw-r--r--pkgs/desktops/gnome/games/tali/default.nix6
-rw-r--r--pkgs/desktops/gnome/misc/geary/default.nix6
-rw-r--r--pkgs/desktops/gnome/misc/gitg/default.nix6
-rw-r--r--pkgs/desktops/gnome/misc/gnome-applets/default.nix4
-rw-r--r--pkgs/desktops/gnome/misc/gnome-flashback/default.nix12
-rw-r--r--pkgs/desktops/gnome/misc/gnome-packagekit/default.nix4
-rw-r--r--pkgs/desktops/gnome/misc/gnome-panel/default.nix8
-rw-r--r--pkgs/desktops/gnome/misc/gnome-panel/wrapper.nix4
-rw-r--r--pkgs/desktops/gnome/misc/gnome-tweaks/default.nix23
-rw-r--r--pkgs/desktops/gnome/misc/gpaste/default.nix26
-rw-r--r--pkgs/desktops/gnome/misc/metacity/default.nix8
-rw-r--r--pkgs/desktops/gnome/misc/nautilus-python/default.nix4
-rw-r--r--pkgs/desktops/gnome/misc/pomodoro/default.nix4
-rw-r--r--pkgs/desktops/lomiri/applications/lomiri-system-settings/default.nix2
-rw-r--r--pkgs/desktops/lomiri/applications/lomiri-system-settings/wrapper.nix4
-rw-r--r--pkgs/desktops/lomiri/applications/lomiri/default.nix4
-rw-r--r--pkgs/desktops/lomiri/services/content-hub/default.nix4
-rw-r--r--pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix4
-rw-r--r--pkgs/desktops/lumina/lumina/default.nix4
-rw-r--r--pkgs/desktops/lxde/core/lxappearance/default.nix4
-rw-r--r--pkgs/desktops/lxde/core/lxsession/default.nix4
-rw-r--r--pkgs/desktops/mate/atril/default.nix4
-rw-r--r--pkgs/desktops/mate/caja-extensions/default.nix4
-rw-r--r--pkgs/desktops/mate/caja/default.nix4
-rw-r--r--pkgs/desktops/mate/caja/with-extensions.nix4
-rw-r--r--pkgs/desktops/mate/engrampa/default.nix4
-rw-r--r--pkgs/desktops/mate/eom/default.nix4
-rw-r--r--pkgs/desktops/mate/marco/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-applets/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-calc/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-control-center/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-desktop/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-indicator-applet/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-media/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-netbook/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-notification-daemon/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-panel/default.nix6
-rw-r--r--pkgs/desktops/mate/mate-panel/with-applets.nix4
-rw-r--r--pkgs/desktops/mate/mate-power-manager/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-screensaver/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-session-manager/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-settings-daemon/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-settings-daemon/wrapped.nix4
-rw-r--r--pkgs/desktops/mate/mate-system-monitor/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-terminal/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-tweak/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-user-share/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-utils/default.nix4
-rw-r--r--pkgs/desktops/mate/mozo/default.nix4
-rw-r--r--pkgs/desktops/mate/pluma/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/appcenter/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-calendar/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-camera/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-code/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-dock/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-files/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-mail/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-photos/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-tasks/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-terminal/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-videos/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/switchboard/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/switchboard/wrapper.nix4
-rw-r--r--pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix6
-rw-r--r--pkgs/desktops/pantheon/desktop/gala/default.nix4
-rw-r--r--pkgs/desktops/pantheon/desktop/wingpanel/default.nix4
-rw-r--r--pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix4
-rw-r--r--pkgs/desktops/pantheon/granite/default.nix4
-rw-r--r--pkgs/desktops/pantheon/services/contractor/default.nix4
-rw-r--r--pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix4
-rw-r--r--pkgs/desktops/pantheon/services/elementary-notifications/default.nix10
-rw-r--r--pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix4
-rw-r--r--pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix4
-rw-r--r--pkgs/desktops/pantheon/services/pantheon-agent-polkit/default.nix4
-rw-r--r--pkgs/desktops/plasma-5/kde-gtk-config/default.nix4
-rw-r--r--pkgs/desktops/rox/rox-filer/default.nix4
-rw-r--r--pkgs/desktops/xfce/applications/catfish/default.nix4
-rw-r--r--pkgs/desktops/xfce/mkXfceDerivation.nix4
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-dockbarx-plugin/default.nix4
-rw-r--r--pkgs/development/compilers/dtc/default.nix6
-rw-r--r--pkgs/development/compilers/flutter/wrapper.nix4
-rw-r--r--pkgs/development/compilers/gnu-cim/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/12/default.nix47
-rw-r--r--pkgs/development/compilers/llvm/12/llvm/default.nix357
-rw-r--r--pkgs/development/compilers/llvm/13/default.nix42
-rw-r--r--pkgs/development/compilers/llvm/13/llvm/default.nix315
-rw-r--r--pkgs/development/compilers/llvm/14/default.nix23
-rw-r--r--pkgs/development/compilers/llvm/14/llvm/default.nix323
-rw-r--r--pkgs/development/compilers/llvm/15/default.nix59
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/default.nix442
-rw-r--r--pkgs/development/compilers/llvm/16/default.nix52
-rw-r--r--pkgs/development/compilers/llvm/16/llvm/default.nix435
-rw-r--r--pkgs/development/compilers/llvm/17/default.nix52
-rw-r--r--pkgs/development/compilers/llvm/17/llvm/default.nix431
-rw-r--r--pkgs/development/compilers/llvm/18/default.nix52
-rw-r--r--pkgs/development/compilers/llvm/common/clang/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/common/llvm/default.nix (renamed from pkgs/development/compilers/llvm/18/llvm/default.nix)334
-rw-r--r--pkgs/development/compilers/llvm/git/default.nix52
-rw-r--r--pkgs/development/compilers/llvm/git/llvm/default.nix435
-rw-r--r--pkgs/development/compilers/orc/default.nix2
-rw-r--r--pkgs/development/compilers/rust/rustc.nix2
-rw-r--r--pkgs/development/compilers/sbcl/default.nix6
-rw-r--r--pkgs/development/compilers/vala/default.nix12
-rw-r--r--pkgs/development/coq-modules/coqide/default.nix4
-rw-r--r--pkgs/development/coq-modules/vscoq-language-server/default.nix4
-rw-r--r--pkgs/development/embedded/arduino/arduino-core/default.nix4
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix23
-rw-r--r--pkgs/development/haskell-modules/configuration-nix.nix2
-rw-r--r--pkgs/development/interpreters/erlang/generic-builder.nix4
-rw-r--r--pkgs/development/interpreters/gnudatalanguage/default.nix4
-rw-r--r--pkgs/development/interpreters/gtk-server/default.nix4
-rw-r--r--pkgs/development/interpreters/ngn-k/default.nix2
-rw-r--r--pkgs/development/interpreters/racket/default.nix4
-rw-r--r--pkgs/development/interpreters/racket/racket_7_9.nix4
-rw-r--r--pkgs/development/interpreters/ruby/default.nix8
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/default.nix4
-rw-r--r--pkgs/development/libraries/aravis/default.nix6
-rw-r--r--pkgs/development/libraries/at-spi2-core/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-auth/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-common/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-io/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-s3/default.nix4
-rw-r--r--pkgs/development/libraries/aws-crt-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/bamf/default.nix4
-rw-r--r--pkgs/development/libraries/duckdb/default.nix1
-rw-r--r--pkgs/development/libraries/duckdb/versions.json6
-rw-r--r--pkgs/development/libraries/enchant/2.x.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix21
-rw-r--r--pkgs/development/libraries/folks/default.nix4
-rw-r--r--pkgs/development/libraries/gcr/4.nix4
-rw-r--r--pkgs/development/libraries/gcr/default.nix4
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/default.nix4
-rw-r--r--pkgs/development/libraries/geis/default.nix4
-rw-r--r--pkgs/development/libraries/geoclue/default.nix4
-rw-r--r--pkgs/development/libraries/giflib/default.nix11
-rw-r--r--pkgs/development/libraries/gjs/default.nix8
-rw-r--r--pkgs/development/libraries/gjs/disable-introspection-test.patch12
-rw-r--r--pkgs/development/libraries/glib-networking/default.nix4
-rw-r--r--pkgs/development/libraries/glib/default.nix136
-rw-r--r--pkgs/development/libraries/glib/elementary-terminal-support.patch4
-rw-r--r--pkgs/development/libraries/glib/glib-appinfo-watch.patch26
-rw-r--r--pkgs/development/libraries/glib/schema-override-variable.patch4
-rw-r--r--pkgs/development/libraries/glib/skip-timer-test.patch17
-rw-r--r--pkgs/development/libraries/glib/split-dev-programs.patch34
-rw-r--r--pkgs/development/libraries/glibc/2.39-master.patch8526
-rw-r--r--pkgs/development/libraries/glibc/common.nix17
-rw-r--r--pkgs/development/libraries/glibc/default.nix3
-rw-r--r--pkgs/development/libraries/glibmm/2.68.nix4
-rw-r--r--pkgs/development/libraries/glibmm/default.nix4
-rw-r--r--pkgs/development/libraries/gnome-online-accounts/default.nix27
-rw-r--r--pkgs/development/libraries/gobject-introspection/default.nix10
-rw-r--r--pkgs/development/libraries/gsettings-desktop-schemas/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/bad/default.nix25
-rw-r--r--pkgs/development/libraries/gstreamer/bad/fix-paths.patch26
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix9
-rw-r--r--pkgs/development/libraries/gstreamer/core/default.nix9
-rw-r--r--pkgs/development/libraries/gstreamer/devtools/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/ges/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/good/default.nix14
-rw-r--r--pkgs/development/libraries/gstreamer/libav/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/rtsp-server/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/ugly/default.nix6
-rw-r--r--pkgs/development/libraries/gstreamer/vaapi/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/viperfx/default.nix4
-rw-r--r--pkgs/development/libraries/gtk-frdp/default.nix10
-rw-r--r--pkgs/development/libraries/gtk/4.x.nix12
-rw-r--r--pkgs/development/libraries/gtkmm/4.x.nix4
-rw-r--r--pkgs/development/libraries/gtksourceview/5.x.nix6
-rw-r--r--pkgs/development/libraries/gvfs/default.nix16
-rw-r--r--pkgs/development/libraries/hyena/default.nix2
-rw-r--r--pkgs/development/libraries/icu/make-icu.nix2
-rw-r--r--pkgs/development/libraries/intel-gmmlib/default.nix4
-rw-r--r--pkgs/development/libraries/kde-frameworks/kded.nix4
-rw-r--r--pkgs/development/libraries/libadwaita/default.nix4
-rw-r--r--pkgs/development/libraries/libajantv2/default.nix15
-rw-r--r--pkgs/development/libraries/libarchive/default.nix30
-rw-r--r--pkgs/development/libraries/libbluray/default.nix11
-rw-r--r--pkgs/development/libraries/libcloudproviders/default.nix2
-rw-r--r--pkgs/development/libraries/libdazzle/default.nix2
-rw-r--r--pkgs/development/libraries/libdex/default.nix13
-rw-r--r--pkgs/development/libraries/libgnome-games-support/2.0.nix2
-rw-r--r--pkgs/development/libraries/libgnome-games-support/default.nix2
-rw-r--r--pkgs/development/libraries/libgnomekbd/default.nix4
-rw-r--r--pkgs/development/libraries/libgweather/default.nix4
-rw-r--r--pkgs/development/libraries/libhandy/default.nix2
-rw-r--r--pkgs/development/libraries/libical/default.nix8
-rw-r--r--pkgs/development/libraries/libjxl/default.nix4
-rw-r--r--pkgs/development/libraries/liblc3/default.nix9
-rw-r--r--pkgs/development/libraries/libmodulemd/default.nix26
-rw-r--r--pkgs/development/libraries/libmodulemd/glib-devdoc.patch13
-rw-r--r--pkgs/development/libraries/libopus/default.nix5
-rw-r--r--pkgs/development/libraries/libopus/fix-pkg-config-paths.patch13
-rw-r--r--pkgs/development/libraries/libpanel/default.nix4
-rw-r--r--pkgs/development/libraries/libpeas/2.x.nix4
-rw-r--r--pkgs/development/libraries/libpeas/default.nix4
-rw-r--r--pkgs/development/libraries/librealsense/default.nix2
-rw-r--r--pkgs/development/libraries/libsecret/default.nix9
-rw-r--r--pkgs/development/libraries/libshumate/default.nix28
-rw-r--r--pkgs/development/libraries/libunique/3.x.nix2
-rw-r--r--pkgs/development/libraries/libunique/default.nix2
-rw-r--r--pkgs/development/libraries/libunwind/default.nix2
-rw-r--r--pkgs/development/libraries/libusb1/default.nix15
-rw-r--r--pkgs/development/libraries/libwacom/default.nix4
-rw-r--r--pkgs/development/libraries/libwebp/default.nix6
-rw-r--r--pkgs/development/libraries/llhttp/default.nix16
-rw-r--r--pkgs/development/libraries/mesa/default.nix392
-rw-r--r--pkgs/development/libraries/mlt/default.nix4
-rw-r--r--pkgs/development/libraries/msgpack-c/default.nix9
-rw-r--r--pkgs/development/libraries/openssl/default.nix6
-rw-r--r--pkgs/development/libraries/pango/default.nix4
-rw-r--r--pkgs/development/libraries/pangomm/2.48.nix4
-rw-r--r--pkgs/development/libraries/python-qt/default.nix4
-rw-r--r--pkgs/development/libraries/qtkeychain/default.nix3
-rw-r--r--pkgs/development/libraries/re2/default.nix4
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix14
-rw-r--r--pkgs/development/libraries/snappy/default.nix9
-rw-r--r--pkgs/development/libraries/spice-gtk/default.nix4
-rw-r--r--pkgs/development/libraries/template-glib/default.nix4
-rw-r--r--pkgs/development/libraries/totem-pl-parser/default.nix2
-rw-r--r--pkgs/development/libraries/tracker-miners/default.nix4
-rw-r--r--pkgs/development/libraries/tracker/default.nix6
-rw-r--r--pkgs/development/libraries/vte/default.nix10
-rw-r--r--pkgs/development/libraries/wildmidi/default.nix8
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK32.nix2
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix4
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix4
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal-xapp/default.nix4
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal/default.nix6
-rw-r--r--pkgs/development/lisp-modules/packages.nix2
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix641
-rw-r--r--pkgs/development/lua-modules/overrides.nix40
-rw-r--r--pkgs/development/lua-modules/toml.patch25
-rw-r--r--pkgs/development/misc/yelp-tools/default.nix2
-rw-r--r--pkgs/development/python-modules/accelerate/default.nix9
-rw-r--r--pkgs/development/python-modules/aioairzone-cloud/default.nix4
-rw-r--r--pkgs/development/python-modules/aiobotocore/default.nix4
-rw-r--r--pkgs/development/python-modules/aiodns/default.nix32
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix22
-rw-r--r--pkgs/development/python-modules/aiorpcx/default.nix4
-rw-r--r--pkgs/development/python-modules/aiortm/default.nix4
-rw-r--r--pkgs/development/python-modules/aiosmtpd/default.nix10
-rw-r--r--pkgs/development/python-modules/albumentations/default.nix4
-rw-r--r--pkgs/development/python-modules/allure-behave/default.nix4
-rw-r--r--pkgs/development/python-modules/allure-pytest/default.nix4
-rw-r--r--pkgs/development/python-modules/allure-python-commons-test/default.nix4
-rw-r--r--pkgs/development/python-modules/allure-python-commons/default.nix4
-rw-r--r--pkgs/development/python-modules/amaranth-boards/default.nix6
-rw-r--r--pkgs/development/python-modules/amaranth-soc/default.nix2
-rw-r--r--pkgs/development/python-modules/amaranth/default.nix2
-rw-r--r--pkgs/development/python-modules/anthropic/default.nix59
-rw-r--r--pkgs/development/python-modules/argcomplete/default.nix4
-rw-r--r--pkgs/development/python-modules/astropy-healpix/default.nix4
-rw-r--r--pkgs/development/python-modules/astroquery/default.nix4
-rw-r--r--pkgs/development/python-modules/atpublic/default.nix8
-rw-r--r--pkgs/development/python-modules/avro/default.nix1
-rw-r--r--pkgs/development/python-modules/azure-identity/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-cdn/default.nix7
-rw-r--r--pkgs/development/python-modules/b2sdk/default.nix7
-rw-r--r--pkgs/development/python-modules/bdffont/default.nix4
-rw-r--r--pkgs/development/python-modules/bids-validator/default.nix4
-rw-r--r--pkgs/development/python-modules/birch/default.nix6
-rw-r--r--pkgs/development/python-modules/black/default.nix4
-rw-r--r--pkgs/development/python-modules/bokeh/default.nix6
-rw-r--r--pkgs/development/python-modules/bokeh/hardcode-nodejs-npmjs-paths.patch11
-rw-r--r--pkgs/development/python-modules/boto3-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/botocore/default.nix4
-rw-r--r--pkgs/development/python-modules/boxx/default.nix4
-rw-r--r--pkgs/development/python-modules/breathe/default.nix5
-rw-r--r--pkgs/development/python-modules/build/default.nix4
-rw-r--r--pkgs/development/python-modules/cachier/default.nix4
-rw-r--r--pkgs/development/python-modules/cartopy/default.nix4
-rw-r--r--pkgs/development/python-modules/casa-formats-io/default.nix4
-rw-r--r--pkgs/development/python-modules/cbor2/default.nix4
-rw-r--r--pkgs/development/python-modules/celery/default.nix65
-rw-r--r--pkgs/development/python-modules/click-didyoumean/default.nix27
-rw-r--r--pkgs/development/python-modules/controku/default.nix4
-rw-r--r--pkgs/development/python-modules/coverage/default.nix4
-rw-r--r--pkgs/development/python-modules/css-inline/Cargo.lock643
-rw-r--r--pkgs/development/python-modules/css-inline/default.nix7
-rw-r--r--pkgs/development/python-modules/cvxpy/default.nix4
-rw-r--r--pkgs/development/python-modules/cython/default.nix4
-rw-r--r--pkgs/development/python-modules/databricks-connect/default.nix4
-rw-r--r--pkgs/development/python-modules/dbt-core/default.nix4
-rw-r--r--pkgs/development/python-modules/dbus-python/default.nix94
-rw-r--r--pkgs/development/python-modules/dbus-python/fix-includedir.patch8
-rw-r--r--pkgs/development/python-modules/dbutils/default.nix4
-rw-r--r--pkgs/development/python-modules/desktop-notifier/default.nix4
-rw-r--r--pkgs/development/python-modules/django-auth-ldap/default.nix4
-rw-r--r--pkgs/development/python-modules/django-bootstrap3/default.nix4
-rw-r--r--pkgs/development/python-modules/django-bootstrap4/default.nix4
-rw-r--r--pkgs/development/python-modules/django-bootstrap5/default.nix36
-rw-r--r--pkgs/development/python-modules/django-configurations/default.nix4
-rw-r--r--pkgs/development/python-modules/django-mailman3/default.nix27
-rw-r--r--pkgs/development/python-modules/dkimpy/default.nix4
-rw-r--r--pkgs/development/python-modules/docplex/default.nix4
-rw-r--r--pkgs/development/python-modules/docutils/default.nix31
-rw-r--r--pkgs/development/python-modules/dogtail/default.nix4
-rw-r--r--pkgs/development/python-modules/domeneshop/default.nix9
-rw-r--r--pkgs/development/python-modules/duckdb-engine/default.nix25
-rw-r--r--pkgs/development/python-modules/duckdb-engine/remote_data.patch24
-rw-r--r--pkgs/development/python-modules/duckdb/default.nix4
-rw-r--r--pkgs/development/python-modules/dulwich/default.nix2
-rw-r--r--pkgs/development/python-modules/dwdwfsapi/default.nix13
-rw-r--r--pkgs/development/python-modules/ecdsa/default.nix4
-rw-r--r--pkgs/development/python-modules/elastic-transport/default.nix19
-rw-r--r--pkgs/development/python-modules/elasticsearch/default.nix4
-rw-r--r--pkgs/development/python-modules/elasticsearch8/default.nix4
-rw-r--r--pkgs/development/python-modules/execnet/default.nix4
-rw-r--r--pkgs/development/python-modules/faker/default.nix4
-rw-r--r--pkgs/development/python-modules/fastapi/default.nix4
-rw-r--r--pkgs/development/python-modules/ffmpy/default.nix2
-rw-r--r--pkgs/development/python-modules/filelock/default.nix4
-rw-r--r--pkgs/development/python-modules/flake8-bugbear/default.nix4
-rw-r--r--pkgs/development/python-modules/flask/default.nix4
-rw-r--r--pkgs/development/python-modules/flexmock/default.nix4
-rw-r--r--pkgs/development/python-modules/fontbakery/default.nix4
-rw-r--r--pkgs/development/python-modules/fontmake/default.nix4
-rw-r--r--pkgs/development/python-modules/frozendict/default.nix7
-rw-r--r--pkgs/development/python-modules/gamble/default.nix4
-rw-r--r--pkgs/development/python-modules/gekko/default.nix2
-rw-r--r--pkgs/development/python-modules/geopandas/default.nix16
-rw-r--r--pkgs/development/python-modules/geventhttpclient/default.nix42
-rw-r--r--pkgs/development/python-modules/glyphsets/default.nix4
-rw-r--r--pkgs/development/python-modules/google-auth/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-iam/default.nix9
-rw-r--r--pkgs/development/python-modules/google-cloud-kms/default.nix4
-rw-r--r--pkgs/development/python-modules/govee-local-api/default.nix27
-rw-r--r--pkgs/development/python-modules/gradio-pdf/default.nix2
-rw-r--r--pkgs/development/python-modules/gradio/client.nix2
-rw-r--r--pkgs/development/python-modules/gradio/default.nix6
-rw-r--r--pkgs/development/python-modules/grpcio-channelz/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-status/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-testing/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-tools/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio/default.nix4
-rw-r--r--pkgs/development/python-modules/gst-python/default.nix4
-rw-r--r--pkgs/development/python-modules/h5py/default.nix13
-rw-r--r--pkgs/development/python-modules/hatchling/default.nix4
-rw-r--r--pkgs/development/python-modules/hdf5plugin/default.nix2
-rw-r--r--pkgs/development/python-modules/httpcore/default.nix7
-rw-r--r--pkgs/development/python-modules/hypercorn/default.nix32
-rw-r--r--pkgs/development/python-modules/hypothesis/default.nix4
-rw-r--r--pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix4
-rw-r--r--pkgs/development/python-modules/idna/default.nix9
-rw-r--r--pkgs/development/python-modules/importlib-metadata/default.nix4
-rw-r--r--pkgs/development/python-modules/importlib-resources/default.nix4
-rw-r--r--pkgs/development/python-modules/inflect/default.nix12
-rw-r--r--pkgs/development/python-modules/instructor/default.nix71
-rw-r--r--pkgs/development/python-modules/ipympl/default.nix4
-rw-r--r--pkgs/development/python-modules/itsdangerous/default.nix15
-rw-r--r--pkgs/development/python-modules/jaraco-collections/default.nix4
-rw-r--r--pkgs/development/python-modules/jaraco-functools/default.nix14
-rw-r--r--pkgs/development/python-modules/joblib/default.nix13
-rw-r--r--pkgs/development/python-modules/jpylyzer/default.nix15
-rw-r--r--pkgs/development/python-modules/jsonpickle/default.nix4
-rw-r--r--pkgs/development/python-modules/kazoo/default.nix4
-rw-r--r--pkgs/development/python-modules/keras/default.nix4
-rw-r--r--pkgs/development/python-modules/keyrings-alt/default.nix6
-rw-r--r--pkgs/development/python-modules/kombu/default.nix4
-rw-r--r--pkgs/development/python-modules/langchain-community/default.nix4
-rw-r--r--pkgs/development/python-modules/langchain-core/default.nix4
-rw-r--r--pkgs/development/python-modules/langchain/default.nix2
-rw-r--r--pkgs/development/python-modules/langsmith/default.nix9
-rw-r--r--pkgs/development/python-modules/ledgerblue/default.nix23
-rw-r--r--pkgs/development/python-modules/lmfit/default.nix4
-rw-r--r--pkgs/development/python-modules/maestral/default.nix23
-rw-r--r--pkgs/development/python-modules/magic-wormhole/default.nix4
-rw-r--r--pkgs/development/python-modules/magika/default.nix4
-rw-r--r--pkgs/development/python-modules/mako/default.nix4
-rw-r--r--pkgs/development/python-modules/manim/default.nix (renamed from pkgs/applications/video/manim/default.nix)48
-rw-r--r--pkgs/development/python-modules/manim/failing_tests.nix (renamed from pkgs/applications/video/manim/failing_tests.nix)0
-rw-r--r--pkgs/development/python-modules/manim/pytest-report-header.patch (renamed from pkgs/applications/video/manim/pytest-report-header.patch)0
-rw-r--r--pkgs/development/python-modules/markdown/default.nix16
-rw-r--r--pkgs/development/python-modules/mashumaro/default.nix4
-rw-r--r--pkgs/development/python-modules/mat2/default.nix4
-rw-r--r--pkgs/development/python-modules/matplotlib-inline/default.nix26
-rw-r--r--pkgs/development/python-modules/matplotlib/default.nix28
-rw-r--r--pkgs/development/python-modules/maxminddb/default.nix4
-rw-r--r--pkgs/development/python-modules/mecab-python3/default.nix7
-rw-r--r--pkgs/development/python-modules/meson-python/default.nix4
-rw-r--r--pkgs/development/python-modules/milksnake/default.nix10
-rw-r--r--pkgs/development/python-modules/mkdocstrings/default.nix4
-rw-r--r--pkgs/development/python-modules/mocket/default.nix4
-rw-r--r--pkgs/development/python-modules/mpi4py/default.nix4
-rw-r--r--pkgs/development/python-modules/mypy-protobuf/default.nix4
-rw-r--r--pkgs/development/python-modules/myst-parser/default.nix15
-rw-r--r--pkgs/development/python-modules/netcdf4/default.nix6
-rw-r--r--pkgs/development/python-modules/networkx/default.nix4
-rw-r--r--pkgs/development/python-modules/nilearn/default.nix4
-rw-r--r--pkgs/development/python-modules/numba-scipy/default.nix4
-rw-r--r--pkgs/development/python-modules/numexpr/default.nix50
-rw-r--r--pkgs/development/python-modules/numpy/default.nix3
-rw-r--r--pkgs/development/python-modules/openrazer/daemon.nix2
-rw-r--r--pkgs/development/python-modules/orjson/default.nix8
-rw-r--r--pkgs/development/python-modules/paddle2onnx/default.nix4
-rw-r--r--pkgs/development/python-modules/panel/default.nix4
-rw-r--r--pkgs/development/python-modules/parsedmarc/default.nix4
-rw-r--r--pkgs/development/python-modules/parsel/default.nix4
-rw-r--r--pkgs/development/python-modules/parso/default.nix4
-rw-r--r--pkgs/development/python-modules/path/default.nix4
-rw-r--r--pkgs/development/python-modules/pathlib-abc/default.nix4
-rw-r--r--pkgs/development/python-modules/pdm-backend/default.nix4
-rw-r--r--pkgs/development/python-modules/pdoc/default.nix2
-rw-r--r--pkgs/development/python-modules/pg8000/default.nix16
-rw-r--r--pkgs/development/python-modules/phonenumbers/default.nix4
-rw-r--r--pkgs/development/python-modules/pikepdf/default.nix4
-rw-r--r--pkgs/development/python-modules/pikepdf/paths.patch16
-rw-r--r--pkgs/development/python-modules/pillow/default.nix4
-rw-r--r--pkgs/development/python-modules/pipdeptree/default.nix43
-rw-r--r--pkgs/development/python-modules/pixel-font-builder/default.nix4
-rw-r--r--pkgs/development/python-modules/plotly/default.nix4
-rw-r--r--pkgs/development/python-modules/pyasn1/default.nix4
-rw-r--r--pkgs/development/python-modules/pycparser/default.nix4
-rw-r--r--pkgs/development/python-modules/pycups/default.nix4
-rw-r--r--pkgs/development/python-modules/pydrawise/default.nix4
-rw-r--r--pkgs/development/python-modules/pyelftools/default.nix17
-rw-r--r--pkgs/development/python-modules/pyerfa/default.nix21
-rw-r--r--pkgs/development/python-modules/pyfakefs/default.nix6
-rw-r--r--pkgs/development/python-modules/pygame-ce/default.nix123
-rw-r--r--pkgs/development/python-modules/pygame-ce/fix-dependency-finding.patch41
-rw-r--r--pkgs/development/python-modules/pygame-ce/skip-surface-tests.patch26
-rw-r--r--pkgs/development/python-modules/pygame/default.nix8
-rw-r--r--pkgs/development/python-modules/pygobject/3.nix5
-rw-r--r--pkgs/development/python-modules/pykalman/default.nix4
-rw-r--r--pkgs/development/python-modules/pykdtree/default.nix4
-rw-r--r--pkgs/development/python-modules/pymc/default.nix4
-rw-r--r--pkgs/development/python-modules/pymdown-extensions/default.nix5
-rw-r--r--pkgs/development/python-modules/pymongo-inmemory/default.nix6
-rw-r--r--pkgs/development/python-modules/pymongo/default.nix4
-rw-r--r--pkgs/development/python-modules/pymysql/default.nix10
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix8
-rw-r--r--pkgs/development/python-modules/pyproject-metadata/default.nix17
-rw-r--r--pkgs/development/python-modules/pyqt-builder/default.nix6
-rw-r--r--pkgs/development/python-modules/pyramid-beaker/default.nix4
-rw-r--r--pkgs/development/python-modules/pyrender/default.nix11
-rw-r--r--pkgs/development/python-modules/pysimplegui/default.nix4
-rw-r--r--pkgs/development/python-modules/pytensor/default.nix1
-rw-r--r--pkgs/development/python-modules/pytest-mock/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-order/default.nix12
-rw-r--r--pkgs/development/python-modules/python-dbusmock/default.nix2
-rw-r--r--pkgs/development/python-modules/python-jose/default.nix7
-rw-r--r--pkgs/development/python-modules/python-musicpd/default.nix4
-rw-r--r--pkgs/development/python-modules/pytikz-allefeld/default.nix9
-rw-r--r--pkgs/development/python-modules/pyunpack/default.nix4
-rw-r--r--pkgs/development/python-modules/pyvis/default.nix9
-rw-r--r--pkgs/development/python-modules/pywavelets/default.nix45
-rw-r--r--pkgs/development/python-modules/pywbem/default.nix4
-rw-r--r--pkgs/development/python-modules/qdldl/default.nix4
-rw-r--r--pkgs/development/python-modules/qrcode/default.nix3
-rw-r--r--pkgs/development/python-modules/readme-renderer/default.nix12
-rw-r--r--pkgs/development/python-modules/redis/default.nix4
-rw-r--r--pkgs/development/python-modules/referencing/default.nix46
-rw-r--r--pkgs/development/python-modules/remi/default.nix15
-rw-r--r--pkgs/development/python-modules/reportlab/default.nix4
-rw-r--r--pkgs/development/python-modules/reproject/default.nix4
-rw-r--r--pkgs/development/python-modules/requests-mock/default.nix19
-rw-r--r--pkgs/development/python-modules/rpy2/default.nix4
-rw-r--r--pkgs/development/python-modules/rq/default.nix10
-rw-r--r--pkgs/development/python-modules/rubicon-objc/default.nix62
-rw-r--r--pkgs/development/python-modules/s3transfer/default.nix4
-rw-r--r--pkgs/development/python-modules/safety/default.nix4
-rw-r--r--pkgs/development/python-modules/scalene/default.nix4
-rw-r--r--pkgs/development/python-modules/schwifty/default.nix4
-rw-r--r--pkgs/development/python-modules/scikit-bio/default.nix4
-rw-r--r--pkgs/development/python-modules/scikit-build/default.nix2
-rw-r--r--pkgs/development/python-modules/scikit-learn/default.nix19
-rw-r--r--pkgs/development/python-modules/setuptools/default.nix4
-rw-r--r--pkgs/development/python-modules/setuptools/setuptools-distutils-C++.patch32
-rw-r--r--pkgs/development/python-modules/sigstore-protobuf-specs/default.nix4
-rw-r--r--pkgs/development/python-modules/skytemple-ssb-debugger/default.nix4
-rw-r--r--pkgs/development/python-modules/slicer/default.nix4
-rw-r--r--pkgs/development/python-modules/snaptime/default.nix9
-rw-r--r--pkgs/development/python-modules/snowflake-sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/spglib/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx-autoapi/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx-autobuild/default.nix35
-rw-r--r--pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx-pytest/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx-rtd-theme/default.nix5
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix12
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-jquery/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-tikz/default.nix4
-rw-r--r--pkgs/development/python-modules/spyder/default.nix14
-rw-r--r--pkgs/development/python-modules/sqlalchemy-utils/default.nix10
-rw-r--r--pkgs/development/python-modules/sqlglot/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlparse/default.nix18
-rw-r--r--pkgs/development/python-modules/stack-data/default.nix34
-rw-r--r--pkgs/development/python-modules/statsmodels/default.nix15
-rw-r--r--pkgs/development/python-modules/strct/default.nix4
-rw-r--r--pkgs/development/python-modules/stripe/default.nix4
-rw-r--r--pkgs/development/python-modules/sunpy/default.nix4
-rw-r--r--pkgs/development/python-modules/tablib/default.nix4
-rw-r--r--pkgs/development/python-modules/tidalapi/default.nix4
-rw-r--r--pkgs/development/python-modules/tifffile/default.nix4
-rw-r--r--pkgs/development/python-modules/total-connect-client/default.nix10
-rw-r--r--pkgs/development/python-modules/traitlets/default.nix4
-rw-r--r--pkgs/development/python-modules/trimesh/default.nix6
-rw-r--r--pkgs/development/python-modules/trio-asyncio/default.nix29
-rw-r--r--pkgs/development/python-modules/trio-websocket/default.nix28
-rw-r--r--pkgs/development/python-modules/trio/default.nix26
-rw-r--r--pkgs/development/python-modules/trove-classifiers/default.nix4
-rw-r--r--pkgs/development/python-modules/trytond/default.nix4
-rw-r--r--pkgs/development/python-modules/type-infer/default.nix4
-rw-r--r--pkgs/development/python-modules/typer/default.nix18
-rw-r--r--pkgs/development/python-modules/types-pillow/default.nix4
-rw-r--r--pkgs/development/python-modules/types-protobuf/default.nix4
-rw-r--r--pkgs/development/python-modules/types-pyopenssl/default.nix4
-rw-r--r--pkgs/development/python-modules/types-python-dateutil/default.nix4
-rw-r--r--pkgs/development/python-modules/types-pytz/default.nix4
-rw-r--r--pkgs/development/python-modules/types-pyyaml/default.nix4
-rw-r--r--pkgs/development/python-modules/types-s3transfer/default.nix4
-rw-r--r--pkgs/development/python-modules/types-setuptools/default.nix4
-rw-r--r--pkgs/development/python-modules/types-toml/default.nix4
-rw-r--r--pkgs/development/python-modules/typing-extensions/default.nix4
-rw-r--r--pkgs/development/python-modules/uqbar/default.nix4
-rw-r--r--pkgs/development/python-modules/uvicorn/default.nix10
-rw-r--r--pkgs/development/python-modules/validators/default.nix33
-rw-r--r--pkgs/development/python-modules/versioningit/default.nix4
-rw-r--r--pkgs/development/python-modules/virt-firmware/default.nix4
-rw-r--r--pkgs/development/python-modules/virtualenv/default.nix4
-rw-r--r--pkgs/development/python-modules/werkzeug/default.nix13
-rw-r--r--pkgs/development/python-modules/wheezy-template/default.nix4
-rw-r--r--pkgs/development/python-modules/whenever/default.nix4
-rw-r--r--pkgs/development/python-modules/xdot/default.nix4
-rw-r--r--pkgs/development/python-modules/xmlsec/default.nix4
-rw-r--r--pkgs/development/python-modules/ydiff/default.nix4
-rw-r--r--pkgs/development/python-modules/zarr/default.nix4
-rw-r--r--pkgs/development/python-modules/zephyr-python-api/default.nix7
-rw-r--r--pkgs/development/python-modules/zipp/default.nix4
-rw-r--r--pkgs/development/python-modules/zlib-ng/default.nix4
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/ruby-modules/gem-config/default.nix12
-rw-r--r--pkgs/development/tools/analysis/frama-c/default.nix4
-rw-r--r--pkgs/development/tools/backblaze-b2/default.nix4
-rw-r--r--pkgs/development/tools/bbin/default.nix4
-rw-r--r--pkgs/development/tools/cambalache/default.nix18
-rw-r--r--pkgs/development/tools/click/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/drone/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/github-runner/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/gitlab-runner/default.nix6
-rw-r--r--pkgs/development/tools/database/sqlitebrowser/default.nix4
-rw-r--r--pkgs/development/tools/documentation/gtk-doc/default.nix4
-rw-r--r--pkgs/development/tools/electron/binary/generic.nix4
-rw-r--r--pkgs/development/tools/electron/wrapper.nix4
-rw-r--r--pkgs/development/tools/glade/default.nix6
-rw-r--r--pkgs/development/tools/glamoroustoolkit/default.nix4
-rw-r--r--pkgs/development/tools/gnome-desktop-testing/default.nix2
-rw-r--r--pkgs/development/tools/gotestsum/default.nix17
-rw-r--r--pkgs/development/tools/misc/astyle/default.nix4
-rw-r--r--pkgs/development/tools/misc/awf/default.nix4
-rw-r--r--pkgs/development/tools/misc/d-spy/default.nix4
-rw-r--r--pkgs/development/tools/misc/gpuvis/default.nix4
-rw-r--r--pkgs/development/tools/misc/lttng-tools/default.nix4
-rw-r--r--pkgs/development/tools/misc/lttng-ust/default.nix4
-rw-r--r--pkgs/development/tools/misc/msitools/default.nix2
-rw-r--r--pkgs/development/tools/misc/stlink/default.nix4
-rw-r--r--pkgs/development/tools/misc/texlab/default.nix8
-rw-r--r--pkgs/development/tools/nemiver/default.nix12
-rw-r--r--pkgs/development/tools/nwjs/default.nix4
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/default.nix10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-query.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rust.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json10
-rw-r--r--pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json10
-rw-r--r--pkgs/development/tools/pip-audit/default.nix46
-rw-r--r--pkgs/development/tools/profiling/sysprof/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-c/default.nix10
-rw-r--r--pkgs/development/tools/rust/cargo-nextest/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-whatfeatures/default.nix6
-rw-r--r--pkgs/development/tools/scenebuilder/default.nix4
-rw-r--r--pkgs/development/tools/vala-lint/default.nix4
-rw-r--r--pkgs/development/web/cog/default.nix4
-rw-r--r--pkgs/development/web/cypress/default.nix4
-rw-r--r--pkgs/development/web/flyctl/default.nix12
-rw-r--r--pkgs/development/web/insomnia/default.nix4
-rw-r--r--pkgs/development/web/nodejs/node-npm-build-npm-package-logic.patch4
-rw-r--r--pkgs/development/web/postman/linux.nix4
-rw-r--r--pkgs/development/web/publii/default.nix4
-rw-r--r--pkgs/games/abuse/default.nix20
-rw-r--r--pkgs/games/doom-ports/slade/default.nix4
-rw-r--r--pkgs/games/freeciv/default.nix4
-rw-r--r--pkgs/games/gamehub/default.nix4
-rw-r--r--pkgs/games/gnonograms/default.nix4
-rw-r--r--pkgs/games/grapejuice/default.nix4
-rw-r--r--pkgs/games/gscrabble/default.nix4
-rw-r--r--pkgs/games/gshogi/default.nix4
-rw-r--r--pkgs/games/gweled/default.nix4
-rw-r--r--pkgs/games/hmcl/default.nix4
-rw-r--r--pkgs/games/jfsw/default.nix4
-rw-r--r--pkgs/games/jumpnbump/default.nix4
-rw-r--r--pkgs/games/liberation-circuit/default.nix4
-rw-r--r--pkgs/games/linthesia/default.nix4
-rw-r--r--pkgs/games/maptool/default.nix4
-rw-r--r--pkgs/games/minecraft/default.nix4
-rw-r--r--pkgs/games/openxcom/default.nix6
-rw-r--r--pkgs/games/principia/default.nix4
-rw-r--r--pkgs/games/runescape-launcher/default.nix4
-rw-r--r--pkgs/games/sgt-puzzles/default.nix4
-rw-r--r--pkgs/games/space-station-14-launcher/space-station-14-launcher.nix4
-rw-r--r--pkgs/games/steam/runtime.nix16
-rw-r--r--pkgs/games/vassal/default.nix4
-rw-r--r--pkgs/kde/misc/ktextaddons/default.nix4
-rw-r--r--pkgs/kde/plasma/kde-gtk-config/default.nix4
-rw-r--r--pkgs/misc/drivers/sc-controller/default.nix4
-rw-r--r--pkgs/misc/plasma-hud/default.nix4
-rw-r--r--pkgs/misc/screensavers/light-locker/default.nix4
-rw-r--r--pkgs/misc/screensavers/xlockmore/default.nix4
-rw-r--r--pkgs/misc/sndio/default.nix16
-rw-r--r--pkgs/misc/solfege/default.nix4
-rw-r--r--pkgs/os-specific/linux/cpupower-gui/default.nix4
-rw-r--r--pkgs/os-specific/linux/ffado/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-manager/default.nix4
-rw-r--r--pkgs/os-specific/linux/guvcview/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix9
-rw-r--r--pkgs/os-specific/linux/libcap-ng/default.nix4
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix16
-rw-r--r--pkgs/os-specific/linux/nftables/fix-py-libnftables.patch13
-rw-r--r--pkgs/os-specific/linux/nftables/python.nix26
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/settings.nix4
-rw-r--r--pkgs/os-specific/linux/pam/default.nix22
-rw-r--r--pkgs/os-specific/linux/piper/default.nix4
-rw-r--r--pkgs/os-specific/linux/power-profiles-daemon/default.nix9
-rw-r--r--pkgs/os-specific/linux/tiscamera/default.nix6
-rw-r--r--pkgs/os-specific/linux/tuna/default.nix4
-rw-r--r--pkgs/os-specific/linux/waydroid/default.nix4
-rw-r--r--pkgs/os-specific/linux/zenmonitor/default.nix4
-rw-r--r--pkgs/servers/gonic/default.nix1
-rw-r--r--pkgs/servers/gpsd/default.nix4
-rw-r--r--pkgs/servers/home-assistant/default.nix14
-rw-r--r--pkgs/servers/hqplayerd/rygel.nix4
-rw-r--r--pkgs/servers/http/jetty/12.x.nix4
-rw-r--r--pkgs/servers/misc/gobgpd/default.nix6
-rw-r--r--pkgs/servers/pulseaudio/default.nix4
-rw-r--r--pkgs/servers/rpiplay/default.nix4
-rw-r--r--pkgs/servers/search/meilisearch/default.nix7
-rw-r--r--pkgs/servers/search/typesense/default.nix4
-rw-r--r--pkgs/servers/search/typesense/sources.json4
-rwxr-xr-xpkgs/servers/search/typesense/update.sh1
-rw-r--r--pkgs/servers/sql/postgresql/12.nix6
-rw-r--r--pkgs/servers/sql/postgresql/13.nix4
-rw-r--r--pkgs/servers/sql/postgresql/14.nix4
-rw-r--r--pkgs/servers/sql/postgresql/15.nix6
-rw-r--r--pkgs/servers/sql/postgresql/16.nix6
-rw-r--r--pkgs/servers/sql/postgresql/default.nix1
-rw-r--r--pkgs/servers/sql/postgresql/generic.nix46
-rw-r--r--pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch12
-rw-r--r--pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch14
-rw-r--r--pkgs/servers/sql/postgresql/patches/less-is-more.patch5
-rw-r--r--pkgs/servers/sql/postgresql/patches/locale-binary-path.patch2
-rw-r--r--pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch11
-rw-r--r--pkgs/servers/sql/postgresql/patches/paths-with-postgresql-suffix.patch (renamed from pkgs/servers/sql/postgresql/patches/findstring.patch)18
-rw-r--r--pkgs/servers/sql/postgresql/patches/relative-to-symlinks-16+.patch (renamed from pkgs/servers/sql/postgresql/patches/disable-normalize_exec_path.patch)5
-rw-r--r--pkgs/servers/sql/postgresql/patches/relative-to-symlinks.patch13
-rw-r--r--pkgs/servers/sql/postgresql/patches/socketdir-in-run-13+.patch (renamed from pkgs/servers/sql/postgresql/patches/socketdir-in-run-13.patch)6
-rw-r--r--pkgs/servers/sql/postgresql/patches/socketdir-in-run.patch2
-rw-r--r--pkgs/servers/sql/postgresql/patches/specify_pkglibdir_at_runtime.patch5
-rw-r--r--pkgs/servers/uxplay/default.nix4
-rw-r--r--pkgs/servers/vouch-proxy/default.nix6
-rw-r--r--pkgs/servers/x11/xorg/default.nix200
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix1
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list64
-rwxr-xr-xpkgs/servers/x11/xorg/update.py116
-rw-r--r--pkgs/shells/zsh/spaceship-prompt/default.nix4
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix11
-rw-r--r--pkgs/tools/X11/arandr/default.nix4
-rw-r--r--pkgs/tools/X11/caffeine-ng/default.nix4
-rw-r--r--pkgs/tools/X11/obconf/default.nix4
-rw-r--r--pkgs/tools/X11/opentabletdriver/default.nix4
-rw-r--r--pkgs/tools/X11/wpgtk/default.nix4
-rw-r--r--pkgs/tools/X11/xborders/default.nix4
-rw-r--r--pkgs/tools/X11/xpra/default.nix4
-rw-r--r--pkgs/tools/archivers/xarchiver/default.nix4
-rw-r--r--pkgs/tools/audio/abcmidi/default.nix4
-rw-r--r--pkgs/tools/audio/gvolicon/default.nix4
-rw-r--r--pkgs/tools/audio/headset-charge-indicator/default.nix4
-rw-r--r--pkgs/tools/audio/mictray/default.nix4
-rw-r--r--pkgs/tools/audio/mpdris2/default.nix4
-rw-r--r--pkgs/tools/audio/pasystray/default.nix4
-rw-r--r--pkgs/tools/audio/volctl/default.nix4
-rw-r--r--pkgs/tools/bluetooth/blueberry/default.nix4
-rw-r--r--pkgs/tools/bluetooth/blueman/default.nix4
-rw-r--r--pkgs/tools/cd-dvd/brasero/default.nix6
-rw-r--r--pkgs/tools/compression/flips/default.nix4
-rw-r--r--pkgs/tools/games/minecraft/mcaselector/default.nix4
-rw-r--r--pkgs/tools/games/mymcplus/default.nix4
-rw-r--r--pkgs/tools/games/opentracker/default.nix4
-rw-r--r--pkgs/tools/games/scarab/default.nix4
-rw-r--r--pkgs/tools/games/ukmm/default.nix4
-rw-r--r--pkgs/tools/graphics/agi/default.nix4
-rw-r--r--pkgs/tools/graphics/escrotum/default.nix4
-rw-r--r--pkgs/tools/graphics/gromit-mpx/default.nix4
-rw-r--r--pkgs/tools/graphics/icoutils/default.nix14
-rw-r--r--pkgs/tools/graphics/pdftag/default.nix4
-rw-r--r--pkgs/tools/graphics/wdisplays/default.nix4
-rw-r--r--pkgs/tools/graphics/zbar/default.nix4
-rw-r--r--pkgs/tools/inputmethods/emote/default.nix4
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix4
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-bamboo/default.nix4
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-cangjie/default.nix4
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix12
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix4
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix4
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix4
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix4
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-uniemoji/default.nix4
-rw-r--r--pkgs/tools/inputmethods/ibus/default.nix4
-rw-r--r--pkgs/tools/inputmethods/input-remapper/default.nix6
-rw-r--r--pkgs/tools/llm/shell_gpt/default.nix48
-rw-r--r--pkgs/tools/misc/alarm-clock-applet/default.nix4
-rw-r--r--pkgs/tools/misc/archi/default.nix4
-rw-r--r--pkgs/tools/misc/birdfont/default.nix4
-rw-r--r--pkgs/tools/misc/clipster/default.nix4
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix8
-rw-r--r--pkgs/tools/misc/fsearch/default.nix4
-rw-r--r--pkgs/tools/misc/gaphor/default.nix6
-rw-r--r--pkgs/tools/misc/gparted/default.nix4
-rw-r--r--pkgs/tools/misc/gpick/default.nix4
-rw-r--r--pkgs/tools/misc/gsmartcontrol/default.nix4
-rw-r--r--pkgs/tools/misc/gtkterm/default.nix4
-rw-r--r--pkgs/tools/misc/gwe/default.nix4
-rw-r--r--pkgs/tools/misc/hakuneko/default.nix4
-rw-r--r--pkgs/tools/misc/hashit/default.nix4
-rw-r--r--pkgs/tools/misc/jugglinglab/default.nix4
-rw-r--r--pkgs/tools/misc/mongodb-compass/default.nix4
-rw-r--r--pkgs/tools/misc/moserial/default.nix2
-rw-r--r--pkgs/tools/misc/mutagen-compose/default.nix6
-rw-r--r--pkgs/tools/misc/nautilus-open-any-terminal/default.nix4
-rw-r--r--pkgs/tools/misc/parcellite/default.nix4
-rw-r--r--pkgs/tools/misc/plotinus/default.nix4
-rw-r--r--pkgs/tools/misc/pokemonsay/default.nix14
-rw-r--r--pkgs/tools/misc/popsicle/default.nix4
-rw-r--r--pkgs/tools/misc/qflipper/default.nix4
-rw-r--r--pkgs/tools/misc/remind/default.nix4
-rw-r--r--pkgs/tools/misc/remote-exec/default.nix4
-rw-r--r--pkgs/tools/misc/rmate-sh/default.nix2
-rw-r--r--pkgs/tools/misc/rmlint/default.nix4
-rw-r--r--pkgs/tools/misc/scanmem/default.nix4
-rw-r--r--pkgs/tools/misc/scdl/default.nix4
-rw-r--r--pkgs/tools/misc/staruml/default.nix4
-rw-r--r--pkgs/tools/misc/system-config-printer/default.nix4
-rw-r--r--pkgs/tools/misc/trackma/default.nix4
-rw-r--r--pkgs/tools/misc/urn-timer/default.nix4
-rw-r--r--pkgs/tools/misc/usbimager/default.nix4
-rw-r--r--pkgs/tools/misc/woeusb-ng/default.nix4
-rw-r--r--pkgs/tools/misc/wv/default.nix15
-rw-r--r--pkgs/tools/misc/xdaliclock/default.nix4
-rw-r--r--pkgs/tools/misc/xflux/gui.nix4
-rw-r--r--pkgs/tools/misc/yad/default.nix4
-rw-r--r--pkgs/tools/networking/gobgp/default.nix6
-rw-r--r--pkgs/tools/networking/gp-saml-gui/default.nix4
-rw-r--r--pkgs/tools/networking/gupnp-tools/default.nix4
-rw-r--r--pkgs/tools/networking/haguichi/default.nix4
-rw-r--r--pkgs/tools/networking/haproxy/default.nix4
-rw-r--r--pkgs/tools/networking/libreswan/default.nix58
-rw-r--r--pkgs/tools/networking/networkmanager/applet/default.nix4
-rw-r--r--pkgs/tools/networking/ngrok/versions.json36
-rw-r--r--pkgs/tools/networking/openssh/common.nix4
-rw-r--r--pkgs/tools/networking/openvpn3/default.nix4
-rw-r--r--pkgs/tools/networking/phodav/default.nix2
-rw-r--r--pkgs/tools/networking/uget/default.nix4
-rw-r--r--pkgs/tools/nix/nix-query-tree-viewer/default.nix4
-rw-r--r--pkgs/tools/package-management/nix/default.nix9
-rw-r--r--pkgs/tools/security/cryptomator/default.nix4
-rw-r--r--pkgs/tools/security/eid-mw/default.nix4
-rw-r--r--pkgs/tools/security/gencfsm/default.nix4
-rw-r--r--pkgs/tools/security/gnome-keysign/default.nix6
-rw-r--r--pkgs/tools/security/keybase/gui.nix4
-rw-r--r--pkgs/tools/security/onioncircuits/default.nix4
-rw-r--r--pkgs/tools/security/onlykey/default.nix4
-rw-r--r--pkgs/tools/security/pcsc-tools/default.nix27
-rw-r--r--pkgs/tools/security/pcsclite/default.nix45
-rw-r--r--pkgs/tools/security/pinentry/default.nix4
-rw-r--r--pkgs/tools/security/xsser/default.nix4
-rw-r--r--pkgs/tools/security/yubihsm-shell/default.nix4
-rw-r--r--pkgs/tools/system/automatic-timezoned/default.nix6
-rw-r--r--pkgs/tools/system/cm-rgb/default.nix4
-rw-r--r--pkgs/tools/system/gkraken/default.nix4
-rw-r--r--pkgs/tools/system/psensor/default.nix4
-rw-r--r--pkgs/tools/text/comrak/default.nix6
-rw-r--r--pkgs/tools/text/gtranslator/default.nix10
-rw-r--r--pkgs/tools/text/languagetool/default.nix4
-rw-r--r--pkgs/tools/text/markdownlint-cli/default.nix6
-rw-r--r--pkgs/tools/text/mdbook-pagetoc/default.nix6
-rw-r--r--pkgs/tools/text/poedit/default.nix4
-rw-r--r--pkgs/tools/text/recode/default.nix8
-rw-r--r--pkgs/tools/text/snippetpixie/default.nix4
-rw-r--r--pkgs/tools/typesetting/pdfchain/default.nix4
-rw-r--r--pkgs/tools/typesetting/tex/texlive/generate-fixed-hashes.nix25
-rw-r--r--pkgs/tools/typesetting/xmlto/default.nix78
-rw-r--r--pkgs/tools/video/untrunc-anthwlock/default.nix4
-rw-r--r--pkgs/tools/wayland/gtklock/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix73
-rw-r--r--pkgs/top-level/perl-packages.nix3
-rw-r--r--pkgs/top-level/python-packages.nix17
-rw-r--r--pkgs/top-level/release-haskell.nix1
1661 files changed, 20506 insertions, 9962 deletions
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 219efb6e2a548..432191b92de47 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -105,3 +105,6 @@ fb0e5be84331188a69b3edd31679ca6576edb75a
 
 # {pkgs/development/cuda-modules,pkgs/test/cuda,pkgs/top-level/cuda-packages.nix}: reformat all CUDA files with nixfmt-rfc-style 2023-03-01
 802a1b4d3338f24cbc4efd704616654456d75a94
+
+# postgresql: move packages.nix to ext/default.nix
+719034f6f6749d624faa28dff259309fc0e3e730
diff --git a/.github/workflows/check-nix-format.yml b/.github/workflows/check-nix-format.yml
index aca8808fa261b..5e30762821ea9 100644
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@@ -37,6 +37,7 @@ jobs:
             pkgs/development/cuda-modules
             pkgs/test/cuda
             pkgs/top-level/cuda-packages.nix
+          NIX_FMT_PATHS_VSCODE_EXTS: pkgs/applications/editors/vscode/extensions
         # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
         run: |
           for env_var in "${!NIX_FMT_PATHS_@}"; do
diff --git a/doc/README.md b/doc/README.md
index 41afc090b3740..96ac107fc1801 100644
--- a/doc/README.md
+++ b/doc/README.md
@@ -62,7 +62,7 @@ Allow linking arbitrary place in the text (e.g. individual list items, sentences
 They are defined using a hybrid of the link syntax with the attributes syntax known from headings, called [bracketed spans](https://github.com/jgm/commonmark-hs/blob/master/commonmark-extensions/test/bracketed_spans.md):
 
 ```markdown
-- []{#ssec-gnome-hooks-glib} `glib` setup hook will populate `GSETTINGS_SCHEMAS_PATH` and then `wrapGAppsHook` will prepend it to `XDG_DATA_DIRS`.
+- []{#ssec-gnome-hooks-glib} `glib` setup hook will populate `GSETTINGS_SCHEMAS_PATH` and then `wrapGApps*` hook will prepend it to `XDG_DATA_DIRS`.
 ```
 
 #### Automatic links
diff --git a/doc/build-helpers/special/fhs-environments.section.md b/doc/build-helpers/special/fhs-environments.section.md
index 918d1e8c2951d..b87bb97278576 100644
--- a/doc/build-helpers/special/fhs-environments.section.md
+++ b/doc/build-helpers/special/fhs-environments.section.md
@@ -57,4 +57,4 @@ You can create a simple environment using a `shell.nix` like this:
 Running `nix-shell` on it would drop you into a shell inside an FHS env where those libraries and binaries are available in FHS-compliant paths. Applications that expect an FHS structure (i.e. proprietary binaries) can run inside this environment without modification.
 You can build a wrapper by running your binary in `runScript`, e.g. `./bin/start.sh`. Relative paths work as expected.
 
-Additionally, the FHS builder links all relocated gsettings-schemas (the glib setup-hook moves them to `share/gsettings-schemas/${name}/glib-2.0/schemas`) to their standard FHS location. This means you don't need to wrap binaries with `wrapGAppsHook`.
+Additionally, the FHS builder links all relocated gsettings-schemas (the glib setup-hook moves them to `share/gsettings-schemas/${name}/glib-2.0/schemas`) to their standard FHS location. This means you don't need to wrap binaries with `wrapGApps*` hook.
diff --git a/doc/languages-frameworks/gnome.section.md b/doc/languages-frameworks/gnome.section.md
index 21cdcb0dd35e3..7433277708911 100644
--- a/doc/languages-frameworks/gnome.section.md
+++ b/doc/languages-frameworks/gnome.section.md
@@ -82,7 +82,7 @@ Previously, a GTK theme needed to be in `XDG_DATA_DIRS`. This is no longer neces
 
 If your application uses [GStreamer](https://gstreamer.freedesktop.org/) or [Grilo](https://gitlab.gnome.org/GNOME/grilo), you should set `GST_PLUGIN_SYSTEM_PATH_1_0` and `GRL_PLUGIN_PATH`, respectively.
 
-## Onto `wrapGAppsHook` {#ssec-gnome-hooks}
+## Onto `wrapGApps*` hooks {#ssec-gnome-hooks}
 
 Given the requirements above, the package expression would become messy quickly:
 
@@ -102,27 +102,29 @@ Given the requirements above, the package expression would become messy quickly:
 }
 ```
 
-Fortunately, there is [`wrapGAppsHook`]{#ssec-gnome-hooks-wrapgappshook}. It works in conjunction with other setup hooks that populate environment variables, and it will then wrap all executables in `bin` and `libexec` directories using said variables. For convenience, it also adds `dconf.lib` for a GIO module implementing a GSettings backend using `dconf`, `gtk3` for GSettings schemas, and `librsvg` for GdkPixbuf loader to the closure.
+Fortunately, we have a [family of hooks]{#ssec-gnome-hooks-wrapgappshook} that automate this. They work in conjunction with other setup hooks that populate environment variables, and will then wrap all executables in `bin` and `libexec` directories using said variables.
 
-There is also [`wrapGAppsHook4`]{#ssec-gnome-hooks-wrapgappshook4}, which replaces GTK 3 with GTK 4. Instead of `wrapGAppsHook`, this should be used for all GTK4 applications.
+- [`wrapGAppsHook3`]{#ssec-gnome-hooks-wrapgappshook3} for GTK 3 apps. For convenience, it also adds `dconf.lib` for a GIO module implementing a GSettings backend using `dconf`, `gtk3` for GSettings schemas, and `librsvg` for GdkPixbuf loader to the closure.
+- [`wrapGAppsHook4`]{#ssec-gnome-hooks-wrapgappshook4} for GTK 4 apps. Same as `wrapGAppsHook3` but replaces `gtk3` with `gtk4`.
+- [`wrapGAppsNoGuiHook`]{#ssec-gnome-hooks-wrapgappsnoguihook} for programs without a graphical interface. Same as the above but does not bring `gtk3` and `librsvg` into the closure.
 
-In case you are packaging a program without a graphical interface, you might want to use [`wrapGAppsNoGuiHook`]{#ssec-gnome-hooks-wrapgappsnoguihook}, which runs the same script as `wrapGAppsHook` but does not bring `gtk3` and `librsvg` into the closure.
+The hooks do the the following:
 
-- `wrapGAppsHook` itself will add the package’s `share` directory to `XDG_DATA_DIRS`.
+- `wrapGApps*` hook itself will add the package’s `share` directory to `XDG_DATA_DIRS`.
 
-- []{#ssec-gnome-hooks-glib} `glib` setup hook will populate `GSETTINGS_SCHEMAS_PATH` and then `wrapGAppsHook` will prepend it to `XDG_DATA_DIRS`.
+- []{#ssec-gnome-hooks-glib} `glib` setup hook will populate `GSETTINGS_SCHEMAS_PATH` and then `wrapGApps*` hook will prepend it to `XDG_DATA_DIRS`.
 
-- []{#ssec-gnome-hooks-gdk-pixbuf} `gdk-pixbuf` setup hook will populate `GDK_PIXBUF_MODULE_FILE` with the path to biggest `loaders.cache` file from the dependencies containing [GdkPixbuf loaders](#ssec-gnome-gdk-pixbuf-loaders). This works fine when there are only two packages containing loaders (`gdk-pixbuf` and e.g. `librsvg`) – it will choose the second one, reasonably expecting that it will be bigger since it describes extra loader in addition to the default ones. But when there are more than two loader packages, this logic will break. One possible solution would be constructing a custom cache file for each package containing a program like `services/x11/gdk-pixbuf.nix` NixOS module does. `wrapGAppsHook` copies the `GDK_PIXBUF_MODULE_FILE` environment variable into the produced wrapper.
+- []{#ssec-gnome-hooks-gdk-pixbuf} `gdk-pixbuf` setup hook will populate `GDK_PIXBUF_MODULE_FILE` with the path to biggest `loaders.cache` file from the dependencies containing [GdkPixbuf loaders](#ssec-gnome-gdk-pixbuf-loaders). This works fine when there are only two packages containing loaders (`gdk-pixbuf` and e.g. `librsvg`) – it will choose the second one, reasonably expecting that it will be bigger since it describes extra loader in addition to the default ones. But when there are more than two loader packages, this logic will break. One possible solution would be constructing a custom cache file for each package containing a program like `services/x11/gdk-pixbuf.nix` NixOS module does. `wrapGApps*` hook copies the `GDK_PIXBUF_MODULE_FILE` environment variable into the produced wrapper.
 
 - []{#ssec-gnome-hooks-gtk-drop-icon-theme-cache} One of `gtk3`’s setup hooks will remove `icon-theme.cache` files from package’s icon theme directories to avoid conflicts. Icon theme packages should prevent this with `dontDropIconThemeCache = true;`.
 
-- []{#ssec-gnome-hooks-dconf} `dconf.lib` is a dependency of `wrapGAppsHook`, which then also adds it to the `GIO_EXTRA_MODULES` variable.
+- []{#ssec-gnome-hooks-dconf} `dconf.lib` is a dependency of `wrapGApps*` hook, which then also adds it to the `GIO_EXTRA_MODULES` variable.
 
 - []{#ssec-gnome-hooks-hicolor-icon-theme} `hicolor-icon-theme`’s setup hook will add icon themes to `XDG_ICON_DIRS`.
 
-- []{#ssec-gnome-hooks-gobject-introspection} `gobject-introspection` setup hook populates `GI_TYPELIB_PATH` variable with `lib/girepository-1.0` directories of dependencies, which is then added to wrapper by `wrapGAppsHook`. It also adds `share` directories of dependencies to `XDG_DATA_DIRS`, which is intended to promote GIR files but it also [pollutes the closures](https://github.com/NixOS/nixpkgs/issues/32790) of packages using `wrapGAppsHook`.
+- []{#ssec-gnome-hooks-gobject-introspection} `gobject-introspection` setup hook populates `GI_TYPELIB_PATH` variable with `lib/girepository-1.0` directories of dependencies, which is then added to wrapper by `wrapGApps*` hook. It also adds `share` directories of dependencies to `XDG_DATA_DIRS`, which is intended to promote GIR files but it also [pollutes the closures](https://github.com/NixOS/nixpkgs/issues/32790) of packages using `wrapGApps*` hook.
 
-- []{#ssec-gnome-hooks-gst-grl-plugins} Setup hooks of `gst_all_1.gstreamer` and `grilo` will populate the `GST_PLUGIN_SYSTEM_PATH_1_0` and `GRL_PLUGIN_PATH` variables, respectively, which will then be added to the wrapper by `wrapGAppsHook`.
+- []{#ssec-gnome-hooks-gst-grl-plugins} Setup hooks of `gst_all_1.gstreamer` and `grilo` will populate the `GST_PLUGIN_SYSTEM_PATH_1_0` and `GRL_PLUGIN_PATH` variables, respectively, which will then be added to the wrapper by `wrapGApps*` hook.
 
 You can also pass additional arguments to `makeWrapper` using `gappsWrapperArgs` in `preFixup` hook:
 
@@ -147,15 +149,15 @@ Most GNOME package offer [`updateScript`](#var-passthru-updateScript), it is the
 
 ### `GLib-GIO-ERROR **: 06:04:50.903: No GSettings schemas are installed on the system` {#ssec-gnome-common-issues-no-schemas}
 
-There are no schemas available in `XDG_DATA_DIRS`. Temporarily add a random package containing schemas like `gsettings-desktop-schemas` to `buildInputs`. [`glib`](#ssec-gnome-hooks-glib) and [`wrapGAppsHook`](#ssec-gnome-hooks-wrapgappshook) setup hooks will take care of making the schemas available to application and you will see the actual missing schemas with the [next error](#ssec-gnome-common-issues-missing-schema). Or you can try looking through the source code for the actual schemas used.
+There are no schemas available in `XDG_DATA_DIRS`. Temporarily add a random package containing schemas like `gsettings-desktop-schemas` to `buildInputs`. [`glib`](#ssec-gnome-hooks-glib) and [`wrapGApps*`](#ssec-gnome-hooks-wrapgappshook) setup hooks will take care of making the schemas available to application and you will see the actual missing schemas with the [next error](#ssec-gnome-common-issues-missing-schema). Or you can try looking through the source code for the actual schemas used.
 
 ### `GLib-GIO-ERROR **: 06:04:50.903: Settings schema ‘org.gnome.foo’ is not installed` {#ssec-gnome-common-issues-missing-schema}
 
 Package is missing some GSettings schemas. You can find out the package containing the schema with `nix-locate org.gnome.foo.gschema.xml` and let the hooks handle the wrapping as [above](#ssec-gnome-common-issues-no-schemas).
 
-### When using `wrapGAppsHook` with special derivers you can end up with double wrapped binaries. {#ssec-gnome-common-issues-double-wrapped}
+### When using `wrapGApps*` hook with special derivers you can end up with double wrapped binaries. {#ssec-gnome-common-issues-double-wrapped}
 
-This is because derivers like `python.pkgs.buildPythonApplication` or `qt5.mkDerivation` have setup-hooks automatically added that produce wrappers with makeWrapper. The simplest way to workaround that is to disable the `wrapGAppsHook` automatic wrapping with `dontWrapGApps = true;` and pass the arguments it intended to pass to makeWrapper to another.
+This is because derivers like `python.pkgs.buildPythonApplication` or `qt5.mkDerivation` have setup-hooks automatically added that produce wrappers with makeWrapper. The simplest way to workaround that is to disable the `wrapGApps*` hook automatic wrapping with `dontWrapGApps = true;` and pass the arguments it intended to pass to makeWrapper to another.
 
 In the case of a Python application it could look like:
 
@@ -165,7 +167,7 @@ python3.pkgs.buildPythonApplication {
   version = "3.32.2";
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     # ...
   ];
@@ -187,7 +189,7 @@ mkDerivation {
   version = "3.47.0";
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     qmake
     # ...
   ];
diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index 13f029ee1f40b..b4cd5acfcc5b2 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -13,7 +13,7 @@ let
     "x86_64-darwin" "i686-darwin" "aarch64-darwin" "armv7a-darwin"
 
     # FreeBSD
-    "i686-freebsd13" "x86_64-freebsd13"
+    "i686-freebsd" "x86_64-freebsd"
 
     # Genode
     "aarch64-genode" "i686-genode" "x86_64-genode"
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index b16445eadfea8..8a3726f369682 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -328,7 +328,7 @@ rec {
   # BSDs
 
   x86_64-freebsd = {
-    config = "x86_64-unknown-freebsd13";
+    config = "x86_64-unknown-freebsd";
     useLLVM = true;
   };
 
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index 191e9734b879a..4890912d7fed4 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -326,11 +326,7 @@ rec {
     # the normalized name for macOS.
     macos    = { execFormat = macho;   families = { inherit darwin; }; name = "darwin"; };
     ios      = { execFormat = macho;   families = { inherit darwin; }; };
-    # A tricky thing about FreeBSD is that there is no stable ABI across
-    # versions. That means that putting in the version as part of the
-    # config string is paramount.
-    freebsd12 = { execFormat = elf;     families = { inherit bsd; }; name = "freebsd"; version = 12; };
-    freebsd13 = { execFormat = elf;     families = { inherit bsd; }; name = "freebsd"; version = 13; };
+    freebsd  = { execFormat = elf;     families = { inherit bsd; }; name = "freebsd"; };
     linux    = { execFormat = elf;     families = { }; };
     netbsd   = { execFormat = elf;     families = { inherit bsd; }; };
     none     = { execFormat = unknown; families = { }; };
diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix
index e142ff307fbd4..03c5d68689624 100644
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@@ -40,7 +40,7 @@ lib.runTests (
 
   testarm = mseteq arm [ "armv5tel-linux" "armv6l-linux" "armv6l-netbsd" "armv6l-none" "armv7a-linux" "armv7a-netbsd" "armv7l-linux" "armv7l-netbsd" "arm-none" "armv7a-darwin" ];
   testarmv7 = mseteq armv7 [ "armv7a-darwin" "armv7a-linux" "armv7l-linux" "armv7a-netbsd" "armv7l-netbsd" ];
-  testi686 = mseteq i686 [ "i686-linux" "i686-freebsd13" "i686-genode" "i686-netbsd" "i686-openbsd" "i686-cygwin" "i686-windows" "i686-none" "i686-darwin" ];
+  testi686 = mseteq i686 [ "i686-linux" "i686-freebsd" "i686-genode" "i686-netbsd" "i686-openbsd" "i686-cygwin" "i686-windows" "i686-none" "i686-darwin" ];
   testmips = mseteq mips [ "mips-none" "mips64-none" "mips-linux" "mips64-linux" "mips64el-linux" "mipsel-linux" "mipsel-netbsd" ];
   testmmix = mseteq mmix [ "mmix-mmixware" ];
   testpower = mseteq power [ "powerpc-netbsd" "powerpc-none" "powerpc64-linux" "powerpc64le-linux" "powerpcle-none" ];
@@ -48,11 +48,11 @@ lib.runTests (
   testriscv32 = mseteq riscv32 [ "riscv32-linux" "riscv32-netbsd" "riscv32-none" ];
   testriscv64 = mseteq riscv64 [ "riscv64-linux" "riscv64-netbsd" "riscv64-none" ];
   tests390x = mseteq s390x [ "s390x-linux" "s390x-none" ];
-  testx86_64 = mseteq x86_64 [ "x86_64-linux" "x86_64-darwin" "x86_64-freebsd13" "x86_64-genode" "x86_64-redox" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin" "x86_64-solaris" "x86_64-windows" "x86_64-none" ];
+  testx86_64 = mseteq x86_64 [ "x86_64-linux" "x86_64-darwin" "x86_64-freebsd" "x86_64-genode" "x86_64-redox" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin" "x86_64-solaris" "x86_64-windows" "x86_64-none" ];
 
   testcygwin = mseteq cygwin [ "i686-cygwin" "x86_64-cygwin" ];
   testdarwin = mseteq darwin [ "x86_64-darwin" "i686-darwin" "aarch64-darwin" "armv7a-darwin" ];
-  testfreebsd = mseteq freebsd [ "i686-freebsd13" "x86_64-freebsd13" ];
+  testfreebsd = mseteq freebsd [ "i686-freebsd" "x86_64-freebsd" ];
   testgenode = mseteq genode [ "aarch64-genode" "i686-genode" "x86_64-genode" ];
   testredox = mseteq redox [ "x86_64-redox" ];
   testgnu = mseteq gnu (linux /* ++ kfreebsd ++ ... */);
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b854584c85189..91ce54638a536 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2071,12 +2071,6 @@
     githubId = 135230;
     name = "Aycan iRiCAN";
   };
-  ayes-web = {
-    email = "ayes2022@protonmail.com";
-    github = "ayes-web";
-    githubId = 52951851;
-    name = "ayes-web";
-  };
   aynish = {
     github = "Chickensoupwithrice";
     githubId = 22575913;
@@ -2264,6 +2258,12 @@
     githubId = 576355;
     name = "Bas van Dijk";
   };
+  BatteredBunny = {
+    email = "ayes2022@protonmail.com";
+    github = "BatteredBunny";
+    githubId = 52951851;
+    name = "BatteredBunny";
+  };
   BattleCh1cken = {
     email = "BattleCh1cken@larkov.de";
     github = "BattleCh1cken";
@@ -7702,6 +7702,12 @@
     githubId = 10654650;
     name = "Guillaume Koenig";
   };
+  guitargeek = {
+    email = "jonas.rembser@cern.ch";
+    github = "guitargeek";
+    githubId = 6578603;
+    name = "Jonas Rembser";
+  };
   guserav = {
     github = "guserav";
     githubId = 28863828;
@@ -15271,6 +15277,12 @@
     githubId = 1788628;
     name = "pandaman";
   };
+  pandapip1 = {
+    email = "gavinnjohn@gmail.com";
+    github = "Pandapip1";
+    githubId = 45835846;
+    name = "Gavin John";
+  };
   panicgh = {
     email = "nbenes.gh@xandea.de";
     github = "panicgh";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 82bf551c1fe98..b356afe398d77 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -10,13 +10,13 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `cryptsetup` has been upgraded from 2.6.1 to 2.7.0. Cryptsetup is a critical component enabling LUKS-based (but not only) full disk encryption.
   Take the time to review [the release notes](https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.7.0/docs/v2.7.0-ReleaseNotes).
-  One of the highlight is that it is now possible to use hardware OPAL-based encryption of your disk with `cryptsetup`, it has a lot of caveats, see the above notes for the full details.
+  One of the highlights is that it is now possible to use hardware OPAL-based encryption of your disk with `cryptsetup`. It has a lot of caveats, see the above notes for the full details.
 
 - `screen`'s module has been cleaned, and will now require you to set `programs.screen.enable` in order to populate `screenrc` and add the program to the environment.
 
 - `linuxPackages_testing_bcachefs` is now fully deprecated by `linuxPackages_latest`, and is therefore no longer available.
 
-- The default kernel package has been updated from 6.1 to 6.6. All supported kernels remain available.
+- (TODO not sure what path to use here) The default kernel package has been updated from 6.1 to 6.6. All supported kernels remain available.
 
 - NixOS now installs a stub ELF loader that prints an informative error message when users attempt to run binaries not made for NixOS.
    - This can be disabled through the `environment.stub-ld.enable` option.
@@ -34,9 +34,9 @@ In addition to numerous new and upgraded packages, this release has the followin
   - `nixVersions.git` which tracks the latest Nix master and is roughly updated once a week. This is intended to enable people to easily test unreleased changes of Nix to catch regressions earlier.
   - `nixVersions.latest` which points to the latest Nix version packaged in nixpkgs.
 
-- Julia environments can now be built with arbitrary packages from the ecosystem using the `.withPackages` function. For example: `julia.withPackages ["Plots"]`.
+- `julia` environments can now be built with arbitrary packages from the ecosystem using the `.withPackages` function. For example: `julia.withPackages ["Plots"]`.
 
-- The PipeWire and WirePlumber modules have removed support for using
+- `pipewire` and `wireplumber` modules have removed support for using
 `environment.etc."pipewire/..."` and `environment.etc."wireplumber/..."`.
 Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for PipeWire and
 `services.pipewire.wireplumber.configPackages` for WirePlumber instead."
@@ -45,7 +45,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
   Refer to upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/)
   and release notes for [v15](https://goteleport.com/docs/changelog/#1500-013124).
 
-- A new option `systemd.sysusers.enable` was added. If enabled, users and
+- `systemd.sysusers.enable` option was added. If enabled, users and
   groups are created with systemd-sysusers instead of with a custom perl script.
 
 - `virtualisation.docker.enableNvidia` and `virtualisation.podman.enableNvidia` options are deprecated. `hardware.nvidia-container-toolkit.enable` should be used instead. This option will expose GPUs on containers with the `--device` CLI option. This is supported by Docker 25, Podman 3.2.0 and Singularity 4. Any container runtime that supports the CDI specification will take advantage of this feature.
@@ -69,16 +69,16 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
   }
   ```
 
-- The initial Incus LTS release (v6.0.x) is now available through `virtualisation.incus` as the default. Users who wish to continue using the non-LTS release will need to set `virtualisation.incus.package = pkgs.incus`. Stable release users are encouraged to stay on the LTS release as non-LTS releases will by default not be backported.
+- `virtialisation.incus` now defaults to the newly-added `incus-lts` release (v6.0.x). Users who wish to continue using the non-LTS release will need to set `virtualisation.incus.package = pkgs.incus`. Stable release users are encouraged to stay on the LTS release as non-LTS releases will by default not be backported.
 
-- Canonical LXD has been upgraded to v5.21.x, an LTS release. The LTS release is now the only supported LXD release. Users are encouraged to [migrate to Incus](https://linuxcontainers.org/incus/docs/main/howto/server_migrate_lxd/) for better support on NixOS.
+- Canonical `lxd` has been upgraded to v5.21.x, an LTS release. The LTS release is now the only supported LXD release. Users are encouraged to [migrate to Incus](https://linuxcontainers.org/incus/docs/main/howto/server_migrate_lxd/) for better support on NixOS.
 
-- lua interpreters default LUA_PATH and LUA_CPATH are not overriden by nixpkgs
+- `lua` interpreters default LUA_PATH and LUA_CPATH are not overriden by nixpkgs
   anymore, we patch LUA_ROOT instead which is more respectful to upstream.
 
-- Plasma 6 is now available and can be installed with `services.xserver.desktopManager.plasma6.enable = true;`. Plasma 5 will likely be deprecated in the next release (24.11). Note that Plasma 6 runs as Wayland by default, and the X11 session needs to be explicitly selected if necessary.
+- `plasma6` is now available and can be installed with `services.xserver.desktopManager.plasma6.enable = true;`. Plasma 5 will likely be deprecated in the next release (24.11). Note that Plasma 6 runs as Wayland by default, and the X11 session needs to be explicitly selected if necessary.
 
-- The desktop mode of Lomiri (formerly known as Unity8), using Mir 2.x to function as a Wayland compositor, is now available and can be installed with `services.desktopManager.lomiri.enable = true`. Note that some core applications, services and indicators have yet to be packaged, and some functions may remain incomplete, but the base experience should be there.
+- `lomiri` (formerly known as Unity8) desktop mode, using Mir 2.x to function as a Wayland compositor, is now available and can be installed with `services.desktopManager.lomiri.enable = true`. Note that some core applications, services and indicators have yet to be packaged, and some functions may remain incomplete, but the base experience should be there.
 
 ## New Services {#sec-release-24.05-new-services}
 
@@ -100,7 +100,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - [ryzen-smu](https://gitlab.com/leogx9r/ryzen_smu), Linux kernel driver to expose the SMU (System Management Unit) for certain AMD Ryzen Processors. Includes the userspace program `monitor_cpu`. Available at [hardward.cpu.amd.ryzen-smu](#opt-hardware.cpu.amd.ryzen-smu.enable)
 
-- systemd's gateway, upload, and remote services, which provides ways of sending journals across the network. Enable using [services.journald.gateway](#opt-services.journald.gateway.enable), [services.journald.upload](#opt-services.journald.upload.enable), and [services.journald.remote](#opt-services.journald.remote.enable).
+- `systemd`'s `gateway`, `upload`, and `remote` services, which provide ways of sending journals across the network. Enable using [services.journald.gateway](#opt-services.journald.gateway.enable), [services.journald.upload](#opt-services.journald.upload.enable), and [services.journald.remote](#opt-services.journald.remote.enable).
 
 - [GNS3](https://www.gns3.com/), a network software emulator. Available as [services.gns3-server](#opt-services.gns3-server.enable).
 
@@ -127,7 +127,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 - [db-rest](https://github.com/derhuerst/db-rest), a wrapper around Deutsche Bahn's internal API for public transport data. Available as [services.db-rest](#opt-services.db-rest.enable).
 
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
-The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server softwares.
+The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server software.
 
 - [mautrix-meta](https://github.com/mautrix/meta), a Matrix <-> Facebook and Matrix <-> Instagram hybrid puppeting/relaybot bridge. Available as services.mautrix-meta
 
@@ -139,7 +139,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [Suwayomi Server](https://github.com/Suwayomi/Suwayomi-Server), a free and open source manga reader server that runs extensions built for [Tachiyomi](https://tachiyomi.org). Available as [services.suwayomi-server](#opt-services.suwayomi-server.enable).
 
-- A self-hosted management server for the [Netbird](https://netbird.io). Available as [services.netbird.server](#opt-services.netbird.server.enable).
+- [Netbird](https://netbird.io), an open-source VPN management platform, now has a self-hosted management server. Available as [services.netbird.server](#opt-services.netbird.server.enable).
 
 - [ping_exporter](https://github.com/czerwonk/ping_exporter), a Prometheus exporter for ICMP echo requests. Available as [services.prometheus.exporters.ping](#opt-services.prometheus.exporters.ping.enable).
 
@@ -151,9 +151,9 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [Monado](https://monado.freedesktop.org/), an open source XR runtime. Available as [services.monado](#opt-services.monado.enable).
 
-- [Pretix](https://pretix.eu/about/en/), an open source ticketing software for events. Available as [services.pretix]($opt-services-pretix.enable).
+- [Pretix](https://pretix.eu/about/en/), an open source ticketing software for events. Available as [services.pretix](#opt-services.pretix.enable).
 
-- [microsocks](https://github.com/rofl0r/microsocks), a tiny, portable SOCKS5 server with very moderate resource usage. Available as [services.microsocks]($opt-services-microsocks.enable).
+- [microsocks](https://github.com/rofl0r/microsocks), a tiny, portable SOCKS5 server with very moderate resource usage. Available as [services.microsocks](#opt-services.microsocks.enable).
 
 - [inadyn](https://github.com/troglobit/inadyn), a Dynamic DNS client with built-in support for multiple providers. Available as [services.inadyn](#opt-services.inadyn.enable).
 
@@ -163,21 +163,21 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [armagetronad](https://wiki.armagetronad.org), a mid-2000s 3D lightcycle game widely played at iD Tech Camps. You can define multiple servers using `services.armagetronad.<server>.enable`.
 
-- [wyoming-satellite](https://github.com/rhasspy/wyoming-satellite), a voice assistant satellite for Home Assistant using the Wyoming protocol. Available as [services.wyoming.satellite]($opt-services.wyoming.satellite.enable).
+- [wyoming-satellite](https://github.com/rhasspy/wyoming-satellite), a voice assistant satellite for Home Assistant using the Wyoming protocol. Available as [services.wyoming.satellite](#opt-services.wyoming.satellite.enable).
 
 - [TuxClocker](https://github.com/Lurkki14/tuxclocker), a hardware control and monitoring program. Available as [programs.tuxclocker](#opt-programs.tuxclocker.enable).
 
-- binfmt option for AppImage-run to support running [AppImage](https://appimage.org/)'s seamlessly on NixOS.. Available as [programs.appimage.binfmt](#opt-programs.appimage.binfmt).
+- [AppImage](https://appimage.org/), a tool to package desktop applications, now has a `binfmt` option to support running AppImages seamlessly on NixOS. Available as [programs.appimage.binfmt](#opt-programs.appimage.binfmt).
 
 - [nh](https://github.com/viperML/nh), yet another Nix CLI helper. Available as [programs.nh](#opt-programs.nh.enable).
 
 - [ALVR](https://github.com/alvr-org/alvr), a VR desktop streamer. Available as [programs.alvr](#opt-programs.alvr.enable)
 
-- [RustDesk](https://rustdesk.com), a full-featured open source remote control alternative for self-hosting and security with minimal configuration. Alternative to TeamViewer.
+- [RustDesk](https://rustdesk.com), a full-featured open source remote control alternative for self-hosting and security with minimal configuration. Alternative to TeamViewer. Available as [services.rustdesk-server](#opt-services.rustdesk-server.enable).
 
-- [Scrutiny](https://github.com/AnalogJ/scrutiny), a S.M.A.R.T monitoring tool for hard disks with a web frontend.
+- [Scrutiny](https://github.com/AnalogJ/scrutiny), a S.M.A.R.T monitoring tool for hard disks with a web frontend. Available as [services.scrutiny](#opt-services.scrutiny.enable).
 
-- [davis](https://github.com/tchapi/davis), a simple CardDav and CalDav server inspired by Baïkal. Available as [services.davis]($opt-services-davis.enable).
+- [davis](https://github.com/tchapi/davis), a simple CardDav and CalDav server inspired by Baïkal. Available as [services.davis](#opt-services.davis.enable).
 
 - [Firefly-iii](https://www.firefly-iii.org), a free and open source personal finance manager. Available as [services.firefly-iii](#opt-services.firefly-iii.enable)
 
@@ -208,7 +208,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   defaulting to `/etc/ssh/authorized_keys.d/%u`.
   ::: {.warning}
   Users of {manpage}`pam_ssh_agent_auth(8)` must take care that the pubkeys they use (for instance with `sudo`)
-  are listed in [`sshAgentAuth.authorizedKeysFiles`]..
+  are listed in [`sshAgentAuth.authorizedKeysFiles`].
   :::
   ::: {.note}
   Previously, all `services.openssh.authorizedKeysFiles` were trusted, including `~/.ssh/authorized_keys`,
@@ -226,7 +226,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `cudaPackages.autoFixElfFiles` has been deprecated for `pkgs.autoFixElfFiles`. Functionality has not changed, but the setuphook has been renamed and moved to the top-level package scope.
 
-- `appimageTools.wrapAppImage` now create the binary at `$out/bin/${pname}` rather than `$out/bin/${pname}-${version}`, which will break downstream workarounds.
+- `appimageTools.wrapAppImage` now creates the binary at `$out/bin/${pname}` rather than `$out/bin/${pname}-${version}`, which will break downstream workarounds.
 
 - `pdns` was updated to version [v4.9.x](https://doc.powerdns.com/authoritative/changelog/4.9.html), which introduces breaking changes. Check out the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-4-9-0) for details.
 
@@ -246,16 +246,16 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   The list in `nixos/modules/virtualisation/amazon-ec2-amis.nix` will stop
   being updated and will be removed in the future.
 
-- The option `services.postgresql.ensureUsers._.ensurePermissions` has been removed as it's
+- The option `services.postgresql.ensureUsers._.ensurePermissions` has been removed as it is
   not declarative and is broken with newer postgresql versions. Consider using
   [](#opt-services.postgresql.ensureUsers._.ensureDBOwnership)
-  instead or a tool that's more suited for managing the data inside a postgresql database.
+  instead or a tool that is more suited for managing the data inside a postgresql database.
 
 - `idris2` was updated to v0.7.0. This version introduces breaking changes. Check out the [changelog](https://github.com/idris-lang/Idris2/blob/v0.7.0/CHANGELOG.md#v070) for details.
 
 - `nvtop` family of packages was reorganized into nested attrset. `nvtop` has been renamed to `nvtopPackages.full`, and all `nvtop-{amd,nvidia,intel,msm}` packages are now named as `nvtopPackages.{amd,nvidia,intel,msm}`
 
-- `neo4j` has been updated to version 5, you may want to read the [release notes for Neo4j 5](https://neo4j.com/release-notes/database/neo4j-5/)
+- `neo4j` has been updated to version 5. You may want to read the [release notes for Neo4j 5](https://neo4j.com/release-notes/database/neo4j-5/).
 
 - `services.neo4j.allowUpgrade` was removed and no longer has any effect. Neo4j 5 supports automatic rolling upgrades.
 
@@ -497,6 +497,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `erlang-ls` package no longer ships the `els_dap` binary as of v0.51.0.
 
+- `icu` no longer includes `install-sh` and `mkinstalldirs` in the shared folder.
+
 ## Other Notable Changes {#sec-release-24.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index b811823d698a1..1d7976cef36a2 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -47,7 +47,7 @@ with lib;
       gst_all_1 = super.gst_all_1 // {
         gst-plugins-bad = super.gst_all_1.gst-plugins-bad.override { guiSupport = false; };
         gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableWayland = false; enableX11 = false; };
-        gst-plugins-good = super.gst_all_1.gst-plugins-good.override { enableX11 = false; };
+        gst-plugins-good = super.gst_all_1.gst-plugins-good.override { enableWayland = false; enableX11 = false; gtkSupport = false; qt5Support = false; qt6Support = false; };
       };
       imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
       imagemagickBig = super.imagemagickBig.override { libX11Support = false; libXtSupport = false; };
diff --git a/nixos/modules/hardware/openrazer.nix b/nixos/modules/hardware/openrazer.nix
index 99b5510543233..5ba6abfdb3d7e 100644
--- a/nixos/modules/hardware/openrazer.nix
+++ b/nixos/modules/hardware/openrazer.nix
@@ -19,7 +19,9 @@ let
       [Startup]
       sync_effects_enabled = ${toPyBoolStr cfg.syncEffectsEnabled}
       devices_off_on_screensaver = ${toPyBoolStr cfg.devicesOffOnScreensaver}
-      mouse_battery_notifier = ${toPyBoolStr cfg.mouseBatteryNotifier}
+      battery_notifier = ${toPyBoolStr (cfg.mouseBatteryNotifier || cfg.batteryNotifier.enable)}
+      battery_notifier_freq = ${builtins.toString cfg.batteryNotifier.frequency}
+      battery_notifier_percent = ${builtins.toString cfg.batteryNotifier.percentage}
 
       [Statistics]
       key_statistics = ${toPyBoolStr cfg.keyStatistics}
@@ -86,6 +88,41 @@ in
         '';
       };
 
+      batteryNotifier = mkOption {
+        description = ''
+          Settings for device battery notifications.
+        '';
+        default = {};
+        type = types.submodule {
+          options = {
+            enable = mkOption {
+              type = types.bool;
+              default = true;
+              description = ''
+                Mouse battery notifier.
+              '';
+            };
+            frequency = mkOption {
+              type = types.int;
+              default = 600;
+              description = ''
+                How often battery notifications should be shown (in seconds).
+                A value of 0 disables notifications.
+              '';
+            };
+
+            percentage = mkOption {
+              type = types.int;
+              default = 33;
+              description = ''
+                At what battery percentage the device should reach before
+                sending notifications.
+              '';
+            };
+          };
+        };
+      };
+
       keyStatistics = mkOption {
         type = types.bool;
         default = false;
@@ -107,6 +144,13 @@ in
   };
 
   config = mkIf cfg.enable {
+    warnings = flatten [
+      (optional cfg.mouseBatteryNotifier ''
+        The option openrazer.mouseBatteryNotifier is deprecated.
+        Please use openrazer.batteryNotifier instead to enable and configure battery notifications.
+      '')
+    ];
+
     boot.extraModulePackages = [ kernelPackages.openrazer ];
     boot.kernelModules = drivers;
 
@@ -127,15 +171,15 @@ in
     systemd.user.services.openrazer-daemon = {
       description = "Daemon to manage razer devices in userspace";
       unitConfig.Documentation = "man:openrazer-daemon(8)";
-        # Requires a graphical session so the daemon knows when the screensaver
-        # starts. See the 'devicesOffOnScreensaver' option.
-        wantedBy = [ "graphical-session.target" ];
-        partOf = [ "graphical-session.target" ];
-        serviceConfig = {
-          Type = "dbus";
-          BusName = "org.razer";
-          ExecStart = "${daemonExe} --foreground";
-          Restart = "always";
+      # Requires a graphical session so the daemon knows when the screensaver
+      # starts. See the 'devicesOffOnScreensaver' option.
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "org.razer";
+        ExecStart = "${daemonExe} --foreground";
+        Restart = "always";
       };
     };
   };
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 8a386b4848b91..8a9d8c210b34d 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -1,8 +1,31 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
+  inherit (lib)
+    attrValues
+    concatMapStrings
+    concatStringsSep
+    const
+    elem
+    filterAttrs
+    isString
+    literalExpression
+    mapAttrs
+    mapAttrsToList
+    mkAfter
+    mkBefore
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    mkPackageOption
+    mkRemovedOptionModule
+    mkRenamedOptionModule
+    optionalString
+    types
+    versionAtLeast
+    ;
 
   cfg = config.services.postgresql;
 
@@ -14,7 +37,7 @@ let
       #     package = pkgs.postgresql_<major>;
       #   };
       # works.
-      base = if cfg.enableJIT then cfg.package.withJIT else cfg.package;
+      base = if cfg.enableJIT then cfg.package.withJIT else cfg.package.withoutJIT;
     in
     if cfg.extraPlugins == []
       then base
@@ -24,7 +47,7 @@ let
     if true == value then "yes"
     else if false == value then "no"
     else if isString value then "'${lib.replaceStrings ["'"] ["''"] value}'"
-    else toString value;
+    else builtins.toString value;
 
   # The main PostgreSQL configuration file.
   configFile = pkgs.writeTextDir "postgresql.conf" (concatStringsSep "\n" (mapAttrsToList (n: v: "${n} = ${toStr v}") (filterAttrs (const (x: x != null)) cfg.settings)));
@@ -439,7 +462,7 @@ in
   config = mkIf cfg.enable {
 
     assertions = map ({ name, ensureDBOwnership, ... }: {
-      assertion = ensureDBOwnership -> builtins.elem name cfg.ensureDatabases;
+      assertion = ensureDBOwnership -> elem name cfg.ensureDatabases;
       message = ''
         For each database user defined with `services.postgresql.ensureUsers` and
         `ensureDBOwnership = true;`, a database with the same name must be defined
@@ -537,7 +560,7 @@ in
         # Wait for PostgreSQL to be ready to accept connections.
         postStart =
           ''
-            PSQL="psql --port=${toString cfg.settings.port}"
+            PSQL="psql --port=${builtins.toString cfg.settings.port}"
 
             while ! $PSQL -d postgres -c "" 2> /dev/null; do
                 if ! kill -0 "$MAINPID"; then exit 1; fi
diff --git a/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix b/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix
index b5573d2fc21bc..67af93dd007fb 100644
--- a/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix
@@ -26,7 +26,21 @@ with lib;
   ###### implementation
   config = mkIf config.services.gnome.gnome-remote-desktop.enable {
     services.pipewire.enable = true;
+    services.dbus.packages = [ pkgs.gnome.gnome-remote-desktop ];
+
+    environment.systemPackages = [ pkgs.gnome.gnome-remote-desktop ];
 
     systemd.packages = [ pkgs.gnome.gnome-remote-desktop ];
+    systemd.tmpfiles.packages = [ pkgs.gnome.gnome-remote-desktop ];
+
+    # TODO: if possible, switch to using provided g-r-d sysusers.d
+    users = {
+      users.gnome-remote-desktop = {
+        isSystemUser = true;
+        group = "gnome-remote-desktop";
+        home = "/var/lib/gnome-remote-desktop";
+      };
+      groups.gnome-remote-desktop = { };
+    };
   };
 }
diff --git a/nixos/modules/services/home-automation/ebusd.nix b/nixos/modules/services/home-automation/ebusd.nix
index aaf2ca1d775d5..d388022d7b50b 100644
--- a/nixos/modules/services/home-automation/ebusd.nix
+++ b/nixos/modules/services/home-automation/ebusd.nix
@@ -97,50 +97,50 @@ in
 
     logs = {
       main = mkOption {
-        type = types.enum [ "error" "notice" "info" "debug"];
+        type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
         description = ''
-          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
 
       network = mkOption {
-        type = types.enum [ "error" "notice" "info" "debug"];
+        type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
         description = ''
-          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
 
       bus = mkOption {
-        type = types.enum [ "error" "notice" "info" "debug"];
+        type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
         description = ''
-          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
 
       update = mkOption {
-        type = types.enum [ "error" "notice" "info" "debug"];
+        type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
         description = ''
-          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
 
       other = mkOption {
-        type = types.enum [ "error" "notice" "info" "debug"];
+        type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
         description = ''
-          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
 
       all = mkOption {
-        type = types.enum [ "error" "notice" "info" "debug"];
+        type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
         description = ''
-          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
     };
diff --git a/nixos/modules/services/logging/logrotate.nix b/nixos/modules/services/logging/logrotate.nix
index 3e29828eba2f2..9344277fc1e02 100644
--- a/nixos/modules/services/logging/logrotate.nix
+++ b/nixos/modules/services/logging/logrotate.nix
@@ -224,7 +224,7 @@ in
           and users are replaced by dummy users), so tests are complemented by a
           logrotate-checkconf service that is enabled by default.
           This extra check can be disabled by disabling it at the systemd level with the
-          {option}`services.systemd.services.logrotate-checkconf.enable` option.
+          {option}`systemd.services.logrotate-checkconf.enable` option.
 
           Conversely there are still things that might make this check fail incorrectly
           (e.g. a file path where we don't have access to intermediate directories):
diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix
index 7e7ca7e4060ec..180c9800d7345 100644
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -534,14 +534,11 @@ in {
               hyperkittyApiKey=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 64)
               secretKey=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 64)
 
-              mailmanWebCfgTmp=$(mktemp)
-              jq -n '.MAILMAN_ARCHIVER_KEY=$archiver_key | .SECRET_KEY=$secret_key' \
+              install -m 0440 -o root -g mailman \
+                <(jq -n '.MAILMAN_ARCHIVER_KEY=$archiver_key | .SECRET_KEY=$secret_key' \
                   --arg archiver_key "$hyperkittyApiKey" \
-                  --arg secret_key "$secretKey" \
-                  >"$mailmanWebCfgTmp"
-              chown root:mailman "$mailmanWebCfgTmp"
-              chmod 440 "$mailmanWebCfgTmp"
-              mv -n "$mailmanWebCfgTmp" "$mailmanWebCfg"
+                  --arg secret_key "$secretKey") \
+                "$mailmanWebCfg"
           fi
 
           hyperkittyApiKey="$(jq -r .MAILMAN_ARCHIVER_KEY "$mailmanWebCfg")"
diff --git a/nixos/modules/services/security/vault.nix b/nixos/modules/services/security/vault.nix
index ab86da47b2e1c..650f9bda99c33 100644
--- a/nixos/modules/services/security/vault.nix
+++ b/nixos/modules/services/security/vault.nix
@@ -56,8 +56,8 @@ in
       };
 
       devRootTokenID = mkOption {
-        type = types.str;
-        default = false;
+        type = types.nullOr types.str;
+        default = null;
         description = ''
           Initial root token. This only applies when {option}`services.vault.dev` is true
         '';
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 337d53e869efe..08fab09e1e559 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -352,7 +352,8 @@ let
 
         # The acme-challenge location doesn't need to be added if we are not using any automated
         # certificate provisioning and can also be omitted when we use a certificate obtained via a DNS-01 challenge
-        acmeLocation = optionalString (vhost.enableACME || (vhost.useACMEHost != null && config.security.acme.certs.${vhost.useACMEHost}.dnsProvider == null))
+        acmeName = if vhost.useACMEHost != null then vhost.useACMEHost else vhostName;
+        acmeLocation = optionalString ((vhost.enableACME || vhost.useACMEHost != null) && config.security.acme.certs.${acmeName}.dnsProvider == null)
           # Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx)
           # We use ^~ here, so that we don't check any regexes (which could
           # otherwise easily override this intended match accidentally).
diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
index 482527d1e8ad5..2e0eef67c0b3e 100644
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@@ -157,6 +157,7 @@ in
 
         # packages
         nemo-with-extensions
+        gnome-online-accounts-gtk
         cinnamon-control-center
         cinnamon-settings-daemon
         libgnomekbd
diff --git a/nixos/modules/services/x11/desktop-managers/gnome.nix b/nixos/modules/services/x11/desktop-managers/gnome.nix
index a0cf56e7a920d..42cb57ef5a415 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@@ -408,10 +408,6 @@ in
 
       services.avahi.enable = mkDefault true;
 
-      xdg.portal.extraPortals = [
-        pkgs.gnome.gnome-shell
-      ];
-
       services.geoclue2.enable = mkDefault true;
       services.geoclue2.enableDemoAgent = false; # GNOME has its own geoclue agent
 
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 2d7ccac7d92c8..4d04853d20a56 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -9,7 +9,7 @@ let
   cfg = config.virtualisation.incus;
   preseedFormat = pkgs.formats.yaml { };
 
-  serverBinPath = ''${pkgs.qemu_kvm}/libexec:${
+  serverBinPath = ''/run/wrappers/bin:${pkgs.qemu_kvm}/libexec:${
     lib.makeBinPath (
       with pkgs;
       [
@@ -33,30 +33,41 @@ let
         gzip
         iproute2
         iptables
+        iw
         kmod
+        libnvidia-container
+        libxfs
         lvm2
         minio
+        minio-client
         nftables
-        qemu_kvm
         qemu-utils
+        qemu_kvm
         rsync
+        squashfs-tools-ng
         squashfsTools
+        sshfs
         swtpm
         systemd
         thin-provisioning-tools
         util-linux
         virtiofsd
+        xdelta
         xz
+      ]
+      ++ lib.optionals config.security.apparmor.enable [
+        apparmor-bin-utils
 
         (writeShellScriptBin "apparmor_parser" ''
           exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
         '')
       ]
+      ++ lib.optionals config.services.ceph.client.enable [ ceph-client ]
+      ++ lib.optionals config.virtualisation.vswitch.enable [ config.virtualisation.vswitch.package ]
       ++ lib.optionals config.boot.zfs.enabled [
         config.boot.zfs.package
         "${config.boot.zfs.package}/lib/udev"
       ]
-      ++ lib.optionals config.virtualisation.vswitch.enable [ config.virtualisation.vswitch.package ]
     )
   }'';
 
diff --git a/nixos/tests/installed-tests/default.nix b/nixos/tests/installed-tests/default.nix
index e87edb2007e93..b1ddfe3dcbd80 100644
--- a/nixos/tests/installed-tests/default.nix
+++ b/nixos/tests/installed-tests/default.nix
@@ -1,5 +1,5 @@
 # NixOS tests for gnome-desktop-testing-runner using software
-# See https://wiki.gnome.org/Initiatives/GnomeGoals/InstalledTests
+# See https://github.com/NixOS/nixpkgs/issues/34987
 
 { system ? builtins.currentSystem,
   config ? {},
diff --git a/nixos/tests/installed-tests/gnome-photos.nix b/nixos/tests/installed-tests/gnome-photos.nix
index bcb6479ee89c6..010ad97024026 100644
--- a/nixos/tests/installed-tests/gnome-photos.nix
+++ b/nixos/tests/installed-tests/gnome-photos.nix
@@ -13,7 +13,7 @@ makeInstalledTest {
       (stdenv.mkDerivation {
         name = "desktop-gsettings";
         dontUnpack = true;
-        nativeBuildInputs = [ glib wrapGAppsHook ];
+        nativeBuildInputs = [ glib wrapGAppsHook3 ];
         buildInputs = [ gsettings-desktop-schemas ];
         installPhase = ''
           runHook preInstall
diff --git a/nixos/tests/libreswan.nix b/nixos/tests/libreswan.nix
index aadba941fab17..c798a04645bc0 100644
--- a/nixos/tests/libreswan.nix
+++ b/nixos/tests/libreswan.nix
@@ -119,11 +119,11 @@ in
       with subtest("Libreswan is ready"):
           alice.wait_for_unit("ipsec")
           bob.wait_for_unit("ipsec")
-          alice.succeed("ipsec verify 1>&2")
+          alice.succeed("ipsec checkconfig")
 
       with subtest("Alice and Bob can start the tunnel"):
-          alice.execute("ipsec auto --start tunnel >&2 &")
-          bob.succeed("ipsec auto --start tunnel")
+          alice.execute("ipsec start tunnel >&2 &")
+          bob.succeed("ipsec start tunnel")
           # apparently this is needed to "wake" the tunnel
           bob.execute("ping -c1 alice")
 
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index a039986621cab..2684b6f45e84e 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }:
 
 let inherit (import ./ssh-keys.nix pkgs)
-      snakeOilPrivateKey snakeOilPublicKey;
+      snakeOilPrivateKey snakeOilPublicKey snakeOilEd25519PrivateKey snakeOilEd25519PublicKey;
 in {
   name = "openssh";
   meta = with pkgs.lib.maintainers; {
@@ -108,6 +108,31 @@ in {
         };
       };
 
+    server-no-openssl =
+      { ... }:
+      {
+        programs.ssh.package = pkgs.opensshPackages.openssh.override {
+          linkOpenssl = false;
+        };
+        services.openssh = {
+          enable = true;
+          hostKeys = [
+            { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+          ];
+          settings = {
+            # Must not specify the OpenSSL provided algorithms.
+            Ciphers = [ "chacha20-poly1305@openssh.com" ];
+            KexAlgorithms = [
+              "curve25519-sha256"
+              "curve25519-sha256@libssh.org"
+            ];
+          };
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilEd25519PublicKey
+        ];
+      };
+
     server-no-pam =
       { pkgs, ... }:
       {
@@ -139,6 +164,7 @@ in {
     server_allowed_users.wait_for_unit("sshd", timeout=30)
     server_localhost_only.wait_for_unit("sshd", timeout=30)
     server_match_rule.wait_for_unit("sshd", timeout=30)
+    server_no_openssl.wait_for_unit("sshd", timeout=30)
     server_no_pam.wait_for_unit("sshd", timeout=30)
 
     server_lazy.wait_for_unit("sshd.socket", timeout=30)
@@ -230,6 +256,16 @@ in {
             timeout=30
         )
 
+    with subtest("no-openssl"):
+        client.succeed(
+            "cat ${snakeOilEd25519PrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-no-openssl true",
+            timeout=30
+        )
+
     with subtest("no-pam"):
         client.succeed(
             "cat ${snakeOilPrivateKey} > privkey.snakeoil"
diff --git a/nixos/tests/postgresql-jit.nix b/nixos/tests/postgresql-jit.nix
index baf26b8da2b39..f4b1d07a7faf8 100644
--- a/nixos/tests/postgresql-jit.nix
+++ b/nixos/tests/postgresql-jit.nix
@@ -1,6 +1,7 @@
 { system ? builtins.currentSystem
 , config ? {}
 , pkgs ? import ../.. { inherit system config; }
+, package ? null
 }:
 
 with import ../lib/testing-python.nix { inherit system pkgs; };
@@ -9,14 +10,17 @@ let
   inherit (pkgs) lib;
   packages = builtins.attrNames (import ../../pkgs/servers/sql/postgresql pkgs);
 
-  mkJitTest = packageName: makeTest {
-    name = "${packageName}";
+  mkJitTestFromName = name:
+    mkJitTest pkgs.${name};
+
+  mkJitTest = package: makeTest {
+    name = package.name;
     meta.maintainers = with lib.maintainers; [ ma27 ];
     nodes.machine = { pkgs, lib, ... }: {
       services.postgresql = {
+        inherit package;
         enable = true;
         enableJIT = true;
-        package = pkgs.${packageName};
         initialScript = pkgs.writeText "init.sql" ''
           create table demo (id int);
           insert into demo (id) select generate_series(1, 5);
@@ -45,4 +49,7 @@ let
     '';
   };
 in
-lib.genAttrs packages mkJitTest
+if package == null then
+  lib.genAttrs packages mkJitTestFromName
+else
+  mkJitTest package
diff --git a/nixos/tests/postgresql-wal-receiver.nix b/nixos/tests/postgresql-wal-receiver.nix
index b0bd7711dbcd9..ab2ab4ad0d4fa 100644
--- a/nixos/tests/postgresql-wal-receiver.nix
+++ b/nixos/tests/postgresql-wal-receiver.nix
@@ -1,6 +1,7 @@
 { system ? builtins.currentSystem,
   config ? {},
-  pkgs ? import ../.. { inherit system config; }
+  pkgs ? import ../.. { inherit system config; },
+  package ? null
 }:
 
 with import ../lib/testing-python.nix { inherit system pkgs; };
@@ -9,111 +10,110 @@ let
   lib = pkgs.lib;
 
   # Makes a test for a PostgreSQL package, given by name and looked up from `pkgs`.
-  makePostgresqlWalReceiverTest = postgresqlPackage:
+  makeTestAttribute = name:
   {
-    name = postgresqlPackage;
-    value =
-      let
-        pkg = pkgs."${postgresqlPackage}";
-        postgresqlDataDir = "/var/lib/postgresql/${pkg.psqlSchema}";
-        replicationUser = "wal_receiver_user";
-        replicationSlot = "wal_receiver_slot";
-        replicationConn = "postgresql://${replicationUser}@localhost";
-        baseBackupDir = "/tmp/pg_basebackup";
-        walBackupDir = "/tmp/pg_wal";
-        atLeast12 = lib.versionAtLeast pkg.version "12.0";
-
-        recoveryFile = if atLeast12
-            then pkgs.writeTextDir "recovery.signal" ""
-            else pkgs.writeTextDir "recovery.conf" "restore_command = 'cp ${walBackupDir}/%f %p'";
-
-      in makeTest {
-        name = "postgresql-wal-receiver-${postgresqlPackage}";
-        meta.maintainers = with lib.maintainers; [ pacien ];
-
-        nodes.machine = { ... }: {
-          services.postgresql = {
-            package = pkg;
-            enable = true;
-            settings = lib.mkMerge [
-              {
-                wal_level = "archive"; # alias for replica on pg >= 9.6
-                max_wal_senders = 10;
-                max_replication_slots = 10;
-              }
-              (lib.mkIf atLeast12 {
-                restore_command = "cp ${walBackupDir}/%f %p";
-                recovery_end_command = "touch recovery.done";
-              })
-            ];
-            authentication = ''
-              host replication ${replicationUser} all trust
-            '';
-            initialScript = pkgs.writeText "init.sql" ''
-              create user ${replicationUser} replication;
-              select * from pg_create_physical_replication_slot('${replicationSlot}');
-            '';
-          };
+    inherit name;
+    value = makePostgresqlWalReceiverTest pkgs."${name}";
+  };
+
+  makePostgresqlWalReceiverTest = pkg:
+    let
+      postgresqlDataDir = "/var/lib/postgresql/${pkg.psqlSchema}";
+      replicationUser = "wal_receiver_user";
+      replicationSlot = "wal_receiver_slot";
+      replicationConn = "postgresql://${replicationUser}@localhost";
+      baseBackupDir = "/tmp/pg_basebackup";
+      walBackupDir = "/tmp/pg_wal";
+
+      recoveryFile = pkgs.writeTextDir "recovery.signal" "";
 
-          services.postgresqlWalReceiver.receivers.main = {
-            postgresqlPackage = pkg;
-            connection = replicationConn;
-            slot = replicationSlot;
-            directory = walBackupDir;
+    in makeTest {
+      name = "postgresql-wal-receiver-${pkg.name}";
+      meta.maintainers = with lib.maintainers; [ pacien ];
+
+      nodes.machine = { ... }: {
+        services.postgresql = {
+          package = pkg;
+          enable = true;
+          settings = {
+            max_replication_slots = 10;
+            max_wal_senders = 10;
+            recovery_end_command = "touch recovery.done";
+            restore_command = "cp ${walBackupDir}/%f %p";
+            wal_level = "archive"; # alias for replica on pg >= 9.6
           };
-          # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
-          # default 60sec is fine for real system, but is too much for a test
-          systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
+          authentication = ''
+            host replication ${replicationUser} all trust
+          '';
+          initialScript = pkgs.writeText "init.sql" ''
+            create user ${replicationUser} replication;
+            select * from pg_create_physical_replication_slot('${replicationSlot}');
+          '';
         };
 
-        testScript = ''
-          # make an initial base backup
-          machine.wait_for_unit("postgresql")
-          machine.wait_for_unit("postgresql-wal-receiver-main")
-          # WAL receiver healthchecks PG every 5 seconds, so let's be sure they have connected each other
-          # required only for 9.4
-          machine.sleep(5)
-          machine.succeed(
-              "${pkg}/bin/pg_basebackup --dbname=${replicationConn} --pgdata=${baseBackupDir}"
-          )
-
-          # create a dummy table with 100 records
-          machine.succeed(
-              "sudo -u postgres psql --command='create table dummy as select * from generate_series(1, 100) as val;'"
-          )
-
-          # stop postgres and destroy data
-          machine.systemctl("stop postgresql")
-          machine.systemctl("stop postgresql-wal-receiver-main")
-          machine.succeed("rm -r ${postgresqlDataDir}/{base,global,pg_*}")
-
-          # restore the base backup
-          machine.succeed(
-              "cp -r ${baseBackupDir}/* ${postgresqlDataDir} && chown postgres:postgres -R ${postgresqlDataDir}"
-          )
-
-          # prepare WAL and recovery
-          machine.succeed("chmod a+rX -R ${walBackupDir}")
-          machine.execute(
-              "for part in ${walBackupDir}/*.partial; do mv $part ''${part%%.*}; done"
-          )  # make use of partial segments too
-          machine.succeed(
-              "cp ${recoveryFile}/* ${postgresqlDataDir}/ && chmod 666 ${postgresqlDataDir}/recovery*"
-          )
-
-          # replay WAL
-          machine.systemctl("start postgresql")
-          machine.wait_for_file("${postgresqlDataDir}/recovery.done")
-          machine.systemctl("restart postgresql")
-          machine.wait_for_unit("postgresql")
-
-          # check that our records have been restored
-          machine.succeed(
-              "test $(sudo -u postgres psql --pset='pager=off' --tuples-only --command='select count(distinct val) from dummy;') -eq 100"
-          )
-        '';
+        services.postgresqlWalReceiver.receivers.main = {
+          postgresqlPackage = pkg;
+          connection = replicationConn;
+          slot = replicationSlot;
+          directory = walBackupDir;
+        };
+        # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
+        # default 60sec is fine for real system, but is too much for a test
+        systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
       };
+
+      testScript = ''
+        # make an initial base backup
+        machine.wait_for_unit("postgresql")
+        machine.wait_for_unit("postgresql-wal-receiver-main")
+        # WAL receiver healthchecks PG every 5 seconds, so let's be sure they have connected each other
+        # required only for 9.4
+        machine.sleep(5)
+        machine.succeed(
+            "${pkg}/bin/pg_basebackup --dbname=${replicationConn} --pgdata=${baseBackupDir}"
+        )
+
+        # create a dummy table with 100 records
+        machine.succeed(
+            "sudo -u postgres psql --command='create table dummy as select * from generate_series(1, 100) as val;'"
+        )
+
+        # stop postgres and destroy data
+        machine.systemctl("stop postgresql")
+        machine.systemctl("stop postgresql-wal-receiver-main")
+        machine.succeed("rm -r ${postgresqlDataDir}/{base,global,pg_*}")
+
+        # restore the base backup
+        machine.succeed(
+            "cp -r ${baseBackupDir}/* ${postgresqlDataDir} && chown postgres:postgres -R ${postgresqlDataDir}"
+        )
+
+        # prepare WAL and recovery
+        machine.succeed("chmod a+rX -R ${walBackupDir}")
+        machine.execute(
+            "for part in ${walBackupDir}/*.partial; do mv $part ''${part%%.*}; done"
+        )  # make use of partial segments too
+        machine.succeed(
+            "cp ${recoveryFile}/* ${postgresqlDataDir}/ && chmod 666 ${postgresqlDataDir}/recovery*"
+        )
+
+        # replay WAL
+        machine.systemctl("start postgresql")
+        machine.wait_for_file("${postgresqlDataDir}/recovery.done")
+        machine.systemctl("restart postgresql")
+        machine.wait_for_unit("postgresql")
+
+        # check that our records have been restored
+        machine.succeed(
+            "test $(sudo -u postgres psql --pset='pager=off' --tuples-only --command='select count(distinct val) from dummy;') -eq 100"
+        )
+      '';
     };
 
-# Maps the generic function over all attributes of PostgreSQL packages
-in builtins.listToAttrs (map makePostgresqlWalReceiverTest (builtins.attrNames (import ../../pkgs/servers/sql/postgresql pkgs)))
+in
+if package == null then
+  # all-tests.nix: Maps the generic function over all attributes of PostgreSQL packages
+  builtins.listToAttrs (map makeTestAttribute (builtins.attrNames (import ../../pkgs/servers/sql/postgresql pkgs)))
+else
+  # Called directly from <package>.tests
+  makePostgresqlWalReceiverTest package
diff --git a/nixos/tests/ssh-keys.nix b/nixos/tests/ssh-keys.nix
index df9ff38a3b22a..675f3a0b43947 100644
--- a/nixos/tests/ssh-keys.nix
+++ b/nixos/tests/ssh-keys.nix
@@ -12,4 +12,16 @@ pkgs:
     "yNTYAAABBBChdA2BmwcG49OrQN33f/sj+OHL5sJhwVl2Qim0vkUJQCry1zFpKTa"
     "9ZcDMiWaEhoAR6FGoaGI04ff7CS+1yybQ= snakeoil"
   ];
+
+  snakeOilEd25519PrivateKey = pkgs.writeText "privkey.snakeoil" ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACAYBTIWo1J4PkY4/7AhVyPT8xvAUI67tp+yYFFRdSm7+QAAAJC89yCivPcg
+    ogAAAAtzc2gtZWQyNTUxOQAAACAYBTIWo1J4PkY4/7AhVyPT8xvAUI67tp+yYFFRdSm7+Q
+    AAAEDJmKp3lX6Pz0unTc0QZwrHb8Eyr9fJUopE9d2/+q+eCxgFMhajUng+Rjj/sCFXI9Pz
+    G8BQjru2n7JgUVF1Kbv5AAAACnRvbUBvemRlc2sBAgM=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
+
+  snakeOilEd25519PublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBgFMhajUng+Rjj/sCFXI9PzG8BQjru2n7JgUVF1Kbv5 snakeoil";
 }
diff --git a/pkgs/applications/accessibility/dasher/default.nix b/pkgs/applications/accessibility/dasher/default.nix
index 0de562c5331bb..6e602dc35c331 100644
--- a/pkgs/applications/accessibility/dasher/default.nix
+++ b/pkgs/applications/accessibility/dasher/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitLab
 , autoreconfHook
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gtk3
 , expat
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     autoreconfHook
-    wrapGAppsHook
+    wrapGAppsHook3
     pkg-config
     # doc generation
     gnome-doc-utils
diff --git a/pkgs/applications/accessibility/mousetweaks/default.nix b/pkgs/applications/accessibility/mousetweaks/default.nix
index 5426f2c8fdd08..c05c1dd8bf1d8 100644
--- a/pkgs/applications/accessibility/mousetweaks/default.nix
+++ b/pkgs/applications/accessibility/mousetweaks/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config
-, glib, gtk3, gnome, gsettings-desktop-schemas, wrapGAppsHook
+, glib, gtk3, gnome, gsettings-desktop-schemas, wrapGAppsHook3
 , xorg
 }:
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
    sha256 = "005fhmvb45sa9mq17dpa23n1xnspiissx5rnpiy7hiqmy3g5rg8f";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   buildInputs = [
     glib gtk3 gsettings-desktop-schemas
diff --git a/pkgs/applications/accessibility/squeekboard/default.nix b/pkgs/applications/accessibility/squeekboard/default.nix
index c7ea8b34a66f6..119217ddfd8c5 100644
--- a/pkgs/applications/accessibility/squeekboard/default.nix
+++ b/pkgs/applications/accessibility/squeekboard/default.nix
@@ -17,7 +17,7 @@
 , rustPlatform
 , rustc
 , feedbackd
-, wrapGAppsHook
+, wrapGAppsHook3
 , fetchpatch
 , nixosTests
 }:
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     pkg-config
     glib
     wayland
-    wrapGAppsHook
+    wrapGAppsHook3
     rustPlatform.cargoSetupHook
     cargo
     rustc
diff --git a/pkgs/applications/audio/ario/default.nix b/pkgs/applications/audio/ario/default.nix
index b9e14f486b7ab..f34ff19ea04ce 100644
--- a/pkgs/applications/audio/ario/default.nix
+++ b/pkgs/applications/audio/ario/default.nix
@@ -13,7 +13,7 @@
 , libsoup
 , libxml2
 , taglib
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index c0db59b1d2bbd..365ea7d9c9eb0 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , cmake
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , python3
 , gettext
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optionals stdenv.isLinux [
     linuxHeaders
   ];
diff --git a/pkgs/applications/audio/audio-recorder/default.nix b/pkgs/applications/audio/audio-recorder/default.nix
index 72d31e2966ff5..ebf9eafcb0d3f 100644
--- a/pkgs/applications/audio/audio-recorder/default.nix
+++ b/pkgs/applications/audio/audio-recorder/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl
 , pkg-config, intltool
 , glib, dbus, gtk3, libappindicator-gtk3, gst_all_1
-, librsvg, wrapGAppsHook
+, librsvg, wrapGAppsHook3
 , pulseaudioSupport ? true, libpulseaudio }:
 
 stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   # https://bugs.launchpad.net/audio-recorder/+bug/1784622
   env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
-  nativeBuildInputs = [ pkg-config intltool wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config intltool wrapGAppsHook3 ];
 
   buildInputs = [
     glib dbus gtk3 librsvg libappindicator-gtk3
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
index 5f750a885d155..8eda6c204b7f8 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
@@ -2,7 +2,7 @@
 , gdk-pixbuf, glib, gtk3, lib, xorg
 , libglvnd, libjack2, ffmpeg
 , libxkbcommon, xdg-utils, zlib, pulseaudio
-, wrapGAppsHook, makeWrapper }:
+, wrapGAppsHook3, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-cF8gVPjM0KUcKOW09uFccp4/lzbUmZcBkVOwr/A/8Yw=";
   };
 
-  nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook3 ];
 
   unpackCmd = ''
     mkdir -p root
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
index 9d4da64074616..24d5147327aa5 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@@ -16,7 +16,7 @@
 , makeWrapper
 , pipewire
 , pulseaudio
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 , xorg
 , zlib
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-gtQ1mhXk0AqGidZk5TCzSR58pD1JJoELMBmELtqyb4U=";
   };
 
-  nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook3 ];
 
   unpackCmd = ''
     mkdir -p root
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
index 3ec595e3e8bbc..e795128ba944f 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
@@ -19,7 +19,7 @@
 , pango
 , pipewire
 , pulseaudio
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 , xorg
 , zlib
@@ -27,14 +27,14 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
-  version = "5.1.6";
+  version = "5.1.8";
 
   src = fetchurl {
     url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "sha256-U1Qp7/7kAr1IEcv256I2J/sb5MYxfR20Pi5N8WaVh2U=";
+    sha256 = "sha256-KxNLae/uTYL1m/X+/7wr7hhKfw31NpB9Mw9RzfrTuus=";
   };
 
-  nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook3 ];
 
   unpackCmd = ''
     mkdir -p root
diff --git a/pkgs/applications/audio/buzztrax/default.nix b/pkgs/applications/audio/buzztrax/default.nix
index 85d8fbed7671f..eee9d4cadbc01 100644
--- a/pkgs/applications/audio/buzztrax/default.nix
+++ b/pkgs/applications/audio/buzztrax/default.nix
@@ -7,7 +7,7 @@
 , itstool
 , libtool
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , yelp-tools
 , clutter-gtk
 , gst_all_1
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
     itstool
     libtool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     yelp-tools
   ];
 
diff --git a/pkgs/applications/audio/deadbeef/default.nix b/pkgs/applications/audio/deadbeef/default.nix
index f26fd4903726f..d141a61963659 100644
--- a/pkgs/applications/audio/deadbeef/default.nix
+++ b/pkgs/applications/audio/deadbeef/default.nix
@@ -8,7 +8,7 @@
 , swift-corelibs-libdispatch
 # deadbeef can use either gtk2 or gtk3
 , gtk2Support ? false, gtk2
-, gtk3Support ? true, gtk3, gsettings-desktop-schemas, wrapGAppsHook
+, gtk3Support ? true, gtk3, gsettings-desktop-schemas, wrapGAppsHook3
 # input plugins
 , vorbisSupport ? true, libvorbis
 , mp123Support ? true, libmad
@@ -112,7 +112,7 @@ in clangStdenv.mkDerivation {
     libtool
     pkg-config
   ] ++ optionals gtk3Support [
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/audio/denemo/default.nix b/pkgs/applications/audio/denemo/default.nix
index ed4460a283226..1a5ce4c77e6e0 100644
--- a/pkgs/applications/audio/denemo/default.nix
+++ b/pkgs/applications/audio/denemo/default.nix
@@ -3,7 +3,7 @@
 , glib, libxml2, librsvg, libsndfile, aubio
 , gtk3, gtksourceview, evince, fluidsynth, rubberband
 , autoreconfHook, gtk-doc
-, portaudio, portmidi, fftw, wrapGAppsHook }:
+, portaudio, portmidi, fftw, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "denemo";
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoreconfHook
     gtk-doc
-    wrapGAppsHook
+    wrapGAppsHook3
     intltool
     gettext
     pkg-config
diff --git a/pkgs/applications/audio/easyabc/default.nix b/pkgs/applications/audio/easyabc/default.nix
index 9fb792626ac2c..bdc753d0f45e0 100644
--- a/pkgs/applications/audio/easyabc/default.nix
+++ b/pkgs/applications/audio/easyabc/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, fetchPypi, substituteAll, python39, fluidsynth, soundfont-fluid, wrapGAppsHook, abcmidi, abcm2ps, ghostscript }:
+{ lib, fetchFromGitHub, fetchPypi, substituteAll, python39, fluidsynth, soundfont-fluid, wrapGAppsHook3, abcmidi, abcm2ps, ghostscript }:
 
 let
   # requires python39 due to https://stackoverflow.com/a/71902541 https://github.com/jwdj/EasyABC/issues/52
@@ -28,7 +28,7 @@ in python.pkgs.buildPythonApplication {
     hash = "sha256-leC3A4HQMeJNeZXArb3YAYr2mddGPcws618NrRh2Q1Y=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   propagatedBuildInputs = with python.pkgs; [
     cx-freeze
diff --git a/pkgs/applications/audio/easytag/default.nix b/pkgs/applications/audio/easytag/default.nix
index 6d3fd8f1d17d7..34a4ddc64b379 100644
--- a/pkgs/applications/audio/easytag/default.nix
+++ b/pkgs/applications/audio/easytag/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, intltool, gtk3, glib, libid3tag, id3lib, taglib
 , libvorbis, libogg, opusfile, flac, itstool, libxml2, gsettings-desktop-schemas
-, gnome, wrapGAppsHook
+, gnome, wrapGAppsHook3
 }:
 
 let
@@ -16,7 +16,7 @@ in stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "-lid3tag -lz";
 
-  nativeBuildInputs = [ pkg-config intltool itstool libxml2 wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config intltool itstool libxml2 wrapGAppsHook3 ];
   buildInputs = [
     gtk3 glib libid3tag id3lib taglib libvorbis libogg opusfile flac
     gsettings-desktop-schemas gnome.adwaita-icon-theme
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "View and edit tags for various audio files";
     mainProgram = "easytag";
-    homepage = "https://wiki.gnome.org/Apps/EasyTAG";
+    homepage = "https://gitlab.gnome.org/GNOME/easytag";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/audio/exaile/default.nix b/pkgs/applications/audio/exaile/default.nix
index a2f75fd85a705..624f14558142c 100644
--- a/pkgs/applications/audio/exaile/default.nix
+++ b/pkgs/applications/audio/exaile/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub
-, gobject-introspection, makeWrapper, wrapGAppsHook
+, gobject-introspection, makeWrapper, wrapGAppsHook3
 , gtk3, gst_all_1, python3
 , gettext, gnome, help2man, keybinder3, libnotify, librsvg, streamripper, udisks, webkitgtk
 , iconTheme ? gnome.adwaita-icon-theme
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     gobject-introspection
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optionals documentationSupport [
     help2man
     python3.pkgs.sphinx
diff --git a/pkgs/applications/audio/gmpc/default.nix b/pkgs/applications/audio/gmpc/default.nix
index 33930dfb7d2d1..071e900b59b27 100644
--- a/pkgs/applications/audio/gmpc/default.nix
+++ b/pkgs/applications/audio/gmpc/default.nix
@@ -16,7 +16,7 @@
 , libICE
 , sqlite
 , hicolor-icon-theme
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     sha256 = "0b3bnxf98i5lhjyljvgxgx9xmb6p46cn3a9cccrng14nagri9556";
   };
 
-  nativeBuildInputs = [ pkg-config libtool intltool gob2 vala wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config libtool intltool gob2 vala wrapGAppsHook3 ];
   buildInputs = [
     glib
     gtk2
diff --git a/pkgs/applications/audio/gnome-podcasts/default.nix b/pkgs/applications/audio/gnome-podcasts/default.nix
index bba557913297f..55ffb370d60aa 100644
--- a/pkgs/applications/audio/gnome-podcasts/default.nix
+++ b/pkgs/applications/audio/gnome-podcasts/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Listen to your favorite podcasts";
     mainProgram = "gnome-podcasts";
-    homepage = "https://wiki.gnome.org/Apps/Podcasts";
+    homepage = "https://apps.gnome.org/Podcasts/";
     license = licenses.gpl3Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/applications/audio/goodvibes/default.nix b/pkgs/applications/audio/goodvibes/default.nix
index 111cad65a013d..d2eb394e59b3d 100644
--- a/pkgs/applications/audio/goodvibes/default.nix
+++ b/pkgs/applications/audio/goodvibes/default.nix
@@ -10,7 +10,7 @@
 , libsoup
 , keybinder3
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook3
 , appstream-glib
 , desktop-file-utils
 }:
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     appstream-glib
     desktop-file-utils
   ];
diff --git a/pkgs/applications/audio/gpodder/default.nix b/pkgs/applications/audio/gpodder/default.nix
index 80f12aa2d0dc7..cde01e65bdeed 100644
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@@ -8,7 +8,7 @@
 , intltool
 , python3
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 }:
 
@@ -34,7 +34,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
     glibcLocales
     gobject-introspection
   ];
diff --git a/pkgs/applications/audio/gspeech/default.nix b/pkgs/applications/audio/gspeech/default.nix
index f2216ed7d2560..86a93c78962de 100644
--- a/pkgs/applications/audio/gspeech/default.nix
+++ b/pkgs/applications/audio/gspeech/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , python3
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , glibcLocales
 , gobject-introspection
 , gettext
@@ -30,7 +30,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     pango
     gdk-pixbuf
diff --git a/pkgs/applications/audio/gst123/default.nix b/pkgs/applications/audio/gst123/default.nix
index 37b343f540b41..65d925342be2c 100644
--- a/pkgs/applications/audio/gst123/default.nix
+++ b/pkgs/applications/audio/gst123/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , autoreconfHook
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gst_all_1
 , gtk3
 , ncurses
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/guitarix/default.nix b/pkgs/applications/audio/guitarix/default.nix
index c1d1cf5571c50..50c00101dc210 100644
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@@ -31,7 +31,7 @@
 , sord
 , sratom
 , wafHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , zita-convolver
 , zita-resampler
 , optimizationSupport ? false # Enable support for native CPU extensions
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     python3
     wafHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/hivelytracker/default.nix b/pkgs/applications/audio/hivelytracker/default.nix
index 324d0ca362b4c..8ad62eb81a5a4 100644
--- a/pkgs/applications/audio/hivelytracker/default.nix
+++ b/pkgs/applications/audio/hivelytracker/default.nix
@@ -6,7 +6,7 @@
 , SDL_image
 , SDL_ttf
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/hushboard/default.nix b/pkgs/applications/audio/hushboard/default.nix
index 3248ab35b22cb..dbc0a467024cb 100644
--- a/pkgs/applications/audio/hushboard/default.nix
+++ b/pkgs/applications/audio/hushboard/default.nix
@@ -9,7 +9,7 @@
 , pycairo
 , pygobject3
 , six
-, wrapGAppsHook
+, wrapGAppsHook3
 , xlib
 }:
 
@@ -25,7 +25,7 @@ buildPythonApplication {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/audio/indicator-sound-switcher/default.nix b/pkgs/applications/audio/indicator-sound-switcher/default.nix
index c47aff47fffe5..1a99287348276 100644
--- a/pkgs/applications/audio/indicator-sound-switcher/default.nix
+++ b/pkgs/applications/audio/indicator-sound-switcher/default.nix
@@ -5,7 +5,7 @@
 , gettext
 , gtk3
 , gobject-introspection
-, intltool, wrapGAppsHook, glib
+, intltool, wrapGAppsHook3, glib
 , librsvg
 , libayatana-appindicator
 , libpulseaudio
@@ -32,7 +32,7 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     gettext
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
     glib
     gdk-pixbuf
   ];
diff --git a/pkgs/applications/audio/lingot/default.nix b/pkgs/applications/audio/lingot/default.nix
index 3d7339f571d65..4cc31ae421549 100644
--- a/pkgs/applications/audio/lingot/default.nix
+++ b/pkgs/applications/audio/lingot/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , pkg-config
 , intltool
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , alsa-lib
 , libpulseaudio
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/lollypop/default.nix b/pkgs/applications/audio/lollypop/default.nix
index 34dbf0318a71c..129c90745e814 100644
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@@ -18,7 +18,7 @@
 , gdk-pixbuf
 , glib
 , pango
-, wrapGAppsHook
+, wrapGAppsHook3
 , lastFMSupport ? true
 , youtubeSupport ? true
 }:
@@ -45,7 +45,7 @@ python3.pkgs.buildPythonApplication rec  {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = with gst_all_1; [
@@ -102,7 +102,7 @@ python3.pkgs.buildPythonApplication rec  {
   meta = with lib; {
     changelog = "https://gitlab.gnome.org/World/lollypop/tags/${version}";
     description = "A modern music player for GNOME";
-    homepage = "https://wiki.gnome.org/Apps/Lollypop";
+    homepage = "https://gitlab.gnome.org/World/lollypop";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ lovesegfault ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/audio/lyrebird/default.nix b/pkgs/applications/audio/lyrebird/default.nix
index 5eb2d745cdc32..be12c55596509 100644
--- a/pkgs/applications/audio/lyrebird/default.nix
+++ b/pkgs/applications/audio/lyrebird/default.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchFromGitHub
 , makeDesktopItem
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , gobject-introspection
 , sox
@@ -34,7 +34,7 @@ python3Packages.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3Packages; [ toml pygobject3 ];
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
 
   buildInputs = [ gtk3 sox ];
 
diff --git a/pkgs/applications/audio/mpdevil/default.nix b/pkgs/applications/audio/mpdevil/default.nix
index 9dff169594471..3ca2a0e661526 100644
--- a/pkgs/applications/audio/mpdevil/default.nix
+++ b/pkgs/applications/audio/mpdevil/default.nix
@@ -3,7 +3,7 @@
 , python3Packages
 , gdk-pixbuf, glib, gobject-introspection, gtk3
 , libnotify
-, wrapGAppsHook }:
+, wrapGAppsHook3 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "mpdevil";
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication rec {
   format = "other";
 
   nativeBuildInputs = [
-    glib.dev gobject-introspection gtk3 pkg-config meson ninja wrapGAppsHook
+    glib.dev gobject-introspection gtk3 pkg-config meson ninja wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -40,7 +40,7 @@ python3Packages.buildPythonApplication rec {
 
   # Prevent double wrapping.
   dontWrapGApps = true;
-  # Otherwise wrapGAppsHook do not pick up the dependencies correctly.
+  # Otherwise wrapGAppsHook3 do not pick up the dependencies correctly.
   strictDeps = false;
   # There aren't any checks.
   doCheck = false;
diff --git a/pkgs/applications/audio/musescore/default.nix b/pkgs/applications/audio/musescore/default.nix
index 707ec5c8ebfe8..37d713b5e5341 100644
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@@ -84,11 +84,6 @@ in stdenv'.mkDerivation (finalAttrs: {
     "--set-default QT_QPA_PLATFORM xcb"
   ];
 
-  # HACK `propagatedSandboxProfile` does not appear to actually propagate the
-  # sandbox profile from `qtbase`, see:
-  # https://github.com/NixOS/nixpkgs/issues/237458
-  sandboxProfile = toString qtbase.__propagatedSandboxProfile or null;
-
   nativeBuildInputs = [
     wrapQtAppsHook
     cmake
diff --git a/pkgs/applications/audio/muso/default.nix b/pkgs/applications/audio/muso/default.nix
index 30b26e7e59796..217ff8afef8af 100644
--- a/pkgs/applications/audio/muso/default.nix
+++ b/pkgs/applications/audio/muso/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, rustPlatform
-, pkg-config, wrapGAppsHook, CoreServices
+, pkg-config, wrapGAppsHook3, CoreServices
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-09DWUER0ZWQuwfE3sjov2GjJNI7coE3D3E5iUy9mlSE=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = lib.optional stdenv.isDarwin CoreServices;
 
   preConfigure = ''
diff --git a/pkgs/applications/audio/paprefs/default.nix b/pkgs/applications/audio/paprefs/default.nix
index 212d866059da1..fa28433fe9cd3 100644
--- a/pkgs/applications/audio/paprefs/default.nix
+++ b/pkgs/applications/audio/paprefs/default.nix
@@ -8,7 +8,7 @@
 , pulseaudioFull
 , glibmm
 , gtkmm3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     ninja
     gettext
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/pavucontrol/default.nix b/pkgs/applications/audio/pavucontrol/default.nix
index 00aed303666eb..019c777cd046c 100644
--- a/pkgs/applications/audio/pavucontrol/default.nix
+++ b/pkgs/applications/audio/pavucontrol/default.nix
@@ -9,7 +9,7 @@
 , libcanberra-gtk3
 , json-glib
 , gnome
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     gnome.adwaita-icon-theme
   ];
 
-  nativeBuildInputs = [ pkg-config intltool wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config intltool wrapGAppsHook3 ];
 
   configureFlags = [ "--disable-lynx" ];
 
diff --git a/pkgs/applications/audio/pithos/default.nix b/pkgs/applications/audio/pithos/default.nix
index 1ff4aedb6b00f..dbb3a63fce6b7 100644
--- a/pkgs/applications/audio/pithos/default.nix
+++ b/pkgs/applications/audio/pithos/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, meson, ninja, pkg-config, appstream-glib
-, wrapGAppsHook, pythonPackages, gtk3, gnome, gobject-introspection
+, wrapGAppsHook3, pythonPackages, gtk3, gnome, gobject-introspection
 , libnotify, libsecret, gst_all_1 }:
 
 pythonPackages.buildPythonApplication rec {
@@ -20,7 +20,7 @@ pythonPackages.buildPythonApplication rec {
     patchShebangs meson_post_install.py
   '';
 
-  nativeBuildInputs = [ meson ninja pkg-config appstream-glib wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja pkg-config appstream-glib wrapGAppsHook3 ];
 
   propagatedNativeBuildInputs = [
     gobject-introspection
diff --git a/pkgs/applications/audio/praat/default.nix b/pkgs/applications/audio/praat/default.nix
index 6ea7b2f885368..797e9bd0e5f1b 100644
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@@ -6,7 +6,7 @@
 , libpulseaudio
 , pkg-config
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/pulseeffects-legacy/default.nix b/pkgs/applications/audio/pulseeffects-legacy/default.nix
index c243b99f098c7..1fb71e05d2f20 100644
--- a/pkgs/applications/audio/pulseeffects-legacy/default.nix
+++ b/pkgs/applications/audio/pulseeffects-legacy/default.nix
@@ -7,7 +7,7 @@
 , python3
 , libxml2
 , desktop-file-utils
-, wrapGAppsHook
+, wrapGAppsHook3
 , gst_all_1
 , pulseaudio
 , gtk3
@@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
     itstool
     python3
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/quodlibet/default.nix b/pkgs/applications/audio/quodlibet/default.nix
index f7baad9c53a07..66d74efdcfd7a 100644
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@@ -5,7 +5,7 @@
   # build time
 , gettext
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 
   # runtime
 , adwaita-icon-theme
@@ -62,7 +62,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [
     gettext
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ (with python3.pkgs; [
     sphinx-rtd-theme
     sphinxHook
diff --git a/pkgs/applications/audio/radiotray-ng/default.nix b/pkgs/applications/audio/radiotray-ng/default.nix
index 56c316dadcdb4..c67f3f4c56c0c 100644
--- a/pkgs/applications/audio/radiotray-ng/default.nix
+++ b/pkgs/applications/audio/radiotray-ng/default.nix
@@ -26,7 +26,7 @@
 # Testing
 , gtest
 # Fixup
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeWrapper
 }:
 
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/0GlQdSsIPKGrDT9CgxvaH8TpAbqxFduwL2A2+BSrEI=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook makeWrapper ];
+  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 makeWrapper ];
 
   buildInputs = [
     curl
diff --git a/pkgs/applications/audio/rhythmbox/default.nix b/pkgs/applications/audio/rhythmbox/default.nix
index 9929a32aabbfa..0ef2bd5a6c40e 100644
--- a/pkgs/applications/audio/rhythmbox/default.nix
+++ b/pkgs/applications/audio/rhythmbox/default.nix
@@ -27,7 +27,7 @@
 , tdb
 , json-glib
 , itstool
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktop-file-utils
 , gst_all_1
 , gst_plugins ? with gst_all_1; [ gst-plugins-good gst-plugins-ugly ]
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     vala
     glib
     itstool
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils
     gobject-introspection
   ];
@@ -113,7 +113,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Rhythmbox";
+    homepage = "https://gitlab.gnome.org/GNOME/rhythmbox";
     description = "A music playing application for GNOME";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/applications/audio/sfxr/default.nix b/pkgs/applications/audio/sfxr/default.nix
index 552bc8ea52a56..6f148fae25244 100644
--- a/pkgs/applications/audio/sfxr/default.nix
+++ b/pkgs/applications/audio/sfxr/default.nix
@@ -6,7 +6,7 @@
 , SDL
 , gtk3
 , gsettings-desktop-schemas
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     SDL
     gtk3
     gsettings-desktop-schemas
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   makeFlags = [ "DESTDIR=$(out)" ];
diff --git a/pkgs/applications/audio/sonata/default.nix b/pkgs/applications/audio/sonata/default.nix
index 97397da96f259..b0093a8093da7 100644
--- a/pkgs/applications/audio/sonata/default.nix
+++ b/pkgs/applications/audio/sonata/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, wrapGAppsHook, gettext
+{ lib, fetchFromGitHub, wrapGAppsHook3, gettext
 , python3Packages, gnome, gtk3, glib, gdk-pixbuf, gsettings-desktop-schemas, gobject-introspection }:
 
 let
@@ -19,7 +19,7 @@ in buildPythonApplication rec {
   nativeBuildInputs = [
     gettext
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/sonic-pi/default.nix b/pkgs/applications/audio/sonic-pi/default.nix
index c35a2a80643cc..bc1c72cf746e6 100644
--- a/pkgs/applications/audio/sonic-pi/default.nix
+++ b/pkgs/applications/audio/sonic-pi/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sonic-pi";
-  version = "4.5.0";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "sonic-pi-net";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-s9B3OBwiUdCJyxbeQXeidv38pzmvC442Byl+llabqp0=";
+    hash = "sha256-JMextQY0jLShWmqRQoVAbqIzDhA1mOzI7vfsG7+jjX0=";
   };
 
   mixFodDeps = beamPackages.fetchMixDeps {
diff --git a/pkgs/applications/audio/sound-juicer/default.nix b/pkgs/applications/audio/sound-juicer/default.nix
index 261de6e48450d..88e7a314c822e 100644
--- a/pkgs/applications/audio/sound-juicer/default.nix
+++ b/pkgs/applications/audio/sound-juicer/default.nix
@@ -16,7 +16,7 @@
 , libdiscid
 , isocodes
 , gsettings-desktop-schemas
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     pkg-config
     itstool
     libxml2
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A Gnome CD Ripper";
     mainProgram = "sound-juicer";
-    homepage = "https://wiki.gnome.org/Apps/SoundJuicer";
+    homepage = "https://gitlab.gnome.org/GNOME/sound-juicer";
     maintainers = [ maintainers.bdimcheff ];
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/applications/audio/soundconverter/default.nix b/pkgs/applications/audio/soundconverter/default.nix
index b07ed63f220df..27238e36d088c 100644
--- a/pkgs/applications/audio/soundconverter/default.nix
+++ b/pkgs/applications/audio/soundconverter/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchurl
 # Optional due to unfree license.
 , faacSupport ? false
-, glib, python3Packages, gtk3, wrapGAppsHook
+, glib, python3Packages, gtk3, wrapGAppsHook3
 , gsettings-desktop-schemas, intltool, xvfb-run
 , gobject-introspection, gst_all_1, fdk-aac-encoder }:
 
@@ -26,7 +26,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index bd206709c26e5..6bc15adf6082e 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK32, gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK32, gtk3, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "spek";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VYt2so2k3Rk3sLSV1Tf1G2pESYiXygrKr9Koop8ChCg=";
   };
 
-  nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook3 ];
 
   buildInputs = [ ffmpeg wxGTK32 gtk3 ];
 
diff --git a/pkgs/applications/audio/spotify/linux.nix b/pkgs/applications/audio/spotify/linux.nix
index 202f8b4ceeec1..88e4e8658a8bd 100644
--- a/pkgs/applications/audio/spotify/linux.nix
+++ b/pkgs/applications/audio/spotify/linux.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, squashfsTools, xorg, alsa-lib, makeShellWrapper, wrapGAppsHook, openssl, freetype
+{ fetchurl, lib, stdenv, squashfsTools, xorg, alsa-lib, makeShellWrapper, wrapGAppsHook3, openssl, freetype
 , glib, pango, cairo, atk, gdk-pixbuf, gtk3, cups, nspr, nss_latest, libpng, libnotify
 , libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg_4, curlWithGnuTls, zlib, gnome
 , at-spi2-atk, at-spi2-core, libpulseaudio, libdrm, mesa, libxkbcommon
@@ -90,7 +90,7 @@ stdenv.mkDerivation {
     hash = "sha512-o4iLcbNqbsxo9YJMy0SXO7Udv4CMhhBcsf53UuqWKFFWY/jKVN+Lb+dB7Jf9+UowpmbrP44w97Oi+dnbfFXYjQ==";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook makeShellWrapper squashfsTools ];
+  nativeBuildInputs = [ wrapGAppsHook3 makeShellWrapper squashfsTools ];
 
   dontStrip = true;
   dontPatchELF = true;
diff --git a/pkgs/applications/audio/sublime-music/default.nix b/pkgs/applications/audio/sublime-music/default.nix
index 2ce12df23dcf6..edb572ad1bd68 100644
--- a/pkgs/applications/audio/sublime-music/default.nix
+++ b/pkgs/applications/audio/sublime-music/default.nix
@@ -4,7 +4,7 @@
 , gobject-introspection
 , gtk3
 , pango
-, wrapGAppsHook
+, wrapGAppsHook3
 , xvfb-run
 , chromecastSupport ? false
 , serverSupport ? false
@@ -57,7 +57,7 @@ python.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [
     python.pkgs.flit-core
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/audio/transcribe/default.nix b/pkgs/applications/audio/transcribe/default.nix
index 0d311adf8799d..785550a0a040b 100644
--- a/pkgs/applications/audio/transcribe/default.nix
+++ b/pkgs/applications/audio/transcribe/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , fetchzip
 , lib
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 , which
 , alsa-lib
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     which
     xdg-utils
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = with gst_all_1; [
diff --git a/pkgs/applications/audio/tuner/default.nix b/pkgs/applications/audio/tuner/default.nix
index 0f4db5af20a6e..8262fa152bde9 100644
--- a/pkgs/applications/audio/tuner/default.nix
+++ b/pkgs/applications/audio/tuner/default.nix
@@ -7,7 +7,7 @@
 , vala
 , glib
 , itstool
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktop-file-utils
 , libsoup
 , json-glib
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     vala
     glib
     itstool
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils
   ];
 
diff --git a/pkgs/applications/audio/vcv-rack/default.nix b/pkgs/applications/audio/vcv-rack/default.nix
index c086436de09ff..907cd09961489 100644
--- a/pkgs/applications/audio/vcv-rack/default.nix
+++ b/pkgs/applications/audio/vcv-rack/default.nix
@@ -24,7 +24,7 @@
 , rtmidi
 , speexdsp
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 , zstd
 }:
 
@@ -183,7 +183,7 @@ stdenv.mkDerivation rec {
     libicns
     makeWrapper
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   buildInputs = [
     alsa-lib
diff --git a/pkgs/applications/audio/vocal/default.nix b/pkgs/applications/audio/vocal/default.nix
index 00f4ac9172ac3..eeea9a73f1e69 100644
--- a/pkgs/applications/audio/vocal/default.nix
+++ b/pkgs/applications/audio/vocal/default.nix
@@ -21,7 +21,7 @@
 , gst_all_1
 , json-glib
 , libgee
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     ninja
     vala
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = with gst_all_1; [
diff --git a/pkgs/applications/audio/ymuse/default.nix b/pkgs/applications/audio/ymuse/default.nix
index 2c8da2f3af44e..19859a1d819d9 100644
--- a/pkgs/applications/audio/ymuse/default.nix
+++ b/pkgs/applications/audio/ymuse/default.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchFromGitHub
 , buildGoModule
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , glib
 , gobject-introspection
@@ -26,7 +26,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     glib
     gobject-introspection
     gdk-pixbuf
diff --git a/pkgs/applications/audio/zrythm/default.nix b/pkgs/applications/audio/zrythm/default.nix
index 663c159d5d9b0..8ec6ba1a040aa 100644
--- a/pkgs/applications/audio/zrythm/default.nix
+++ b/pkgs/applications/audio/zrythm/default.nix
@@ -1,12 +1,9 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchFromSourcehut
-, fetchpatch
-, SDL2
+, fetchzip
 , alsa-lib
 , appstream
-, appstream-glib
 , bash-completion
 , boost
 , breeze-icons
@@ -16,7 +13,6 @@
 , curl
 , dbus
 , dconf
-, faust2lv2
 , fftw
 , fftwFloat
 , flex
@@ -27,159 +23,140 @@
 , guile
 , help2man
 , jq
-, json-glib
 , kissfft
 , libadwaita
-, libaudec
 , libbacktrace
 , libcyaml
 , libepoxy
-, libgtop
 , libjack2
 , libpanel
 , libpulseaudio
 , libsamplerate
-, libsass
 , libsndfile
-, libsoundio
 , libxml2
 , libyaml
 , lilv
 , lv2
 , meson
 , ninja
-, pandoc
-, pcre
 , pcre2
 , pkg-config
 , python3
-, reproc
-, rtaudio
+, rtaudio_6
 , rtmidi
 , rubberband
 , sassc
 , serd
 , sord
 , sox
+, soxr
 , sratom
 , texi2html
 , vamp-plugin-sdk
 , wrapGAppsHook4
+, writeScript
 , xdg-utils
 , xxHash
+, yyjson
 , zix
 , zstd
 }:
 
 let
-  # As of zrythm-1.0.0-beta.4.5.62, Zrythm needs clap
-  # https://github.com/falktx/carla/tree/main/source/includes/clap, which is
-  # only available on Carla unstable as of 2023-02-24.
-  carla-unstable = carla.overrideAttrs (oldAttrs: rec {
+  # Error: Dependency carla-host-plugin found: NO found 2.5.6 but need: '>=2.6.0'
+  # So we need Carla unstable
+  carla-unstable = carla.overrideAttrs (oldAttrs: {
     pname = "carla";
-    version = "unstable-2023-05-12";
+    version = "unstable-2024-04-26";
 
     src = fetchFromGitHub {
       owner = "falkTX";
-      repo = pname;
-      rev = "0175570f1d41285f39efe0ee32234458e0ed941c";
-      hash = "sha256-yfVzZV8G4AUDM8+yS9finzobpOb1PUEPgBWFhEY4nFQ=";
+      repo = "carla";
+      rev = "948991d7b5104280c03960925908e589c77b169a";
+      hash = "sha256-uGAuKheoMfP9hZXsw29ec+58dJM8wMuowe95QutzKBY=";
     };
   });
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zrythm";
-  version = "1.0.0-beta.4.9.1";
+  version = "1.0.0-rc.1";
 
-  src = fetchFromSourcehut {
-    owner = "~alextee";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-U3IUqNbHu20uyWfkTsLOOlUZjcUL4QdHilB3srSsebw=";
+  src = fetchzip {
+    url = "https://www.zrythm.org/releases/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
+    sha256 = "sha256-Ljbw7bjGI6js4OP9KEXCkhC9AMbInSz0nn+pROm4vXw=";
   };
 
+  passthru.updateScript = writeScript "update-zrythm" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl common-updater-scripts
+
+    version="$(curl -s https://www.zrythm.org/releases/ | grep -o -m 1 'href="zrythm-[^"]*\.tar\.xz"' | head -1 | sed 's/href="zrythm-\(.*\)\.tar\.xz"/\1/')"
+    update-source-version zrythm "$version"
+  '';
+
   nativeBuildInputs = [
+    chromaprint
     cmake
+    flex
+    guile
     help2man
     jq
-    libaudec
     libxml2
+    lilv
     meson
     ninja
-    pandoc
     pkg-config
     python3
     python3.pkgs.sphinx
     sassc
+    serd
+    sord
+    sratom
     texi2html
     wrapGAppsHook4
   ];
 
   buildInputs = [
-    SDL2
     alsa-lib
     appstream
-    appstream-glib
     bash-completion
     boost
-    breeze-icons
     carla-unstable
-    chromaprint
     curl
     dbus
     dconf
-    faust2lv2
     fftw
     fftwFloat
-    flex
     glib
     graphviz
     gtk4
     gtksourceview5
-    guile
-    json-glib
     kissfft
     libadwaita
     libbacktrace
     libcyaml
     libepoxy
-    libgtop
     libjack2
     libpanel
     libpulseaudio
     libsamplerate
-    libsass
     libsndfile
-    libsoundio
     libyaml
-    lilv
     lv2
-    pcre
     pcre2
-    reproc
-    rtaudio
+    rtaudio_6
     rtmidi
     rubberband
-    serd
-    sord
     sox
-    sratom
+    soxr
     vamp-plugin-sdk
     xdg-utils
     xxHash
+    yyjson
     zix
     zstd
   ];
 
-  patches = [
-    # Fix gcc-13 build failure
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://gitlab.zrythm.org/zrythm/zrythm/-/commit/cbc2b3715b939718479631841f2d9703fb28e6da.diff";
-      hash = "sha256-2ZTSaCtSO3yynJVFe5B1AEjWhjRa5YyA26ergAfdL5Y=";
-    })
-  ];
-
   # Zrythm uses meson to build, but requires cmake for dependency detection.
   dontUseCmakeConfigure = true;
 
@@ -197,7 +174,6 @@ stdenv.mkDerivation rec {
     "-Dmanpage=true"
     "-Drtaudio=enabled"
     "-Drtmidi=enabled"
-    "-Dsdl=enabled"
     # "-Duser_manual=true" # needs sphinx-intl
   ];
 
@@ -220,7 +196,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     gappsWrapperArgs+=(
-      --prefix GSETTINGS_SCHEMA_DIR : "$out/share/gsettings-schemas/${pname}-${version}/glib-2.0/schemas/"
+      --prefix GSETTINGS_SCHEMA_DIR : "$out/share/gsettings-schemas/${finalAttrs.pname}-${finalAttrs.version}/glib-2.0/schemas/"
       --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${breeze-icons}/share"
     )
   '';
@@ -228,8 +204,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.zrythm.org";
     description = "Automated and intuitive digital audio workstation";
-    maintainers = with maintainers; [ tshaynik magnetophon yuu ];
-    platforms = platforms.linux;
+    maintainers = with maintainers; [ tshaynik magnetophon yuu astavie PowerUser64 ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
     license = licenses.agpl3Plus;
   };
-}
+})
diff --git a/pkgs/applications/backup/deja-dup/default.nix b/pkgs/applications/backup/deja-dup/default.nix
index 49c5cadc89f2d..bb5c3c0c980fd 100644
--- a/pkgs/applications/backup/deja-dup/default.nix
+++ b/pkgs/applications/backup/deja-dup/default.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
       of backing up the Right Way (encrypted, off-site, and regular) \
       and uses duplicity as the backend.
     '';
-    homepage = "https://wiki.gnome.org/Apps/DejaDup";
+    homepage = "https://apps.gnome.org/DejaDup/";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ jtojnar ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/backup/timeshift/wrapper.nix b/pkgs/applications/backup/timeshift/wrapper.nix
index e72052fda1ba8..84b3f14ac2ffa 100644
--- a/pkgs/applications/backup/timeshift/wrapper.nix
+++ b/pkgs/applications/backup/timeshift/wrapper.nix
@@ -1,6 +1,6 @@
 { stdenvNoCC
 , lib
-, wrapGAppsHook
+, wrapGAppsHook3
 , gdk-pixbuf
 , librsvg
 , xorg
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation {
 
   nativeBuildInputs = [
     xorg.lndir
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   installPhase = ''
diff --git a/pkgs/applications/blockchains/lnd/default.nix b/pkgs/applications/blockchains/lnd/default.nix
index 73bd7f3afc276..077ff6b11f45c 100644
--- a/pkgs/applications/blockchains/lnd/default.nix
+++ b/pkgs/applications/blockchains/lnd/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.17.4-beta";
+  version = "0.17.5-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    hash = "sha256-O6cGK4UMKrZpYqtghjjqqLBStLG5GEi/Q5liR557I8s=";
+    hash = "sha256-q/mzF6LPW/ThgqfGgjtax8GvoC3JEpg0IetfSTo1XYk=";
   };
 
-  vendorHash = "sha256-eaQmM5bfsUmzTiUALX543VBQRJK+TqW2i28npwSrn3Q=";
+  vendorHash = "sha256-unT0zJrOEmKHpoUsrBHKfn5IziGlaqEtMfkeo/74Rfc=";
 
   subPackages = [ "cmd/lncli" "cmd/lnd" ];
 
diff --git a/pkgs/applications/blockchains/ton/default.nix b/pkgs/applications/blockchains/ton/default.nix
index 888b6f8d2b97e..c602a88dc7bd2 100644
--- a/pkgs/applications/blockchains/ton/default.nix
+++ b/pkgs/applications/blockchains/ton/default.nix
@@ -7,6 +7,7 @@
 , gperf
 , libmicrohttpd
 , libsodium
+, lz4
 , openssl
 , readline
 , secp256k1
@@ -16,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ton";
-  version = "2024.03";
+  version = "2024.04";
 
   src = fetchFromGitHub {
     owner = "ton-blockchain";
     repo = "ton";
     rev = "v${version}";
-    hash = "sha256-AVg33aZAyedmNIFqQJm4Nn6luLxK4mKgnIRmNU7j2C0=";
+    hash = "sha256-hh8D4IZX6RS/RXdhVONhgetqp89kpTC2IwDQ2KHdKsE=";
     fetchSubmodules = true;
   };
 
@@ -38,6 +39,7 @@ stdenv.mkDerivation rec {
     gperf
     libmicrohttpd
     libsodium
+    lz4
     openssl
     readline
     secp256k1
diff --git a/pkgs/applications/display-managers/greetd/gtkgreet.nix b/pkgs/applications/display-managers/greetd/gtkgreet.nix
index 674257e8526e4..10389c262742f 100644
--- a/pkgs/applications/display-managers/greetd/gtkgreet.nix
+++ b/pkgs/applications/display-managers/greetd/gtkgreet.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , fetchFromSourcehut
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , cmake
 , meson
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     cmake
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/display-managers/lightdm-enso-os-greeter/default.nix b/pkgs/applications/display-managers/lightdm-enso-os-greeter/default.nix
index a35b52bf8cd69..b8082c4510d6e 100644
--- a/pkgs/applications/display-managers/lightdm-enso-os-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-enso-os-greeter/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, linkFarm, lightdm-enso-os-greeter
 , dbus, pcre, libepoxy, xorg, at-spi2-core, libxklavier, libxkbcommon
-, gtk3, vala, cmake, libgee, lightdm, gdk-pixbuf, clutter-gtk, wrapGAppsHook, librsvg }:
+, gtk3, vala, cmake, libgee, lightdm, gdk-pixbuf, clutter-gtk, wrapGAppsHook3, librsvg }:
 
 stdenv.mkDerivation {
   pname = "lightdm-enso-os-greeter";
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     cmake
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/display-managers/lightdm-mini-greeter/default.nix b/pkgs/applications/display-managers/lightdm-mini-greeter/default.nix
index 353e5150356f9..16fa1cfe4dcf3 100644
--- a/pkgs/applications/display-managers/lightdm-mini-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-mini-greeter/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, linkFarm, lightdm-mini-greeter, fetchFromGitHub, autoreconfHook, pkg-config, lightdm, gtk3, glib, gdk-pixbuf, wrapGAppsHook, librsvg }:
+{ lib, stdenv, linkFarm, lightdm-mini-greeter, fetchFromGitHub, autoreconfHook, pkg-config, lightdm, gtk3, glib, gdk-pixbuf, wrapGAppsHook3, librsvg }:
 
 stdenv.mkDerivation rec {
   pname = "lightdm-mini-greeter";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Pm7ExfusFIPktX2C4UE07qgOVhcWhVxnaD3QARpmu7Y=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook3 ];
   buildInputs = [ lightdm gtk3 glib gdk-pixbuf librsvg ];
 
   configureFlags = [ "--sysconfdir=/etc" ];
diff --git a/pkgs/applications/display-managers/lightdm-slick-greeter/default.nix b/pkgs/applications/display-managers/lightdm-slick-greeter/default.nix
index 67bbf37545349..b7aded60260d5 100644
--- a/pkgs/applications/display-managers/lightdm-slick-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-slick-greeter/default.nix
@@ -6,7 +6,7 @@
 , vala
 , intltool
 , autoreconfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , cinnamon
 , lightdm
 , gtk3
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     vala
     intltool
     autoreconfHook
-    wrapGAppsHook
+    wrapGAppsHook3
     python3
     python3.pkgs.wrapPython
   ];
diff --git a/pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix b/pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix
index c6c479505d12c..1090be3c932eb 100644
--- a/pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, linkFarm, lightdm-tiny-greeter, fetchFromGitHub
-, pkg-config, lightdm, gtk3, glib, wrapGAppsHook, config, conf ? config.lightdm-tiny-greeter.conf or "" }:
+, pkg-config, lightdm, gtk3, glib, wrapGAppsHook3, config, conf ? config.lightdm-tiny-greeter.conf or "" }:
 
 stdenv.mkDerivation rec {
   pname = "lightdm-tiny-greeter";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "08azpj7b5qgac9bgi1xvd6qy6x2nb7iapa0v40ggr3d1fabyhrg6";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = [ lightdm gtk3 glib ];
 
   postUnpack = lib.optionalString (conf != "") ''
diff --git a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
index 6d29d90d4b565..e3ef95bdcdc67 100644
--- a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
+++ b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , intltool
 , linkFarm
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , xfce4-dev-tools
 , at-spi2-core
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     pkg-config
     intltool
     xfce4-dev-tools
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
     "--sysconfdir=/etc"
     "--disable-indicator-services-command"
-    "--sbindir=${placeholder "out"}/bin" # for wrapGAppsHook to wrap automatically
+    "--sbindir=${placeholder "out"}/bin" # for wrapGAppsHook3 to wrap automatically
   ];
 
   preConfigure = ''
diff --git a/pkgs/applications/editors/apostrophe/default.nix b/pkgs/applications/editors/apostrophe/default.nix
index 501f820664f2f..768402f4e5a7c 100644
--- a/pkgs/applications/editors/apostrophe/default.nix
+++ b/pkgs/applications/editors/apostrophe/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitLab, meson, ninja
-, wrapGAppsHook, pkg-config, desktop-file-utils
+, wrapGAppsHook3, pkg-config, desktop-file-utils
 , appstream-glib, pythonPackages, glib, gobject-introspection
 , gtk3, webkitgtk, glib-networking, gnome, gspell, texliveMedium
 , shared-mime-info, libhandy, fira, sassc
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ meson ninja pkg-config desktop-file-utils
-    appstream-glib wrapGAppsHook sassc gobject-introspection ];
+    appstream-glib wrapGAppsHook3 sassc gobject-introspection ];
 
   buildInputs = [ glib pythonEnv gtk3
     gnome.adwaita-icon-theme webkitgtk gspell texliveMedium
diff --git a/pkgs/applications/editors/bluefish/default.nix b/pkgs/applications/editors/bluefish/default.nix
index afcc62a289994..41b107f0dcae3 100644
--- a/pkgs/applications/editors/bluefish/default.nix
+++ b/pkgs/applications/editors/bluefish/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , gtk
 , libxml2
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-YUPlHGtVedWW86moXg8NhYDJ9Y+ChXWxGYgODKHZQbw=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = [
     gnome.adwaita-icon-theme
     gtk
diff --git a/pkgs/applications/editors/bluej/default.nix b/pkgs/applications/editors/bluej/default.nix
index 32dc84f33a699..0e8629a0693c6 100644
--- a/pkgs/applications/editors/bluej/default.nix
+++ b/pkgs/applications/editors/bluej/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, openjdk, glib, dpkg, wrapGAppsHook }:
+{ lib, stdenv, fetchurl, openjdk, glib, dpkg, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "bluej";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-sOT86opMa9ytxJlfURIsD06HiP+j+oz3lQ0DqmLV1wE=";
   };
 
-  nativeBuildInputs = [ dpkg wrapGAppsHook ];
+  nativeBuildInputs = [ dpkg wrapGAppsHook3 ];
   buildInputs = [ glib ];
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/editors/codeblocks/default.nix b/pkgs/applications/editors/codeblocks/default.nix
index 60edd1871bcac..4c53fbb2a4b7c 100644
--- a/pkgs/applications/editors/codeblocks/default.nix
+++ b/pkgs/applications/editors/codeblocks/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch, pkg-config, file, zip, wxGTK32, gtk3
-, contribPlugins ? false, hunspell, gamin, boost, wrapGAppsHook
+, contribPlugins ? false, hunspell, gamin, boost, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1idaksw1vacmm83krxh5zlb12kad3dkz9ixh70glw1gaibib7vhm";
   };
 
-  nativeBuildInputs = [ pkg-config file zip wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config file zip wrapGAppsHook3 ];
   buildInputs = [ wxGTK32 gtk3 ]
     ++ lib.optionals contribPlugins [ hunspell gamin boost ];
   enableParallelBuilding = true;
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tree-sitter-langs/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tree-sitter-langs/default.nix
index cb4cec172bac1..f8a0ec28a3a2e 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tree-sitter-langs/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tree-sitter-langs/default.nix
@@ -16,9 +16,8 @@
 let
   inherit (melpaStablePackages) tree-sitter-langs;
 
-  libSuffix = if stdenv.isDarwin then "dylib" else "so";
   langName = g: lib.removeSuffix "-grammar" (lib.removePrefix "tree-sitter-" g.pname);
-  soName = g: langName g + "." + libSuffix;
+  soName = g: langName g + stdenv.hostPlatform.extensions.sharedLibrary;
 
   grammarDir = runCommand "emacs-tree-sitter-grammars" {
     # Fake same version number as upstream language bundle to prevent triggering runtime downloads
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index a525335646169..f252923897d18 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -58,7 +58,7 @@
 , tree-sitter
 , texinfo
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 
 # Boolean flags
 , withNativeCompilation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
@@ -212,7 +212,7 @@ mkDerivation (finalAttrs: {
   ] ++ lib.optionals srcRepo [
     autoreconfHook
     texinfo
-  ] ++ lib.optional (withPgtk || withX && (withGTK3 || withXwidgets)) wrapGAppsHook;
+  ] ++ lib.optional (withPgtk || withX && (withGTK3 || withXwidgets)) wrapGAppsHook3;
 
   buildInputs = [
     gettext
diff --git a/pkgs/applications/editors/formiko/default.nix b/pkgs/applications/editors/formiko/default.nix
index 53fee165f5e5a..40c7fba0be82e 100644
--- a/pkgs/applications/editors/formiko/default.nix
+++ b/pkgs/applications/editors/formiko/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonApplication
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , gtk3
 , docutils
@@ -24,7 +24,7 @@ buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     gtk3
   ];
diff --git a/pkgs/applications/editors/geany/default.nix b/pkgs/applications/editors/geany/default.nix
index 517b2ca4fe79a..f6755905c7394 100644
--- a/pkgs/applications/editors/geany/default.nix
+++ b/pkgs/applications/editors/geany/default.nix
@@ -8,7 +8,7 @@
 , libintl
 , hicolor-icon-theme
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     file
     hicolor-icon-theme
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/editors/gedit/default.nix b/pkgs/applications/editors/gedit/default.nix
index 9ec2d3329c1dc..c3fc6fae2dcf1 100644
--- a/pkgs/applications/editors/gedit/default.nix
+++ b/pkgs/applications/editors/gedit/default.nix
@@ -15,7 +15,7 @@
 , libpeas
 , libxml2
 , gsettings-desktop-schemas
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk-doc
 , gobject-introspection
 , docbook-xsl-nons
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     python3
     python3Packages.wrapPython
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     gtk-doc
     gobject-introspection
     docbook-xsl-nons
diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index b1360f2a147e7..f0e7b272f8a73 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -5,7 +5,6 @@
 , desktop-file-utils
 , editorconfig-core-c
 , fetchurl
-, fetchpatch
 , flatpak
 , gnome
 , libgit2-glib
@@ -43,13 +42,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-builder";
-  version = "45.0";
+  version = "46.1";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "JC2gJZMpPUVuokEIpFk0cwoeMW2NxbGNnfDoZNt7pZY=";
+    hash = "sha256-lhaWbVIqLIUCizPAm605cudp6fkK91VNXnGDfb3HiHE=";
   };
 
   patches = [
@@ -64,12 +63,6 @@ stdenv.mkDerivation rec {
     #
     #     Typelib file for namespace 'Pango', version '1.0' not found (g-irepository-error-quark, 0)
     ./fix-finding-test-typelibs.patch
-
-    (fetchpatch {
-      name = "redefinition-of-glib_autoptr_clear_GtkStackPage.patch";
-      url = "https://gitlab.gnome.org/GNOME/gnome-builder/-/commit/7aaaecefc2ea8a37eaeae8b4d726d119d4eb8fa3.patch";
-      hash = "sha256-sYLqhwCd9GOkUMUZAO2trAGKC3013jgivHrNC4atdn0=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -176,7 +169,7 @@ stdenv.mkDerivation rec {
       currently recommend running gnome-builder inside a nix-shell with
       appropriate dependencies loaded.
     '';
-    homepage = "https://wiki.gnome.org/Apps/Builder";
+    homepage = "https://apps.gnome.org/Builder/";
     license = licenses.gpl3Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/applications/editors/gnome-inform7/default.nix b/pkgs/applications/editors/gnome-inform7/default.nix
index cab490cd76e4c..df1baa997a217 100644
--- a/pkgs/applications/editors/gnome-inform7/default.nix
+++ b/pkgs/applications/editors/gnome-inform7/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, python3, perl, bison
-, texinfo, desktop-file-utils, wrapGAppsHook, docbook2x, docbook-xsl-nons
+, texinfo, desktop-file-utils, wrapGAppsHook3, docbook2x, docbook-xsl-nons
 , inform7, gettext, libossp_uuid, gtk3, gobject-introspection, vala, gtk-doc
 , webkitgtk, gtksourceview3, gspell, libxml2, goocanvas2, libplist, glib
 , gst_all_1 }:
@@ -22,7 +22,7 @@ let
       pkg-config
       docbook2x
       docbook-xsl-nons
-      wrapGAppsHook
+      wrapGAppsHook3
       gobject-introspection
     ];
     buildInputs = [
@@ -49,7 +49,7 @@ let
       texinfo
       python3
       glib
-      wrapGAppsHook
+      wrapGAppsHook3
       gobject-introspection
     ];
     buildInputs = [
@@ -84,7 +84,7 @@ in stdenv.mkDerivation {
     inform7
     python3
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   buildInputs = [
     gettext
diff --git a/pkgs/applications/editors/gnome-latex/default.nix b/pkgs/applications/editors/gnome-latex/default.nix
index f78407731d264..505bddde4f5eb 100644
--- a/pkgs/applications/editors/gnome-latex/default.nix
+++ b/pkgs/applications/editors/gnome-latex/default.nix
@@ -6,7 +6,7 @@
 , gtk-doc
 , vala
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , gsettings-desktop-schemas
 , gspell
 , libgedit-gtksourceview
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     gtk-doc
     vala
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
     itstool
     gettext
   ];
diff --git a/pkgs/applications/editors/gobby/default.nix b/pkgs/applications/editors/gobby/default.nix
index d36f89e3c1c73..8801afa34e6c4 100644
--- a/pkgs/applications/editors/gobby/default.nix
+++ b/pkgs/applications/editors/gobby/default.nix
@@ -1,5 +1,5 @@
 { avahiSupport ? false # build support for Avahi in libinfinity
-, lib, stdenv, fetchFromGitHub, autoconf, automake, pkg-config, wrapGAppsHook, yelp-tools
+, lib, stdenv, fetchFromGitHub, autoconf, automake, pkg-config, wrapGAppsHook3, yelp-tools
 , gtkmm3, gsasl, gtksourceview3, libxmlxx, libinfinity, intltool, itstool }:
 
 let
@@ -15,7 +15,7 @@ in stdenv.mkDerivation rec {
     sha256 = "06cbc2y4xkw89jaa0ayhgh7fxr5p2nv3jjs8h2xcbbbgwaw08lk0";
   };
 
-  nativeBuildInputs = [ autoconf automake pkg-config intltool itstool yelp-tools wrapGAppsHook ];
+  nativeBuildInputs = [ autoconf automake pkg-config intltool itstool yelp-tools wrapGAppsHook3 ];
   buildInputs = [ gtkmm3 gsasl gtksourceview3 libxmlxx libinf ];
 
   preConfigure = "./autogen.sh";
diff --git a/pkgs/applications/editors/greenfoot/default.nix b/pkgs/applications/editors/greenfoot/default.nix
index 4a3ae555f21ea..e4734355fd551 100644
--- a/pkgs/applications/editors/greenfoot/default.nix
+++ b/pkgs/applications/editors/greenfoot/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, openjdk, glib, dpkg, wrapGAppsHook }:
+{ lib, stdenv, fetchurl, openjdk, glib, dpkg, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "greenfoot";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-wpmgWtx2jTDjt+7p6HcjU/uy1PRmnAHpJ1rOYb+hV+U=";
   };
 
-  nativeBuildInputs = [ dpkg wrapGAppsHook ];
+  nativeBuildInputs = [ dpkg wrapGAppsHook3 ];
   buildInputs = [ glib ];
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/editors/l3afpad/default.nix b/pkgs/applications/editors/l3afpad/default.nix
index 2caf4ee781e2e..f9632def17716 100644
--- a/pkgs/applications/editors/l3afpad/default.nix
+++ b/pkgs/applications/editors/l3afpad/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, intltool, pkg-config, gtk3, fetchFromGitHub
-, autoreconfHook, wrapGAppsHook }:
+, autoreconfHook, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   version = "unstable-2022-02-14";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ly2w9jmRlprm/PnyC0LYjrxBVK+J0DLiSpzuTUMZpWA=";
   };
 
-  nativeBuildInputs = [ pkg-config autoreconfHook wrapGAppsHook intltool ];
+  nativeBuildInputs = [ pkg-config autoreconfHook wrapGAppsHook3 intltool ];
   buildInputs = [ gtk3 ];
 
   meta = with lib; {
diff --git a/pkgs/applications/editors/lapce/default.nix b/pkgs/applications/editors/lapce/default.nix
index 73cff823859a2..ad29e72fad159 100644
--- a/pkgs/applications/editors/lapce/default.nix
+++ b/pkgs/applications/editors/lapce/default.nix
@@ -19,7 +19,7 @@
 , ApplicationServices
 , Carbon
 , AppKit
-, wrapGAppsHook
+, wrapGAppsHook3
 , wayland
 , gobject-introspection
 , xorg
@@ -82,7 +82,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     perl
     python3
-    wrapGAppsHook # FIX: No GSettings schemas are installed on the system
+    wrapGAppsHook3 # FIX: No GSettings schemas are installed on the system
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/editors/lifeograph/default.nix b/pkgs/applications/editors/lifeograph/default.nix
index 2a9557dce62ee..52e12beb317aa 100644
--- a/pkgs/applications/editors/lifeograph/default.nix
+++ b/pkgs/applications/editors/lifeograph/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchgit, pkg-config, meson, ninja, wrapGAppsHook
+{ stdenv, lib, fetchgit, pkg-config, meson, ninja, wrapGAppsHook3
 , enchant, gtkmm3, libchamplain, libgcrypt, shared-mime-info }:
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     shared-mime-info # for update-mime-database
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/editors/marker/default.nix b/pkgs/applications/editors/marker/default.nix
index f24f83c70f278..7e1d61a3b1725 100644
--- a/pkgs/applications/editors/marker/default.nix
+++ b/pkgs/applications/editors/marker/default.nix
@@ -5,7 +5,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , gtksourceview
 , gtkspell3
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/editors/mindforger/default.nix b/pkgs/applications/editors/mindforger/default.nix
index de304cd6208af..bd8a4b0c648e6 100644
--- a/pkgs/applications/editors/mindforger/default.nix
+++ b/pkgs/applications/editors/mindforger/default.nix
@@ -6,7 +6,7 @@
 , qmake
 , qtbase
 , qtwebengine
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "1pghsw8kwvjhg3jpmjs0n892h2l0pm0cs6ymi8b23fwk0kfj67rd";
   };
 
-  nativeBuildInputs = [ qmake wrapGAppsHook wrapQtAppsHook ];
+  nativeBuildInputs = [ qmake wrapGAppsHook3 wrapQtAppsHook ];
   buildInputs = [ qtbase qtwebengine cmark-gfm ];
 
   doCheck = true;
diff --git a/pkgs/applications/editors/neovim/utils.nix b/pkgs/applications/editors/neovim/utils.nix
index 865c521932818..8f9a5b880032c 100644
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@@ -218,7 +218,7 @@ let
       ];
     in
 
-    toVimPlugin (runCommand "vimplugin-treesitter-grammar-${name}"
+    toVimPlugin (runCommand "treesitter-grammar-${name}"
       {
         meta = {
           platforms = lib.platforms.all;
diff --git a/pkgs/applications/editors/pinegrow/default.nix b/pkgs/applications/editors/pinegrow/default.nix
index cf5d35c1c296c..2e3de9ae8aa36 100644
--- a/pkgs/applications/editors/pinegrow/default.nix
+++ b/pkgs/applications/editors/pinegrow/default.nix
@@ -8,7 +8,7 @@
 , autoPatchelfHook
 , gsettings-desktop-schemas
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeWrapper
 , pinegrowVersion ? "7"
 }:
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     unzip
     autoPatchelfHook
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/editors/pulsar/default.nix b/pkgs/applications/editors/pulsar/default.nix
index a2b572ae516b8..6cd8e423ad529 100644
--- a/pkgs/applications/editors/pulsar/default.nix
+++ b/pkgs/applications/editors/pulsar/default.nix
@@ -3,7 +3,7 @@
 , git
 , git-lfs
 , fetchurl
-, wrapGAppsHook
+, wrapGAppsHook3
 , alsa-lib
 , at-spi2-atk
 , cairo
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     copyDesktopItems
     asar
   ];
diff --git a/pkgs/applications/editors/sublime/3/common.nix b/pkgs/applications/editors/sublime/3/common.nix
index bbb7e6f1e918b..65bbd65163283 100644
--- a/pkgs/applications/editors/sublime/3/common.nix
+++ b/pkgs/applications/editors/sublime/3/common.nix
@@ -1,6 +1,6 @@
 { buildVersion, x32sha256, x64sha256, dev ? false }:
 
-{ fetchurl, lib, stdenv, xorg, glib, glibcLocales, gtk3, cairo, pango, libredirect, makeWrapper, wrapGAppsHook
+{ fetchurl, lib, stdenv, xorg, glib, glibcLocales, gtk3, cairo, pango, libredirect, makeWrapper, wrapGAppsHook3
 , pkexecPath ? "/run/wrappers/bin/pkexec"
 , openssl, bzip2, bash, unzip, zip
 }:
@@ -40,7 +40,7 @@ in let
     dontStrip = true;
     dontPatchELF = true;
     buildInputs = [ glib gtk3 ]; # for GSETTINGS_SCHEMAS_PATH
-    nativeBuildInputs = [ zip unzip makeWrapper wrapGAppsHook ];
+    nativeBuildInputs = [ zip unzip makeWrapper wrapGAppsHook3 ];
 
     # make exec.py in Default.sublime-package use own bash with an LD_PRELOAD instead of "/bin/bash"
     patchPhase = ''
diff --git a/pkgs/applications/editors/sublime/4/common.nix b/pkgs/applications/editors/sublime/4/common.nix
index a7425863d898d..f8083902fdde4 100644
--- a/pkgs/applications/editors/sublime/4/common.nix
+++ b/pkgs/applications/editors/sublime/4/common.nix
@@ -17,7 +17,7 @@
   cairo,
   pango,
   makeWrapper,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   writeShellScript,
   common-updater-scripts,
   curl,
@@ -80,7 +80,7 @@ let
 
     nativeBuildInputs = [
       makeWrapper
-      wrapGAppsHook
+      wrapGAppsHook3
     ];
 
     buildPhase = ''
diff --git a/pkgs/applications/editors/texmaker/default.nix b/pkgs/applications/editors/texmaker/default.nix
index 4684831416b0d..427948822fbcf 100644
--- a/pkgs/applications/editors/texmaker/default.nix
+++ b/pkgs/applications/editors/texmaker/default.nix
@@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchurl, qtbase, qtscript, qtwebengine, qmake, zlib, pkg-config, poppler, wrapGAppsHook }:
+{ lib, mkDerivation, fetchurl, qtbase, qtscript, qtwebengine, qmake, zlib, pkg-config, poppler, wrapGAppsHook3 }:
 
 mkDerivation rec {
   pname = "texmaker";
@@ -10,7 +10,7 @@ mkDerivation rec {
   };
 
   buildInputs = [ qtbase qtscript poppler zlib qtwebengine ];
-  nativeBuildInputs = [ pkg-config poppler qmake wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config poppler qmake wrapGAppsHook3 ];
   env.NIX_CFLAGS_COMPILE = "-I${poppler.dev}/include/poppler";
 
   qmakeFlags = [
diff --git a/pkgs/applications/editors/thiefmd/default.nix b/pkgs/applications/editors/thiefmd/default.nix
index 1b7b4a668b255..d603981302342 100644
--- a/pkgs/applications/editors/thiefmd/default.nix
+++ b/pkgs/applications/editors/thiefmd/default.nix
@@ -5,7 +5,7 @@
 , ninja
 , vala
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktop-file-utils
 , discount
 , glib
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     ninja
     vala
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils
   ];
 
diff --git a/pkgs/applications/editors/tijolo/default.nix b/pkgs/applications/editors/tijolo/default.nix
index c3605691ad869..2b76d492924be 100644
--- a/pkgs/applications/editors/tijolo/default.nix
+++ b/pkgs/applications/editors/tijolo/default.nix
@@ -6,7 +6,7 @@
 , libgit2
 , editorconfig-core-c
 , gtksourceview4
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktopToDarwinBundle
 }:
 crystal.buildCrystalPackage rec {
@@ -20,7 +20,7 @@ crystal.buildCrystalPackage rec {
     hash = "sha256-3TfXvRVP3lu43qF3RWCHnZ3czTaSl5EzrhuTlpnMfKo=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ]
+  nativeBuildInputs = [ wrapGAppsHook3 ]
     ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
   buildInputs = [ vte libgit2 gtksourceview4 editorconfig-core-c ];
 
diff --git a/pkgs/applications/editors/vim/full.nix b/pkgs/applications/editors/vim/full.nix
index 263f8d2984d0c..0f3652a8a7ded 100644
--- a/pkgs/applications/editors/vim/full.nix
+++ b/pkgs/applications/editors/vim/full.nix
@@ -4,7 +4,7 @@
 , libICE
 , vimPlugins
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , runtimeShell
 
 # apple frameworks
@@ -135,7 +135,7 @@ in stdenv.mkDerivation {
   ++ lib.optional wrapPythonDrv makeWrapper
   ++ lib.optional nlsSupport gettext
   ++ lib.optional perlSupport perl
-  ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook
+  ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook3
   ;
 
   buildInputs = [
diff --git a/pkgs/applications/editors/vim/plugins/build-vim-plugin.nix b/pkgs/applications/editors/vim/plugins/build-vim-plugin.nix
index 1611adc97ee3b..db712305c932c 100644
--- a/pkgs/applications/editors/vim/plugins/build-vim-plugin.nix
+++ b/pkgs/applications/editors/vim/plugins/build-vim-plugin.nix
@@ -13,7 +13,6 @@ rec {
 
   buildVimPlugin =
     { name ? "${attrs.pname}-${attrs.version}"
-    , namePrefix ? "vimplugin-"
     , src
     , unpackPhase ? ""
     , configurePhase ? ":"
@@ -27,7 +26,7 @@ rec {
     }@attrs:
     let
       drv = stdenv.mkDerivation (attrs // {
-        name = namePrefix + name;
+        name = lib.warnIf (attrs ? vimprefix) "The 'vimprefix' is now hardcoded in toVimPlugin" name;
 
         inherit unpackPhase configurePhase buildPhase addonInfo preInstall postInstall;
 
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 24435666c0768..0b17b14b7deae 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -78,7 +78,7 @@
 , # sved dependencies
   glib
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , # sniprun dependencies
   bashInteractive
 , coreutils
@@ -1335,11 +1335,11 @@
 
   sved =
     let
-      # we put the script in its own derivation to benefit the magic of wrapGAppsHook
+      # we put the script in its own derivation to benefit the magic of wrapGAppsHook3
       svedbackend = stdenv.mkDerivation {
         name = "svedbackend-${super.sved.name}";
         inherit (super.sved) src;
-        nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+        nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
         buildInputs = [
           glib
           (python3.withPackages (ps: with ps; [ pygobject3 pynvim dbus-python ]))
diff --git a/pkgs/applications/editors/vim/plugins/vim-utils.nix b/pkgs/applications/editors/vim/plugins/vim-utils.nix
index 7b023118f0570..d5536ee3b63a8 100644
--- a/pkgs/applications/editors/vim/plugins/vim-utils.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-utils.nix
@@ -415,6 +415,7 @@ rec {
 
   toVimPlugin = drv:
     drv.overrideAttrs(oldAttrs: {
+      name = "vimplugin-${oldAttrs.name}";
       # dont move the "doc" folder since vim expects it
       forceShare = [ "man" "info" ];
 
diff --git a/pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix b/pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix
index 4ab87219a7cf3..983ae07bb196e 100644
--- a/pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix
@@ -1,22 +1,21 @@
-{ lib
-, vscode-utils }:
+{ lib, vscode-utils }:
 
 let
   inherit (vscode-utils) buildVscodeMarketplaceExtension;
 in
-  buildVscodeMarketplaceExtension {
-    mktplcRef = {
-      name = "vscode-wakatime";
-      publisher = "WakaTime";
-      version = "18.0.5";
-      hash = "sha256-vWqGxMbxKqd4UgKK0sOKadMTDf6Y3TQxfWsc93MHjFs=";
-    };
+buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "vscode-wakatime";
+    publisher = "WakaTime";
+    version = "18.0.5";
+    hash = "sha256-vWqGxMbxKqd4UgKK0sOKadMTDf6Y3TQxfWsc93MHjFs=";
+  };
 
-    meta = {
-      description = ''
-        Visual Studio Code plugin for automatic time tracking and metrics generated
-        from your programming activity
-      '';
-      license = lib.licenses.bsd3;
-    };
-  }
+  meta = {
+    description = ''
+      Visual Studio Code plugin for automatic time tracking and metrics generated
+      from your programming activity
+    '';
+    license = lib.licenses.bsd3;
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix
index 5717ac0c12b57..fadcfe758a553 100644
--- a/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix
@@ -1,11 +1,19 @@
-{ lib, stdenv, vscode-utils, callPackage }:
+{
+  lib,
+  stdenv,
+  vscode-utils,
+  callPackage,
+}:
 let
   version = "1.50.0";
   rescript-editor-analysis = callPackage ./rescript-editor-analysis.nix { inherit version; };
   arch =
-    if stdenv.isLinux then "linux"
-    else if stdenv.isDarwin then "darwin"
-    else throw "Unsupported system: ${stdenv.system}";
+    if stdenv.isLinux then
+      "linux"
+    else if stdenv.isDarwin then
+      "darwin"
+    else
+      throw "Unsupported system: ${stdenv.system}";
   analysisDir = "server/analysis_binaries/${arch}";
 in
 vscode-utils.buildVscodeMarketplaceExtension rec {
@@ -23,7 +31,10 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   meta = {
     description = "The official VSCode plugin for ReScript";
     homepage = "https://github.com/rescript-lang/rescript-vscode";
-    maintainers = [ lib.maintainers.dlip lib.maintainers.jayesh-bhoot ];
+    maintainers = [
+      lib.maintainers.dlip
+      lib.maintainers.jayesh-bhoot
+    ];
     license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/rescript-editor-analysis.nix b/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/rescript-editor-analysis.nix
index 9ab9e4f165ddc..9a00fb31cd41e 100644
--- a/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/rescript-editor-analysis.nix
+++ b/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/rescript-editor-analysis.nix
@@ -1,4 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, bash, ocaml, ocamlPackages, dune_3, version }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  bash,
+  ocaml,
+  ocamlPackages,
+  dune_3,
+  version,
+}:
 
 stdenv.mkDerivation {
   pname = "rescript-editor-analysis";
@@ -11,7 +20,11 @@ stdenv.mkDerivation {
     hash = "sha256-+Ht8qWwxtFWHFMiV/aoZIs2S3SxkOWgdwSKN+akp/LU=";
   };
 
-  nativeBuildInputs = [ ocaml dune_3 ocamlPackages.cppo ];
+  nativeBuildInputs = [
+    ocaml
+    dune_3
+    ocamlPackages.cppo
+  ];
 
   # Skip testing phases because they need to download and install node modules
   postPatch = ''
@@ -28,7 +41,10 @@ stdenv.mkDerivation {
   meta = {
     description = "Analysis binary for the ReScript VSCode plugin";
     homepage = "https://github.com/rescript-lang/rescript-vscode";
-    maintainers = [ lib.maintainers.dlip lib.maintainers.jayesh-bhoot ];
+    maintainers = [
+      lib.maintainers.dlip
+      lib.maintainers.jayesh-bhoot
+    ];
     license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/applications/editors/vscode/extensions/contextmapper.context-mapper-vscode-extension/default.nix b/pkgs/applications/editors/vscode/extensions/contextmapper.context-mapper-vscode-extension/default.nix
index 5ba82c59fee56..9202ddb72b16d 100644
--- a/pkgs/applications/editors/vscode/extensions/contextmapper.context-mapper-vscode-extension/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/contextmapper.context-mapper-vscode-extension/default.nix
@@ -1,8 +1,9 @@
-{ graphviz
-, jre
-, lib
-, makeWrapper
-, vscode-utils
+{
+  graphviz,
+  jre,
+  lib,
+  makeWrapper,
+  vscode-utils,
 }:
 
 vscode-utils.buildVscodeMarketplaceExtension rec {
@@ -13,13 +14,9 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
     hash = "sha256-TvApcBBI+Egu7t4tJuEYTs6mhvABOY2eXVb57O4gWfs=";
   };
 
-  nativeBuildInputs = [
-    makeWrapper
-  ];
+  nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs = [
-    graphviz
-  ];
+  buildInputs = [ graphviz ];
 
   postInstall = ''
     wrapProgram $out/share/vscode/extensions/contextmapper.context-mapper-vscode-extension/lsp/bin/context-mapper-lsp \
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 409cb43eae35d..cfb14bd2cfe73 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3446,6 +3446,8 @@ let
         };
       };
 
+      reditorsupport.r = callPackage ./reditorsupport.r { };
+
       reloadedextensions.reloaded-cpp = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "reloaded-cpp";
@@ -3514,8 +3516,8 @@ let
         mktplcRef = {
           name = "wikitext";
           publisher = "RoweWilsonFrederiskHolme";
-          version = "3.8.0";
-          sha256 = "30540a85163e797028eec9bc3db1866bbf473e98615bf6ade6d1d672017ebe52";
+          version = "3.8.1";
+          hash = "sha256-piwS3SPjx10nsjN5axC+EN0MEDf0r2lVFllqQzciOfc=";
         };
         meta = {
           description = "Extension that helps users view and write MediaWiki's Wikitext files";
@@ -4571,6 +4573,22 @@ let
         };
       };
 
+      vue.volar = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "volar";
+          publisher = "Vue";
+          version = "2.0.16";
+          hash = "sha256-RTBbF7qahYP4L7SZ/5aCM/e5crZAyyPRcgL48FVL1jk=";
+        };
+        meta = {
+          changelog = "https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md";
+          description = "The official Vue VSCode extension";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=Vue.volar";
+          homepage = "https://github.com/vuejs/language-tools";
+          license = lib.licenses.mit;
+        };
+      };
+
       vspacecode.whichkey = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "whichkey";
@@ -4583,6 +4601,22 @@ let
         };
       };
 
+      vue.vscode-typescript-vue-plugin = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-typescript-vue-plugin";
+          publisher = "Vue";
+          version = "1.8.27";
+          hash = "sha256-ym1+WPKBcn4h9lqSFVehfiDoGUEviOSEVXVLhHcYvfc=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/Vue.vscode-typescript-vue-plugin/changelog";
+          description = "Vue VSCode extension for TypeScript";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=Vue.vscode-typescript-vue-plugin";
+          homepage = "https://github.com/vuejs/language-tools";
+          license = lib.licenses.mit;
+        };
+      };
+
       waderyan.gitblame = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "gitblame";
diff --git a/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix b/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix
index f84f625779b39..ba20cb5b3bbe4 100644
--- a/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix
@@ -1,6 +1,4 @@
-{ lib
-, vscode-utils
-}:
+{ lib, vscode-utils }:
 
 vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
diff --git a/pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix b/pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix
index a73da886437f0..dca2a081d92be 100644
--- a/pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix
@@ -1,4 +1,8 @@
-{ lib, vscode-utils, terraform-ls }:
+{
+  lib,
+  vscode-utils,
+  terraform-ls,
+}:
 vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "terraform";
diff --git a/pkgs/applications/editors/vscode/extensions/jebbs.plantuml/default.nix b/pkgs/applications/editors/vscode/extensions/jebbs.plantuml/default.nix
index 0f11ddc5ed2cb..afe4cd7bdb742 100644
--- a/pkgs/applications/editors/vscode/extensions/jebbs.plantuml/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/jebbs.plantuml/default.nix
@@ -1,4 +1,10 @@
-{ lib, vscode-utils, plantuml, jq, moreutils }:
+{
+  lib,
+  vscode-utils,
+  plantuml,
+  jq,
+  moreutils,
+}:
 
 vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
@@ -7,7 +13,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
     version = "2.17.4";
     hash = "sha256-fnz6ubB73i7rJcv+paYyNV1r4cReuyFPjgPM0HO40ug=";
   };
-  nativeBuildInputs = [ jq moreutils ];
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
   postInstall = ''
     cd "$out/$installPrefix"
     jq '.contributes.configuration.properties."plantuml.java".default = "${plantuml}/bin/plantuml"' package.json | sponge package.json
@@ -15,13 +24,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
 
   meta = {
     description = "A Visual Studio Code extension for supporting Rich PlantUML";
-    downloadPage =
-      "https://marketplace.visualstudio.com/items?itemName=jebbs.plantuml";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=jebbs.plantuml";
     homepage = "https://github.com/qjebbs/vscode-plantuml";
-    changelog =
-      "https://marketplace.visualstudio.com/items/jebbs.plantuml/changelog";
+    changelog = "https://marketplace.visualstudio.com/items/jebbs.plantuml/changelog";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.victormignot ];
   };
 }
-
diff --git a/pkgs/applications/editors/vscode/extensions/language-packs.nix b/pkgs/applications/editors/vscode/extensions/language-packs.nix
index 3c3253e2c3da6..6c522acaa1fd2 100644
--- a/pkgs/applications/editors/vscode/extensions/language-packs.nix
+++ b/pkgs/applications/editors/vscode/extensions/language-packs.nix
@@ -4,7 +4,12 @@ with vscode-utils;
 
 let
 
-  buildVscodeLanguagePack = { language, version ? "1.76.2023030809", sha256 }:
+  buildVscodeLanguagePack =
+    {
+      language,
+      version ? "1.76.2023030809",
+      sha256,
+    }:
     buildVscodeMarketplaceExtension {
       mktplcRef = {
         name = "vscode-language-pack-${language}";
@@ -15,7 +20,6 @@ let
         license = lib.licenses.mit;
       };
     };
-
 in
 
 # See list of core language packs at https://github.com/Microsoft/vscode-loc
diff --git a/pkgs/applications/editors/vscode/extensions/mktplcExtRefToFetchArgs.nix b/pkgs/applications/editors/vscode/extensions/mktplcExtRefToFetchArgs.nix
index 6c7ba096f6c58..4f947a493542f 100644
--- a/pkgs/applications/editors/vscode/extensions/mktplcExtRefToFetchArgs.nix
+++ b/pkgs/applications/editors/vscode/extensions/mktplcExtRefToFetchArgs.nix
@@ -1,4 +1,11 @@
-{ publisher, name, version, arch ? "", sha256 ? "", hash ? "" }:
+{
+  publisher,
+  name,
+  version,
+  arch ? "",
+  sha256 ? "",
+  hash ? "",
+}:
 let
   archurl = (if arch == "" then "" else "?targetPlatform=${arch}");
 in
diff --git a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
index e8f5f60ee9edc..50480e3460a95 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
@@ -1,56 +1,59 @@
-{ lib
-, icu
-, openssl
-, patchelf
-, stdenv
-, vscode-utils
+{
+  lib,
+  icu,
+  openssl,
+  patchelf,
+  stdenv,
+  vscode-utils,
 }:
 let
   inherit (stdenv.hostPlatform) system;
   inherit (vscode-utils) buildVscodeMarketplaceExtension;
 
-  extInfo = {
-    x86_64-linux = {
-      arch = "linux-x64";
-      hash = "sha256-7m85Zl9oV40le3nkNPzoKu/AAf8XhQpI8sBMsQXmBg8=";
-      binaries = [
-        "components/vs-green-server/platforms/linux-x64/node_modules/@microsoft/servicehub-controller-net60.linux-x64/Microsoft.ServiceHub.Controller"
-        "components/vs-green-server/platforms/linux-x64/node_modules/@microsoft/visualstudio-code-servicehost.linux-x64/Microsoft.VisualStudio.Code.ServiceHost"
-        "components/vs-green-server/platforms/linux-x64/node_modules/@microsoft/visualstudio-reliability-monitor.linux-x64/Microsoft.VisualStudio.Reliability.Monitor"
-        "components/vs-green-server/platforms/linux-x64/node_modules/@microsoft/visualstudio-server.linux-x64/Microsoft.VisualStudio.Code.Server"
-      ];
-    };
-    aarch64-linux = {
-      arch = "linux-arm64";
-      hash = "sha256-39D55EdwE4baDYbHc9GD/1XoxGbQkUkS1H2uysJHlxw=";
-      binaries = [
-        "components/vs-green-server/platforms/linux-arm64/node_modules/@microsoft/servicehub-controller-net60.linux-arm64/Microsoft.ServiceHub.Controller"
-        "components/vs-green-server/platforms/linux-arm64/node_modules/@microsoft/visualstudio-code-servicehost.linux-arm64/Microsoft.VisualStudio.Code.ServiceHost"
-        "components/vs-green-server/platforms/linux-arm64/node_modules/@microsoft/visualstudio-reliability-monitor.linux-arm64/Microsoft.VisualStudio.Reliability.Monitor"
-        "components/vs-green-server/platforms/linux-arm64/node_modules/@microsoft/visualstudio-server.linux-arm64/Microsoft.VisualStudio.Code.Server"
-      ];
-    };
-    x86_64-darwin = {
-      arch = "darwin-x64";
-      hash = "sha256-gfhJX07R+DIw9FbzaEE0JZwEmDeifiq4vHyMHZZ1udM=";
-      binaries = [
-        "components/vs-green-server/platforms/darwin-x64/node_modules/@microsoft/servicehub-controller-net60.darwin-x64/Microsoft.ServiceHub.Controller"
-        "components/vs-green-server/platforms/darwin-x64/node_modules/@microsoft/visualstudio-code-servicehost.darwin-x64/Microsoft.VisualStudio.Code.ServiceHost"
-        "components/vs-green-server/platforms/darwin-x64/node_modules/@microsoft/visualstudio-reliability-monitor.darwin-x64/Microsoft.VisualStudio.Reliability.Monitor"
-        "components/vs-green-server/platforms/darwin-x64/node_modules/@microsoft/visualstudio-server.darwin-x64/Microsoft.VisualStudio.Code.Server"
-      ];
-    };
-    aarch64-darwin = {
-      arch = "darwin-arm64";
-      hash = "sha256-vogstgCWvI9csNF9JfJ41XPR1POy842g2yhWqIDoHLw=";
-      binaries = [
-        "components/vs-green-server/platforms/darwin-arm64/node_modules/@microsoft/servicehub-controller-net60.darwin-arm64/Microsoft.ServiceHub.Controller"
-        "components/vs-green-server/platforms/darwin-arm64/node_modules/@microsoft/visualstudio-code-servicehost.darwin-arm64/Microsoft.VisualStudio.Code.ServiceHost"
-        "components/vs-green-server/platforms/darwin-arm64/node_modules/@microsoft/visualstudio-reliability-monitor.darwin-arm64/Microsoft.VisualStudio.Reliability.Monitor"
-        "components/vs-green-server/platforms/darwin-arm64/node_modules/@microsoft/visualstudio-server.darwin-arm64/Microsoft.VisualStudio.Code.Server"
-      ];
-    };
-  }.${system} or (throw "Unsupported system: ${system}");
+  extInfo =
+    {
+      x86_64-linux = {
+        arch = "linux-x64";
+        hash = "sha256-7m85Zl9oV40le3nkNPzoKu/AAf8XhQpI8sBMsQXmBg8=";
+        binaries = [
+          "components/vs-green-server/platforms/linux-x64/node_modules/@microsoft/servicehub-controller-net60.linux-x64/Microsoft.ServiceHub.Controller"
+          "components/vs-green-server/platforms/linux-x64/node_modules/@microsoft/visualstudio-code-servicehost.linux-x64/Microsoft.VisualStudio.Code.ServiceHost"
+          "components/vs-green-server/platforms/linux-x64/node_modules/@microsoft/visualstudio-reliability-monitor.linux-x64/Microsoft.VisualStudio.Reliability.Monitor"
+          "components/vs-green-server/platforms/linux-x64/node_modules/@microsoft/visualstudio-server.linux-x64/Microsoft.VisualStudio.Code.Server"
+        ];
+      };
+      aarch64-linux = {
+        arch = "linux-arm64";
+        hash = "sha256-39D55EdwE4baDYbHc9GD/1XoxGbQkUkS1H2uysJHlxw=";
+        binaries = [
+          "components/vs-green-server/platforms/linux-arm64/node_modules/@microsoft/servicehub-controller-net60.linux-arm64/Microsoft.ServiceHub.Controller"
+          "components/vs-green-server/platforms/linux-arm64/node_modules/@microsoft/visualstudio-code-servicehost.linux-arm64/Microsoft.VisualStudio.Code.ServiceHost"
+          "components/vs-green-server/platforms/linux-arm64/node_modules/@microsoft/visualstudio-reliability-monitor.linux-arm64/Microsoft.VisualStudio.Reliability.Monitor"
+          "components/vs-green-server/platforms/linux-arm64/node_modules/@microsoft/visualstudio-server.linux-arm64/Microsoft.VisualStudio.Code.Server"
+        ];
+      };
+      x86_64-darwin = {
+        arch = "darwin-x64";
+        hash = "sha256-gfhJX07R+DIw9FbzaEE0JZwEmDeifiq4vHyMHZZ1udM=";
+        binaries = [
+          "components/vs-green-server/platforms/darwin-x64/node_modules/@microsoft/servicehub-controller-net60.darwin-x64/Microsoft.ServiceHub.Controller"
+          "components/vs-green-server/platforms/darwin-x64/node_modules/@microsoft/visualstudio-code-servicehost.darwin-x64/Microsoft.VisualStudio.Code.ServiceHost"
+          "components/vs-green-server/platforms/darwin-x64/node_modules/@microsoft/visualstudio-reliability-monitor.darwin-x64/Microsoft.VisualStudio.Reliability.Monitor"
+          "components/vs-green-server/platforms/darwin-x64/node_modules/@microsoft/visualstudio-server.darwin-x64/Microsoft.VisualStudio.Code.Server"
+        ];
+      };
+      aarch64-darwin = {
+        arch = "darwin-arm64";
+        hash = "sha256-vogstgCWvI9csNF9JfJ41XPR1POy842g2yhWqIDoHLw=";
+        binaries = [
+          "components/vs-green-server/platforms/darwin-arm64/node_modules/@microsoft/servicehub-controller-net60.darwin-arm64/Microsoft.ServiceHub.Controller"
+          "components/vs-green-server/platforms/darwin-arm64/node_modules/@microsoft/visualstudio-code-servicehost.darwin-arm64/Microsoft.VisualStudio.Code.ServiceHost"
+          "components/vs-green-server/platforms/darwin-arm64/node_modules/@microsoft/visualstudio-reliability-monitor.darwin-arm64/Microsoft.VisualStudio.Reliability.Monitor"
+          "components/vs-green-server/platforms/darwin-arm64/node_modules/@microsoft/visualstudio-server.darwin-arm64/Microsoft.VisualStudio.Code.Server"
+        ];
+      };
+    }
+    .${system} or (throw "Unsupported system: ${system}");
 in
 buildVscodeMarketplaceExtension {
   mktplcRef = {
@@ -61,50 +64,55 @@ buildVscodeMarketplaceExtension {
   };
   sourceRoot = "extension"; # This has more than one folder.
 
-  nativeBuildInputs = [
-    patchelf
-  ];
+  nativeBuildInputs = [ patchelf ];
 
-  postPatch = ''
-    declare ext_unique_id
-    ext_unique_id="$(basename "$out" | head -c 32)"
+  postPatch =
+    ''
+      declare ext_unique_id
+      ext_unique_id="$(basename "$out" | head -c 32)"
 
-    patchelf_add_icu_as_needed() {
-      declare elf="''${1?}"
-      declare icu_major_v="${
-      lib.head (lib.splitVersion (lib.getVersion icu.name))
-    }"
+      patchelf_add_icu_as_needed() {
+        declare elf="''${1?}"
+        declare icu_major_v="${lib.head (lib.splitVersion (lib.getVersion icu.name))}"
 
-      for icu_lib in icui18n icuuc icudata; do
-        patchelf --add-needed "lib''${icu_lib}.so.$icu_major_v" "$elf"
-      done
-    }
+        for icu_lib in icui18n icuuc icudata; do
+          patchelf --add-needed "lib''${icu_lib}.so.$icu_major_v" "$elf"
+        done
+      }
 
-    patchelf_common() {
-      declare elf="''${1?}"
+      patchelf_common() {
+        declare elf="''${1?}"
 
-      patchelf_add_icu_as_needed "$elf"
-      patchelf --add-needed "libssl.so" "$elf"
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${lib.makeLibraryPath [stdenv.cc.cc openssl icu.out]}:\$ORIGIN" \
-        "$elf"
-    }
+        patchelf_add_icu_as_needed "$elf"
+        patchelf --add-needed "libssl.so" "$elf"
+        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-rpath "${
+            lib.makeLibraryPath [
+              stdenv.cc.cc
+              openssl
+              icu.out
+            ]
+          }:\$ORIGIN" \
+          "$elf"
+      }
 
-    substituteInPlace dist/extension.js \
-      --replace 'e.extensionPath,"cache"' 'require("os").tmpdir(),"'"$ext_unique_id"'"' \
-      --replace 't.setExecuteBit=async function(e){if("win32"!==process.platform){const t=i.join(e[a.SERVICEHUB_CONTROLLER_COMPONENT_NAME],"Microsoft.ServiceHub.Controller"),n=i.join(e[a.SERVICEHUB_HOST_COMPONENT_NAME],(0,a.getServiceHubHostEntrypointName)()),r=[(0,a.getServerPath)(e),t,n,(0,c.getReliabilityMonitorPath)(e)];await Promise.all(r.map((e=>(0,o.chmod)(e,"0755"))))}}' 't.setExecuteBit=async function(e){}'
+      substituteInPlace dist/extension.js \
+        --replace 'e.extensionPath,"cache"' 'require("os").tmpdir(),"'"$ext_unique_id"'"' \
+        --replace 't.setExecuteBit=async function(e){if("win32"!==process.platform){const t=i.join(e[a.SERVICEHUB_CONTROLLER_COMPONENT_NAME],"Microsoft.ServiceHub.Controller"),n=i.join(e[a.SERVICEHUB_HOST_COMPONENT_NAME],(0,a.getServiceHubHostEntrypointName)()),r=[(0,a.getServerPath)(e),t,n,(0,c.getReliabilityMonitorPath)(e)];await Promise.all(r.map((e=>(0,o.chmod)(e,"0755"))))}}' 't.setExecuteBit=async function(e){}'
 
-  ''
-  + (lib.concatStringsSep "\n" (map
-    (bin: ''
-      chmod +x "${bin}"
-    '')
-    extInfo.binaries))
-  + lib.optionalString stdenv.isLinux (lib.concatStringsSep "\n" (map
-    (bin: ''
-      patchelf_common "${bin}"
-    '')
-    extInfo.binaries));
+    ''
+    + (lib.concatStringsSep "\n" (
+      map (bin: ''
+        chmod +x "${bin}"
+      '') extInfo.binaries
+    ))
+    + lib.optionalString stdenv.isLinux (
+      lib.concatStringsSep "\n" (
+        map (bin: ''
+          patchelf_common "${bin}"
+        '') extInfo.binaries
+      )
+    );
 
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/ms-dotnettools.csdevkit/changelog";
@@ -112,6 +120,11 @@ buildVscodeMarketplaceExtension {
     downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-dotnettools.csdevkit";
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.ggg ];
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
   };
 }
diff --git a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix
index 213ce3550f45c..189804e981781 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix
@@ -1,11 +1,11 @@
-{ lib
-, vscode-utils
-, patchelf
-, icu
-, stdenv
-, openssl
-, coreutils
-,
+{
+  lib,
+  vscode-utils,
+  patchelf,
+  icu,
+  stdenv,
+  openssl,
+  coreutils,
 }:
 let
   inherit (stdenv.hostPlatform) system;
@@ -26,31 +26,32 @@ let
         ".debugger/x86_64/vsdbg"
       ];
     in
-      {
-        x86_64-linux = {
-          arch = "linux-x64";
-          hash = "sha256-si4HKGVIHu44QNlNI2WEnMff9+QZOMWiBfWQaaFGyQE=";
-          binaries = linuxBins;
-        };
-        aarch64-linux = {
-          arch = "linux-arm64";
-          hash = "sha256-1IXkSRgCHOLD4VeCdqyy54MXCBUX5RDDb3pf7GQH5jA=";
-          binaries = linuxBins;
-        };
-        x86_64-darwin = {
-          arch = "darwin-x64";
-          hash = "sha256-AAbYjZ+YYyGEXSLkiFfluLf7P4OzPhmHzK44N5XT9UI=";
-          binaries = darwinBins;
-        };
-        aarch64-darwin = {
-          arch = "darwin-arm64";
-          hash = "sha256-1m47kX0Jo+UvthNfgdoPdBBOcDyCA8DfP+zRk3SicR0=";
-          binaries = darwinBins ++ [
-            ".debugger/arm64/vsdbg-ui"
-            ".debugger/arm64/vsdbg"
-          ];
-        };
-      }.${system} or (throw "Unsupported system: ${system}");
+    {
+      x86_64-linux = {
+        arch = "linux-x64";
+        hash = "sha256-si4HKGVIHu44QNlNI2WEnMff9+QZOMWiBfWQaaFGyQE=";
+        binaries = linuxBins;
+      };
+      aarch64-linux = {
+        arch = "linux-arm64";
+        hash = "sha256-1IXkSRgCHOLD4VeCdqyy54MXCBUX5RDDb3pf7GQH5jA=";
+        binaries = linuxBins;
+      };
+      x86_64-darwin = {
+        arch = "darwin-x64";
+        hash = "sha256-AAbYjZ+YYyGEXSLkiFfluLf7P4OzPhmHzK44N5XT9UI=";
+        binaries = darwinBins;
+      };
+      aarch64-darwin = {
+        arch = "darwin-arm64";
+        hash = "sha256-1m47kX0Jo+UvthNfgdoPdBBOcDyCA8DfP+zRk3SicR0=";
+        binaries = darwinBins ++ [
+          ".debugger/arm64/vsdbg-ui"
+          ".debugger/arm64/vsdbg"
+        ];
+      };
+    }
+    .${system} or (throw "Unsupported system: ${system}");
 in
 buildVscodeMarketplaceExtension {
   mktplcRef = {
@@ -60,16 +61,13 @@ buildVscodeMarketplaceExtension {
     inherit (extInfo) hash arch;
   };
 
-  nativeBuildInputs = [
-    patchelf
-  ];
+  nativeBuildInputs = [ patchelf ];
 
-  postPatch = ''
+  postPatch =
+    ''
       patchelf_add_icu_as_needed() {
         declare elf="''${1?}"
-        declare icu_major_v="${
-        lib.head (lib.splitVersion (lib.getVersion icu.name))
-      }"
+        declare icu_major_v="${lib.head (lib.splitVersion (lib.getVersion icu.name))}"
 
         for icu_lib in icui18n icuuc icudata; do
           patchelf --add-needed "lib''${icu_lib}.so.$icu_major_v" "$elf"
@@ -82,7 +80,13 @@ buildVscodeMarketplaceExtension {
         patchelf_add_icu_as_needed "$elf"
         patchelf --add-needed "libssl.so" "$elf"
         patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath "${lib.makeLibraryPath [stdenv.cc.cc openssl icu.out]}:\$ORIGIN" \
+          --set-rpath "${
+            lib.makeLibraryPath [
+              stdenv.cc.cc
+              openssl
+              icu.out
+            ]
+          }:\$ORIGIN" \
           "$elf"
       }
 
@@ -90,22 +94,29 @@ buildVscodeMarketplaceExtension {
         --replace 'uname -m' '${lib.getExe' coreutils "uname"} -m'
 
     ''
-    + (lib.concatStringsSep "\n" (map
-      (bin: ''
+    + (lib.concatStringsSep "\n" (
+      map (bin: ''
         chmod +x "${bin}"
-      '')
-      extInfo.binaries))
-    + lib.optionalString stdenv.isLinux (lib.concatStringsSep "\n" (map
-      (bin: ''
-        patchelf_common "${bin}"
-      '')
-      extInfo.binaries));
+      '') extInfo.binaries
+    ))
+    + lib.optionalString stdenv.isLinux (
+      lib.concatStringsSep "\n" (
+        map (bin: ''
+          patchelf_common "${bin}"
+        '') extInfo.binaries
+      )
+    );
 
   meta = {
     description = "Official C# support for Visual Studio Code";
     homepage = "https://github.com/dotnet/vscode-csharp";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ggg ];
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
   };
 }
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
index 25091b95efc4b..67a96652b6ed6 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
@@ -1,19 +1,20 @@
-{ lib
-, vscode-utils
-, icu
-, python3
+{
+  lib,
+  vscode-utils,
+  icu,
+  python3,
   # When `true`, the python default setting will be fixed to specified.
   # Use version from `PATH` for default setting otherwise.
   # Defaults to `false` as we expect it to be project specific most of the time.
-, pythonUseFixed ? false
+  pythonUseFixed ? false,
   # For updateScript
-, writeScript
-, bash
-, curl
-, coreutils
-, gnused
-, jq
-, nix
+  writeScript,
+  bash,
+  curl,
+  coreutils,
+  gnused,
+  jq,
+  nix,
 }:
 
 vscode-utils.buildVscodeMarketplaceExtension rec {
@@ -33,33 +34,37 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
     jedi-language-server
   ];
 
-  postPatch = ''
-    # remove bundled python deps and use libs from nixpkgs
-    rm -r pythonFiles/lib
-    mkdir -p pythonFiles/lib/python/
-    ln -s ${python3.pkgs.debugpy}/lib/*/site-packages/debugpy pythonFiles/lib/python/
-    buildPythonPath "$propagatedBuildInputs"
-    for i in pythonFiles/*.py; do
-      patchPythonScript "$i"
-    done
-  '' + lib.optionalString pythonUseFixed ''
-    # Patch `packages.json` so that nix's *python* is used as default value for `python.pythonPath`.
-    substituteInPlace "./package.json" \
-      --replace "\"default\": \"python\"" "\"default\": \"${python3.interpreter}\""
-  '';
+  postPatch =
+    ''
+      # remove bundled python deps and use libs from nixpkgs
+      rm -r pythonFiles/lib
+      mkdir -p pythonFiles/lib/python/
+      ln -s ${python3.pkgs.debugpy}/lib/*/site-packages/debugpy pythonFiles/lib/python/
+      buildPythonPath "$propagatedBuildInputs"
+      for i in pythonFiles/*.py; do
+        patchPythonScript "$i"
+      done
+    ''
+    + lib.optionalString pythonUseFixed ''
+      # Patch `packages.json` so that nix's *python* is used as default value for `python.pythonPath`.
+      substituteInPlace "./package.json" \
+        --replace "\"default\": \"python\"" "\"default\": \"${python3.interpreter}\""
+    '';
 
   passthru.updateScript = writeScript "update" ''
     #! ${bash}/bin/bash
 
     set -eu -o pipefail
 
-    export PATH=${lib.makeBinPath [
-      curl
-      coreutils
-      gnused
-      jq
-      nix
-    ]}
+    export PATH=${
+      lib.makeBinPath [
+        curl
+        coreutils
+        gnused
+        jq
+        nix
+      ]
+    }
 
     api=$(curl -s 'https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery' \
       -H 'accept: application/json;api-version=3.0-preview.1' \
@@ -82,7 +87,14 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
     homepage = "https://github.com/Microsoft/vscode-python";
     changelog = "https://github.com/microsoft/vscode-python/releases";
     license = lib.licenses.mit;
-    platforms = [ "x86_64-linux" "aarch64-darwin" "x86_64-darwin" ];
-    maintainers = [ lib.maintainers.jraygauthier lib.maintainers.jfchevrette ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
+    maintainers = [
+      lib.maintainers.jraygauthier
+      lib.maintainers.jfchevrette
+    ];
   };
 }
diff --git a/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix b/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix
index 99de6b59b1761..41803cadb3a79 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix
@@ -1,4 +1,9 @@
-{ lib, vscode-utils, jq, moreutils }:
+{
+  lib,
+  vscode-utils,
+  jq,
+  moreutils,
+}:
 
 vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix b/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
index 63e351f69b4a3..3872aad7ea4b8 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
@@ -1,7 +1,8 @@
-{ lib
-, nixosTests
-, vscode-utils
-, useLocalExtensions ? false
+{
+  lib,
+  nixosTests,
+  vscode-utils,
+  useLocalExtensions ? false,
 }:
 # Note that useLocalExtensions requires that vscode-server is not running
 # on host. If it is, you'll need to remove $HOME/.vscode-server,
@@ -92,7 +93,9 @@ buildVscodeMarketplaceExtension {
       --replace '# Start the server\n' '${patch}'
   '';
 
-  passthru.tests = { inherit (nixosTests) vscode-remote-ssh; };
+  passthru.tests = {
+    inherit (nixosTests) vscode-remote-ssh;
+  };
 
   meta = {
     description = "Use any remote machine with a SSH server as your development environment.";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix b/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
index e3af2a04f0fd3..731bddc3553c5 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
@@ -1,8 +1,19 @@
-{ lib, vscode-utils
-, fetchurl, writeScript, runtimeShell
-, jq, clang-tools
-, gdbUseFixed ? true, gdb # The gdb default setting will be fixed to specified. Use version from `PATH` otherwise.
-, autoPatchelfHook, makeWrapper, stdenv, lttng-ust, libkrb5, zlib
+{
+  lib,
+  vscode-utils,
+  fetchurl,
+  writeScript,
+  runtimeShell,
+  jq,
+  clang-tools,
+  gdbUseFixed ? true,
+  gdb, # The gdb default setting will be fixed to specified. Use version from `PATH` otherwise.
+  autoPatchelfHook,
+  makeWrapper,
+  stdenv,
+  lttng-ust,
+  libkrb5,
+  zlib,
 }:
 
 /*
@@ -94,7 +105,13 @@ vscode-utils.buildVscodeMarketplaceExtension {
     description = "The C/C++ extension adds language support for C/C++ to Visual Studio Code, including features such as IntelliSense and debugging.";
     homepage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.cpptools";
     license = lib.licenses.unfree;
-    maintainers = [ lib.maintainers.jraygauthier lib.maintainers.stargate01 ];
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    maintainers = [
+      lib.maintainers.jraygauthier
+      lib.maintainers.stargate01
+    ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
   };
 }
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix
index 0f70451c4652e..180490e60a655 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix
@@ -1,4 +1,8 @@
-{ lib, vscode-utils, xsel }:
+{
+  lib,
+  vscode-utils,
+  xsel,
+}:
 
 vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
diff --git a/pkgs/applications/editors/vscode/extensions/reditorsupport.r/default.nix b/pkgs/applications/editors/vscode/extensions/reditorsupport.r/default.nix
new file mode 100644
index 0000000000000..de1759d7b0e46
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/reditorsupport.r/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  vscode-utils,
+  jq,
+  moreutils,
+  python311Packages,
+  R,
+  rPackages,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "r";
+    publisher = "reditorsupport";
+    version = "2.8.2";
+    hash = "sha256-FPL/JjW452KRchcQ0iHXRJarZXvS3B8PvZhXjf3rMhQ=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  buildInputs = [
+    python311Packages.radian
+    R
+    rPackages.languageserver
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."r.rpath.mac".default = "${lib.getExe' R "R"}"' package.json | sponge package.json
+    jq '.contributes.configuration.properties."r.rpath.linux".default = "${lib.getExe' R "R"}"' package.json | sponge package.json
+    jq '.contributes.configuration.properties."r.rterm.mac".default = "${lib.getExe python311Packages.radian}"' package.json | sponge package.json
+    jq '.contributes.configuration.properties."r.rterm.linux".default = "${lib.getExe python311Packages.radian}"' package.json | sponge package.json
+  '';
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/REditorSupport.r/changelog";
+    description = "A Visual Studio Code extension for the R programming language";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=REditorSupport.r";
+    homepage = "https://github.com/REditorSupport/vscode-R";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.pandapip1 ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
index 056904390c3ea..6fd65c9ae9b4a 100644
--- a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
@@ -1,16 +1,17 @@
-{ lib
-, fetchFromGitHub
-, vscode-utils
-, jq
-, rust-analyzer
-, nodePackages
-, moreutils
-, esbuild
-, pkg-config
-, libsecret
-, stdenv
-, darwin
-, setDefaultServerPath ? true
+{
+  lib,
+  fetchFromGitHub,
+  vscode-utils,
+  jq,
+  rust-analyzer,
+  nodePackages,
+  moreutils,
+  esbuild,
+  pkg-config,
+  libsecret,
+  stdenv,
+  darwin,
+  setDefaultServerPath ? true,
 }:
 
 let
@@ -29,26 +30,32 @@ let
     hash = "sha256-Oj/RPMridKpYt3eRqUIPg9YNrj6npG8THIGuWjsamnE=";
   };
 
-  build-deps = nodePackages."rust-analyzer-build-deps-../../applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps";
+  build-deps =
+    nodePackages."rust-analyzer-build-deps-../../applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps";
   # FIXME: Making a new derivation to link `node_modules` and run `npm run package`
   # will cause a build failure.
   vsix = build-deps.override {
     src = "${src}/editors/code";
-    outputs = [ "vsix" "out" ];
+    outputs = [
+      "vsix"
+      "out"
+    ];
 
     inherit releaseTag;
 
-    nativeBuildInputs = [
-      jq
-      moreutils
-      esbuild
-      # Required by `keytar`, which is a dependency of `vsce`.
-      pkg-config
-      libsecret
-    ] ++ lib.optionals stdenv.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-      darwin.apple_sdk.frameworks.Security
-    ];
+    nativeBuildInputs =
+      [
+        jq
+        moreutils
+        esbuild
+        # Required by `keytar`, which is a dependency of `vsce`.
+        pkg-config
+        libsecret
+      ]
+      ++ lib.optionals stdenv.isDarwin [
+        darwin.apple_sdk.frameworks.AppKit
+        darwin.apple_sdk.frameworks.Security
+      ];
 
     # Follows https://github.com/rust-lang/rust-analyzer/blob/41949748a6123fd6061eb984a47f4fe780525e63/xtask/src/dist.rs#L39-L65
     postRebuild = ''
@@ -65,7 +72,6 @@ let
       echo y | npx vsce package -o $vsix/${pname}.zip
     '';
   };
-
 in
 vscode-utils.buildVscodeExtension {
   inherit version vsix;
@@ -75,7 +81,10 @@ vscode-utils.buildVscodeExtension {
   vscodeExtPublisher = publisher;
   vscodeExtName = pname;
 
-  nativeBuildInputs = lib.optionals setDefaultServerPath [ jq moreutils ];
+  nativeBuildInputs = lib.optionals setDefaultServerPath [
+    jq
+    moreutils
+  ];
 
   preInstall = lib.optionalString setDefaultServerPath ''
     jq '.contributes.configuration.properties."rust-analyzer.server.path".default = $s' \
@@ -86,9 +95,11 @@ vscode-utils.buildVscodeExtension {
   meta = {
     description = "An alternative rust language server to the RLS";
     homepage = "https://github.com/rust-lang/rust-analyzer";
-    license = [ lib.licenses.mit lib.licenses.asl20 ];
+    license = [
+      lib.licenses.mit
+      lib.licenses.asl20
+    ];
     maintainers = [ ];
     platforms = lib.platforms.all;
   };
 }
-
diff --git a/pkgs/applications/editors/vscode/extensions/sumneko.lua/default.nix b/pkgs/applications/editors/vscode/extensions/sumneko.lua/default.nix
index a6a33854d3b1a..4a8db2db4be54 100644
--- a/pkgs/applications/editors/vscode/extensions/sumneko.lua/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/sumneko.lua/default.nix
@@ -1,6 +1,7 @@
-{ lib
-, vscode-utils
-, lua-language-server
+{
+  lib,
+  vscode-utils,
+  lua-language-server,
 }:
 
 vscode-utils.buildVscodeMarketplaceExtension {
diff --git a/pkgs/applications/editors/vscode/extensions/updateSettings.nix b/pkgs/applications/editors/vscode/extensions/updateSettings.nix
index 443b409302796..fe23e099b536d 100644
--- a/pkgs/applications/editors/vscode/extensions/updateSettings.nix
+++ b/pkgs/applications/editors/vscode/extensions/updateSettings.nix
@@ -1,39 +1,43 @@
 # Updates the vscode setting file base on a nix expression
 # should run from the workspace root.
-{ writeShellScriptBin
-, lib
-, jq
+{
+  writeShellScriptBin,
+  lib,
+  jq,
 }:
 ##User Input
-{ settings      ? {}
-# if marked as true will create an empty json file if does not exist
-, createIfDoesNotExists ? true
-, vscodeSettingsFile ? ".vscode/settings.json"
-, userSettingsFolder ? ""
-, symlinkFromUserSetting ? false
+{
+  settings ? { },
+  # if marked as true will create an empty json file if does not exist
+  createIfDoesNotExists ? true,
+  vscodeSettingsFile ? ".vscode/settings.json",
+  userSettingsFolder ? "",
+  symlinkFromUserSetting ? false,
 }:
 let
 
   updateVSCodeSettingsCmd = ''
-  (
-    echo 'updateSettings.nix: Updating ${vscodeSettingsFile}...'
-    oldSettings=$(cat ${vscodeSettingsFile})
-    echo $oldSettings' ${builtins.toJSON settings}' | ${jq}/bin/jq -s add > ${vscodeSettingsFile}
-  )'';
+    (
+      echo 'updateSettings.nix: Updating ${vscodeSettingsFile}...'
+      oldSettings=$(cat ${vscodeSettingsFile})
+      echo $oldSettings' ${builtins.toJSON settings}' | ${jq}/bin/jq -s add > ${vscodeSettingsFile}
+    )'';
 
   createEmptySettingsCmd = ''mkdir -p .vscode && echo "{}" > ${vscodeSettingsFile}'';
   fileName = builtins.baseNameOf vscodeSettingsFile;
-  symlinkFromUserSettingCmd = lib.optionalString symlinkFromUserSetting
-    '' && mkdir -p "${userSettingsFolder}" && ln -sfv "$(pwd)/${vscodeSettingsFile}" "${userSettingsFolder}/" '';
+  symlinkFromUserSettingCmd = lib.optionalString symlinkFromUserSetting ''&& mkdir -p "${userSettingsFolder}" && ln -sfv "$(pwd)/${vscodeSettingsFile}" "${userSettingsFolder}/" '';
 in
 
-  writeShellScriptBin ''vscodeNixUpdate-${lib.removeSuffix ".json" (fileName)}''
-  (lib.optionalString (settings != {})
-    (if createIfDoesNotExists then ''
-      [ ! -f "${vscodeSettingsFile}" ] && ${createEmptySettingsCmd}
-      ${updateVSCodeSettingsCmd} ${symlinkFromUserSettingCmd}
-    ''
-    else ''[ -f "${vscodeSettingsFile}" ] && ${updateVSCodeSettingsCmd} ${symlinkFromUserSettingCmd}
-    ''
-    )
+writeShellScriptBin ''vscodeNixUpdate-${lib.removeSuffix ".json" (fileName)}'' (
+  lib.optionalString (settings != { }) (
+    if createIfDoesNotExists then
+      ''
+        [ ! -f "${vscodeSettingsFile}" ] && ${createEmptySettingsCmd}
+        ${updateVSCodeSettingsCmd} ${symlinkFromUserSettingCmd}
+      ''
+    else
+      ''
+        [ -f "${vscodeSettingsFile}" ] && ${updateVSCodeSettingsCmd} ${symlinkFromUserSettingCmd}
+      ''
   )
+)
diff --git a/pkgs/applications/editors/vscode/extensions/updateSettingsTest.nix b/pkgs/applications/editors/vscode/extensions/updateSettingsTest.nix
index 097b9cad16616..f12350077590d 100644
--- a/pkgs/applications/editors/vscode/extensions/updateSettingsTest.nix
+++ b/pkgs/applications/editors/vscode/extensions/updateSettingsTest.nix
@@ -1,5 +1,5 @@
-with import <nixpkgs>{};
-callPackage (import ./updateSettings.nix) {} {
+with import <nixpkgs> { };
+callPackage (import ./updateSettings.nix) { } {
   settings = {
     a = "fdsdf";
   };
diff --git a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
index b6e47094d57a9..70f4cbd833deb 100644
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
@@ -1,5 +1,20 @@
-{ pkgs, lib, stdenv, fetchFromGitHub, runCommand, rustPlatform, makeWrapper, llvmPackages
-, buildNpmPackage, cmake, nodejs, unzip, python3, pkg-config, libsecret, darwin
+{
+  pkgs,
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  runCommand,
+  rustPlatform,
+  makeWrapper,
+  llvmPackages,
+  buildNpmPackage,
+  cmake,
+  nodejs,
+  unzip,
+  python3,
+  pkg-config,
+  libsecret,
+  darwin,
 }:
 assert lib.versionAtLeast python3.version "3.5";
 let
@@ -31,9 +46,7 @@ let
 
     nativeBuildInputs = [ makeWrapper ];
 
-    env = lib.optionalAttrs stdenv.isDarwin {
-      NIX_LDFLAGS = "-llldb -lc++abi";
-    };
+    env = lib.optionalAttrs stdenv.isDarwin { NIX_LDFLAGS = "-llldb -lc++abi"; };
 
     buildAndTestSubdir = "adapter";
 
@@ -76,12 +89,15 @@ let
       pkg-config
     ];
 
-    buildInputs = [
-      libsecret
-    ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
-      Security
-      AppKit
-    ]);
+    buildInputs =
+      [ libsecret ]
+      ++ lib.optionals stdenv.isDarwin (
+        with darwin.apple_sdk.frameworks;
+        [
+          Security
+          AppKit
+        ]
+      );
 
     dontNpmBuild = true;
 
@@ -103,14 +119,25 @@ let
       "/Applications/Xcode.app/Contents/SharedFrameworks/LLDB.framework/Versions/A/Resources/debugserver"
     else
       "${lldb.out}/bin/lldb-server";
-
-in stdenv.mkDerivation {
+in
+stdenv.mkDerivation {
   pname = "vscode-extension-${publisher}-${pname}";
-  inherit src version vscodeExtUniqueId vscodeExtPublisher vscodeExtName;
+  inherit
+    src
+    version
+    vscodeExtUniqueId
+    vscodeExtPublisher
+    vscodeExtName
+    ;
 
   installPrefix = "share/vscode/extensions/${vscodeExtUniqueId}";
 
-  nativeBuildInputs = [ cmake nodejs unzip makeWrapper ];
+  nativeBuildInputs = [
+    cmake
+    nodejs
+    unzip
+    makeWrapper
+  ];
 
   patches = [ ./cmake-build-extension-only.patch ];
 
@@ -120,12 +147,14 @@ in stdenv.mkDerivation {
       --replace "1.9.2" ${version}
   '';
 
-  postConfigure = ''
-    cp -r ${nodeDeps}/lib/node_modules .
-  '' + lib.optionalString stdenv.isDarwin ''
-    export HOME="$TMPDIR/home"
-    mkdir $HOME
-  '';
+  postConfigure =
+    ''
+      cp -r ${nodeDeps}/lib/node_modules .
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      export HOME="$TMPDIR/home"
+      mkdir $HOME
+    '';
 
   cmakeFlags = [
     # Do not append timestamp to version.
diff --git a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/lldb.nix b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/lldb.nix
index 9c5ce50fa245a..7708c52c80b03 100644
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/lldb.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/lldb.nix
@@ -1,5 +1,9 @@
 # Patched lldb for Rust language support.
-{ fetchFromGitHub, runCommand, llvmPackages }:
+{
+  fetchFromGitHub,
+  runCommand,
+  llvmPackages,
+}:
 let
   llvmSrc = fetchFromGitHub {
     owner = "vadimcn";
@@ -8,8 +12,9 @@ let
     rev = "4c267c83cbb55fedf2e0b89644dc1db320fdfde7";
     hash = "sha256-jM//ej6AxnRYj+8BAn4QrxHPT6HiDzK5RqHPSg3dCcw=";
   };
-in (llvmPackages.lldb.overrideAttrs (oldAttrs: rec {
-  passthru = (oldAttrs.passthru or {}) // {
+in
+(llvmPackages.lldb.overrideAttrs (oldAttrs: rec {
+  passthru = (oldAttrs.passthru or { }) // {
     inherit llvmSrc;
   };
 
@@ -23,7 +28,8 @@ in (llvmPackages.lldb.overrideAttrs (oldAttrs: rec {
     echo "'lldb --version' returns: $versionOutput"
     echo "$versionOutput" | grep -q 'rust-enabled'
   '';
-})).override({
-  monorepoSrc = llvmSrc;
-  libllvm = llvmPackages.libllvm.override({ monorepoSrc = llvmSrc; });
-})
+})).override
+  ({
+    monorepoSrc = llvmSrc;
+    libllvm = llvmPackages.libllvm.override ({ monorepoSrc = llvmSrc; });
+  })
diff --git a/pkgs/applications/editors/vscode/extensions/vscode-utils.nix b/pkgs/applications/editors/vscode/extensions/vscode-utils.nix
index 940a39a217624..d457b156aa97e 100644
--- a/pkgs/applications/editors/vscode/extensions/vscode-utils.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-utils.nix
@@ -1,77 +1,101 @@
-{ stdenv, lib, buildEnv, writeShellScriptBin, fetchurl, vscode, unzip, jq }:
+{
+  stdenv,
+  lib,
+  buildEnv,
+  writeShellScriptBin,
+  fetchurl,
+  vscode,
+  unzip,
+  jq,
+}:
 let
-  buildVscodeExtension = a@{
-    name,
-    src,
-    # Same as "Unique Identifier" on the extension's web page.
-    # For the moment, only serve as unique extension dir.
-    vscodeExtPublisher,
-    vscodeExtName,
-    vscodeExtUniqueId,
-    configurePhase ? ''
-      runHook preConfigure
-      runHook postConfigure
-    '',
-    buildPhase ?''
-      runHook preBuild
-      runHook postBuild
-    '',
-    dontPatchELF ? true,
-    dontStrip ? true,
-    nativeBuildInputs ? [],
-    passthru ? { },
-    ...
-  }:
-  stdenv.mkDerivation ((removeAttrs a [ "vscodeExtUniqueId" ]) // {
-
-    name = "vscode-extension-${name}";
-
-    passthru = passthru // {
-      inherit vscodeExtPublisher vscodeExtName vscodeExtUniqueId;
-    };
-
-    inherit configurePhase buildPhase dontPatchELF dontStrip;
-
-    # Some .vsix files contain other directories (e.g., `package`) that we don't use.
-    # If other directories are present but `sourceRoot` is unset, the unpacker phase fails.
-    sourceRoot = "extension";
-
-    installPrefix = "share/vscode/extensions/${vscodeExtUniqueId}";
-
-    nativeBuildInputs = [ unzip ] ++ nativeBuildInputs;
-
-    installPhase = ''
-
-      runHook preInstall
-
-      mkdir -p "$out/$installPrefix"
-      find . -mindepth 1 -maxdepth 1 | xargs -d'\n' mv -t "$out/$installPrefix/"
-
-      runHook postInstall
-    '';
-
-  });
-
-  fetchVsixFromVscodeMarketplace = mktplcExtRef:
-    fetchurl (import ./mktplcExtRefToFetchArgs.nix mktplcExtRef);
-
-  buildVscodeMarketplaceExtension = a@{
-    name ? "",
-    src ? null,
-    vsix ? null,
-    mktplcRef,
-    ...
-  }: assert "" == name; assert null == src;
-  buildVscodeExtension ((removeAttrs a [ "mktplcRef" "vsix" ]) // {
-    name = "${mktplcRef.publisher}-${mktplcRef.name}-${mktplcRef.version}";
-    version = mktplcRef.version;
-    src = if (vsix != null)
-      then vsix
-      else fetchVsixFromVscodeMarketplace mktplcRef;
-    vscodeExtPublisher = mktplcRef.publisher;
-    vscodeExtName = mktplcRef.name;
-    vscodeExtUniqueId = "${mktplcRef.publisher}.${mktplcRef.name}";
-  });
+  buildVscodeExtension =
+    a@{
+      name,
+      src,
+      # Same as "Unique Identifier" on the extension's web page.
+      # For the moment, only serve as unique extension dir.
+      vscodeExtPublisher,
+      vscodeExtName,
+      vscodeExtUniqueId,
+      configurePhase ? ''
+        runHook preConfigure
+        runHook postConfigure
+      '',
+      buildPhase ? ''
+        runHook preBuild
+        runHook postBuild
+      '',
+      dontPatchELF ? true,
+      dontStrip ? true,
+      nativeBuildInputs ? [ ],
+      passthru ? { },
+      ...
+    }:
+    stdenv.mkDerivation (
+      (removeAttrs a [ "vscodeExtUniqueId" ])
+      // {
+
+        name = "vscode-extension-${name}";
+
+        passthru = passthru // {
+          inherit vscodeExtPublisher vscodeExtName vscodeExtUniqueId;
+        };
+
+        inherit
+          configurePhase
+          buildPhase
+          dontPatchELF
+          dontStrip
+          ;
+
+        # Some .vsix files contain other directories (e.g., `package`) that we don't use.
+        # If other directories are present but `sourceRoot` is unset, the unpacker phase fails.
+        sourceRoot = "extension";
+
+        installPrefix = "share/vscode/extensions/${vscodeExtUniqueId}";
+
+        nativeBuildInputs = [ unzip ] ++ nativeBuildInputs;
+
+        installPhase = ''
+
+          runHook preInstall
+
+          mkdir -p "$out/$installPrefix"
+          find . -mindepth 1 -maxdepth 1 | xargs -d'\n' mv -t "$out/$installPrefix/"
+
+          runHook postInstall
+        '';
+      }
+    );
+
+  fetchVsixFromVscodeMarketplace =
+    mktplcExtRef: fetchurl (import ./mktplcExtRefToFetchArgs.nix mktplcExtRef);
+
+  buildVscodeMarketplaceExtension =
+    a@{
+      name ? "",
+      src ? null,
+      vsix ? null,
+      mktplcRef,
+      ...
+    }:
+    assert "" == name;
+    assert null == src;
+    buildVscodeExtension (
+      (removeAttrs a [
+        "mktplcRef"
+        "vsix"
+      ])
+      // {
+        name = "${mktplcRef.publisher}-${mktplcRef.name}-${mktplcRef.version}";
+        version = mktplcRef.version;
+        src = if (vsix != null) then vsix else fetchVsixFromVscodeMarketplace mktplcRef;
+        vscodeExtPublisher = mktplcRef.publisher;
+        vscodeExtName = mktplcRef.name;
+        vscodeExtUniqueId = "${mktplcRef.publisher}.${mktplcRef.name}";
+      }
+    );
 
   mktplcRefAttrList = [
     "name"
@@ -82,14 +106,18 @@ let
     "arch"
   ];
 
-  mktplcExtRefToExtDrv = ext:
-    buildVscodeMarketplaceExtension (removeAttrs ext mktplcRefAttrList // {
-      mktplcRef = builtins.intersectAttrs (lib.genAttrs mktplcRefAttrList (_: null)) ext;
-    });
+  mktplcExtRefToExtDrv =
+    ext:
+    buildVscodeMarketplaceExtension (
+      removeAttrs ext mktplcRefAttrList
+      // {
+        mktplcRef = builtins.intersectAttrs (lib.genAttrs mktplcRefAttrList (_: null)) ext;
+      }
+    );
 
   extensionFromVscodeMarketplace = mktplcExtRefToExtDrv;
-  extensionsFromVscodeMarketplace = mktplcExtRefList:
-    builtins.map extensionFromVscodeMarketplace mktplcExtRefList;
+  extensionsFromVscodeMarketplace =
+    mktplcExtRefList: builtins.map extensionFromVscodeMarketplace mktplcExtRefList;
 
   vscodeWithConfiguration = import ./vscodeWithConfiguration.nix {
     inherit lib extensionsFromVscodeMarketplace writeShellScriptBin;
@@ -102,7 +130,13 @@ let
   };
 
   vscodeEnv = import ./vscodeEnv.nix {
-    inherit lib buildEnv writeShellScriptBin extensionsFromVscodeMarketplace jq;
+    inherit
+      lib
+      buildEnv
+      writeShellScriptBin
+      extensionsFromVscodeMarketplace
+      jq
+      ;
     vscodeDefault = vscode;
   };
 
@@ -139,9 +173,16 @@ let
   toExtensionJson = extensions: builtins.toJSON (map toExtensionJsonEntry extensions);
 in
 {
-  inherit fetchVsixFromVscodeMarketplace buildVscodeExtension
-          buildVscodeMarketplaceExtension extensionFromVscodeMarketplace
-          extensionsFromVscodeMarketplace
-          vscodeWithConfiguration vscodeExts2nix vscodeEnv
-          toExtensionJsonEntry toExtensionJson;
+  inherit
+    fetchVsixFromVscodeMarketplace
+    buildVscodeExtension
+    buildVscodeMarketplaceExtension
+    extensionFromVscodeMarketplace
+    extensionsFromVscodeMarketplace
+    vscodeWithConfiguration
+    vscodeExts2nix
+    vscodeEnv
+    toExtensionJsonEntry
+    toExtensionJson
+    ;
 }
diff --git a/pkgs/applications/editors/vscode/extensions/vscodeEnv.nix b/pkgs/applications/editors/vscode/extensions/vscodeEnv.nix
index db00ba13e3c84..37b82075e7518 100644
--- a/pkgs/applications/editors/vscode/extensions/vscodeEnv.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscodeEnv.nix
@@ -1,47 +1,58 @@
 #Use vscodeWithConfiguration and vscodeExts2nix to create a vscode executable. When the executable exits, it updates the mutable extension file, which is imported when evaluated by Nix later.
-{ lib
-, buildEnv
-, writeShellScriptBin
-, extensionsFromVscodeMarketplace
-, vscodeDefault
-, jq
+{
+  lib,
+  buildEnv,
+  writeShellScriptBin,
+  extensionsFromVscodeMarketplace,
+  vscodeDefault,
+  jq,
 }:
 ##User input
-{ vscode                           ? vscodeDefault
-, nixExtensions                    ? []
-, vscodeExtsFolderName             ? ".vscode-exts"
-# will add to the command updateSettings (which will run on executing vscode) settings to override in settings.json file
-, settings                         ? {}
-, createSettingsIfDoesNotExists    ? true
-, launch                           ? {}
-, createLaunchIfDoesNotExists      ? true
-# will add to the command updateKeybindings(which will run on executing vscode) keybindings to override in keybinding.json file
-, keybindings                      ? {}
-, createKeybindingsIfDoesNotExists ? true
-, user-data-dir ? ''"''${TMP}''${name}"/vscode-data-dir''
-# if file exists will use it and import the extensions in it into this derivation else will use empty extensions list
-# this file will be created/updated by vscodeExts2nix when vscode exists
-, mutableExtensionsFile
+{
+  vscode ? vscodeDefault,
+  nixExtensions ? [ ],
+  vscodeExtsFolderName ? ".vscode-exts",
+  # will add to the command updateSettings (which will run on executing vscode) settings to override in settings.json file
+  settings ? { },
+  createSettingsIfDoesNotExists ? true,
+  launch ? { },
+  createLaunchIfDoesNotExists ? true,
+  # will add to the command updateKeybindings(which will run on executing vscode) keybindings to override in keybinding.json file
+  keybindings ? { },
+  createKeybindingsIfDoesNotExists ? true,
+  user-data-dir ? ''"''${TMP}''${name}"/vscode-data-dir'',
+  # if file exists will use it and import the extensions in it into this derivation else will use empty extensions list
+  # this file will be created/updated by vscodeExts2nix when vscode exists
+  mutableExtensionsFile,
 }:
 let
   mutableExtensionsFilePath = toString mutableExtensionsFile;
-  mutableExtensions = lib.optionals (builtins.pathExists mutableExtensionsFile) (import mutableExtensionsFilePath);
-  vscodeWithConfiguration = import ./vscodeWithConfiguration.nix {
-    inherit lib writeShellScriptBin extensionsFromVscodeMarketplace;
-    vscodeDefault = vscode;
-  }
-  {
-    inherit nixExtensions mutableExtensions vscodeExtsFolderName user-data-dir;
-  };
+  mutableExtensions = lib.optionals (builtins.pathExists mutableExtensionsFile) (
+    import mutableExtensionsFilePath
+  );
+  vscodeWithConfiguration =
+    import ./vscodeWithConfiguration.nix
+      {
+        inherit lib writeShellScriptBin extensionsFromVscodeMarketplace;
+        vscodeDefault = vscode;
+      }
+      {
+        inherit
+          nixExtensions
+          mutableExtensions
+          vscodeExtsFolderName
+          user-data-dir
+          ;
+      };
 
   updateSettings = import ./updateSettings.nix { inherit lib writeShellScriptBin jq; };
-  userSettingsFolder = "${ user-data-dir }/User";
+  userSettingsFolder = "${user-data-dir}/User";
 
   updateSettingsCmd = updateSettings {
     settings = {
-        "extensions.autoCheckUpdates" = false;
-        "extensions.autoUpdate" = false;
-        "update.mode" = "none";
+      "extensions.autoCheckUpdates" = false;
+      "extensions.autoUpdate" = false;
+      "update.mode" = "none";
     } // settings;
     inherit userSettingsFolder;
     createIfDoesNotExists = createSettingsIfDoesNotExists;
@@ -62,14 +73,16 @@ let
     symlinkFromUserSetting = (user-data-dir != "");
   };
 
-  vscodeExts2nix = import ./vscodeExts2nix.nix {
-    inherit lib writeShellScriptBin;
-    vscodeDefault = vscodeWithConfiguration;
-  }
-  {
-    extensionsToIgnore = nixExtensions;
-    extensions = mutableExtensions;
-  };
+  vscodeExts2nix =
+    import ./vscodeExts2nix.nix
+      {
+        inherit lib writeShellScriptBin;
+        vscodeDefault = vscodeWithConfiguration;
+      }
+      {
+        extensionsToIgnore = nixExtensions;
+        extensions = mutableExtensions;
+      };
   code = writeShellScriptBin "code" ''
     ${updateSettingsCmd}/bin/vscodeNixUpdate-settings
     ${updateLaunchCmd}/bin/vscodeNixUpdate-launch
@@ -81,5 +94,11 @@ let
 in
 buildEnv {
   name = "vscodeEnv";
-  paths = [ code vscodeExts2nix updateSettingsCmd updateLaunchCmd updateKeybindingsCmd ];
+  paths = [
+    code
+    vscodeExts2nix
+    updateSettingsCmd
+    updateLaunchCmd
+    updateKeybindingsCmd
+  ];
 }
diff --git a/pkgs/applications/editors/vscode/extensions/vscodeEnvTest.nix b/pkgs/applications/editors/vscode/extensions/vscodeEnvTest.nix
index 19a9edbf1afe4..2bca1608d2574 100644
--- a/pkgs/applications/editors/vscode/extensions/vscodeEnvTest.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscodeEnvTest.nix
@@ -1,11 +1,13 @@
-with import <nixpkgs>{};
-callPackage (import ./vscodeEnv.nix) {
-  extensionsFromVscodeMarketplace = vscode-utils.extensionsFromVscodeMarketplace;
-  vscodeDefault = vscode;
-} {
-  mutableExtensionsFile = ./extensions.nix;
-  settings = {
-    a = "fdsdf";
-    t = "test";
-  };
-}
+with import <nixpkgs> { };
+callPackage (import ./vscodeEnv.nix)
+  {
+    extensionsFromVscodeMarketplace = vscode-utils.extensionsFromVscodeMarketplace;
+    vscodeDefault = vscode;
+  }
+  {
+    mutableExtensionsFile = ./extensions.nix;
+    settings = {
+      a = "fdsdf";
+      t = "test";
+    };
+  }
diff --git a/pkgs/applications/editors/vscode/extensions/vscodeExts2nix.nix b/pkgs/applications/editors/vscode/extensions/vscodeExts2nix.nix
index 58cbe663c9013..96b892911b06d 100644
--- a/pkgs/applications/editors/vscode/extensions/vscodeExts2nix.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscodeExts2nix.nix
@@ -1,14 +1,16 @@
 # based on the passed vscode will stdout a nix expression with the installed vscode extensions
-{ lib
-, vscodeDefault
-, writeShellScriptBin
+{
+  lib,
+  vscodeDefault,
+  writeShellScriptBin,
 }:
 
 ##User input
-{ vscode             ? vscodeDefault
-, extensionsToIgnore ? []
-# will use those extensions to get sha256 if still exists when executed.
-, extensions         ? []
+{
+  vscode ? vscodeDefault,
+  extensionsToIgnore ? [ ],
+  # will use those extensions to get sha256 if still exists when executed.
+  extensions ? [ ],
 }:
 let
   mktplcExtRefToFetchArgs = import ./mktplcExtRefToFetchArgs.nix;
@@ -17,22 +19,32 @@ writeShellScriptBin "vscodeExts2nix" ''
   echo '['
 
   for line in $(${vscode}/bin/code --list-extensions --show-versions \
-    ${lib.optionalString (extensionsToIgnore != []) ''
-      | grep -v -i '^\(${lib.concatMapStringsSep "\\|" (e : "${e.publisher}.${e.name}") extensionsToIgnore}\)'
-    ''}
+    ${
+      lib.optionalString (extensionsToIgnore != [ ]) ''
+        | grep -v -i '^\(${
+          lib.concatMapStringsSep "\\|" (e: "${e.publisher}.${e.name}") extensionsToIgnore
+        }\)'
+      ''
+    }
   ) ; do
     [[ $line =~ ([^.]*)\.([^@]*)@(.*) ]]
     name=''${BASH_REMATCH[2]}
     publisher=''${BASH_REMATCH[1]}
     version=''${BASH_REMATCH[3]}
 
-    extensions="${lib.concatMapStringsSep "." (e : "${e.publisher}${e.name}@${e.sha256}") extensions}"
+    extensions="${lib.concatMapStringsSep "." (e: "${e.publisher}${e.name}@${e.sha256}") extensions}"
     reCurrentExt=$publisher$name"@([^.]*)"
     if [[ $extensions =~ $reCurrentExt ]]; then
       sha256=''${BASH_REMATCH[1]}
     else
       sha256=$(
-        nix-prefetch-url "${(mktplcExtRefToFetchArgs {publisher = ''"$publisher"''; name = ''"$name"''; version = ''"$version"'';}).url}" 2> /dev/null
+        nix-prefetch-url "${
+          (mktplcExtRefToFetchArgs {
+            publisher = ''"$publisher"'';
+            name = ''"$name"'';
+            version = ''"$version"'';
+          }).url
+        }" 2> /dev/null
       )
     fi
 
diff --git a/pkgs/applications/editors/vscode/extensions/vscodeWithConfiguration.nix b/pkgs/applications/editors/vscode/extensions/vscodeWithConfiguration.nix
index 39479d7c2f2ce..6e2fd767a792e 100644
--- a/pkgs/applications/editors/vscode/extensions/vscodeWithConfiguration.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscodeWithConfiguration.nix
@@ -1,54 +1,61 @@
 # wrapper over vscode to control extensions per project (extensions folder will be created in execution path)
-{ lib
-, writeShellScriptBin
-, extensionsFromVscodeMarketplace
-, vscodeDefault
+{
+  lib,
+  writeShellScriptBin,
+  extensionsFromVscodeMarketplace,
+  vscodeDefault,
 }:
 ## User input
-{ vscode ? vscodeDefault
-# extensions to be symlinked into the project's extensions folder
-, nixExtensions        ? []
-# extensions to be copied into the project's extensions folder
-, mutableExtensions    ? []
-, vscodeExtsFolderName ? ".vscode-exts"
-, user-data-dir ? ''"''${TMP}vscodeWithConfiguration/vscode-data-dir"''
+{
+  vscode ? vscodeDefault,
+  # extensions to be symlinked into the project's extensions folder
+  nixExtensions ? [ ],
+  # extensions to be copied into the project's extensions folder
+  mutableExtensions ? [ ],
+  vscodeExtsFolderName ? ".vscode-exts",
+  user-data-dir ? ''"''${TMP}vscodeWithConfiguration/vscode-data-dir"'',
 }:
 let
   nixExtsDrvs = extensionsFromVscodeMarketplace nixExtensions;
   mutExtsDrvs = extensionsFromVscodeMarketplace mutableExtensions;
-  mutableExtsPaths = lib.forEach mutExtsDrvs ( e:
-  {
+  mutableExtsPaths = lib.forEach mutExtsDrvs (e: {
     origin = "${e}/share/vscode/extensions/${e.vscodeExtUniqueId}";
-    target = ''${vscodeExtsFolderName}/${e.vscodeExtUniqueId}-${(lib.findSingle (ext: "${ext.publisher}.${ext.name}" == e.vscodeExtUniqueId) "" "m" mutableExtensions ).version}'';
-  }
-  );
+    target = ''${vscodeExtsFolderName}/${e.vscodeExtUniqueId}-${
+      (lib.findSingle (
+        ext: "${ext.publisher}.${ext.name}" == e.vscodeExtUniqueId
+      ) "" "m" mutableExtensions).version
+    }'';
+  });
 
   #removed not defined extensions
-  rmExtensions =  lib.optionalString (nixExtensions++mutableExtensions != []) ''
+  rmExtensions = lib.optionalString (nixExtensions ++ mutableExtensions != [ ]) ''
     find ${vscodeExtsFolderName} -mindepth 1 -maxdepth 1 ${
-        lib.concatMapStringsSep " " (e : "! -iname ${e.publisher}.${e.name} ") nixExtensions
-        +
-        lib.concatMapStringsSep " " (e : "! -iname ${e.publisher}.${e.name}-${e.version} ") mutableExtensions
-      } -exec rm -rf {} \;
+      lib.concatMapStringsSep " " (e: "! -iname ${e.publisher}.${e.name} ") nixExtensions
+      + lib.concatMapStringsSep " " (
+        e: "! -iname ${e.publisher}.${e.name}-${e.version} "
+      ) mutableExtensions
+    } -exec rm -rf {} \;
   '';
   #copy mutable extension out of the nix store
   cpExtensions = ''
-    ${lib.concatMapStringsSep "\n" (e : "ln -sfn ${e}/share/vscode/extensions/* ${vscodeExtsFolderName}/") nixExtsDrvs}
-    ${lib.concatMapStringsSep "\n" (ePath : ''
+    ${lib.concatMapStringsSep "\n" (
+      e: "ln -sfn ${e}/share/vscode/extensions/* ${vscodeExtsFolderName}/"
+    ) nixExtsDrvs}
+    ${lib.concatMapStringsSep "\n" (ePath: ''
       if [ ! -d ${ePath.target} ]; then
         cp -a ${ePath.origin} ${ePath.target}
         chmod -R u+rwx ${ePath.target}
       fi
-      '') mutableExtsPaths}
+    '') mutableExtsPaths}
   '';
 in
-  writeShellScriptBin "code" ''
-    if ! [[ "$@" =~ "--list-extension" ]]; then
-      mkdir -p "${vscodeExtsFolderName}"
-      ${rmExtensions}
-      ${cpExtensions}
-    fi
-    ${vscode}/bin/code --extensions-dir "${vscodeExtsFolderName}" ${
-      lib.optionalString (user-data-dir != "") "--user-data-dir ${user-data-dir}"
-      } "$@"
-  ''
+writeShellScriptBin "code" ''
+  if ! [[ "$@" =~ "--list-extension" ]]; then
+    mkdir -p "${vscodeExtsFolderName}"
+    ${rmExtensions}
+    ${cpExtensions}
+  fi
+  ${vscode}/bin/code --extensions-dir "${vscodeExtsFolderName}" ${
+    lib.optionalString (user-data-dir != "") "--user-data-dir ${user-data-dir}"
+  } "$@"
+''
diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index b7fe7d2712a66..5ed75a0ce32e1 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -165,7 +165,7 @@ in
     autoPatchelfHook
     asar
     # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
-    (buildPackages.wrapGAppsHook.override { inherit (buildPackages) makeWrapper; })
+    (buildPackages.wrapGAppsHook3.override { inherit (buildPackages) makeWrapper; })
   ];
 
   dontBuild = true;
diff --git a/pkgs/applications/editors/xed-editor/default.nix b/pkgs/applications/editors/xed-editor/default.nix
index 8ce15bdce09eb..cb147cf099eb8 100644
--- a/pkgs/applications/editors/xed-editor/default.nix
+++ b/pkgs/applications/editors/xed-editor/default.nix
@@ -12,7 +12,7 @@
 , python3
 , meson
 , ninja
-, wrapGAppsHook
+, wrapGAppsHook3
 , intltool
 , itstool
 }:
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     itstool
     ninja
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/emulators/bsnes/ares/default.nix b/pkgs/applications/emulators/bsnes/ares/default.nix
index 0a5993557a08f..ade90d3885676 100644
--- a/pkgs/applications/emulators/bsnes/ares/default.nix
+++ b/pkgs/applications/emulators/bsnes/ares/default.nix
@@ -16,7 +16,7 @@
 , pkg-config
 , udev
 , which
-, wrapGAppsHook
+, wrapGAppsHook3
 , darwin
 }:
 
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     pkg-config
     which
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optionals stdenv.isDarwin [
     libicns
   ];
diff --git a/pkgs/applications/emulators/bsnes/bsnes-hd/default.nix b/pkgs/applications/emulators/bsnes/bsnes-hd/default.nix
index 5ac2100425384..4b8e94dac1d10 100644
--- a/pkgs/applications/emulators/bsnes/bsnes-hd/default.nix
+++ b/pkgs/applications/emulators/bsnes/bsnes-hd/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , libX11, libXv
 , udev
 , SDL2
@@ -47,7 +47,7 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [ pkg-config ]
-    ++ lib.optionals stdenv.isLinux [ wrapGAppsHook ]
+    ++ lib.optionals stdenv.isLinux [ wrapGAppsHook3 ]
     ++ lib.optionals stdenv.isDarwin [ libicns makeWrapper ];
 
   buildInputs = [ SDL2 libao ]
diff --git a/pkgs/applications/emulators/cemu/default.nix b/pkgs/applications/emulators/cemu/default.nix
index a51982a19cd4c..e2fb22542169f 100644
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub
 , addOpenGLRunpath
-, wrapGAppsHook
+, wrapGAppsHook3
 , cmake
 , glslang
 , nasm
@@ -64,7 +64,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     addOpenGLRunpath
-    wrapGAppsHook
+    wrapGAppsHook3
     cmake
     glslang
     nasm
diff --git a/pkgs/applications/emulators/desmume/default.nix b/pkgs/applications/emulators/desmume/default.nix
index 63ebe07202870..89078bc6411a5 100644
--- a/pkgs/applications/emulators/desmume/default.nix
+++ b/pkgs/applications/emulators/desmume/default.nix
@@ -6,7 +6,7 @@
 , agg
 , alsa-lib
 , desktop-file-utils
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , intltool
 , libGLU
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils
     intltool
     libtool
diff --git a/pkgs/applications/emulators/fuse-emulator/default.nix b/pkgs/applications/emulators/fuse-emulator/default.nix
index 378437ca30c87..3ed4ffc9c0731 100644
--- a/pkgs/applications/emulators/fuse-emulator/default.nix
+++ b/pkgs/applications/emulators/fuse-emulator/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, perl, pkg-config, wrapGAppsHook
+{ lib, stdenv, fetchurl, perl, pkg-config, wrapGAppsHook3
 , SDL, bzip2, glib, gtk3, libgcrypt, libpng, libspectrum, libxml2, zlib
 }:
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Oo/t8v/pR8VxVhusVaWa2tTFkzj3TkSbfnpn2coEcJY=";
   };
 
-  nativeBuildInputs = [ perl pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ perl pkg-config wrapGAppsHook3 ];
 
   buildInputs = [ SDL bzip2 glib gtk3 libgcrypt libpng libspectrum libxml2 zlib ];
 
diff --git a/pkgs/applications/emulators/pcem/default.nix b/pkgs/applications/emulators/pcem/default.nix
index e680dd450d304..9ffa24a66e308 100644
--- a/pkgs/applications/emulators/pcem/default.nix
+++ b/pkgs/applications/emulators/pcem/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchzip, wxGTK32, coreutils, SDL2, openal, alsa-lib, pkg-config, gtk3, wrapGAppsHook
+{ stdenv, lib, fetchzip, wxGTK32, coreutils, SDL2, openal, alsa-lib, pkg-config, gtk3, wrapGAppsHook3
 , autoreconfHook, withNetworking ? true, withALSA ? true }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "067pbnc15h6a4pnnym82klr1w8qwfm6p0pkx93gx06wvwqsxvbdv";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook3 ];
   buildInputs = [ wxGTK32 coreutils SDL2 openal gtk3 ]
     ++ lib.optional withALSA alsa-lib;
 
diff --git a/pkgs/applications/emulators/pcsxr/default.nix b/pkgs/applications/emulators/pcsxr/default.nix
index b80c32bd9edaa..06559af0e7328 100644
--- a/pkgs/applications/emulators/pcsxr/default.nix
+++ b/pkgs/applications/emulators/pcsxr/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, autoreconfHook, intltool, pkg-config, gtk3, SDL2, xorg
-, wrapGAppsHook, libcdio, nasm, ffmpeg_4, file
+, wrapGAppsHook3, libcdio, nasm, ffmpeg_4, file
 , fetchpatch }:
 
 stdenv.mkDerivation rec {
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     ./0001-libpcsxcore-fix-build-with-ffmpeg-4.patch
   ];
 
-  nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook3 ];
   buildInputs = [
     gtk3 SDL2 xorg.libXv xorg.libXtst libcdio nasm ffmpeg_4 file
     xorg.libXxf86vm
diff --git a/pkgs/applications/emulators/ruffle/default.nix b/pkgs/applications/emulators/ruffle/default.nix
index 0f5501508afb1..d0ba464858b3e 100644
--- a/pkgs/applications/emulators/ruffle/default.nix
+++ b/pkgs/applications/emulators/ruffle/default.nix
@@ -13,7 +13,7 @@
 , jre_minimal
 , cairo
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gsettings-desktop-schemas
 , glib
 , libxkbcommon
@@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/emulators/sameboy/default.nix b/pkgs/applications/emulators/sameboy/default.nix
index 09d0136c6d88a..643092b0a06b7 100644
--- a/pkgs/applications/emulators/sameboy/default.nix
+++ b/pkgs/applications/emulators/sameboy/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, gtk3, rgbds, SDL2, wrapGAppsHook, glib }:
+{ lib, stdenv, fetchFromGitHub, gtk3, rgbds, SDL2, wrapGAppsHook3, glib }:
 
 stdenv.mkDerivation rec {
   pname = "sameboy";
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   };
 
   enableParallelBuilding = true;
-  # glib and wrapGAppsHook are needed to make the Open ROM menu work.
-  nativeBuildInputs = [ rgbds glib wrapGAppsHook ];
+  # glib and wrapGAppsHook3 are needed to make the Open ROM menu work.
+  nativeBuildInputs = [ rgbds glib wrapGAppsHook3 ];
   buildInputs = [ SDL2 ];
 
   makeFlags = [
diff --git a/pkgs/applications/emulators/vice/default.nix b/pkgs/applications/emulators/vice/default.nix
index 7b3a12a4131d5..cea0f48d01668 100644
--- a/pkgs/applications/emulators/vice/default.nix
+++ b/pkgs/applications/emulators/vice/default.nix
@@ -20,7 +20,7 @@
 , runtimeShell
 , xa
 , file
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 }:
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     file
     flex
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/file-managers/krusader/default.nix b/pkgs/applications/file-managers/krusader/default.nix
index fe0d596f4122d..0df5ed386c43e 100644
--- a/pkgs/applications/file-managers/krusader/default.nix
+++ b/pkgs/applications/file-managers/krusader/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , extra-cmake-modules
 , kdoctools
-, wrapGAppsHook
+, wrapGAppsHook3
 , karchive
 , kconfig
 , kcrash
@@ -30,7 +30,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     extra-cmake-modules
     kdoctools
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/file-managers/pcmanfm/default.nix b/pkgs/applications/file-managers/pcmanfm/default.nix
index bfbe68d885e63..5c614fdede9f2 100644
--- a/pkgs/applications/file-managers/pcmanfm/default.nix
+++ b/pkgs/applications/file-managers/pcmanfm/default.nix
@@ -7,7 +7,7 @@
 , libX11
 , pango
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gnome
 , withGtk3 ? true
 , gtk2
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ glib gtk libfm' libX11 pango gnome.adwaita-icon-theme ];
-  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 intltool ];
 
   configureFlags = optional withGtk3 "--with-gtk=3";
 
diff --git a/pkgs/applications/file-managers/spacefm/default.nix b/pkgs/applications/file-managers/spacefm/default.nix
index 1cab33edb9449..4de3580c1df3e 100644
--- a/pkgs/applications/file-managers/spacefm/default.nix
+++ b/pkgs/applications/file-managers/spacefm/default.nix
@@ -1,5 +1,5 @@
 { pkgs, fetchFromGitHub, lib, stdenv, gtk3, udev, desktop-file-utils
-, shared-mime-info, intltool, pkg-config, wrapGAppsHook, ffmpegthumbnailer
+, shared-mime-info, intltool, pkg-config, wrapGAppsHook3, ffmpegthumbnailer
 , jmtpfs, ifuseSupport ? false, ifuse ? null, lsof, udisks2 }:
 
 stdenv.mkDerivation rec {
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
     gtk3 udev desktop-file-utils shared-mime-info
-    wrapGAppsHook ffmpegthumbnailer jmtpfs lsof udisks2
+    wrapGAppsHook3 ffmpegthumbnailer jmtpfs lsof udisks2
   ] ++ (lib.optionals ifuseSupport [ ifuse ]);
   # Introduced because ifuse doesn't build due to CVEs in libplist
   # Revert when libplist builds again…
diff --git a/pkgs/applications/gis/grass/default.nix b/pkgs/applications/gis/grass/default.nix
index 9dc83fdf23976..4eb10a34d2e24 100644
--- a/pkgs/applications/gis/grass/default.nix
+++ b/pkgs/applications/gis/grass/default.nix
@@ -3,7 +3,7 @@
 , callPackage
 , fetchFromGitHub
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 
 , bison
 , blas
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
 
     bison
     flex
diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index 3476816b1c230..bc0033746b19f 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -3,7 +3,7 @@
 , makeWrapper
 , mkDerivation
 , substituteAll
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 
 , withGrass ? true
@@ -94,7 +94,7 @@ in mkDerivation rec {
 
   nativeBuildInputs = [
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
 
     bison
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index d112ed50a0d52..0cea5f998009f 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -3,7 +3,7 @@
 , makeWrapper
 , mkDerivation
 , substituteAll
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 
 , withGrass ? true
@@ -95,7 +95,7 @@ in mkDerivation rec {
 
   nativeBuildInputs = [
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
 
     bison
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 568a8a0ac02e9..a42ab93900cbe 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -50,13 +50,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-29";
+  version = "7.1.1-30";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-W9WbHzmTa0dA9+mOxXu88qmN1mO9ORaH0Nj6r2s1Q+E=";
+    hash = "sha256-btXl1J/WjV+5BZibgUzylVmBrhR3KBK/ZSbP0B2fM5c=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/graphics/akira/default.nix b/pkgs/applications/graphics/akira/default.nix
index 3903a3acd8eac..03278888c8bab 100644
--- a/pkgs/applications/graphics/akira/default.nix
+++ b/pkgs/applications/graphics/akira/default.nix
@@ -9,7 +9,7 @@
 , pkg-config
 , python3
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , cairo
 , glib
 , goocanvas3
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/avocode/default.nix b/pkgs/applications/graphics/avocode/default.nix
index a6a3563743b36..c10f85a99dcec 100644
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, makeDesktopItem, fetchurl, unzip
 , gdk-pixbuf, glib, gtk3, atk, at-spi2-atk, pango, cairo, freetype, fontconfig, dbus, nss, nspr, alsa-lib, cups, expat, udev, gnome
-, xorg, mozjpeg, makeWrapper, wrapGAppsHook, libuuid, at-spi2-core, libdrm, mesa, libxkbcommon
+, xorg, mozjpeg, makeWrapper, wrapGAppsHook3, libuuid, at-spi2-core, libdrm, mesa, libxkbcommon
 }:
 
 stdenv.mkDerivation rec {
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     comment = "The bridge between designers and developers";
   };
 
-  nativeBuildInputs = [makeWrapper wrapGAppsHook unzip];
+  nativeBuildInputs = [makeWrapper wrapGAppsHook3 unzip];
   buildInputs = [ gtk3 gnome.adwaita-icon-theme ];
 
   # src is producing multiple folder on unzip so we must
diff --git a/pkgs/applications/graphics/ciano/default.nix b/pkgs/applications/graphics/ciano/default.nix
index 7b96dc1f793d5..454a1d28c4772 100644
--- a/pkgs/applications/graphics/ciano/default.nix
+++ b/pkgs/applications/graphics/ciano/default.nix
@@ -11,7 +11,7 @@
 , pkg-config
 , python
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/cloudcompare/default.nix b/pkgs/applications/graphics/cloudcompare/default.nix
index e78b95c363b6e..f66189e0c75c1 100644
--- a/pkgs/applications/graphics/cloudcompare/default.nix
+++ b/pkgs/applications/graphics/cloudcompare/default.nix
@@ -20,7 +20,7 @@
 , qttools
 , tbb
 , xercesc
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 mkDerivation rec {
@@ -38,7 +38,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     cmake
     eigen # header-only
-    wrapGAppsHook
+    wrapGAppsHook3
     copyDesktopItems
   ];
 
diff --git a/pkgs/applications/graphics/darktable/default.nix b/pkgs/applications/graphics/darktable/default.nix
index 324ba3cf8a9c0..c2b8ade1f295a 100644
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@@ -4,7 +4,7 @@
 , libsoup
 , graphicsmagick
 , json-glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , cairo
 , cmake
 , ninja
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
   ];
 
 
-  nativeBuildInputs = [ cmake ninja llvmPackages.llvm pkg-config intltool perl desktop-file-utils wrapGAppsHook ];
+  nativeBuildInputs = [ cmake ninja llvmPackages.llvm pkg-config intltool perl desktop-file-utils wrapGAppsHook3 ];
 
   buildInputs = [
     cairo
diff --git a/pkgs/applications/graphics/dia/default.nix b/pkgs/applications/graphics/dia/default.nix
index c79f50e86d799..534d1f5884b92 100644
--- a/pkgs/applications/graphics/dia/default.nix
+++ b/pkgs/applications/graphics/dia/default.nix
@@ -15,7 +15,7 @@
 , pkg-config
 , poppler
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
   # Building with docs are still failing in unstable-2023-09-28
 , withDocs ? false
 }:
@@ -60,7 +60,7 @@ stdenv.mkDerivation {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++
   lib.optionals withDocs [
     dblatex
diff --git a/pkgs/applications/graphics/drawing/default.nix b/pkgs/applications/graphics/drawing/default.nix
index 90caf78d63135..cf4b650219194 100644
--- a/pkgs/applications/graphics/drawing/default.nix
+++ b/pkgs/applications/graphics/drawing/default.nix
@@ -8,7 +8,7 @@
 , appstream-glib
 , desktop-file-utils
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gdk-pixbuf
 , pango
@@ -36,7 +36,7 @@ python3.pkgs.buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     glib
     gettext
     itstool
diff --git a/pkgs/applications/graphics/figma-linux/default.nix b/pkgs/applications/graphics/figma-linux/default.nix
index fd136a5b40264..6c794c9706bb2 100644
--- a/pkgs/applications/graphics/figma-linux/default.nix
+++ b/pkgs/applications/graphics/figma-linux/default.nix
@@ -4,7 +4,7 @@
 , fetchurl
 , autoPatchelfHook
 , dpkg
-, wrapGAppsHook
+, wrapGAppsHook3
 , ...
 }:
 with lib;
@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-9UfyCqgsg9XAFyZ7V7TogkQou4x+ixFUfjXZ1/qlDmA=";
   };
 
-  nativeBuildInputs = [ autoPatchelfHook dpkg wrapGAppsHook ];
+  nativeBuildInputs = [ autoPatchelfHook dpkg wrapGAppsHook3 ];
 
   buildInputs = with pkgs;[
     alsa-lib
diff --git a/pkgs/applications/graphics/fondo/default.nix b/pkgs/applications/graphics/fondo/default.nix
index f3854b4c69890..46c2c72d91ad3 100644
--- a/pkgs/applications/graphics/fondo/default.nix
+++ b/pkgs/applications/graphics/fondo/default.nix
@@ -17,7 +17,7 @@
 , json-glib
 , glib-networking
 , desktop-file-utils
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/gcolor3/default.nix b/pkgs/applications/graphics/gcolor3/default.nix
index ae36266f29c8d..a5b89a605d55b 100644
--- a/pkgs/applications/graphics/gcolor3/default.nix
+++ b/pkgs/applications/graphics/gcolor3/default.nix
@@ -7,7 +7,7 @@
 , libxml2
 , gtk3
 , libportal-gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     gettext
     pkg-config
     libxml2 # xml-stripblanks preprocessing of GResource
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/geeqie/default.nix b/pkgs/applications/graphics/geeqie/default.nix
index c88e068615bef..4eeb330f6d27e 100644
--- a/pkgs/applications/graphics/geeqie/default.nix
+++ b/pkgs/applications/graphics/geeqie/default.nix
@@ -3,7 +3,7 @@
 , libarchive, djvulibre, libheif, openjpeg, libjxl, libraw, lua5_3, poppler
 , gspell, libtiff, libwebp
 , gphoto2, imagemagick, yad, exiftool, gnome, libnotify
-, wrapGAppsHook, fetchpatch, doxygen
+, wrapGAppsHook3, fetchpatch, doxygen
 , nix-update-script
 }:
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs =
     [ pkg-config gettext intltool
-      wrapGAppsHook doxygen
+      wrapGAppsHook3 doxygen
       meson ninja xxd
     ];
 
diff --git a/pkgs/applications/graphics/gnome-photos/default.nix b/pkgs/applications/graphics/gnome-photos/default.nix
index fbcc5ebcf4785..045a42d0e29d5 100644
--- a/pkgs/applications/graphics/gnome-photos/default.nix
+++ b/pkgs/applications/graphics/gnome-photos/default.nix
@@ -30,7 +30,7 @@
 , python3
 , tracker
 , tracker-miners
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
       pygobject3
       pyatspi
     ]))
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -115,7 +115,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Access, organize and share your photos";
     mainProgram = "gnome-photos";
-    homepage = "https://wiki.gnome.org/Apps/Photos";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-photos";
     license = licenses.gpl3Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
index 000fd3719263f..2ffa57280eaa8 100644
--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, scons, pkg-config, wrapGAppsHook
+{ lib, stdenv, fetchFromGitHub, scons, pkg-config, wrapGAppsHook3
 , glfw3, gtk3, libpng }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ueA0YW2n/DXd9AytDzfPtvtXbvuUm4VDwcdvHWObKxc=";
   };
 
-  nativeBuildInputs = [ scons pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ scons pkg-config wrapGAppsHook3 ];
   buildInputs = [ glfw3 gtk3 libpng ];
 
   buildPhase = ''
diff --git a/pkgs/applications/graphics/gscan2pdf/default.nix b/pkgs/applications/graphics/gscan2pdf/default.nix
index d7ebb0a747ea3..0989c07d8a6f9 100644
--- a/pkgs/applications/graphics/gscan2pdf/default.nix
+++ b/pkgs/applications/graphics/gscan2pdf/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, perlPackages, wrapGAppsHook, fetchpatch,
+{ lib, fetchurl, perlPackages, wrapGAppsHook3, fetchpatch,
   # libs
   librsvg, sane-backends, sane-frontends,
   # runtime dependencies
@@ -28,7 +28,7 @@ perlPackages.buildPerlPackage rec {
     ./image-utf8-fix.patch
   ];
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   buildInputs =
     [ librsvg sane-backends sane-frontends ] ++
diff --git a/pkgs/applications/graphics/gscreenshot/default.nix b/pkgs/applications/graphics/gscreenshot/default.nix
index b3b9deedffa21..a09b39bdadb45 100644
--- a/pkgs/applications/graphics/gscreenshot/default.nix
+++ b/pkgs/applications/graphics/gscreenshot/default.nix
@@ -4,7 +4,7 @@
 , gettext
 , gobject-introspection
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 , scrot
 , slop
@@ -27,12 +27,12 @@ python3Packages.buildPythonApplication rec {
     sha256 = "sha256-BA118PwMslqvnlRES2fEgTjzfNvKNVae7GzWSyuaqYM=";
   };
 
-  # needed for wrapGAppsHook to function
+  # needed for wrapGAppsHook3 to function
   strictDeps = false;
   # tests require a display and fail
   doCheck = false;
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
   propagatedBuildInputs = [
     gettext
     gobject-introspection
diff --git a/pkgs/applications/graphics/gthumb/default.nix b/pkgs/applications/graphics/gthumb/default.nix
index 79793c6887116..fc59139694515 100644
--- a/pkgs/applications/graphics/gthumb/default.nix
+++ b/pkgs/applications/graphics/gthumb/default.nix
@@ -26,7 +26,7 @@
 , bison
 , flex
 , clutter-gtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , shared-mime-info
 , python3
 , desktop-file-utils
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Gthumb";
+    homepage = "https://gitlab.gnome.org/GNOME/gthumb";
     description = "Image browser and viewer for GNOME";
     mainProgram = "gthumb";
     platforms = platforms.linux;
diff --git a/pkgs/applications/graphics/hugin/default.nix b/pkgs/applications/graphics/hugin/default.nix
index 6a0408f98f139..e7c3d7f8972dd 100644
--- a/pkgs/applications/graphics/hugin/default.nix
+++ b/pkgs/applications/graphics/hugin/default.nix
@@ -30,7 +30,7 @@
 , perlPackages
 , sqlite
 , vigra
-, wrapGAppsHook
+, wrapGAppsHook3
 , wxGTK
 , zlib
 }:
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     zlib
   ];
 
-  nativeBuildInputs = [ cmake makeWrapper pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ cmake makeWrapper pkg-config wrapGAppsHook3 ];
 
   # disable installation of the python scripting interface
   cmakeFlags = [ "-DBUILD_HSI:BOOl=OFF" ];
diff --git a/pkgs/applications/graphics/icon-library/default.nix b/pkgs/applications/graphics/icon-library/default.nix
index 25cc1ebebfbc3..3dae4b0e1b687 100644
--- a/pkgs/applications/graphics/icon-library/default.nix
+++ b/pkgs/applications/graphics/icon-library/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "icon-library";
-  version = "0.0.18";
+  version = "0.0.19";
 
   src = fetchurl {
-    url = "https://gitlab.gnome.org/World/design/icon-library/uploads/874b27fcf34662d9686f670d406142c2/icon-library-${version}.tar.xz";
-    hash = "sha256-qCGwTePA817mulFjyRZKw+Fw1S77+QTtA7WH+KocL48=";
+    url = "https://gitlab.gnome.org/World/design/icon-library/uploads/7725604ce39be278abe7c47288085919/icon-library-${version}.tar.xz";
+    hash = "sha256-nWGTYoSa0/fxnD0Mb2132LkeB1oa/gj/oIXBbI+FDw8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/ideogram/default.nix b/pkgs/applications/graphics/ideogram/default.nix
index 12706d6d36f61..721bc1c7f9ad1 100644
--- a/pkgs/applications/graphics/ideogram/default.nix
+++ b/pkgs/applications/graphics/ideogram/default.nix
@@ -12,7 +12,7 @@
 , pantheon
 , desktop-file-utils
 , xorg
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     vala
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/imagej/default.nix b/pkgs/applications/graphics/imagej/default.nix
index b6396c231b19d..2398a61f2134b 100644
--- a/pkgs/applications/graphics/imagej/default.nix
+++ b/pkgs/applications/graphics/imagej/default.nix
@@ -7,7 +7,7 @@
 , makeWrapper
 , makeDesktopItem
 , copyDesktopItems
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
     url = "https://wsr.imagej.net/distros/cross-platform/ij${version}.zip";
     sha256 = "sha256-MGuUdUDuW3s/yGC68rHr6xxzmYScUjdXRawDpc1UQqw=";
   };
-  nativeBuildInputs = [ copyDesktopItems makeWrapper unzip wrapGAppsHook ];
+  nativeBuildInputs = [ copyDesktopItems makeWrapper unzip wrapGAppsHook3 ];
   buildInputs = [ glib ];
   dontWrapGApps = true;
 
diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index 35000a06de02e..358931534ad99 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -40,7 +40,7 @@
 , potrace
 , python3
 , substituteAll
-, wrapGAppsHook
+, wrapGAppsHook3
 , libepoxy
 , zlib
 }:
@@ -119,7 +119,7 @@ stdenv.mkDerivation rec {
     python3Env
     glib # for setup hook
     gdk-pixbuf # for setup hook
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ] ++ (with perlPackages; [
     perl
diff --git a/pkgs/applications/graphics/inkscape/extensions/textext/default.nix b/pkgs/applications/graphics/inkscape/extensions/textext/default.nix
index c3ad003cc1b2c..cb4be37759bcb 100644
--- a/pkgs/applications/graphics/inkscape/extensions/textext/default.nix
+++ b/pkgs/applications/graphics/inkscape/extensions/textext/default.nix
@@ -6,7 +6,7 @@
 , pdflatex
 , lualatex
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , gtk3
 , gtksourceview3
@@ -43,7 +43,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/graphics/kgraphviewer/default.nix b/pkgs/applications/graphics/kgraphviewer/default.nix
index 65ec4eb71d42e..20098eabeff48 100644
--- a/pkgs/applications/graphics/kgraphviewer/default.nix
+++ b/pkgs/applications/graphics/kgraphviewer/default.nix
@@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchurl, cmake, extra-cmake-modules, pkg-config, wrapGAppsHook
+{ lib, mkDerivation, fetchurl, cmake, extra-cmake-modules, pkg-config, wrapGAppsHook3
 , kconfig, kinit, kdoctools, kio, kparts, kwidgetsaddons
 , qtbase, qtsvg
 , boost, graphviz
@@ -19,7 +19,7 @@ mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    cmake extra-cmake-modules pkg-config wrapGAppsHook
+    cmake extra-cmake-modules pkg-config wrapGAppsHook3
     kdoctools
   ];
 
diff --git a/pkgs/applications/graphics/komorebi/default.nix b/pkgs/applications/graphics/komorebi/default.nix
index 2d099b5eb7c96..261f451d07c2f 100644
--- a/pkgs/applications/graphics/komorebi/default.nix
+++ b/pkgs/applications/graphics/komorebi/default.nix
@@ -11,7 +11,7 @@
 , clutter-gtk
 , clutter-gst
 , ninja
-, wrapGAppsHook
+, wrapGAppsHook3
 , testers
 , komorebi
 }:
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     vala
     pkg-config
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/kphotoalbum/default.nix b/pkgs/applications/graphics/kphotoalbum/default.nix
index 6ff2f43399584..aa4bd7fd7e7e6 100644
--- a/pkgs/applications/graphics/kphotoalbum/default.nix
+++ b/pkgs/applications/graphics/kphotoalbum/default.nix
@@ -4,7 +4,7 @@
 , lib
 , extra-cmake-modules
 , kdoctools
-, wrapGAppsHook
+, wrapGAppsHook3
 , exiv2
 , ffmpeg
 , libkdcraw
@@ -38,7 +38,7 @@ mkDerivation rec {
   # be on the system anyway, so there is no real harm including it
   buildInputs = [ exiv2 phonon libvlc ];
 
-  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook3 ];
 
   propagatedBuildInputs = [ kconfig kiconthemes kio kinit kpurpose libkdcraw ];
 
diff --git a/pkgs/applications/graphics/mypaint/default.nix b/pkgs/applications/graphics/mypaint/default.nix
index 80067fa7c6c39..0d261b5e6034a 100644
--- a/pkgs/applications/graphics/mypaint/default.nix
+++ b/pkgs/applications/graphics/mypaint/default.nix
@@ -15,7 +15,7 @@
 , pkg-config
 , python3
 , swig
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -75,7 +75,7 @@ in buildPythonApplication rec {
     gettext
     pkg-config
     swig
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection # for setup hook
     hicolor-icon-theme # fór setup hook
     python3.pkgs.setuptools
diff --git a/pkgs/applications/graphics/ocrfeeder/default.nix b/pkgs/applications/graphics/ocrfeeder/default.nix
index 25df4c69c66c0..7c30e81ab3e2d 100644
--- a/pkgs/applications/graphics/ocrfeeder/default.nix
+++ b/pkgs/applications/graphics/ocrfeeder/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
 , fetchurl
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , intltool
 , itstool
 , libxml2
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     intltool
     itstool
     libxml2
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/OCRFeeder";
+    homepage = "https://gitlab.gnome.org/GNOME/ocrfeeder";
     description = "Complete Optical Character Recognition and Document Analysis and Recognition program";
     maintainers = with maintainers; [ doronbehar ];
     license = licenses.gpl3Plus;
diff --git a/pkgs/applications/graphics/oculante/default.nix b/pkgs/applications/graphics/oculante/default.nix
index 3c571a2adf768..a0c8da4705556 100644
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@@ -17,7 +17,7 @@
 , gtk3
 , darwin
 , perl
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     nasm
     perl
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   checkFlagsArray = [ "--skip=tests::net" ]; # requires network access
diff --git a/pkgs/applications/graphics/openscad/default.nix b/pkgs/applications/graphics/openscad/default.nix
index e0ea00e5c2984..d72994e008b0b 100644
--- a/pkgs/applications/graphics/openscad/default.nix
+++ b/pkgs/applications/graphics/openscad/default.nix
@@ -29,7 +29,7 @@
 , spacenavSupport ? stdenv.isLinux, libspnav
 , wayland
 , wayland-protocols
-, wrapGAppsHook
+, wrapGAppsHook3
 , qtwayland
 , cairo
 }:
@@ -58,7 +58,7 @@ mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ bison flex pkg-config gettext qmake wrapGAppsHook];
+  nativeBuildInputs = [ bison flex pkg-config gettext qmake wrapGAppsHook3];
 
   buildInputs = [
     eigen boost glew opencsg cgal_4 mpfr gmp glib
diff --git a/pkgs/applications/graphics/pencil/default.nix b/pkgs/applications/graphics/pencil/default.nix
index 9924e0b58c148..4b7b6f9b6a478 100644
--- a/pkgs/applications/graphics/pencil/default.nix
+++ b/pkgs/applications/graphics/pencil/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lib, makeWrapper, wrapGAppsHook,
+{ stdenv, fetchurl, lib, makeWrapper, wrapGAppsHook3,
   # build dependencies
   alsa-lib, atk, at-spi2-atk, at-spi2-core, cairo, cups, dbus, expat, fontconfig,
   freetype, gdk-pixbuf, glib, glibc, gtk3, libuuid, nspr, nss, pango,
@@ -58,7 +58,7 @@ in stdenv.mkDerivation rec {
 
   dontBuild = true;
 
-  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook3 ];
 
   buildInputs = deps;
 
diff --git a/pkgs/applications/graphics/pick-colour-picker/default.nix b/pkgs/applications/graphics/pick-colour-picker/default.nix
index bd9ab649d6338..fd736c3ec7ab8 100644
--- a/pkgs/applications/graphics/pick-colour-picker/default.nix
+++ b/pkgs/applications/graphics/pick-colour-picker/default.nix
@@ -6,7 +6,7 @@
 , glib
 , gtk3
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , python
 }:
 
@@ -29,7 +29,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   pythonPath = [
diff --git a/pkgs/applications/graphics/pinta/default.nix b/pkgs/applications/graphics/pinta/default.nix
index 2f523813a24b9..7f9c815eff1f6 100644
--- a/pkgs/applications/graphics/pinta/default.nix
+++ b/pkgs/applications/graphics/pinta/default.nix
@@ -5,7 +5,7 @@
 , glibcLocales
 , gtk3
 , intltool
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildDotnetModule rec {
@@ -14,7 +14,7 @@ buildDotnetModule rec {
 
   nativeBuildInputs = [
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dotnet-sdk = dotnetCorePackages.sdk_7_0;
diff --git a/pkgs/applications/graphics/pizarra/default.nix b/pkgs/applications/graphics/pizarra/default.nix
index b53368439d756..6fd94f57e1e75 100644
--- a/pkgs/applications/graphics/pizarra/default.nix
+++ b/pkgs/applications/graphics/pizarra/default.nix
@@ -9,7 +9,7 @@
 , glib
 , librsvg
 , gdk-pixbuf
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-btvMUKADGHlXLmeKF1K9Js44SljZ0MejGId8aDwPhVU=";
 
-  nativeBuildInputs = [ wrapGAppsHook pkg-config gdk-pixbuf ];
+  nativeBuildInputs = [ wrapGAppsHook3 pkg-config gdk-pixbuf ];
 
   buildInputs = [ gtk3-x11 atk glib librsvg ];
 
diff --git a/pkgs/applications/graphics/processing/default.nix b/pkgs/applications/graphics/processing/default.nix
index 5fa438ef975d8..d71ded259e831 100644
--- a/pkgs/applications/graphics/processing/default.nix
+++ b/pkgs/applications/graphics/processing/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, ant, unzip, makeWrapper, jdk, jogl, rsync, ffmpeg, batik, stripJavaArchivesHook, wrapGAppsHook, libGL }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, ant, unzip, makeWrapper, jdk, jogl, rsync, ffmpeg, batik, stripJavaArchivesHook, wrapGAppsHook3, libGL }:
 let
   buildNumber = "1293";
   vaqua = fetchurl {
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-SzQemZ6iZ9o89/doV8YMv7DmyPSDyckJl3oyxJyfrm0=";
   };
 
-  nativeBuildInputs = [ ant unzip makeWrapper stripJavaArchivesHook wrapGAppsHook ];
+  nativeBuildInputs = [ ant unzip makeWrapper stripJavaArchivesHook wrapGAppsHook3 ];
   buildInputs = [ jdk jogl ant rsync ffmpeg batik ];
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/graphics/rawtherapee/default.nix b/pkgs/applications/graphics/rawtherapee/default.nix
index 2038b09dd822e..bf84ac1df11be 100644
--- a/pkgs/applications/graphics/rawtherapee/default.nix
+++ b/pkgs/applications/graphics/rawtherapee/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeWrapper
 , pixman
 , libpthreadstubs
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optionals stdenv.isDarwin [
     makeWrapper
   ];
diff --git a/pkgs/applications/graphics/shotwell/default.nix b/pkgs/applications/graphics/shotwell/default.nix
index e6d6eb41b9e08..844878a34959d 100644
--- a/pkgs/applications/graphics/shotwell/default.nix
+++ b/pkgs/applications/graphics/shotwell/default.nix
@@ -27,7 +27,7 @@
 , desktop-file-utils
 , gdk-pixbuf
 , librsvg
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , itstool
 , libsecret
@@ -35,8 +35,6 @@
 , gsettings-desktop-schemas
 }:
 
-# for dependencies see https://wiki.gnome.org/Apps/Shotwell/BuildingAndInstalling
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "shotwell";
   version = "0.32.6";
@@ -54,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     itstool
     gettext
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
@@ -97,9 +95,9 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "Popular photo organizer for the GNOME desktop";
     mainProgram = "shotwell";
-    homepage = "https://wiki.gnome.org/Apps/Shotwell";
+    homepage = "https://gitlab.gnome.org/GNOME/shotwell";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [];
+    maintainers = with maintainers; [ bobby285271 ];
     platforms = platforms.linux;
   };
 })
diff --git a/pkgs/applications/graphics/shutter/default.nix b/pkgs/applications/graphics/shutter/default.nix
index d10e8487796ff..9f18033fca487 100644
--- a/pkgs/applications/graphics/shutter/default.nix
+++ b/pkgs/applications/graphics/shutter/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , perlPackages
-, wrapGAppsHook
+, wrapGAppsHook3
 , imagemagick
 , gdk-pixbuf
 , librsvg
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-o95skSr6rszh0wsHQTpu1GjqCDmde7aygIP+i4XQW9A=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
   buildInputs = [
     perlPackages.perl
     procps
diff --git a/pkgs/applications/graphics/snapshot/default.nix b/pkgs/applications/graphics/snapshot/default.nix
index 88fc83f93c8b5..e449daac6dcc8 100644
--- a/pkgs/applications/graphics/snapshot/default.nix
+++ b/pkgs/applications/graphics/snapshot/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snapshot";
-  version = "45.2";
+  version = "46.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/snapshot/${lib.versions.major finalAttrs.version}/snapshot-${finalAttrs.version}.tar.xz";
-    hash = "sha256-iQd4F/xzXMjonbUWKPUuqKxmwZTfxqekLgA8TCnE3T4=";
+    hash = "sha256-Ef55oSuzQFHionnajB9FRYfQEaFPwkI35FTGT0S6z00=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/solvespace/default.nix b/pkgs/applications/graphics/solvespace/default.nix
index e0605ad81e43f..610ef336a9e3f 100644
--- a/pkgs/applications/graphics/solvespace/default.nix
+++ b/pkgs/applications/graphics/solvespace/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , at-spi2-core
 , cairo
 , dbus
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/synfigstudio/default.nix b/pkgs/applications/graphics/synfigstudio/default.nix
index 34f9baad68041..858fef718aaa5 100644
--- a/pkgs/applications/graphics/synfigstudio/default.nix
+++ b/pkgs/applications/graphics/synfigstudio/default.nix
@@ -4,7 +4,7 @@
 , fetchpatch
 , pkg-config
 , autoreconfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 
 , boost
 , cairo
@@ -116,7 +116,7 @@ stdenv.mkDerivation {
     autoreconfHook
     gettext
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   buildInputs = [
     ETL
diff --git a/pkgs/applications/graphics/tev/default.nix b/pkgs/applications/graphics/tev/default.nix
index c1932c3e11c39..7447e549465aa 100644
--- a/pkgs/applications/graphics/tev/default.nix
+++ b/pkgs/applications/graphics/tev/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub
-, cmake, wrapGAppsHook
+, cmake, wrapGAppsHook3
 , libX11, libzip, glfw, libpng, xorg, gnome
 }:
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-+qCRHP0AbYOQBAE4zK2cmWPHZGWjjxC3DZPNm8sgBzs=";
   };
 
-  nativeBuildInputs = [ cmake wrapGAppsHook ];
+  nativeBuildInputs = [ cmake wrapGAppsHook3 ];
   buildInputs = [ libX11 libzip glfw libpng ]
     ++ (with xorg; [ libXrandr libXinerama libXcursor libXi libXxf86vm libXext ]);
 
diff --git a/pkgs/applications/graphics/xournalpp/default.nix b/pkgs/applications/graphics/xournalpp/default.nix
index 54f7287513b1c..2c61584dae5ad 100644
--- a/pkgs/applications/graphics/xournalpp/default.nix
+++ b/pkgs/applications/graphics/xournalpp/default.nix
@@ -3,7 +3,7 @@
 
 , cmake
 , gettext
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 
 , alsa-lib
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       --replace-fail "addr2line" "${binutils}/bin/addr2line"
   '';
 
-  nativeBuildInputs = [ cmake gettext pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ cmake gettext pkg-config wrapGAppsHook3 ];
 
   buildInputs =
     lib.optionals stdenv.isLinux [
diff --git a/pkgs/applications/graphics/xpano/default.nix b/pkgs/applications/graphics/xpano/default.nix
index 9842aca43dd8d..c4b43c5963fea 100644
--- a/pkgs/applications/graphics/xpano/default.nix
+++ b/pkgs/applications/graphics/xpano/default.nix
@@ -10,7 +10,7 @@
 , catch2_3
 , spdlog
 , exiv2
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     cmake
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/yed/default.nix b/pkgs/applications/graphics/yed/default.nix
index 4e70c9d37aba4..7c6029312c8ca 100644
--- a/pkgs/applications/graphics/yed/default.nix
+++ b/pkgs/applications/graphics/yed/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchzip, makeWrapper, unzip, jre, wrapGAppsHook }:
+{ lib, stdenv, fetchzip, makeWrapper, unzip, jre, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "yEd";
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-u83OmIzq9VygKbfa886mj6BIa/9ET1btry2nR/wxeyI=";
   };
 
-  nativeBuildInputs = [ makeWrapper unzip wrapGAppsHook ];
-  # For wrapGAppsHook setup hook
+  nativeBuildInputs = [ makeWrapper unzip wrapGAppsHook3 ];
+  # For wrapGAppsHook3 setup hook
   buildInputs = [ (jre.gtk3 or null) ];
 
   dontConfigure = true;
diff --git a/pkgs/applications/kde/audiotube.nix b/pkgs/applications/kde/audiotube.nix
index bf1ec3099029b..c5a5da8550083 100644
--- a/pkgs/applications/kde/audiotube.nix
+++ b/pkgs/applications/kde/audiotube.nix
@@ -2,7 +2,7 @@
 , mkDerivation
 
 , extra-cmake-modules
-, wrapGAppsHook
+, wrapGAppsHook3
 
 , futuresql
 , gst_all_1
@@ -24,7 +24,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [
     extra-cmake-modules
-    wrapGAppsHook
+    wrapGAppsHook3
     python3Packages.wrapPython
     python3Packages.pybind11
   ];
diff --git a/pkgs/applications/kde/kasts.nix b/pkgs/applications/kde/kasts.nix
index e0f00a1db2042..65e4d09409c7a 100644
--- a/pkgs/applications/kde/kasts.nix
+++ b/pkgs/applications/kde/kasts.nix
@@ -3,7 +3,7 @@
 
 , cmake
 , extra-cmake-modules
-, wrapGAppsHook
+, wrapGAppsHook3
 
 , gst_all_1
 , kconfig
@@ -29,7 +29,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     cmake
     extra-cmake-modules
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/kde/kdenlive/default.nix b/pkgs/applications/kde/kdenlive/default.nix
index 00330b76b3a00..85ccfb0f74083 100644
--- a/pkgs/applications/kde/kdenlive/default.nix
+++ b/pkgs/applications/kde/kdenlive/default.nix
@@ -33,7 +33,7 @@
 , rttr
 , kpurpose
 , kdeclarative
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -79,7 +79,7 @@ mkDerivation {
     rttr
     kpurpose
     kdeclarative
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   # Both MLT and FFMpeg paths must be set or Kdenlive will complain that it
   # doesn't find them. See:
diff --git a/pkgs/applications/kde/partitionmanager/default.nix b/pkgs/applications/kde/partitionmanager/default.nix
index 90adde782c7fd..f65eb6d02b0ba 100644
--- a/pkgs/applications/kde/partitionmanager/default.nix
+++ b/pkgs/applications/kde/partitionmanager/default.nix
@@ -2,7 +2,7 @@
 , lib
 , extra-cmake-modules
 , kdoctools
-, wrapGAppsHook
+, wrapGAppsHook3
 , kconfig
 , kcrash
 , kinit
@@ -67,7 +67,7 @@ in
 mkDerivation {
   pname = "partitionmanager";
 
-  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook3 ];
 
   propagatedBuildInputs = [ kconfig kcrash kinit kpmcore polkit-qt ];
 
diff --git a/pkgs/applications/kde/plasmatube/default.nix b/pkgs/applications/kde/plasmatube/default.nix
index cc83254cb2ac9..fbb577e6c80b7 100644
--- a/pkgs/applications/kde/plasmatube/default.nix
+++ b/pkgs/applications/kde/plasmatube/default.nix
@@ -1,7 +1,7 @@
 { lib
 , mkDerivation
 , extra-cmake-modules
-, wrapGAppsHook
+, wrapGAppsHook3
 , gst_all_1
 , kcoreaddons
 , kdeclarative
@@ -18,7 +18,7 @@ mkDerivation {
 
   nativeBuildInputs = [
     extra-cmake-modules
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/kde/skanlite.nix b/pkgs/applications/kde/skanlite.nix
index 2d2ca212d00cc..0c518cc8ca22b 100644
--- a/pkgs/applications/kde/skanlite.nix
+++ b/pkgs/applications/kde/skanlite.nix
@@ -1,6 +1,6 @@
 {
   mkDerivation, lib,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   extra-cmake-modules, kdoctools,
   kio, libksane
 }:
@@ -15,6 +15,6 @@ mkDerivation {
     maintainers = with maintainers; [ polendri ];
   };
 
-  nativeBuildInputs = [ wrapGAppsHook extra-cmake-modules kdoctools ];
+  nativeBuildInputs = [ wrapGAppsHook3 extra-cmake-modules kdoctools ];
   buildInputs = [ kio libksane ];
 }
diff --git a/pkgs/applications/kde/spectacle.nix b/pkgs/applications/kde/spectacle.nix
index f5471e2d10860..e628a49b81c5c 100644
--- a/pkgs/applications/kde/spectacle.nix
+++ b/pkgs/applications/kde/spectacle.nix
@@ -5,13 +5,13 @@
 , knotifications, kscreen, kwidgetsaddons, kwindowsystem, kxmlgui, libkipi
 , qtx11extras, knewstuff, kwayland, qttools, kcolorpicker, kimageannotator
 , qcoro, qtquickcontrols2, wayland, plasma-wayland-protocols, kpurpose, kpipewire
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 mkDerivation {
   pname = "spectacle";
 
-  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook3 ];
   buildInputs = [
     kconfig kcoreaddons kdbusaddons kdeclarative ki18n kio knotifications
     kscreen kwidgetsaddons kwindowsystem kxmlgui libkipi qtx11extras xcb-util-cursor
diff --git a/pkgs/applications/misc/1password-gui/linux.nix b/pkgs/applications/misc/1password-gui/linux.nix
index 140adde918fc9..bfd9df01dbfac 100644
--- a/pkgs/applications/misc/1password-gui/linux.nix
+++ b/pkgs/applications/misc/1password-gui/linux.nix
@@ -5,7 +5,7 @@
 , src
 , meta
 , makeShellWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , alsa-lib
 , at-spi2-atk
 , at-spi2-core
@@ -49,7 +49,7 @@ let
 in stdenv.mkDerivation {
   inherit pname version src meta;
 
-  nativeBuildInputs = [ makeShellWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ makeShellWrapper wrapGAppsHook3 ];
   buildInputs = [ glib ];
 
   dontConfigure = true;
diff --git a/pkgs/applications/misc/almanah/default.nix b/pkgs/applications/misc/almanah/default.nix
index 35677f56cccbc..f98a569fe6031 100644
--- a/pkgs/applications/misc/almanah/default.nix
+++ b/pkgs/applications/misc/almanah/default.nix
@@ -22,7 +22,7 @@
 , pkg-config
 , python3
 , sqlite
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Small GTK application to allow to keep a diary of your life";
     mainProgram = "almanah";
-    homepage = "https://wiki.gnome.org/Apps/Almanah_Diary";
+    homepage = "https://gitlab.gnome.org/GNOME/almanah";
     license = licenses.gpl3Plus;
     platforms = platforms.unix;
     maintainers = teams.gnome.members;
diff --git a/pkgs/applications/misc/appeditor/default.nix b/pkgs/applications/misc/appeditor/default.nix
index 508c59bab7c2d..46adf420932d2 100644
--- a/pkgs/applications/misc/appeditor/default.nix
+++ b/pkgs/applications/misc/appeditor/default.nix
@@ -11,7 +11,7 @@
 , glib
 , gtk3
 , libgee
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     vala
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/auto-multiple-choice/default.nix b/pkgs/applications/misc/auto-multiple-choice/default.nix
index bdd1e6fbb8540..c39430091e0d5 100644
--- a/pkgs/applications/misc/auto-multiple-choice/default.nix
+++ b/pkgs/applications/misc/auto-multiple-choice/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , perlPackages
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , cairo
 , dblatex
 , gnumake
@@ -99,7 +99,7 @@ stdenv.mkDerivation (finalAttrs: rec {
   nativeBuildInputs = [
     pkg-config
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/misc/avizo/default.nix b/pkgs/applications/misc/avizo/default.nix
index 59021e92b0d87..77d942797abcd 100644
--- a/pkgs/applications/misc/avizo/default.nix
+++ b/pkgs/applications/misc/avizo/default.nix
@@ -13,7 +13,7 @@
 , librsvg
 , gobject-introspection
 , gdk-pixbuf
-, wrapGAppsHook
+, wrapGAppsHook3
 , pamixer
 , brightnessctl
 }:
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Vj8OrNlAstl0AXTeVAPdEf5JgnAmJwl9s3Jdc0ZiYQc=";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config vala gobject-introspection wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja pkg-config vala gobject-introspection wrapGAppsHook3 ];
 
   buildInputs = [ dbus dbus-glib gdk-pixbuf glib gtk-layer-shell gtk3 librsvg ];
 
diff --git a/pkgs/applications/misc/bambu-studio/default.nix b/pkgs/applications/misc/bambu-studio/default.nix
index 43b6cb8769ef7..388b10f1356d5 100644
--- a/pkgs/applications/misc/bambu-studio/default.nix
+++ b/pkgs/applications/misc/bambu-studio/default.nix
@@ -8,7 +8,7 @@
   fetchFromGitHub,
   cmake,
   pkg-config,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   boost179,
   cereal,
   cgal_5,
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/barrier/default.nix b/pkgs/applications/misc/barrier/default.nix
index d02712848b72a..ee988b79f8219 100644
--- a/pkgs/applications/misc/barrier/default.nix
+++ b/pkgs/applications/misc/barrier/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, cmake, curl, xorg, avahi, qtbase, mkDerivation,
-  openssl, wrapGAppsHook,
+  openssl, wrapGAppsHook3,
   avahiWithLibdnssdCompat ? avahi.override { withLibdnssdCompat = true; },
   fetchpatch
 }:
@@ -32,7 +32,7 @@ mkDerivation rec {
   ];
 
   buildInputs = [ curl xorg.libX11 xorg.libXext xorg.libXtst avahiWithLibdnssdCompat qtbase ];
-  nativeBuildInputs = [ cmake wrapGAppsHook ];
+  nativeBuildInputs = [ cmake wrapGAppsHook3 ];
 
   postFixup = ''
     substituteInPlace "$out/share/applications/barrier.desktop" --replace "Exec=barrier" "Exec=$out/bin/barrier"
diff --git a/pkgs/applications/misc/bleachbit/default.nix b/pkgs/applications/misc/bleachbit/default.nix
index c6e4adf8a560a..bb0e777186a28 100644
--- a/pkgs/applications/misc/bleachbit/default.nix
+++ b/pkgs/applications/misc/bleachbit/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , gettext
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gtk3
 , libnotify
@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     gettext
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/break-time/default.nix b/pkgs/applications/misc/break-time/default.nix
index a4bbf4d4c104e..2b6263e3223e7 100644
--- a/pkgs/applications/misc/break-time/default.nix
+++ b/pkgs/applications/misc/break-time/default.nix
@@ -6,7 +6,7 @@
 , python3
 , rustPlatform
 , lib
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     pkg-config
     python3 # needed for Rust xcb package
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/caerbannog/default.nix b/pkgs/applications/misc/caerbannog/default.nix
index 0d21c7e165705..0ca33877d124f 100644
--- a/pkgs/applications/misc/caerbannog/default.nix
+++ b/pkgs/applications/misc/caerbannog/default.nix
@@ -6,7 +6,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , atk
 , libhandy
@@ -32,7 +32,7 @@ python3.pkgs.buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index ce72458f3a0f6..bdd8af4ebffed 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -26,7 +26,7 @@
 , sqlite
 , wrapQtAppsHook
 , xdg-utils
-, wrapGAppsHook
+, wrapGAppsHook3
 , unrarSupport ? false
 }:
 
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     qmake
     removeReferencesTo
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/applications/misc/cbatticon/default.nix b/pkgs/applications/misc/cbatticon/default.nix
index 665957ca0ea1e..1221703006322 100644
--- a/pkgs/applications/misc/cbatticon/default.nix
+++ b/pkgs/applications/misc/cbatticon/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, gettext, glib, gtk3, libnotify, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, gettext, glib, gtk3, libnotify, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "cbatticon";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VQjJujF9lnVvQxV+0YqodLgnI9F90JKDAGBu5nM/Q/c=";
   };
 
-  nativeBuildInputs = [ pkg-config gettext wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config gettext wrapGAppsHook3 ];
 
   buildInputs =  [ glib gtk3 libnotify ];
 
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index ffa44c63f96c4..48d382e284ff3 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -4,7 +4,7 @@
 , cmake
 , pkg-config
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtkmm3
 , gtksourceview
 , gtksourceviewmm
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/cipher/default.nix b/pkgs/applications/misc/cipher/default.nix
index 8486db6f7fc03..a51279c73a261 100644
--- a/pkgs/applications/misc/cipher/default.nix
+++ b/pkgs/applications/misc/cipher/default.nix
@@ -11,7 +11,7 @@
 , glib
 , gtk3
 , libgee
-, wrapGAppsHook }:
+, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "cipher";
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     vala
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/clipit/default.nix b/pkgs/applications/misc/clipit/default.nix
index b40bc4fec9303..0bd48d2adf63d 100644
--- a/pkgs/applications/misc/clipit/default.nix
+++ b/pkgs/applications/misc/clipit/default.nix
@@ -1,6 +1,6 @@
 { fetchFromGitHub, lib, stdenv
 , autoreconfHook, intltool, pkg-config
-, gtk3, libayatana-appindicator, xdotool, which, wrapGAppsHook }:
+, gtk3, libayatana-appindicator, xdotool, which, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "clipit";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     intltoolize --copy --force --automake
   '';
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook autoreconfHook intltool ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 autoreconfHook intltool ];
   configureFlags = [ "--with-gtk3" "--enable-appindicator=yes" ];
   buildInputs = [ gtk3 libayatana-appindicator ];
 
diff --git a/pkgs/applications/misc/cobang/default.nix b/pkgs/applications/misc/cobang/default.nix
index 336b4d7c1a507..15db663db99ee 100644
--- a/pkgs/applications/misc/cobang/default.nix
+++ b/pkgs/applications/misc/cobang/default.nix
@@ -19,7 +19,7 @@
 , setuptools
 , python
 , pytestCheckHook
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication rec {
@@ -43,7 +43,7 @@ buildPythonApplication rec {
   nativeBuildInputs = [
     # Needed to recognize gobject namespaces
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
     setuptools
   ];
 
diff --git a/pkgs/applications/misc/diffuse/default.nix b/pkgs/applications/misc/diffuse/default.nix
index 0f5cf3c0adc1c..a4a9e73db86ed 100644
--- a/pkgs/applications/misc/diffuse/default.nix
+++ b/pkgs/applications/misc/diffuse/default.nix
@@ -3,7 +3,7 @@
 , meson
 , ninja
 , gettext
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , pango
 , gdk-pixbuf
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
   format = "other";
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     meson
     ninja
     gettext
diff --git a/pkgs/applications/misc/dockbarx/default.nix b/pkgs/applications/misc/dockbarx/default.nix
index 3b147bdcc3604..815a482a216f3 100644
--- a/pkgs/applications/misc/dockbarx/default.nix
+++ b/pkgs/applications/misc/dockbarx/default.nix
@@ -6,7 +6,7 @@
 , keybinder3
 , libwnck
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -24,7 +24,7 @@ python3Packages.buildPythonApplication rec {
     glib.dev
     gobject-introspection
     python3Packages.polib
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/fbmenugen/default.nix b/pkgs/applications/misc/fbmenugen/default.nix
index 90d3f3b014248..56a3ce5f28dd1 100644
--- a/pkgs/applications/misc/fbmenugen/default.nix
+++ b/pkgs/applications/misc/fbmenugen/default.nix
@@ -6,7 +6,7 @@
 , perlPackages
 , substituteAll
 , xorg
-, wrapGAppsHook
+, wrapGAppsHook3
 , gitUpdater
 }:
 
@@ -33,7 +33,7 @@ perlPackages.buildPerlPackage rec {
 
   nativeBuildInputs = [
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/feedbackd/default.nix b/pkgs/applications/misc/feedbackd/default.nix
index 45da9c1afaa8c..f0d90a495c771 100644
--- a/pkgs/applications/misc/feedbackd/default.nix
+++ b/pkgs/applications/misc/feedbackd/default.nix
@@ -12,7 +12,7 @@
 , ninja
 , pkg-config
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gsound
 , json-glib
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/findex/default.nix b/pkgs/applications/misc/findex/default.nix
index 29ddc3d461a4c..8af4fc35d7de8 100644
--- a/pkgs/applications/misc/findex/default.nix
+++ b/pkgs/applications/misc/findex/default.nix
@@ -2,7 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , keybinder3
 }:
 
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
       --replace-fail '/opt/findex/style.css' "$out/share/findex/style.css"
   '';
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   buildInputs = [ keybinder3 ];
 
diff --git a/pkgs/applications/misc/fluxboxlauncher/default.nix b/pkgs/applications/misc/fluxboxlauncher/default.nix
index 19e70ad7c54cf..7172ce535071a 100644
--- a/pkgs/applications/misc/fluxboxlauncher/default.nix
+++ b/pkgs/applications/misc/fluxboxlauncher/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , python3
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , glibcLocales
 , gobject-introspection
 , gettext
@@ -24,7 +24,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     pango
     gdk-pixbuf
diff --git a/pkgs/applications/misc/font-manager/default.nix b/pkgs/applications/misc/font-manager/default.nix
index 309d8fa2faf5d..9568c0c929b0a 100644
--- a/pkgs/applications/misc/font-manager/default.nix
+++ b/pkgs/applications/misc/font-manager/default.nix
@@ -16,7 +16,7 @@
 , gtk3
 , gnome
 , desktop-file-utils
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 # withWebkit enables the "webkit" feature, also known as Google Fonts
 , withWebkit ? true, glib-networking, libsoup, webkitgtk
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     desktop-file-utils
     vala
     yelp-tools
-    wrapGAppsHook
+    wrapGAppsHook3
     # For https://github.com/FontManager/master/blob/master/lib/unicode/meson.build
     gobject-introspection
   ];
diff --git a/pkgs/applications/misc/fontfinder/default.nix b/pkgs/applications/misc/fontfinder/default.nix
index f0fc3dfd3a7d7..db55b02065265 100644
--- a/pkgs/applications/misc/fontfinder/default.nix
+++ b/pkgs/applications/misc/fontfinder/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , rustPlatform
 , rustc
-, wrapGAppsHook
+, wrapGAppsHook3
 , gdk-pixbuf
 , gtk3
 , libsoup_3
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     pkg-config
     rustPlatform.cargoSetupHook
     rustc
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/formatter/default.nix b/pkgs/applications/misc/formatter/default.nix
index f53ea0f030ca7..8f5c4c9c6b322 100644
--- a/pkgs/applications/misc/formatter/default.nix
+++ b/pkgs/applications/misc/formatter/default.nix
@@ -16,7 +16,7 @@
 , hfsprogs
 , ntfs3g
 , libgee
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     vala
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/foxtrotgps/default.nix b/pkgs/applications/misc/foxtrotgps/default.nix
index 745a2357e2362..bb9049dde7919 100644
--- a/pkgs/applications/misc/foxtrotgps/default.nix
+++ b/pkgs/applications/misc/foxtrotgps/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchbzr, autoreconfHook, texinfo, help2man, imagemagick, pkg-config
-, curl, gnome2, gpsd, gtk2, wrapGAppsHook
+, curl, gnome2, gpsd, gtk2, wrapGAppsHook3
 , intltool, libexif, python3Packages, sqlite }:
 
 let
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config autoreconfHook texinfo help2man
-    imagemagick wrapGAppsHook intltool
+    imagemagick wrapGAppsHook3 intltool
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/gImageReader/default.nix b/pkgs/applications/misc/gImageReader/default.nix
index bc293b455b2a8..8aa564fc780bb 100644
--- a/pkgs/applications/misc/gImageReader/default.nix
+++ b/pkgs/applications/misc/gImageReader/default.nix
@@ -6,7 +6,7 @@
 
 # Gtk deps
 # upstream gImagereader supports Qt too
-, gobject-introspection, wrapGAppsHook
+, gobject-introspection, wrapGAppsHook3
 , gtkmm3, gtksourceview3, gtksourceviewmm, gtkspell3, gtkspellmm, cairomm
 }:
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     pythonEnv
 
     # Gtk specific
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/misc/gcstar/default.nix b/pkgs/applications/misc/gcstar/default.nix
index 0f6478f50fcd2..02662f11f96b4 100644
--- a/pkgs/applications/misc/gcstar/default.nix
+++ b/pkgs/applications/misc/gcstar/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
 , fetchFromGitLab
 , perlPackages
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-37yjKI4l/nUzDnra1AGxDQxNafMsLi1bSifG6pz33zg=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   buildInputs = with perlPackages; [
     perl
diff --git a/pkgs/applications/misc/genxword/default.nix b/pkgs/applications/misc/genxword/default.nix
index 5ba67ecddcdb1..199a63f967198 100644
--- a/pkgs/applications/misc/genxword/default.nix
+++ b/pkgs/applications/misc/genxword/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , gettext
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , pango
 , gtksourceview3
 }:
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [
     gettext
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/gkrellm/default.nix b/pkgs/applications/misc/gkrellm/default.nix
index 523ba837f3a10..218110f6d17de 100644
--- a/pkgs/applications/misc/gkrellm/default.nix
+++ b/pkgs/applications/misc/gkrellm/default.nix
@@ -12,7 +12,7 @@
 , IOKit
 , copyDesktopItems
 , makeDesktopItem
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     sha256 = "01lccz4fga40isv09j8rjgr0qy10rff9vj042n6gi6gdv4z69q0y";
   };
 
-  nativeBuildInputs = [ copyDesktopItems pkg-config which wrapGAppsHook ];
+  nativeBuildInputs = [ copyDesktopItems pkg-config which wrapGAppsHook3 ];
   buildInputs = [ gettext glib gtk2 libX11 libSM libICE ]
     ++ lib.optionals stdenv.isDarwin [ IOKit ];
 
diff --git a/pkgs/applications/misc/glom/default.nix b/pkgs/applications/misc/glom/default.nix
index 5c8eb94712a68..67618ed083f56 100644
--- a/pkgs/applications/misc/glom/default.nix
+++ b/pkgs/applications/misc/glom/default.nix
@@ -31,7 +31,7 @@
 , postgresql_15
 , gobject-introspection
 , yelp-tools
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -70,7 +70,7 @@ in stdenv.mkDerivation rec {
     doxygen
     graphviz
     sphinx-build
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection # for setup hook
   ];
 
diff --git a/pkgs/applications/misc/gmtp/default.nix b/pkgs/applications/misc/gmtp/default.nix
index 31c62f53423c4..dc5111c2a7222 100644
--- a/pkgs/applications/misc/gmtp/default.nix
+++ b/pkgs/applications/misc/gmtp/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, libmtp, libid3tag, flac, libvorbis, gtk3
-, gsettings-desktop-schemas, wrapGAppsHook
+, gsettings-desktop-schemas, wrapGAppsHook3
 }:
 
 let version = "1.3.11"; in
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
     sha256 = "04q6byyq002fhzkc2rkkahwh5b6272xakaj4m3vwm8la8jf0r0ss";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = [ libmtp libid3tag flac libvorbis gtk3 gsettings-desktop-schemas ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/gnome-multi-writer/default.nix b/pkgs/applications/misc/gnome-multi-writer/default.nix
index b4cca2f3bf63b..f73016681c0ee 100644
--- a/pkgs/applications/misc/gnome-multi-writer/default.nix
+++ b/pkgs/applications/misc/gnome-multi-writer/default.nix
@@ -12,7 +12,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , polkit
 , udisks
 }:
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Tool for writing an ISO file to multiple USB devices at once";
     mainProgram = "gnome-multi-writer";
-    homepage = "https://wiki.gnome.org/Apps/MultiWriter";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-multi-writer";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/applications/misc/gnome-recipes/default.nix b/pkgs/applications/misc/gnome-recipes/default.nix
index dc4df70bc00e4..ecc6413fe0f19 100644
--- a/pkgs/applications/misc/gnome-recipes/default.nix
+++ b/pkgs/applications/misc/gnome-recipes/default.nix
@@ -8,7 +8,7 @@
 , gettext
 , itstool
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , glib
 , libsoup
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Recipe management application for GNOME";
     mainProgram = "gnome-recipes";
-    homepage = "https://wiki.gnome.org/Apps/Recipes";
+    homepage = "https://gitlab.gnome.org/GNOME/recipes";
     maintainers = teams.gnome.members;
     license = licenses.gpl3Plus;
     platforms = platforms.unix;
diff --git a/pkgs/applications/misc/gnome-tecla/default.nix b/pkgs/applications/misc/gnome-tecla/default.nix
index 43f77763f1291..c1a3183086be4 100644
--- a/pkgs/applications/misc/gnome-tecla/default.nix
+++ b/pkgs/applications/misc/gnome-tecla/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tecla";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/tecla/${lib.versions.major finalAttrs.version}/tecla-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XAK7QBmxz/tWY9phB1A+/4U4Nqh4PdRwXdBKSfetwls=";
+    hash = "sha256-Sggeq4Z6WosJdYmRytdkWSDzI6q8qVRAgpD7b0RZGw8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/gnome-usage/default.nix b/pkgs/applications/misc/gnome-usage/default.nix
index c969c92ffdd2e..85d7f36d2014c 100644
--- a/pkgs/applications/misc/gnome-usage/default.nix
+++ b/pkgs/applications/misc/gnome-usage/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-usage";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "5nfE/iwBSXqE/x4RV+kTHp+ZmfGnjTUjSvHXfYJ18pQ=";
+    hash = "sha256-GGrajgAYjIn4yrVPNZmO2XpG6rb9shiRAoNhvzhqybI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/goldendict-ng/default.nix b/pkgs/applications/misc/goldendict-ng/default.nix
index 5d86aece035da..1693c8a12dd51 100644
--- a/pkgs/applications/misc/goldendict-ng/default.nix
+++ b/pkgs/applications/misc/goldendict-ng/default.nix
@@ -26,7 +26,7 @@
 , qtmultimedia
 , qtspeech
 , wrapQtAppsHook
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+OiZEkhNV06fZXPXv9zDzgJS5M3isHlcOXee3p/ejpw=";
   };
 
-  nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook wrapGAppsHook3 ];
   buildInputs = [
     qtbase
     qtsvg
diff --git a/pkgs/applications/misc/goldendict/default.nix b/pkgs/applications/misc/goldendict/default.nix
index a339e399e33d6..4f5df502fdfcd 100644
--- a/pkgs/applications/misc/goldendict/default.nix
+++ b/pkgs/applications/misc/goldendict/default.nix
@@ -2,7 +2,7 @@
 , libXtst, libvorbis, hunspell, lzo, xz, bzip2, libiconv
 , qtbase, qtsvg, qtwebkit, qtx11extras, qttools, qmake
 , wrapQtAppsHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , withCC ? true, opencc
 , withEpwing ? true, libeb
 , withExtraTiff ? true, libtiff
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
       --replace "opencc.2" "opencc"
   '';
 
-  nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook wrapGAppsHook3 ];
   buildInputs = [
     qtbase qtsvg qtwebkit qttools
     libvorbis hunspell xz lzo
diff --git a/pkgs/applications/misc/gpx-viewer/default.nix b/pkgs/applications/misc/gpx-viewer/default.nix
index 9a18c9d5c9d97..daaf92fc72de2 100644
--- a/pkgs/applications/misc/gpx-viewer/default.nix
+++ b/pkgs/applications/misc/gpx-viewer/default.nix
@@ -10,7 +10,7 @@
 , gnome
 , libchamplain
 , gdl
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook # Fix error: GLib-GIO-ERROR **: No GSettings schemas are installed on the system
+    wrapGAppsHook3 # Fix error: GLib-GIO-ERROR **: No GSettings schemas are installed on the system
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/gramps/default.nix b/pkgs/applications/misc/gramps/default.nix
index fdfcfe4ce3160..7feab95b003a1 100644
--- a/pkgs/applications/misc/gramps/default.nix
+++ b/pkgs/applications/misc/gramps/default.nix
@@ -7,7 +7,7 @@
 , gexiv2
 , pango
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , gettext
   # Optional packages:
 , enableOSM ? true
@@ -44,7 +44,7 @@ buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     intltool
     gettext
     gobject-introspection
diff --git a/pkgs/applications/misc/grsync/default.nix b/pkgs/applications/misc/grsync/default.nix
index da41a71d95eab..0e0a6cb87eebc 100644
--- a/pkgs/applications/misc/grsync/default.nix
+++ b/pkgs/applications/misc/grsync/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, dee, gtk3, intltool, libdbusmenu-gtk3, libunity, pkg-config, rsync, wrapGAppsHook }:
+{ lib, stdenv, fetchurl, dee, gtk3, intltool, libdbusmenu-gtk3, libunity, pkg-config, rsync, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   version = "1.3.1";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     intltool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/gum/default.nix b/pkgs/applications/misc/gum/default.nix
index b85e00d095ed0..258079f61c93d 100644
--- a/pkgs/applications/misc/gum/default.nix
+++ b/pkgs/applications/misc/gum/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gum";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NgMEgSfHVLCEKZ3MmNV571ySMUD8wj+kq5EccGrxtZc=";
+    hash = "sha256-TpLaZ/935S57K60NdgJXVY+YQEedralZMoQHWRgkH+A=";
   };
 
-  vendorHash = "sha256-fmc6nbS/Xmn/YRwToRH7EhP4SFRMf8hjZ/rLtaP/USo=";
+  vendorHash = "sha256-UgpOHZ/CEnGsmUTyNrhh+qDmKEplr18b/OrO2qcIhF4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/applications/misc/gummi/default.nix b/pkgs/applications/misc/gummi/default.nix
index 7131c5cd12275..857db4fd95bfd 100644
--- a/pkgs/applications/misc/gummi/default.nix
+++ b/pkgs/applications/misc/gummi/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, pkgs
 , glib, gtk3, gtksourceview3, gtkspell3, poppler, texlive
-, pkg-config, intltool, autoreconfHook, wrapGAppsHook
+, pkg-config, intltool, autoreconfHook, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    pkg-config intltool autoreconfHook wrapGAppsHook
+    pkg-config intltool autoreconfHook wrapGAppsHook3
   ];
   buildInputs = [
     glib gtksourceview3 gtk3 gtkspell3 poppler
diff --git a/pkgs/applications/misc/hamster/default.nix b/pkgs/applications/misc/hamster/default.nix
index c425014e24ed8..bdab5d71e9ef2 100644
--- a/pkgs/applications/misc/hamster/default.nix
+++ b/pkgs/applications/misc/hamster/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, python3Packages, intltool, glib, itstool, gtk3
-, wrapGAppsHook, gobject-introspection, pango, gdk-pixbuf, atk, wafHook }:
+, wrapGAppsHook3, gobject-introspection, pango, gdk-pixbuf, atk, wafHook }:
 
 python3Packages.buildPythonApplication rec {
   pname = "hamster";
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     python3Packages.setuptools
-    wrapGAppsHook
+    wrapGAppsHook3
     intltool
     itstool
     wafHook
diff --git a/pkgs/applications/misc/holochain-launcher/default.nix b/pkgs/applications/misc/holochain-launcher/default.nix
index 111a36e3ee02a..3d7c6b6c205be 100644
--- a/pkgs/applications/misc/holochain-launcher/default.nix
+++ b/pkgs/applications/misc/holochain-launcher/default.nix
@@ -7,7 +7,7 @@
 , openssl
 , webkitgtk
 , libappindicator
-, wrapGAppsHook
+, wrapGAppsHook3
 , shared-mime-info
 , glib-networking
 }:
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoPatchelfHook
     dpkg
-    wrapGAppsHook # required for FileChooser
+    wrapGAppsHook3 # required for FileChooser
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/input-leap/default.nix b/pkgs/applications/misc/input-leap/default.nix
index 567bb08fb911d..9f40735771fc5 100644
--- a/pkgs/applications/misc/input-leap/default.nix
+++ b/pkgs/applications/misc/input-leap/default.nix
@@ -21,7 +21,7 @@
 , pkg-config
 , qtbase
 , qttools
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 mkDerivation rec {
@@ -36,7 +36,7 @@ mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ pkg-config cmake wrapGAppsHook qttools ];
+  nativeBuildInputs = [ pkg-config cmake wrapGAppsHook3 qttools ];
   buildInputs = [
     curl qtbase avahi
     libX11 libXext libXtst libXinerama libXrandr libXdmcp libICE libSM
diff --git a/pkgs/applications/misc/keepassxc/default.nix b/pkgs/applications/misc/keepassxc/default.nix
index e74a45c02f311..e8804f6009464 100644
--- a/pkgs/applications/misc/keepassxc/default.nix
+++ b/pkgs/applications/misc/keepassxc/default.nix
@@ -20,7 +20,7 @@
 , qtsvg
 , qtx11extras
 , readline
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 , zlib
 
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
     qttools
     pkg-config
   ]
-  ++ lib.optional (!stdenv.isDarwin) wrapGAppsHook;
+  ++ lib.optional (!stdenv.isDarwin) wrapGAppsHook3;
 
   dontWrapGApps = true;
   preFixup = ''
diff --git a/pkgs/applications/misc/keeweb/default.nix b/pkgs/applications/misc/keeweb/default.nix
index 22f3ad668ccbf..a7260dc509b72 100644
--- a/pkgs/applications/misc/keeweb/default.nix
+++ b/pkgs/applications/misc/keeweb/default.nix
@@ -4,7 +4,7 @@
 , undmg
 , dpkg
 , autoPatchelfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeWrapper
 , alsa-lib
 , at-spi2-atk
@@ -92,7 +92,7 @@ else stdenv.mkDerivation {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    wrapGAppsHook
+    wrapGAppsHook3
     makeWrapper
   ];
 
diff --git a/pkgs/applications/misc/keymapp/default.nix b/pkgs/applications/misc/keymapp/default.nix
index 55cc3f3f9810f..59dae9589fa7a 100644
--- a/pkgs/applications/misc/keymapp/default.nix
+++ b/pkgs/applications/misc/keymapp/default.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchurl
 , autoPatchelfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , libusb1
 , webkitgtk
 , gtk3
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     copyDesktopItems
     autoPatchelfHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/keystore-explorer/default.nix b/pkgs/applications/misc/keystore-explorer/default.nix
index fb5990f5dca0b..d5576ccb725e7 100644
--- a/pkgs/applications/misc/keystore-explorer/default.nix
+++ b/pkgs/applications/misc/keystore-explorer/default.nix
@@ -1,4 +1,4 @@
-{ fetchzip, lib, stdenv, jdk, runtimeShell, glib, wrapGAppsHook }:
+{ fetchzip, lib, stdenv, jdk, runtimeShell, glib, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   version = "5.5.3";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   # glib is necessary so file dialogs don't hang.
   buildInputs = [ glib ];
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/misc/klipperscreen/default.nix b/pkgs/applications/misc/klipperscreen/default.nix
index 789ab7c688287..5364d090f75d2 100644
--- a/pkgs/applications/misc/klipperscreen/default.nix
+++ b/pkgs/applications/misc/klipperscreen/default.nix
@@ -1,7 +1,7 @@
 { lib
 , python3
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , gitUpdater
 }: python3.pkgs.buildPythonApplication rec {
@@ -18,7 +18,7 @@
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   pythonPath = with python3.pkgs; [
diff --git a/pkgs/applications/misc/krename/default.nix b/pkgs/applications/misc/krename/default.nix
index 98ba8836efca7..6cc5df92ae727 100644
--- a/pkgs/applications/misc/krename/default.nix
+++ b/pkgs/applications/misc/krename/default.nix
@@ -1,6 +1,6 @@
 {
   mkDerivation, fetchurl, fetchpatch, lib,
-  extra-cmake-modules, kdoctools, wrapGAppsHook,
+  extra-cmake-modules, kdoctools, wrapGAppsHook3,
   kconfig, kinit, kjsembed, taglib, exiv2, podofo,
   kcrash
 }:
@@ -27,7 +27,7 @@ in mkDerivation rec {
 
   buildInputs = [ taglib exiv2 podofo ];
 
-  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook3 ];
 
   propagatedBuildInputs = [ kconfig kcrash kinit kjsembed ];
 
diff --git a/pkgs/applications/misc/kupfer/default.nix b/pkgs/applications/misc/kupfer/default.nix
index fbb33c7e096fe..8c22612ad452c 100644
--- a/pkgs/applications/misc/kupfer/default.nix
+++ b/pkgs/applications/misc/kupfer/default.nix
@@ -9,7 +9,7 @@
 , keybinder3
 , desktop-file-utils
 , shared-mime-info
-, wrapGAppsHook
+, wrapGAppsHook3
 , wafHook
 , bash
 , dbus
@@ -29,7 +29,7 @@ buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook intltool
+    wrapGAppsHook3 intltool
     # For setup hook
     gobject-introspection wafHook
     itstool            # for help pages
diff --git a/pkgs/applications/misc/lutris/default.nix b/pkgs/applications/misc/lutris/default.nix
index 3ee6148ef16b9..b16acc4787b78 100644
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@@ -15,7 +15,7 @@
 , libnotify
 , pango
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 
   # check inputs
 , xvfb-run
@@ -85,7 +85,7 @@ buildPythonApplication rec {
     hash = "sha256-Ed1bhugBe97XmY050A5jCPcnLj0Fd7qPX2p/Ab+YbOE=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
   buildInputs = [
     atk
     gdk-pixbuf
diff --git a/pkgs/applications/misc/mako/default.nix b/pkgs/applications/misc/mako/default.nix
index ca7849c566a98..8c4e37661a8c6 100644
--- a/pkgs/applications/misc/mako/default.nix
+++ b/pkgs/applications/misc/mako/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, scdoc
 , systemd, pango, cairo, gdk-pixbuf, jq, bash
 , wayland, wayland-protocols
-, wrapGAppsHook }:
+, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "mako";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   depsBuildBuild = [ pkg-config ];
-  nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-protocols wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-protocols wrapGAppsHook3 ];
   buildInputs = [ systemd pango cairo gdk-pixbuf wayland ];
 
   mesonFlags = [
diff --git a/pkgs/applications/misc/maliit-keyboard/default.nix b/pkgs/applications/misc/maliit-keyboard/default.nix
index 3669dfe5a5b7b..c67ac7a402fc9 100644
--- a/pkgs/applications/misc/maliit-keyboard/default.nix
+++ b/pkgs/applications/misc/maliit-keyboard/default.nix
@@ -17,7 +17,7 @@
 
 , cmake
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 mkDerivation rec {
@@ -58,7 +58,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   postInstall = ''
diff --git a/pkgs/applications/misc/markets/default.nix b/pkgs/applications/misc/markets/default.nix
index 436891482f19b..e24e902abc036 100644
--- a/pkgs/applications/misc/markets/default.nix
+++ b/pkgs/applications/misc/markets/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub
 , desktop-file-utils, glib, gtk3, meson, ninja, pkg-config, python3, vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib-networking, gobject-introspection, json-glib, libgee, libhandy, libsoup
 }:
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     desktop-file-utils glib gtk3 meson ninja pkg-config python3 vala
-    wrapGAppsHook gobject-introspection
+    wrapGAppsHook3 gobject-introspection
   ];
   buildInputs = [
     glib glib-networking gtk3 json-glib libgee libhandy
diff --git a/pkgs/applications/misc/meerk40t/default.nix b/pkgs/applications/misc/meerk40t/default.nix
index c1a0b41a58ac4..e0a3921824de2 100644
--- a/pkgs/applications/misc/meerk40t/default.nix
+++ b/pkgs/applications/misc/meerk40t/default.nix
@@ -3,7 +3,7 @@
 , meerk40t-camera
 , python3Packages
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ (with python3Packages; [
     setuptools
   ]);
diff --git a/pkgs/applications/misc/minder/default.nix b/pkgs/applications/misc/minder/default.nix
index a02647f4a9fbc..e4e58d9bf6c3e 100644
--- a/pkgs/applications/misc/minder/default.nix
+++ b/pkgs/applications/misc/minder/default.nix
@@ -8,7 +8,7 @@
 , python3
 , shared-mime-info
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , cairo
 , discount
 , glib
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     python3
     shared-mime-info
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/minigalaxy/default.nix b/pkgs/applications/misc/minigalaxy/default.nix
index ad694c01cdcba..aa31ffa5cc2b0 100644
--- a/pkgs/applications/misc/minigalaxy/default.nix
+++ b/pkgs/applications/misc/minigalaxy/default.nix
@@ -11,7 +11,7 @@
 , steam-run
 , unzip
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index 92574896bbd97..caecc46d5432c 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -35,7 +35,7 @@
 , cairo
 , libxkbcommon
 , libepoxy
-, wrapGAppsHook
+, wrapGAppsHook3
 , at-spi2-core
 , dbus
 , bash
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     jre
     swig
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/notifymuch/default.nix b/pkgs/applications/misc/notifymuch/default.nix
index 6ba819133eccf..72a0485b0a7ee 100644
--- a/pkgs/applications/misc/notifymuch/default.nix
+++ b/pkgs/applications/misc/notifymuch/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , gobject-introspection
 , libnotify
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , python3
 }:
@@ -30,7 +30,7 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/misc/ns-usbloader/default.nix b/pkgs/applications/misc/ns-usbloader/default.nix
index 2a08b24435a28..8ab52711a6cee 100644
--- a/pkgs/applications/misc/ns-usbloader/default.nix
+++ b/pkgs/applications/misc/ns-usbloader/default.nix
@@ -4,7 +4,7 @@
 , copyDesktopItems
 , makeDesktopItem
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , gvfs
 , maven
 , jre
@@ -42,7 +42,7 @@ maven.buildMavenPackage rec {
   nativeBuildInputs = [
     copyDesktopItems
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     gvfs
   ];
 
diff --git a/pkgs/applications/misc/numberstation/default.nix b/pkgs/applications/misc/numberstation/default.nix
index 7a1393637dffd..651e4420280df 100644
--- a/pkgs/applications/misc/numberstation/default.nix
+++ b/pkgs/applications/misc/numberstation/default.nix
@@ -10,7 +10,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -38,7 +38,7 @@ python3.pkgs.buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/nwg-bar/default.nix b/pkgs/applications/misc/nwg-bar/default.nix
index 356b1edb15aeb..d80986db6e030 100644
--- a/pkgs/applications/misc/nwg-bar/default.nix
+++ b/pkgs/applications/misc/nwg-bar/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , gtk3
 , gtk-layer-shell
-, wrapGAppsHook }:
+, wrapGAppsHook3 }:
 
 buildGoModule rec {
   pname = "nwg-bar";
@@ -26,7 +26,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-/kqhZcIuoN/XA0i1ua3lzVGn4ghkekFYScL1o3kgBX4=";
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   buildInputs = [ gtk3 gtk-layer-shell librsvg ];
 
diff --git a/pkgs/applications/misc/nwg-displays/default.nix b/pkgs/applications/misc/nwg-displays/default.nix
index 22d4e20d5eef7..e014100f45c57 100644
--- a/pkgs/applications/misc/nwg-displays/default.nix
+++ b/pkgs/applications/misc/nwg-displays/default.nix
@@ -7,7 +7,7 @@
 , gtk3
 , pango
 , python310Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 , hyprlandSupport ? true
 , wlr-randr
 }:
@@ -25,7 +25,7 @@ python310Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/nwg-dock-hyprland/default.nix b/pkgs/applications/misc/nwg-dock-hyprland/default.nix
index 607dd7c22facf..19003c66a6755 100644
--- a/pkgs/applications/misc/nwg-dock-hyprland/default.nix
+++ b/pkgs/applications/misc/nwg-dock-hyprland/default.nix
@@ -2,7 +2,7 @@
 , buildGoModule
 , fetchFromGitHub
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk-layer-shell
 }:
 
@@ -21,7 +21,7 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" ];
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = [ gtk-layer-shell ];
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/nwg-menu/default.nix b/pkgs/applications/misc/nwg-menu/default.nix
index 6733a5dac3f4d..27be9aa08fa9e 100644
--- a/pkgs/applications/misc/nwg-menu/default.nix
+++ b/pkgs/applications/misc/nwg-menu/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub
-, buildGoModule, pkg-config, wrapGAppsHook, gobject-introspection
+, buildGoModule, pkg-config, wrapGAppsHook3, gobject-introspection
 , gtk-layer-shell, gtk3, pango, gdk-pixbuf, atk
 }:
 
@@ -19,7 +19,7 @@ buildGoModule rec {
   doCheck = false;
 
   buildInputs = [ atk gtk3 gdk-pixbuf gtk-layer-shell pango ];
-  nativeBuildInputs = [ pkg-config wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 gobject-introspection ];
 
   prePatch = ''
     for file in main.go tools.go; do
diff --git a/pkgs/applications/misc/nwg-panel/default.nix b/pkgs/applications/misc/nwg-panel/default.nix
index 840b048d2d4cd..064fead047334 100644
--- a/pkgs/applications/misc/nwg-panel/default.nix
+++ b/pkgs/applications/misc/nwg-panel/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub
-, python3Packages, wrapGAppsHook, gobject-introspection
+, python3Packages, wrapGAppsHook3, gobject-introspection
 , gtk-layer-shell, pango, gdk-pixbuf, atk
 # Extra packages called by various internal nwg-panel modules
 , hyprland         # hyprctl
@@ -28,12 +28,12 @@ python3Packages.buildPythonApplication rec {
   # No tests
   doCheck = false;
 
-  # Because of wrapGAppsHook
+  # Because of wrapGAppsHook3
   strictDeps = false;
   dontWrapGApps = true;
 
   buildInputs = [ atk gdk-pixbuf gtk-layer-shell pango playerctl ];
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
   propagatedBuildInputs = (with python3Packages;
     [ i3ipc netifaces psutil pybluez pygobject3 requests dasbus setuptools ])
     # Run-time GTK dependency required by the Tray module
diff --git a/pkgs/applications/misc/nwg-wrapper/default.nix b/pkgs/applications/misc/nwg-wrapper/default.nix
index 5b28628318961..f5b524c890198 100644
--- a/pkgs/applications/misc/nwg-wrapper/default.nix
+++ b/pkgs/applications/misc/nwg-wrapper/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3Packages, fetchFromGitHub, gtk-layer-shell, gtk3, gobject-introspection, wrapGAppsHook, wlr-randr }:
+{ lib, python3Packages, fetchFromGitHub, gtk-layer-shell, gtk3, gobject-introspection, wrapGAppsHook3, wlr-randr }:
 
 python3Packages.buildPythonPackage rec {
   pname = "nwg-wrapper";
@@ -11,7 +11,7 @@ python3Packages.buildPythonPackage rec {
     sha256 = "sha256-GKDAdjO67aedCEFHKDukQ+oPMomTPwFE/CvJu112fus=";
   };
 
-  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+  nativeBuildInputs = [ gobject-introspection wrapGAppsHook3 ];
 
   buildInputs = [ gtk3 gtk-layer-shell ];
 
diff --git a/pkgs/applications/misc/onboard/default.nix b/pkgs/applications/misc/onboard/default.nix
index cdcdb2b1e5149..6f210791ce9af 100644
--- a/pkgs/applications/misc/onboard/default.nix
+++ b/pkgs/applications/misc/onboard/default.nix
@@ -23,7 +23,7 @@
 , pkg-config
 , procps
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , xorg
 , yelp
 }:
@@ -60,7 +60,7 @@ python3.pkgs.buildPythonApplication rec {
     gobject-introspection
     intltool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/openlp/default.nix b/pkgs/applications/misc/openlp/default.nix
index a075a9bec6f5f..c77b494f08cac 100644
--- a/pkgs/applications/misc/openlp/default.nix
+++ b/pkgs/applications/misc/openlp/default.nix
@@ -1,6 +1,6 @@
 # This file contains all runtime glue: Bindings to optional runtime dependencies
 # for pdfSupport, presentationSupport, and media playback.
-{ lib, mkDerivation, wrapGAppsHook, python3Packages
+{ lib, mkDerivation, wrapGAppsHook3, python3Packages
 
 # qt deps
 , qtbase, qtmultimedia
@@ -40,7 +40,7 @@ in mkDerivation {
   pname = baseLib.pname + lib.optionalString (pdfSupport && presentationSupport && vlcSupport && gstreamerSupport) "-full";
   inherit (baseLib) version src;
 
-  nativeBuildInputs = [ python3Packages.wrapPython wrapGAppsHook ];
+  nativeBuildInputs = [ python3Packages.wrapPython wrapGAppsHook3 ];
   buildInputs = [ qtbase ] ++ optionals gstreamerSupport
     ([ qtmultimedia.bin gst_all_1.gstreamer ] ++ gstPlugins gst_all_1);
   propagatedBuildInputs = optional pdfSupport mupdf
diff --git a/pkgs/applications/misc/orca/fix-paths.patch b/pkgs/applications/misc/orca/fix-paths.patch
deleted file mode 100644
index 45ae4b827ba59..0000000000000
--- a/pkgs/applications/misc/orca/fix-paths.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-diff --git a/src/orca/debug.py b/src/orca/debug.py
-index b7e11ea60..9ab996765 100644
---- a/src/orca/debug.py
-+++ b/src/orca/debug.py
-@@ -447,7 +447,7 @@ def traceit(frame, event, arg):
-     return traceit
- 
- def getOpenFDCount(pid):
--    procs = subprocess.check_output([ 'lsof', '-w', '-Ff', '-p', str(pid)])
-+    procs = subprocess.check_output([ '@lsof@', '-w', '-Ff', '-p', str(pid)])
-     procs = procs.decode('UTF-8').split('\n')
-     files = list(filter(lambda s: s and s[0] == 'f' and s[1:].isdigit(), procs))
- 
-@@ -465,7 +465,7 @@ def getCmdline(pid):
-     return cmdline
- 
- def pidOf(procName):
--    openFile = subprocess.Popen(f'pgrep {procName}',
-+    openFile = subprocess.Popen(f'@pgrep@ {procName}',
-                                 shell=True,
-                                 stdout=subprocess.PIPE).stdout
-     pids = openFile.read()
-diff --git a/src/orca/orca.py b/src/orca/orca.py
-index d4e89f918..bb3e6cc1d 100644
---- a/src/orca/orca.py
-+++ b/src/orca/orca.py
-@@ -312,7 +312,7 @@ def updateKeyMap(keyboardEvent):
- 
- def _setXmodmap(xkbmap):
-     """Set the keyboard map using xkbcomp."""
--    p = subprocess.Popen(['xkbcomp', '-w0', '-', os.environ['DISPLAY']],
-+    p = subprocess.Popen(['@xkbcomp@', '-w0', '-', os.environ['DISPLAY']],
-         stdin=subprocess.PIPE, stdout=None, stderr=None)
-     p.communicate(xkbmap)
- 
-@@ -389,7 +389,7 @@ def _storeXmodmap(keyList):
-     """
- 
-     global _originalXmodmap
--    _originalXmodmap = subprocess.check_output(['xkbcomp', os.environ['DISPLAY'], '-'])
-+    _originalXmodmap = subprocess.check_output(['@xkbcomp@', os.environ['DISPLAY'], '-'])
- 
- def _restoreXmodmap(keyList=[]):
-     """Restore the original xmodmap values for the keys in keyList.
-@@ -404,7 +404,7 @@ def _restoreXmodmap(keyList=[]):
- 
-     global _capsLockCleared
-     _capsLockCleared = False
--    p = subprocess.Popen(['xkbcomp', '-w0', '-', os.environ['DISPLAY']],
-+    p = subprocess.Popen(['@xkbcomp@', '-w0', '-', os.environ['DISPLAY']],
-         stdin=subprocess.PIPE, stdout=None, stderr=None)
-     p.communicate(_originalXmodmap)
- 
-diff --git a/src/orca/orca_bin.py.in b/src/orca/orca_bin.py.in
-index 9d64af948..ca9c9e083 100644
---- a/src/orca/orca_bin.py.in
-+++ b/src/orca/orca_bin.py.in
-@@ -65,7 +65,7 @@ class ListApps(argparse.Action):
-                 name = "[DEAD]"
- 
-             try:
--                cmdline = subprocess.getoutput('cat /proc/%s/cmdline' % pid)
-+                cmdline = subprocess.getoutput('@cat@ /proc/%s/cmdline' % pid)
-             except Exception:
-                 cmdline = '(exception encountered)'
-             else:
-@@ -198,7 +198,7 @@ def inGraphicalDesktop():
- def otherOrcas():
-     """Returns the pid of any other instances of Orca owned by this user."""
- 
--    openFile = subprocess.Popen('pgrep -u %s -x orca' % os.getuid(),
-+    openFile = subprocess.Popen('@pgrep@ -u %s -x orca' % os.getuid(),
-                                 shell=True,
-                                 stdout=subprocess.PIPE).stdout
-     pids = openFile.read()
-diff --git a/src/orca/script_utilities.py b/src/orca/script_utilities.py
-index ed8b155e4..0436cca42 100644
---- a/src/orca/script_utilities.py
-+++ b/src/orca/script_utilities.py
-@@ -144,7 +144,7 @@ class Utilities:
-             return ""
- 
-         try:
--            cmdline = subprocess.getoutput(f"cat /proc/{pid}/cmdline")
-+            cmdline = subprocess.getoutput(f"@cat@ /proc/{pid}/cmdline")
-         except Exception:
-             return ""
- 
diff --git a/pkgs/applications/misc/otpclient/default.nix b/pkgs/applications/misc/otpclient/default.nix
index e53cc20874ba6..0ab84ea083720 100644
--- a/pkgs/applications/misc/otpclient/default.nix
+++ b/pkgs/applications/misc/otpclient/default.nix
@@ -4,7 +4,7 @@
 , cmake
 , pkg-config
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , jansson
 , libgcrypt
 , libzip
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/oversteer/default.nix b/pkgs/applications/misc/oversteer/default.nix
index eb47b4225d87d..6618d154cdda5 100644
--- a/pkgs/applications/misc/oversteer/default.nix
+++ b/pkgs/applications/misc/oversteer/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, gettext, python3, python3Packages
 , meson, ninja, udev, appstream, appstream-glib, desktop-file-utils, gtk3
-, wrapGAppsHook, gobject-introspection, bash, }:
+, wrapGAppsHook3, gobject-introspection, bash, }:
 let
   python = python3.withPackages (p:
     with p; [
@@ -33,7 +33,7 @@ in stdenv.mkDerivation {
     pkg-config
     gettext
     python
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     meson
     udev
diff --git a/pkgs/applications/misc/pattypan/default.nix b/pkgs/applications/misc/pattypan/default.nix
index c1f5aa84b0eb5..344540e848635 100644
--- a/pkgs/applications/misc/pattypan/default.nix
+++ b/pkgs/applications/misc/pattypan/default.nix
@@ -4,7 +4,7 @@
 , ant
 , jdk
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeDesktopItem
 , copyDesktopItems
 , stripJavaArchivesHook
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     ant
     jdk
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     copyDesktopItems
     stripJavaArchivesHook
   ];
diff --git a/pkgs/applications/misc/pdf-quench/default.nix b/pkgs/applications/misc/pdf-quench/default.nix
index 78151061700aa..bfb240e2b9d21 100644
--- a/pkgs/applications/misc/pdf-quench/default.nix
+++ b/pkgs/applications/misc/pdf-quench/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, pkgs, python3, wrapGAppsHook, gobject-introspection }:
+{ lib, fetchFromGitHub, pkgs, python3, wrapGAppsHook3, gobject-introspection }:
 
 python3.pkgs.buildPythonApplication {
   pname = "pdf-quench";
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication {
     sha256 = "1rp9rlwr6rarcsxygv5x2c5psgwl6r69k0lsgribgyyla9cf2m7n";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
   buildInputs = with pkgs; [
     gtk3
     goocanvas2
diff --git a/pkgs/applications/misc/pdfarranger/default.nix b/pkgs/applications/misc/pdfarranger/default.nix
index 2973a4b9a36cd..7e0dc4c2fdb2c 100644
--- a/pkgs/applications/misc/pdfarranger/default.nix
+++ b/pkgs/applications/misc/pdfarranger/default.nix
@@ -1,6 +1,6 @@
 { fetchFromGitHub
 , lib
-, wrapGAppsHook
+, wrapGAppsHook3
 , python3Packages
 , gtk3
 , poppler_gi
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ (with python3Packages; [
     setuptools
   ]);
@@ -39,7 +39,7 @@ python3Packages.buildPythonApplication rec {
     python-dateutil
   ];
 
-  # incompatible with wrapGAppsHook
+  # incompatible with wrapGAppsHook3
   strictDeps = false;
   dontWrapGApps = true;
   preFixup = ''
diff --git a/pkgs/applications/misc/pdfpc/default.nix b/pkgs/applications/misc/pdfpc/default.nix
index 7d46836b796e4..5b77a264ed2bf 100644
--- a/pkgs/applications/misc/pdfpc/default.nix
+++ b/pkgs/applications/misc/pdfpc/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, vala, gtk3, libgee
-, poppler, libpthreadstubs, gstreamer, gst-plugins-base, gst-plugins-good, gst-libav, gobject-introspection, wrapGAppsHook
+, poppler, libpthreadstubs, gstreamer, gst-plugins-base, gst-plugins-good, gst-libav, gobject-introspection, wrapGAppsHook3
 , qrencode, webkitgtk, discount, json-glib, fetchpatch }:
 
 stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     cmake pkg-config vala
     # For setup hook
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/pdfsam-basic/default.nix b/pkgs/applications/misc/pdfsam-basic/default.nix
index c7d88edef8678..ce3ce1a740120 100644
--- a/pkgs/applications/misc/pdfsam-basic/default.nix
+++ b/pkgs/applications/misc/pdfsam-basic/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, makeDesktopItem, fetchurl, jdk21, wrapGAppsHook, glib }:
+{ lib, stdenv, makeDesktopItem, fetchurl, jdk21, wrapGAppsHook3, glib }:
 
 stdenv.mkDerivation rec {
   pname = "pdfsam-basic";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     tar xvf data.tar.gz
   '';
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
   buildInputs = [ glib ];
 
   preFixup = ''
diff --git a/pkgs/applications/misc/pdfslicer/default.nix b/pkgs/applications/misc/pdfslicer/default.nix
index ed20f460a1677..d856dfaca8cb3 100644
--- a/pkgs/applications/misc/pdfslicer/default.nix
+++ b/pkgs/applications/misc/pdfslicer/default.nix
@@ -5,7 +5,7 @@
 , gettext
 , intltool
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtkmm3
 , libuuid
 , poppler
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     gettext
     intltool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/phoc/default.nix b/pkgs/applications/misc/phoc/default.nix
index deccbabe3fd47..d999744bdb89f 100644
--- a/pkgs/applications/misc/phoc/default.nix
+++ b/pkgs/applications/misc/phoc/default.nix
@@ -6,7 +6,7 @@
 , ninja
 , pkg-config
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , libinput
 , gnome
 , gnome-desktop
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/plank/default.nix b/pkgs/applications/misc/plank/default.nix
index fb3226e6d8030..69be975be0ba2 100644
--- a/pkgs/applications/misc/plank/default.nix
+++ b/pkgs/applications/misc/plank/default.nix
@@ -21,7 +21,7 @@
 , file
 , gnome-menus
 , libgee
-, wrapGAppsHook
+, wrapGAppsHook3
 , autoreconfHook
 }:
 
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     libxml2 # xmllint
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/playonlinux/default.nix b/pkgs/applications/misc/playonlinux/default.nix
index 0b4f445c00669..4f12fb470671e 100644
--- a/pkgs/applications/misc/playonlinux/default.nix
+++ b/pkgs/applications/misc/playonlinux/default.nix
@@ -26,7 +26,7 @@
 # needed for avoiding crash on file selector
 , gsettings-desktop-schemas
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , hicolor-icon-theme
 }:
 
@@ -79,7 +79,7 @@ in stdenv.mkDerivation {
     ./0001-fix-locale.patch
   ];
 
-  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook3 ];
 
   preBuild = ''
     makeFlagsArray+=(PYTHON="python -m py_compile")
diff --git a/pkgs/applications/misc/polar-bookshelf/default.nix b/pkgs/applications/misc/polar-bookshelf/default.nix
index 983dc81d1790d..1e29c225f92c4 100644
--- a/pkgs/applications/misc/polar-bookshelf/default.nix
+++ b/pkgs/applications/misc/polar-bookshelf/default.nix
@@ -3,7 +3,7 @@
 , makeWrapper
 , fetchurl
 , dpkg
-, wrapGAppsHook
+, wrapGAppsHook3
 , autoPatchelfHook
 , gtk3
 , cairo
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     autoPatchelfHook
     makeWrapper
     dpkg
diff --git a/pkgs/applications/misc/polar-bookshelf1/default.nix b/pkgs/applications/misc/polar-bookshelf1/default.nix
index a4ff885a71b8a..572a981b4ccf8 100644
--- a/pkgs/applications/misc/polar-bookshelf1/default.nix
+++ b/pkgs/applications/misc/polar-bookshelf1/default.nix
@@ -36,7 +36,7 @@
 , nss
 , openssl
 , pango
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     autoPatchelfHook
     dpkg
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   runtimeLibs = lib.makeLibraryPath [ libudev0-shim glibc curl openssl libnghttp2 ];
diff --git a/pkgs/applications/misc/polychromatic/default.nix b/pkgs/applications/misc/polychromatic/default.nix
index f940f5a4af803..9ed291c79c7eb 100644
--- a/pkgs/applications/misc/polychromatic/default.nix
+++ b/pkgs/applications/misc/polychromatic/default.nix
@@ -10,7 +10,7 @@
 , sassc
 , python3Packages
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , libappindicator-gtk3
 , libxcb
 , qt5
@@ -48,7 +48,7 @@ python3Packages.buildPythonApplication rec {
     meson
     ninja
     sassc
-    wrapGAppsHook
+    wrapGAppsHook3
     qt5.wrapQtAppsHook
   ];
 
diff --git a/pkgs/applications/misc/premid/default.nix b/pkgs/applications/misc/premid/default.nix
index f621d510e411d..876c4c33de28e 100644
--- a/pkgs/applications/misc/premid/default.nix
+++ b/pkgs/applications/misc/premid/default.nix
@@ -1,4 +1,4 @@
-{ autoPatchelfHook, makeDesktopItem, lib, stdenv, wrapGAppsHook, fetchurl, copyDesktopItems
+{ autoPatchelfHook, makeDesktopItem, lib, stdenv, wrapGAppsHook3, fetchurl, copyDesktopItems
 , alsa-lib, at-spi2-atk, at-spi2-core, atk, cairo, cups, dbus, expat, fontconfig
 , freetype, gdk-pixbuf, glib, gtk3, libcxx, libdrm, libnotify, libpulseaudio, libuuid
 , libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    wrapGAppsHook
+    wrapGAppsHook3
     copyDesktopItems
   ];
 
diff --git a/pkgs/applications/misc/printrun/default.nix b/pkgs/applications/misc/printrun/default.nix
index 61acdd32857cb..884ce49dd8347 100644
--- a/pkgs/applications/misc/printrun/default.nix
+++ b/pkgs/applications/misc/printrun/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3Packages, fetchFromGitHub, glib, wrapGAppsHook }:
+{ lib, python3Packages, fetchFromGitHub, glib, wrapGAppsHook3 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "printrun";
@@ -18,7 +18,7 @@ python3Packages.buildPythonApplication rec {
     sed -i -r "s|/usr(/local)?/share/|$out/share/|g" printrun/utils.py
   '';
 
-  nativeBuildInputs = [ glib wrapGAppsHook ];
+  nativeBuildInputs = [ glib wrapGAppsHook3 ];
 
   propagatedBuildInputs = with python3Packages; [
     appdirs cython dbus-python numpy six wxpython psutil pyglet pyopengl pyserial cffi cairosvg lxml
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index 7952eadea68fa..b1e2a80617bae 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , boost
 , cereal
 , cgal
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/pytrainer/default.nix b/pkgs/applications/misc/pytrainer/default.nix
index 6d907fab0db46..49be94cc2baba 100644
--- a/pkgs/applications/misc/pytrainer/default.nix
+++ b/pkgs/applications/misc/pytrainer/default.nix
@@ -13,7 +13,7 @@
 , sqlite
 , tzdata
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , xvfb-run
 }:
 
@@ -48,7 +48,7 @@ in python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/qcad/default.nix b/pkgs/applications/misc/qcad/default.nix
index e67a96fe7cd3d..c36068e65962d 100644
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@@ -18,14 +18,14 @@
 
 mkDerivation rec {
   pname = "qcad";
-  version = "3.29.4.1";
+  version = "3.29.6.2";
 
   src = fetchFromGitHub {
     name = "qcad-${version}-src";
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    hash = "sha256-00lPgiE3hsP3SL96ygBP91CaAWi1IGOYUO7zC/ORG1U=";
+    hash = "sha256-NKWuvhVGtlhWOfV0MWyViTgk0luA8mvnwQS0TZj7Ulc=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/qtpass/default.nix b/pkgs/applications/misc/qtpass/default.nix
index ae26de760ee6d..d401a57dda78a 100644
--- a/pkgs/applications/misc/qtpass/default.nix
+++ b/pkgs/applications/misc/qtpass/default.nix
@@ -23,9 +23,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ qmake qttools wrapQtAppsHook ];
 
-  # HACK `propagatedSandboxProfile` does not appear to actually propagate the sandbox profile from `qt5.qtbase`
-  sandboxProfile = toString qtbase.__propagatedSandboxProfile;
-
   qmakeFlags = [
     # setup hook only sets QMAKE_LRELEASE, set QMAKE_LUPDATE too:
     "QMAKE_LUPDATE=${qttools.dev}/bin/lupdate"
diff --git a/pkgs/applications/misc/redshift/default.nix b/pkgs/applications/misc/redshift/default.nix
index ff0ba6c0edb7a..f0c46f8c207a8 100644
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, fetchFromGitLab
 , autoconf, automake, gettext, intltool
-, libtool, pkg-config, wrapGAppsHook, wrapPython, gobject-introspection
+, libtool, pkg-config, wrapGAppsHook3, wrapPython, gobject-introspection
 , gtk3, python, pygobject3, pyxdg
 
 , withQuartz ? stdenv.isDarwin, ApplicationServices
@@ -33,7 +33,7 @@ let
         intltool
         libtool
         pkg-config
-        wrapGAppsHook
+        wrapGAppsHook3
         wrapPython
         gobject-introspection
         python
diff --git a/pkgs/applications/misc/regextester/default.nix b/pkgs/applications/misc/regextester/default.nix
index 05daa180d0297..902ae57492011 100644
--- a/pkgs/applications/misc/regextester/default.nix
+++ b/pkgs/applications/misc/regextester/default.nix
@@ -13,7 +13,7 @@
 , gsettings-desktop-schemas
 , desktop-file-utils
 , pantheon
-, wrapGAppsHook }:
+, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "regextester";
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils
   ];
 
diff --git a/pkgs/applications/misc/remontoire/default.nix b/pkgs/applications/misc/remontoire/default.nix
index 0aabaababf6a5..754d32617e789 100644
--- a/pkgs/applications/misc/remontoire/default.nix
+++ b/pkgs/applications/misc/remontoire/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktop-file-utils
 , glib
 , gtk3
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils
   ];
 
diff --git a/pkgs/applications/misc/rofi-top/default.nix b/pkgs/applications/misc/rofi-top/default.nix
index 328eca9da894f..877cbd6a284ef 100644
--- a/pkgs/applications/misc/rofi-top/default.nix
+++ b/pkgs/applications/misc/rofi-top/default.nix
@@ -8,7 +8,7 @@
 , libgtop
 , pkg-config
 , rofi-unwrapped
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
     gobject-introspection
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/rofi/wrapper.nix b/pkgs/applications/misc/rofi/wrapper.nix
index 2f98fe164161b..f8da5074b52aa 100644
--- a/pkgs/applications/misc/rofi/wrapper.nix
+++ b/pkgs/applications/misc/rofi/wrapper.nix
@@ -1,4 +1,4 @@
-{ symlinkJoin, lib, rofi-unwrapped, makeWrapper, wrapGAppsHook, gdk-pixbuf, hicolor-icon-theme, theme ? null, plugins ? [], symlink-dmenu ? false }:
+{ symlinkJoin, lib, rofi-unwrapped, makeWrapper, wrapGAppsHook3, gdk-pixbuf, hicolor-icon-theme, theme ? null, plugins ? [], symlink-dmenu ? false }:
 
 symlinkJoin {
   name = "rofi-${rofi-unwrapped.version}";
@@ -7,7 +7,7 @@ symlinkJoin {
     rofi-unwrapped.out
   ] ++ (lib.forEach plugins (p: p.out));
 
-  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook3 ];
   buildInputs = [ gdk-pixbuf ];
 
   preferLocalBuild = true;
diff --git a/pkgs/applications/misc/rootbar/default.nix b/pkgs/applications/misc/rootbar/default.nix
index 41582e1b413c2..2ef92f1c9aa21 100644
--- a/pkgs/applications/misc/rootbar/default.nix
+++ b/pkgs/applications/misc/rootbar/default.nix
@@ -7,7 +7,7 @@
 , json_c
 , libpulseaudio
 , wayland
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    meson ninja pkg-config wrapGAppsHook
+    meson ninja pkg-config wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/safeeyes/default.nix b/pkgs/applications/misc/safeeyes/default.nix
index 39bb82aaaef6d..87925d732e89a 100644
--- a/pkgs/applications/misc/safeeyes/default.nix
+++ b/pkgs/applications/misc/safeeyes/default.nix
@@ -11,7 +11,7 @@
 , testers
 , xprintidle
 , xprop
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 with python3.pkgs;
@@ -30,7 +30,7 @@ buildPythonApplication rec {
   '';
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/misc/sequeler/default.nix b/pkgs/applications/misc/sequeler/default.nix
index 49fa61270b4d2..aa76a65a17523 100644
--- a/pkgs/applications/misc/sequeler/default.nix
+++ b/pkgs/applications/misc/sequeler/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, nix-update-script
-, vala, meson, ninja, pkg-config, pantheon, gettext, wrapGAppsHook, python3, desktop-file-utils
+, vala, meson, ninja, pkg-config, pantheon, gettext, wrapGAppsHook3, python3, desktop-file-utils
 , gtk3, glib, libgee, libgda, gtksourceview, libxml2, libsecret, libssh2 }:
 
 
@@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-MsHHTYERe0v+u3KnVtx+jmJTKORJTJ7bNfJMZHV9Ly4=";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config vala gettext wrapGAppsHook python3 desktop-file-utils ];
+  nativeBuildInputs = [ meson ninja pkg-config vala gettext wrapGAppsHook3 python3 desktop-file-utils ];
 
   buildInputs = [ gtk3 glib pantheon.granite libgee sqlGda gtksourceview libxml2 libsecret libssh2 ];
 
diff --git a/pkgs/applications/misc/shipments/default.nix b/pkgs/applications/misc/shipments/default.nix
index 792f997c5f850..1bcb2e4e104f4 100644
--- a/pkgs/applications/misc/shipments/default.nix
+++ b/pkgs/applications/misc/shipments/default.nix
@@ -9,7 +9,7 @@
 , pkg-config
 , python3
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/misc/siglo/default.nix b/pkgs/applications/misc/siglo/default.nix
index 1231d2fd47fd9..2aeedcc25b2b6 100644
--- a/pkgs/applications/misc/siglo/default.nix
+++ b/pkgs/applications/misc/siglo/default.nix
@@ -4,7 +4,7 @@
 , glib
 , meson
 , ninja
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktop-file-utils
 , gobject-introspection
 , gtk3
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     glib
     meson
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
     python3.pkgs.wrapPython
     python3
     desktop-file-utils
diff --git a/pkgs/applications/misc/skytemple/default.nix b/pkgs/applications/misc/skytemple/default.nix
index 116c5096cb599..4442e79944ac1 100644
--- a/pkgs/applications/misc/skytemple/default.nix
+++ b/pkgs/applications/misc/skytemple/default.nix
@@ -4,7 +4,7 @@
 , gtk3
 , gtksourceview4
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , python3Packages
 }:
 
@@ -31,7 +31,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/misc/slic3r/default.nix b/pkgs/applications/misc/slic3r/default.nix
index 6695f53e99327..102dc8f4b3c8d 100644
--- a/pkgs/applications/misc/slic3r/default.nix
+++ b/pkgs/applications/misc/slic3r/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, perl, makeWrapper
-, makeDesktopItem, which, perlPackages, boost, wrapGAppsHook
+, makeDesktopItem, which, perlPackages, boost, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-cf0QTOzhLyTcbJryCQoTVzU8kfrPV6SLpqi4s36X5N0=";
   };
 
-  nativeBuildInputs = [ makeWrapper which wrapGAppsHook ];
+  nativeBuildInputs = [ makeWrapper which wrapGAppsHook3 ];
   buildInputs =
   [boost] ++
   (with perlPackages; [ perl
diff --git a/pkgs/applications/misc/snapmaker-luban/default.nix b/pkgs/applications/misc/snapmaker-luban/default.nix
index 351a17c5fc4d2..dc5fe5993f4f7 100644
--- a/pkgs/applications/misc/snapmaker-luban/default.nix
+++ b/pkgs/applications/misc/snapmaker-luban/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, autoPatchelfHook, makeDesktopItem, copyDesktopItems, wrapGAppsHook, fetchurl
+{ lib, stdenv, autoPatchelfHook, makeDesktopItem, copyDesktopItems, wrapGAppsHook3, fetchurl
 , alsa-lib, at-spi2-atk, at-spi2-core, atk, cairo, cups
 , gtk3, nss, glib, dbus, nspr, gdk-pixbuf, libdrm, mesa
 , libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    wrapGAppsHook
+    wrapGAppsHook3
     copyDesktopItems
   ];
 
diff --git a/pkgs/applications/misc/snapper-gui/default.nix b/pkgs/applications/misc/snapper-gui/default.nix
index c82b0813f78ba..8029eee15f896 100644
--- a/pkgs/applications/misc/snapper-gui/default.nix
+++ b/pkgs/applications/misc/snapper-gui/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, python3, python3Packages
-, gnome, gtk3, wrapGAppsHook, gtksourceview3, snapper
+, gnome, gtk3, wrapGAppsHook3, gtksourceview3, snapper
 , gobject-introspection
 }:
 
@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication rec {
     sha256 = "13j4spbi9pxg69zifzai8ifk4207sn0vwh6vjqryi0snd5sylh7h";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
 
   buildInputs = [
     python3
diff --git a/pkgs/applications/misc/solaar/default.nix b/pkgs/applications/misc/solaar/default.nix
index f3cd458510b35..8d59db378728c 100644
--- a/pkgs/applications/misc/solaar/default.nix
+++ b/pkgs/applications/misc/solaar/default.nix
@@ -3,7 +3,7 @@
 , gobject-introspection
 , gtk3
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 , gdk-pixbuf
 , libappindicator
 , librsvg
@@ -28,7 +28,7 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     gdk-pixbuf
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/sticky/default.nix b/pkgs/applications/misc/sticky/default.nix
index 9e9df71ddf9ac..423944cafb1fa 100644
--- a/pkgs/applications/misc/sticky/default.nix
+++ b/pkgs/applications/misc/sticky/default.nix
@@ -5,7 +5,7 @@
 , meson
 , ninja
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , cinnamon
 , glib
 , gspell
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     python3.pkgs.wrapPython
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/streamdeck-ui/default.nix b/pkgs/applications/misc/streamdeck-ui/default.nix
index f46be1a24324b..f8ecf3694e511 100644
--- a/pkgs/applications/misc/streamdeck-ui/default.nix
+++ b/pkgs/applications/misc/streamdeck-ui/default.nix
@@ -4,7 +4,7 @@
 , copyDesktopItems
 , writeText
 , makeDesktopItem
-, wrapGAppsHook
+, wrapGAppsHook3
 , xvfb-run
 , qt6
 }:
@@ -71,7 +71,7 @@ python3Packages.buildPythonApplication rec {
     python3Packages.poetry-core
     copyDesktopItems
     qt6.wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/misc/survex/default.nix b/pkgs/applications/misc/survex/default.nix
index 6f2098ea4778b..2bb4184b4353b 100644
--- a/pkgs/applications/misc/survex/default.nix
+++ b/pkgs/applications/misc/survex/default.nix
@@ -14,7 +14,7 @@
 , pkg-config
 , proj
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , wxGTK32
 }:
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     perl
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/swappy/default.nix b/pkgs/applications/misc/swappy/default.nix
index b0cfc24aab655..cb56e4281da06 100644
--- a/pkgs/applications/misc/swappy/default.nix
+++ b/pkgs/applications/misc/swappy/default.nix
@@ -11,7 +11,7 @@
 , scdoc
 , libnotify
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , hicolor-icon-theme
 }:
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-/XPvy98Il4i8cDl9vH6f0/AZmiSqseSXnen7HfMqCDo=";
   };
 
-  nativeBuildInputs = [ glib meson ninja pkg-config scdoc wrapGAppsHook ];
+  nativeBuildInputs = [ glib meson ninja pkg-config scdoc wrapGAppsHook3 ];
 
   buildInputs = [
     cairo pango gtk libnotify wayland glib hicolor-icon-theme
diff --git a/pkgs/applications/misc/swaynotificationcenter/default.nix b/pkgs/applications/misc/swaynotificationcenter/default.nix
index 3f2310a8507f7..b2ea718d87e55 100644
--- a/pkgs/applications/misc/swaynotificationcenter/default.nix
+++ b/pkgs/applications/misc/swaynotificationcenter/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , testers
-, wrapGAppsHook
+, wrapGAppsHook3
 , bash-completion
 , dbus
 , dbus-glib
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: rec {
     sassc
     scdoc
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/swaysettings/default.nix b/pkgs/applications/misc/swaysettings/default.nix
index babd312d3edde..490f0048081e5 100644
--- a/pkgs/applications/misc/swaysettings/default.nix
+++ b/pkgs/applications/misc/swaysettings/default.nix
@@ -22,7 +22,7 @@
 , python3
 , stdenv
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/misc/system76-keyboard-configurator/default.nix b/pkgs/applications/misc/system76-keyboard-configurator/default.nix
index 94dc95a466cd4..096f0589baedf 100644
--- a/pkgs/applications/misc/system76-keyboard-configurator/default.nix
+++ b/pkgs/applications/misc/system76-keyboard-configurator/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, gtk3, glib, wrapGAppsHook, libusb1, hidapi, udev, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, gtk3, glib, wrapGAppsHook3, libusb1, hidapi, udev, pkg-config }:
 
 # system76-keyboard-configurator tries to spawn a daemon as root via pkexec, so
 # your system needs a PolicyKit authentication agent running for the
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     pkg-config
     glib # for glib-compile-resources
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/themechanger/default.nix b/pkgs/applications/misc/themechanger/default.nix
index 652fe267852a9..e1c26828c97ee 100644
--- a/pkgs/applications/misc/themechanger/default.nix
+++ b/pkgs/applications/misc/themechanger/default.nix
@@ -3,7 +3,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktop-file-utils
 , glib
 , gtk3
@@ -30,7 +30,7 @@ python3Packages.buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils
     gtk3
   ];
diff --git a/pkgs/applications/misc/tint2/default.nix b/pkgs/applications/misc/tint2/default.nix
index ac50a46fde6db..18aa389ac1e7c 100644
--- a/pkgs/applications/misc/tint2/default.nix
+++ b/pkgs/applications/misc/tint2/default.nix
@@ -20,7 +20,7 @@
 , libpthreadstubs
 , libXdmcp
 , libstartup_notification
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     pkg-config
     cmake
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/tuhi/default.nix b/pkgs/applications/misc/tuhi/default.nix
index b3334c59c4a0a..759ad401ede6c 100644
--- a/pkgs/applications/misc/tuhi/default.nix
+++ b/pkgs/applications/misc/tuhi/default.nix
@@ -8,7 +8,7 @@
 , glib
 , gtk3
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , fetchFromGitHub
 }:
 
@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     pkg-config meson ninja
     appstream-glib desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
   buildInputs = [
diff --git a/pkgs/applications/misc/udiskie/default.nix b/pkgs/applications/misc/udiskie/default.nix
index 94ea64d3792bb..7df3f1d23b9cc 100644
--- a/pkgs/applications/misc/udiskie/default.nix
+++ b/pkgs/applications/misc/udiskie/default.nix
@@ -9,7 +9,7 @@
 , librsvg
 , python3
 , udisks2
-, wrapGAppsHook
+, wrapGAppsHook3
 , testers
 , udiskie
 }:
@@ -40,7 +40,7 @@ python3.pkgs.buildPythonApplication rec {
     gobject-introspection
     installShellFiles
     python3.pkgs.setuptools
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/misc/ulauncher/default.nix b/pkgs/applications/misc/ulauncher/default.nix
index 080e96359e5ad..9c455fa6ba729 100644
--- a/pkgs/applications/misc/ulauncher/default.nix
+++ b/pkgs/applications/misc/ulauncher/default.nix
@@ -7,7 +7,7 @@
 , gnome
 , gobject-introspection
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , webkitgtk
 , libnotify
 , keybinder3
@@ -32,7 +32,7 @@ python3Packages.buildPythonApplication rec {
     distutils-extra
     gobject-introspection
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
     gdk-pixbuf
   ];
 
diff --git a/pkgs/applications/misc/upwork/default.nix b/pkgs/applications/misc/upwork/default.nix
index e1cf49f61aec5..6375b2537258d 100644
--- a/pkgs/applications/misc/upwork/default.nix
+++ b/pkgs/applications/misc/upwork/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, requireFile, dpkg, wrapGAppsHook, autoPatchelfHook
+{ lib, stdenv, requireFile, dpkg, wrapGAppsHook3, autoPatchelfHook
 , alsa-lib, atk, at-spi2-atk, at-spi2-core, cairo, cups, dbus, expat, fontconfig, freetype
 , gdk-pixbuf, glib, gtk3, libcxx, libdrm, libnotify, libpulseaudio, libuuid, libX11, libxcb
 , libXcomposite, libXcursor, libXdamage, libXext, libXfixes, libXi, libXrandr, libXrender
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     dpkg
-    wrapGAppsHook
+    wrapGAppsHook3
     autoPatchelfHook
   ];
 
diff --git a/pkgs/applications/misc/variety/default.nix b/pkgs/applications/misc/variety/default.nix
index e26496718f39c..e90a8e9a1e01c 100644
--- a/pkgs/applications/misc/variety/default.nix
+++ b/pkgs/applications/misc/variety/default.nix
@@ -10,7 +10,7 @@
 , librsvg
 , python3
 , runtimeShell
-, wrapGAppsHook
+, wrapGAppsHook3
 , fehSupport ? false
 , feh
 , imagemagickSupport ? true
@@ -32,7 +32,7 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/misc/veracrypt/default.nix b/pkgs/applications/misc/veracrypt/default.nix
index 66aca8645adca..a7b0eed9037b0 100644
--- a/pkgs/applications/misc/veracrypt/default.nix
+++ b/pkgs/applications/misc/veracrypt/default.nix
@@ -13,7 +13,7 @@
 , ntfs3g
 , btrfs-progs
 , pcsclite
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "src";
 
-  nativeBuildInputs = [ makeself pkg-config yasm wrapGAppsHook ];
+  nativeBuildInputs = [ makeself pkg-config yasm wrapGAppsHook3 ];
   buildInputs = [ fuse lvm2 wxGTK pcsclite ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/viking/default.nix b/pkgs/applications/misc/viking/default.nix
index 8a987ed24672e..1335d950405fb 100644
--- a/pkgs/applications/misc/viking/default.nix
+++ b/pkgs/applications/misc/viking/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch
 , desktopToDarwinBundle
-, docbook_xml_dtd_45, docbook_xsl, intltool, itstool, libxslt, pkg-config, wrapGAppsHook, yelp-tools
+, docbook_xml_dtd_45, docbook_xsl, intltool, itstool, libxslt, pkg-config, wrapGAppsHook3, yelp-tools
 , curl, gdk-pixbuf, gtk3, json-glib, libxml2
 , gpsbabel
 , withGeoClue ? true, geoclue2
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ docbook_xml_dtd_45 docbook_xsl intltool itstool libxslt pkg-config wrapGAppsHook yelp-tools ]
+  nativeBuildInputs = [ docbook_xml_dtd_45 docbook_xsl intltool itstool libxslt pkg-config wrapGAppsHook3 yelp-tools ]
     ++ lib.optional stdenv.isDarwin desktopToDarwinBundle;
 
   buildInputs = [ curl gdk-pixbuf gtk3 json-glib libxml2 ]
diff --git a/pkgs/applications/misc/volnoti/default.nix b/pkgs/applications/misc/volnoti/default.nix
index bd61cd753f986..f03de6d9e658e 100644
--- a/pkgs/applications/misc/volnoti/default.nix
+++ b/pkgs/applications/misc/volnoti/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch
 , pkg-config, dbus, gdk-pixbuf, glib, libX11, gtk2, librsvg
-, dbus-glib, autoreconfHook, wrapGAppsHook }:
+, dbus-glib, autoreconfHook, wrapGAppsHook3 }:
 
 stdenv.mkDerivation {
   pname = "volnoti-unstable";
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config autoreconfHook wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config autoreconfHook wrapGAppsHook3 ];
 
   buildInputs = [
     dbus gdk-pixbuf glib libX11 gtk2 dbus-glib librsvg
diff --git a/pkgs/applications/misc/waypaper/default.nix b/pkgs/applications/misc/waypaper/default.nix
index 36f79865d31ad..2722d8782fb4d 100644
--- a/pkgs/applications/misc/waypaper/default.nix
+++ b/pkgs/applications/misc/waypaper/default.nix
@@ -2,7 +2,7 @@
 , python3
 , fetchFromGitHub
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , killall
 }:
 
@@ -19,7 +19,7 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/misc/wofi/default.nix b/pkgs/applications/misc/wofi/default.nix
index 30e7072644f39..fc124c56eb569 100644
--- a/pkgs/applications/misc/wofi/default.nix
+++ b/pkgs/applications/misc/wofi/default.nix
@@ -6,7 +6,7 @@
 , ninja
 , wayland
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , installShellFiles
 }:
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     vc = "hg";
   };
 
-  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook installShellFiles ];
+  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook3 installShellFiles ];
   buildInputs = [ wayland gtk3 ];
 
   patches = [
diff --git a/pkgs/applications/misc/workrave/default.nix b/pkgs/applications/misc/workrave/default.nix
index c4a5e692cfcac..ebe09f8b861c2 100644
--- a/pkgs/applications/misc/workrave/default.nix
+++ b/pkgs/applications/misc/workrave/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , autoconf
 , autoconf-archive
 , automake
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     intltool
     libtool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     jinja2
     gobject-introspection
   ];
diff --git a/pkgs/applications/misc/xautoclick/default.nix b/pkgs/applications/misc/xautoclick/default.nix
index 3429e80f0540e..68daf189fc9b2 100644
--- a/pkgs/applications/misc/xautoclick/default.nix
+++ b/pkgs/applications/misc/xautoclick/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, xorg, pkg-config
 , cmake, libevdev
-, gtkSupport ? true, gtk3, pcre, glib, wrapGAppsHook
+, gtkSupport ? true, gtk3, pcre, glib, wrapGAppsHook3
 , fltkSupport ? true, fltk
 , qtSupport ? true, qt5
 }:
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ libevdev xorg.libXtst ]
-    ++ lib.optionals gtkSupport [ gtk3 pcre glib wrapGAppsHook ]
+    ++ lib.optionals gtkSupport [ gtk3 pcre glib wrapGAppsHook3 ]
     ++ lib.optionals fltkSupport [ fltk ]
     ++ lib.optionals qtSupport [ qt5.qtbase qt5.wrapQtAppsHook ];
 
diff --git a/pkgs/applications/misc/xdgmenumaker/default.nix b/pkgs/applications/misc/xdgmenumaker/default.nix
index 130b97189a626..f2953805ff29c 100644
--- a/pkgs/applications/misc/xdgmenumaker/default.nix
+++ b/pkgs/applications/misc/xdgmenumaker/default.nix
@@ -6,7 +6,7 @@
 , pango
 , python3Packages
 , txt2tags
-, wrapGAppsHook
+, wrapGAppsHook3
 , gitUpdater
 }:
 
@@ -30,7 +30,7 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     gobject-introspection
     txt2tags
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/xiphos/default.nix b/pkgs/applications/misc/xiphos/default.nix
index 994127baca6d0..83690f129bffa 100644
--- a/pkgs/applications/misc/xiphos/default.nix
+++ b/pkgs/applications/misc/xiphos/default.nix
@@ -23,7 +23,7 @@
 , pkg-config
 , sword
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , yelp-tools
 , zip
 }:
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
     itstool
     libxslt
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     yelp-tools # for yelp-build
     zip # for building help epubs
   ];
diff --git a/pkgs/applications/misc/xneur/default.nix b/pkgs/applications/misc/xneur/default.nix
index e282d84f9c931..6f99290c517a8 100644
--- a/pkgs/applications/misc/xneur/default.nix
+++ b/pkgs/applications/misc/xneur/default.nix
@@ -5,7 +5,7 @@
 , autoreconfHook
 , intltool
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , enchant
 , gdk-pixbuf
 , glib
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     autoreconfHook
     intltool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/xpad/default.nix b/pkgs/applications/misc/xpad/default.nix
index 13b29491bf3f7..d945ae7ff0baa 100644
--- a/pkgs/applications/misc/xpad/default.nix
+++ b/pkgs/applications/misc/xpad/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl
-, autoreconfHook, pkg-config, wrapGAppsHook
+, autoreconfHook, pkg-config, wrapGAppsHook3
 , glib, intltool, gtk3, gtksourceview }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1qpmlwn0bcw1q73ag0l0fdnlzmwawfvsy4g9y5b0vyrc58lcp5d3";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook intltool ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook3 intltool ];
 
   buildInputs = [ glib gtk3 gtksourceview ];
 
diff --git a/pkgs/applications/misc/zathura/core/default.nix b/pkgs/applications/misc/zathura/core/default.nix
index 3b529c18f52dc..8b452c7f1a40c 100644
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, meson, ninja, wrapGAppsHook, pkg-config, gitUpdater
+{ lib, stdenv, fetchFromGitLab, meson, ninja, wrapGAppsHook3, pkg-config, gitUpdater
 , appstream-glib, json-glib, desktop-file-utils, python3
 , gtk, girara, gettext, libxml2, check
 , sqlite, glib, texlive, libintl, libseccomp
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     meson ninja pkg-config desktop-file-utils python3.pythonOnBuildForHost.pkgs.sphinx
-    gettext wrapGAppsHook libxml2 appstream-glib
+    gettext wrapGAppsHook3 libxml2 appstream-glib
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/badwolf/default.nix b/pkgs/applications/networking/browsers/badwolf/default.nix
index 5772586d8d4ef..dabbdf8981923 100644
--- a/pkgs/applications/networking/browsers/badwolf/default.nix
+++ b/pkgs/applications/networking/browsers/badwolf/default.nix
@@ -4,7 +4,7 @@
 , ninja
 , pkg-config
 , ed
-, wrapGAppsHook
+, wrapGAppsHook3
 , webkitgtk
 , libxml2
 , glib-networking
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     ed
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/brave/make-brave.nix b/pkgs/applications/networking/browsers/brave/make-brave.nix
index 8fde41e60a16b..f0b9fb6cf0c6e 100644
--- a/pkgs/applications/networking/browsers/brave/make-brave.nix
+++ b/pkgs/applications/networking/browsers/brave/make-brave.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wrapGAppsHook, makeWrapper
+{ lib, stdenv, fetchurl, wrapGAppsHook3, makeWrapper
 , alsa-lib
 , at-spi2-atk
 , at-spi2-core
@@ -112,7 +112,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     dpkg
-    (wrapGAppsHook.override { inherit makeWrapper; })
+    (wrapGAppsHook3.override { inherit makeWrapper; })
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/castor/default.nix b/pkgs/applications/networking/browsers/castor/default.nix
index 6d35a7091e8f5..f02ae0f6e05e3 100644
--- a/pkgs/applications/networking/browsers/castor/default.nix
+++ b/pkgs/applications/networking/browsers/castor/default.nix
@@ -2,7 +2,7 @@
 , fetchFromSourcehut
 , rustPlatform
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , openssl
 , gtk3
 , gdk-pixbuf
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index df33a2bbe7571..d78943a5c5c26 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -1,6 +1,7 @@
 { stdenv, lib, fetchurl, fetchpatch
 , recompressTarball
 , buildPackages
+, buildPlatform
 , pkgsBuildBuild
 , pkgsBuildTarget
 # Channel data:
@@ -114,9 +115,6 @@ let
     # "opus"
   ];
 
-  opusWithCustomModes = libopus.override {
-    withCustomModes = true;
-  };
 
   # build paths and release info
   packageName = extraAttrs.packageName or extraAttrs.name;
@@ -175,7 +173,6 @@ let
       buildPlatformLlvmStdenv.cc
       pkg-config
       libuuid
-      (libpng.override { apngSupport = false; }) # needed for "host/generate_colors_info"
     ]
     # When cross-compiling, chromium builds a huge proportion of its
     # components for both the `buildPlatform` (which it calls
@@ -183,12 +180,39 @@ let
     # half of the dependencies are needed here.  To avoid having to
     # maintain a separate list of buildPlatform-dependencies, we
     # simply throw in the kitchen sink.
-    ++ buildInputs
-    ;
+    # ** Because of overrides, we have to copy the list as it otherwise mess with splicing **
+    ++ [
+      (buildPackages.libpng.override { apngSupport = false; })  # https://bugs.chromium.org/p/chromium/issues/detail?id=752403
+      (buildPackages.libopus.override { withCustomModes = true; })
+      bzip2 flac speex
+      libevent expat libjpeg snappy
+      libcap
+      minizip libwebp
+      libusb1 re2
+      ffmpeg libxslt libxml2
+      nasm
+      nspr nss
+      util-linux alsa-lib
+      libkrb5
+      glib gtk3 dbus-glib
+      libXScrnSaver libXcursor libXtst libxshmfence libGLU libGL
+      mesa # required for libgbm
+      pciutils protobuf speechd libXdamage at-spi2-core
+      pipewire
+      libva
+      libdrm wayland mesa.drivers libxkbcommon
+      curl
+      libepoxy
+      libffi
+      libevdev
+    ] ++ lib.optional systemdSupport systemd
+      ++ lib.optionals cupsSupport [ libgcrypt cups ]
+      ++ lib.optional pulseSupport libpulseaudio;
 
     buildInputs = [
-      (libpng.override { apngSupport = false; }) # https://bugs.chromium.org/p/chromium/issues/detail?id=752403
-      bzip2 flac speex opusWithCustomModes
+      (libpng.override { apngSupport = false; })  # https://bugs.chromium.org/p/chromium/issues/detail?id=752403
+      (libopus.override { withCustomModes = true; })
+      bzip2 flac speex
       libevent expat libjpeg snappy
       libcap
       minizip libwebp
@@ -248,8 +272,8 @@ let
       # Partial revert of https://github.com/chromium/chromium/commit/3687976b0c6d36cf4157419a24a39f6770098d61
       # allowing us to use our rustc and our clang.
       ./patches/chromium-121-rust.patch
-    ] ++ lib.optionals (chromiumVersionAtLeast "124" && !chromiumVersionAtLeast "125") [
-      # M124 shipped with broken --ozone-platform-hint flag handling, which we rely on
+    ] ++ lib.optionals (chromiumVersionAtLeast "124" && !chromiumVersionAtLeast "124.0.6367.118") [
+      # M124 < 124.0.6367.118 shipped with broken --ozone-platform-hint flag handling, which we rely on
       # for our NIXOS_OZONE_WL (wayland) environment variable.
       # See <https://issues.chromium.org/issues/329678163>.
       # This is the commit for the fix that landed in M125, which applies clean on M124.
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index c3ef4848ee44e..345370868d715 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -15,9 +15,9 @@
         version = "2024-03-14";
       };
     };
-    hash = "sha256-tajZtdiXgs5lRLTmDmgNTM2vD+N+LuWpBS0dYzxUsMA=";
-    hash_deb_amd64 = "sha256-CyCbZQ5ce8WLTt2JVSqbDkLDboE4BloiZ8pJff3dmSY=";
-    version = "124.0.6367.91";
+    hash = "sha256-+r/48dxipSAo74v1deMuKalW+Hj85hCun63ZcgLYDLk=";
+    hash_deb_amd64 = "sha256-H3bv6WiVBl4j38ROZ80+SD9UO9ok+xxcKFxDd9yjWNY=";
+    version = "124.0.6367.118";
   };
   ungoogled-chromium = {
     deps = {
diff --git a/pkgs/applications/networking/browsers/eolie/default.nix b/pkgs/applications/networking/browsers/eolie/default.nix
index 4b9270b7d5180..8649969d8c30a 100644
--- a/pkgs/applications/networking/browsers/eolie/default.nix
+++ b/pkgs/applications/networking/browsers/eolie/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchgit, meson, ninja, pkg-config, nix-update-script
 , python3, gtk3, libsecret, gst_all_1, webkitgtk, glib
 , glib-networking, gtkspell3, hunspell, desktop-file-utils
-, gobject-introspection, wrapGAppsHook, gnome }:
+, gobject-introspection, wrapGAppsHook3, gnome }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "eolie";
@@ -23,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = with gst_all_1; [
@@ -72,7 +72,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "A new GNOME web browser";
     mainProgram = "eolie";
-    homepage = "https://wiki.gnome.org/Apps/Eolie";
+    homepage = "https://gitlab.gnome.org/World/eolie";
     license  = licenses.gpl3Plus;
     maintainers = with maintainers; [ samdroid-apps ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/networking/browsers/ephemeral/default.nix b/pkgs/applications/networking/browsers/ephemeral/default.nix
index 4002d52715b30..41ae308ff0312 100644
--- a/pkgs/applications/networking/browsers/ephemeral/default.nix
+++ b/pkgs/applications/networking/browsers/ephemeral/default.nix
@@ -14,7 +14,7 @@
 , pkg-config
 , python3
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib-networking
 }:
 
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     vala
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index 44b63cab7dbbe..81abbb268397f 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, config, wrapGAppsHook, autoPatchelfHook
+{ lib, stdenv, fetchurl, config, wrapGAppsHook3, autoPatchelfHook
 , alsa-lib
 , curl
 , dbus-glib
@@ -64,7 +64,7 @@ stdenv.mkDerivation {
 
   src = fetchurl { inherit (source) url sha256; };
 
-  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook patchelfUnstable ];
+  nativeBuildInputs = [ wrapGAppsHook3 autoPatchelfHook patchelfUnstable ];
   buildInputs = [
     gtk3
     adwaita-icon-theme
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 4483cd31bd653..56dda27e54c92 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -50,7 +50,7 @@ in
 , rustPlatform
 , unzip
 , which
-, wrapGAppsHook
+, wrapGAppsHook3
 
 # runtime
 , bzip2
@@ -289,7 +289,7 @@ buildStdenv.mkDerivation {
     rustc
     unzip
     which
-    wrapGAppsHook
+    wrapGAppsHook3
   ]
   ++ lib.optionals crashreporterSupport [ dump_syms patchelf ]
   ++ lib.optionals pgoSupport [ xvfb-run ]
diff --git a/pkgs/applications/networking/browsers/luakit/default.nix b/pkgs/applications/networking/browsers/luakit/default.nix
index a861f2f44bfc4..6011755e3892e 100644
--- a/pkgs/applications/networking/browsers/luakit/default.nix
+++ b/pkgs/applications/networking/browsers/luakit/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , help2man
 , glib-networking
 , gst_all_1
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     help2man
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   buildInputs = [
     gtk3
diff --git a/pkgs/applications/networking/browsers/midori/default.nix b/pkgs/applications/networking/browsers/midori/default.nix
index 3bf46be683193..f937f690b5820 100644
--- a/pkgs/applications/networking/browsers/midori/default.nix
+++ b/pkgs/applications/networking/browsers/midori/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , intltool
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , gcr
 , libpeas
 , gtk3
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/mullvad-browser/default.nix b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
index a34b5022a7a39..580bee84b70ea 100644
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
@@ -5,7 +5,7 @@
 , copyDesktopItems
 , makeWrapper
 , writeText
-, wrapGAppsHook
+, wrapGAppsHook3
 , autoPatchelfHook
 , callPackage
 
@@ -125,7 +125,7 @@ stdenv.mkDerivation rec {
 
   src = sources.${stdenv.hostPlatform.system} or (throw "unsupported system: ${stdenv.hostPlatform.system}");
 
-  nativeBuildInputs = [ copyDesktopItems makeWrapper wrapGAppsHook autoPatchelfHook ];
+  nativeBuildInputs = [ copyDesktopItems makeWrapper wrapGAppsHook3 autoPatchelfHook ];
   buildInputs = [
     gtk3
     alsa-lib
diff --git a/pkgs/applications/networking/browsers/netsurf/browser.nix b/pkgs/applications/networking/browsers/netsurf/browser.nix
index 6feb02faa9d2b..36f669439d000 100644
--- a/pkgs/applications/networking/browsers/netsurf/browser.nix
+++ b/pkgs/applications/networking/browsers/netsurf/browser.nix
@@ -20,7 +20,7 @@
 , openssl
 , perlPackages
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , xxd
 
 # Netsurf-specific dependencies
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     xxd
   ]
-  ++ lib.optional (uilib == "gtk2" || uilib == "gtk3") wrapGAppsHook;
+  ++ lib.optional (uilib == "gtk2" || uilib == "gtk3") wrapGAppsHook3;
 
   buildInputs = [
     check
diff --git a/pkgs/applications/networking/browsers/nyxt/default.nix b/pkgs/applications/networking/browsers/nyxt/default.nix
index 6a990201c75d9..d0a040748dc87 100644
--- a/pkgs/applications/networking/browsers/nyxt/default.nix
+++ b/pkgs/applications/networking/browsers/nyxt/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, sbclPackages
-, makeWrapper, wrapGAppsHook, gst_all_1
+, makeWrapper, wrapGAppsHook3, gst_all_1
 , glib, gdk-pixbuf, cairo
 , mailcap, pango, gtk3
 , glib-networking, gsettings-desktop-schemas
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = sbclPackages.nyxt;
 
-  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook3 ];
   gstBuildInputs = with gst_all_1; [
     gstreamer gst-libav
     gst-plugins-base
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index 94f2a466295f4..e8638a1313f9e 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -40,7 +40,7 @@
 , at-spi2-atk
 , at-spi2-core
 , autoPatchelfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , qt6
 , proprietaryCodecs ? false
 , vivaldi-ffmpeg-codecs
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     dpkg
     autoPatchelfHook
-    wrapGAppsHook
+    wrapGAppsHook3
     qt6.wrapQtAppsHook
   ];
 
diff --git a/pkgs/applications/networking/browsers/palemoon/bin.nix b/pkgs/applications/networking/browsers/palemoon/bin.nix
index 9b3ea171b4f5e..3a449623a0f61 100644
--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@@ -13,7 +13,7 @@
 , libXt
 , libpulseaudio
 , makeDesktopItem
-, wrapGAppsHook
+, wrapGAppsHook3
 , writeScript
 , testers
 }:
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     autoPatchelfHook
     copyDesktopItems
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/surf/default.nix b/pkgs/applications/networking/browsers/surf/default.nix
index 012a86aadb384..ad1b9a51a4432 100644
--- a/pkgs/applications/networking/browsers/surf/default.nix
+++ b/pkgs/applications/networking/browsers/surf/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit
-, pkg-config, wrapGAppsHook
+, pkg-config, wrapGAppsHook3
 , glib, gcr, glib-networking, gsettings-desktop-schemas, gtk, libsoup, webkitgtk
 , xorg, dmenu, findutils, gnused, coreutils, gst_all_1
 , patches ? null
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "1v926hiayddylq79n8l7dy51bm0dsa9n18nx9bkhg666cx973x4z";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = [
     glib
     gcr
diff --git a/pkgs/applications/networking/browsers/tor-browser/default.nix b/pkgs/applications/networking/browsers/tor-browser/default.nix
index 91456e85e6f7e..7ab20a22b8d7a 100644
--- a/pkgs/applications/networking/browsers/tor-browser/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser/default.nix
@@ -6,7 +6,7 @@
 , makeWrapper
 , writeText
 , autoPatchelfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , callPackage
 
 , atk
@@ -144,7 +144,7 @@ stdenv.mkDerivation rec {
 
   src = sources.${stdenv.hostPlatform.system} or (throw "unsupported system: ${stdenv.hostPlatform.system}");
 
-  nativeBuildInputs = [ autoPatchelfHook copyDesktopItems makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ autoPatchelfHook copyDesktopItems makeWrapper wrapGAppsHook3 ];
   buildInputs = [
     gtk3
     alsa-lib
diff --git a/pkgs/applications/networking/browsers/vimb/default.nix b/pkgs/applications/networking/browsers/vimb/default.nix
index 8df37ed5e0862..a78fcf36f3840 100644
--- a/pkgs/applications/networking/browsers/vimb/default.nix
+++ b/pkgs/applications/networking/browsers/vimb/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, libsoup, webkitgtk, gtk3, glib-networking
-, gsettings-desktop-schemas, wrapGAppsHook
+, gsettings-desktop-schemas, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Eq4riJSznKpkW9JJDnTCLxZ9oMJTmWkIoGphOiCcSAg=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook pkg-config ];
+  nativeBuildInputs = [ wrapGAppsHook3 pkg-config ];
   buildInputs = [ gtk3 libsoup webkitgtk glib-networking gsettings-desktop-schemas ];
 
   passthru = {
diff --git a/pkgs/applications/networking/browsers/yandex-browser/default.nix b/pkgs/applications/networking/browsers/yandex-browser/default.nix
index 9c1e5a0d22455..d5f761c3b1f8a 100644
--- a/pkgs/applications/networking/browsers/yandex-browser/default.nix
+++ b/pkgs/applications/networking/browsers/yandex-browser/default.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchurl
 , autoPatchelfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , flac
 , gnome2
 , harfbuzzFull
@@ -83,7 +83,7 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoPatchelfHook
     qt6.wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/calls/default.nix b/pkgs/applications/networking/calls/default.nix
index 77a80df87ed58..92c9978b4a143 100644
--- a/pkgs/applications/networking/calls/default.nix
+++ b/pkgs/applications/networking/calls/default.nix
@@ -21,7 +21,7 @@
 , libgdata
 , dbus
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , xvfb-run
 , gtk-doc
 , docbook-xsl-nons
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     desktop-file-utils
     appstream-glib
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     gtk-doc
     docbook-xsl-nons
     docbook_xml_dtd_43
diff --git a/pkgs/applications/networking/cluster/kn/default.nix b/pkgs/applications/networking/cluster/kn/default.nix
index 3a5f18cbf581d..3face97137cca 100644
--- a/pkgs/applications/networking/cluster/kn/default.nix
+++ b/pkgs/applications/networking/cluster/kn/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kn";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "knative";
     repo = "client";
     rev = "knative-v${version}";
-    sha256 = "sha256-irMipYDYMyA0l9d7tI1wS7XsxGWjBzTvxmhpKM1gLW8=";
+    sha256 = "sha256-sUMQrBAOhpMxMawOdvLFSUrcU9od6pmT7NabSywoQn8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/temporal/default.nix b/pkgs/applications/networking/cluster/temporal/default.nix
index b077379bee79e..49094fa960429 100644
--- a/pkgs/applications/networking/cluster/temporal/default.nix
+++ b/pkgs/applications/networking/cluster/temporal/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "temporal";
-  version = "1.23.0";
+  version = "1.23.1";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "temporal";
     rev = "v${version}";
-    hash = "sha256-4e8z4k7loL9vVYe5jut1X/5qDboChQxZtPO1ZBHNb7o=";
+    hash = "sha256-yu5EfW5ThTJx6ouCBoEEq9wU4MtlFGqqRaHMgIPaRqY=";
   };
 
-  vendorHash = "sha256-4xwdVFE0CGcOA8Efj4ECionPP9rbzT02zyr2HR143AM=";
+  vendorHash = "sha256-INmc/qbayjI+umkoGL8ih/iC7xqUkO1kfIZN5cQn/bw=";
 
   excludedPackages = [ "./build" ];
 
diff --git a/pkgs/applications/networking/dropbox/cli.nix b/pkgs/applications/networking/dropbox/cli.nix
index 38c5220563761..a922d70cd68fd 100644
--- a/pkgs/applications/networking/dropbox/cli.nix
+++ b/pkgs/applications/networking/dropbox/cli.nix
@@ -12,7 +12,7 @@
 }:
 
 let
-  version = "2023.09.06";
+  version = "2024.04.17";
   dropboxd = "${dropbox}/bin/dropbox";
 in
 stdenv.mkDerivation {
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://linux.dropbox.com/packages/nautilus-dropbox-${version}.tar.bz2";
-    hash = "sha256-kZMwj8Fn8Hf58C57wE025TlmiSs5TaKMGEzvb2QjgSw=";
+    hash = "sha256-pqCYzxaqR0f0CBaseT1Z436K47cIDQswYR1sK4Zj8sE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix b/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix
index 902b6a7b35cb2..edab321b11b0e 100644
--- a/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix
+++ b/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix
@@ -8,7 +8,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 
 , glib
 , glib-networking
@@ -40,7 +40,7 @@ python3.pkgs.buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/feedreaders/rssguard/default.nix b/pkgs/applications/networking/feedreaders/rssguard/default.nix
index 499b8a2893d0e..1a3124f64ad5a 100644
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@@ -4,7 +4,7 @@
 , cmake
 , qtwebengine
 , qttools
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs =  [ qtwebengine qttools ];
-  nativeBuildInputs = [ cmake wrapGAppsHook wrapQtAppsHook ];
+  nativeBuildInputs = [ cmake wrapGAppsHook3 wrapQtAppsHook ];
   qmakeFlags = [ "CONFIG+=release" ];
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/ftp/filezilla/default.nix b/pkgs/applications/networking/ftp/filezilla/default.nix
index 351fafc136ff2..10cf454dc659e 100644
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@@ -12,7 +12,7 @@
 , sqlite
 , tinyxml
 , boost
-, wrapGAppsHook
+, wrapGAppsHook3
 , wxGTK32
 , gtk3
 , xdg-utils
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     "--disable-autoupdatecheck"
   ];
 
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook3 ];
 
   buildInputs = [
     boost
diff --git a/pkgs/applications/networking/ftp/taxi/default.nix b/pkgs/applications/networking/ftp/taxi/default.nix
index 75e3b43a1a274..b29ee472f146b 100644
--- a/pkgs/applications/networking/ftp/taxi/default.nix
+++ b/pkgs/applications/networking/ftp/taxi/default.nix
@@ -14,7 +14,7 @@
 , pkg-config
 , python3
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/alfaview/default.nix b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
index 666140c8dec2b..c8bea44ddd787 100644
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, dpkg, autoPatchelfHook, makeWrapper, wrapGAppsHook
+{ stdenv, lib, fetchurl, dpkg, autoPatchelfHook, makeWrapper, wrapGAppsHook3
 , alsa-lib, dbus, fontconfig, freetype, glib, gst_all_1, libGL
 , libinput, libpulseaudio, libsecret, libtiff, libxkbcommon
 , mesa, openssl, systemd, xorg }:
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     dpkg
     makeWrapper
     autoPatchelfHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/armcord/default.nix b/pkgs/applications/networking/instant-messengers/armcord/default.nix
index c52ed6fe5cc53..a52b77905a516 100644
--- a/pkgs/applications/networking/instant-messengers/armcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/armcord/default.nix
@@ -4,7 +4,7 @@
 , autoPatchelfHook
 , dpkg
 , makeBinaryWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , alsa-lib
 , at-spi2-atk
 , at-spi2-core
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
         };
       }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
-  nativeBuildInputs = [ autoPatchelfHook dpkg makeBinaryWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ autoPatchelfHook dpkg makeBinaryWrapper wrapGAppsHook3 ];
 
   dontWrapGApps = true;
 
diff --git a/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix b/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
index 841df5a4cd610..95956b3f25605 100644
--- a/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
@@ -7,7 +7,7 @@
 , cargo-tauri
 , cinny
 , copyDesktopItems
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , openssl
 , dbus
@@ -65,7 +65,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     copyDesktopItems
-    wrapGAppsHook
+    wrapGAppsHook3
     pkg-config
     cargo-tauri
   ];
diff --git a/pkgs/applications/networking/instant-messengers/coyim/default.nix b/pkgs/applications/networking/instant-messengers/coyim/default.nix
index 8223f9598b61f..47fb0f161063f 100644
--- a/pkgs/applications/networking/instant-messengers/coyim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/coyim/default.nix
@@ -7,7 +7,7 @@
 , gdk-pixbuf
 , glib
 , gnome
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 }:
 
@@ -24,7 +24,7 @@ buildGoPackage rec {
     sha256 = "sha256-PmB6POaHKEXzIAaz3lAbUOhtVOzrj5oXRk90giYo6SI=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   buildInputs = [ glib cairo gdk-pixbuf gtk3 gnome.adwaita-icon-theme ];
 
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index 1d7a64b892a09..eb3f29cf2a391 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -1,5 +1,5 @@
 { pname, version, src, meta, binaryName, desktopName, autoPatchelfHook
-, makeDesktopItem, lib, stdenv, wrapGAppsHook, makeShellWrapper, alsa-lib, at-spi2-atk
+, makeDesktopItem, lib, stdenv, wrapGAppsHook3, makeShellWrapper, alsa-lib, at-spi2-atk
 , at-spi2-core, atk, cairo, cups, dbus, expat, fontconfig, freetype, gdk-pixbuf
 , glib, gtk3, libcxx, libdrm, libglvnd, libnotify, libpulseaudio, libuuid, libX11
 , libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext, libXfixes
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     libxshmfence
     mesa
     nss
-    wrapGAppsHook
+    wrapGAppsHook3
     makeShellWrapper
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/feishu/default.nix b/pkgs/applications/networking/instant-messengers/feishu/default.nix
index 8900f26d90a45..6d89bca9e4fa0 100644
--- a/pkgs/applications/networking/instant-messengers/feishu/default.nix
+++ b/pkgs/applications/networking/instant-messengers/feishu/default.nix
@@ -55,7 +55,7 @@
 , stdenv
 , systemd
 , wayland
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 
 # for custom command line arguments, e.g. "--use-gl=desktop"
diff --git a/pkgs/applications/networking/instant-messengers/franz/generic.nix b/pkgs/applications/networking/instant-messengers/franz/generic.nix
index 533c5c7310b38..dcbb29e61afcc 100644
--- a/pkgs/applications/networking/instant-messengers/franz/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/generic.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , autoPatchelfHook
 , dpkg
 , xorg
@@ -38,7 +38,7 @@ in stdenv.mkDerivation (rec {
   # Don't remove runtime deps.
   dontPatchELF = true;
 
-  nativeBuildInputs = [ autoPatchelfHook makeWrapper wrapGAppsHook dpkg ];
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper wrapGAppsHook3 dpkg ];
   buildInputs = extraBuildInputs ++ (with xorg; [
     libXi
     libXcursor
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index 458577b8d053c..765e03425aaf1 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, fetchFromGitLab, gettext, wrapGAppsHook
+{ lib, fetchurl, fetchFromGitLab, gettext, wrapGAppsHook3
 
 # Native dependencies
 , python3, gtk3, gobject-introspection, gnome
@@ -41,7 +41,7 @@ python3.pkgs.buildPythonApplication rec {
     ++ lib.optional enableAppIndicator libappindicator-gtk3;
 
   nativeBuildInputs = [
-    gettext wrapGAppsHook gobject-introspection
+    gettext wrapGAppsHook3 gobject-introspection
   ];
 
   dontWrapGApps = true;
@@ -77,7 +77,7 @@ python3.pkgs.buildPythonApplication rec {
   # test are broken in 1.7.3, 1.8.0
   doCheck = false;
 
-  # necessary for wrapGAppsHook
+  # necessary for wrapGAppsHook3
   strictDeps = false;
 
   meta = {
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index 98b4b69e69293..91676d45a04c0 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -50,7 +50,7 @@
 , qtsvg
 , qtwebengine
 , qtwebchannel
-, wrapGAppsHook
+, wrapGAppsHook3
 , withWebengine ? true
 
   # for pjsip
@@ -204,7 +204,7 @@ stdenv.mkDerivation rec {
   dontWrapGApps = true;
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
     pkg-config
     cmake
diff --git a/pkgs/applications/networking/instant-messengers/mikutter/default.nix b/pkgs/applications/networking/instant-messengers/mikutter/default.nix
index b34ed84d044da..3938d03447f83 100644
--- a/pkgs/applications/networking/instant-messengers/mikutter/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mikutter/default.nix
@@ -12,7 +12,7 @@
 , libnotify
 , makeDesktopItem
 , which
-, wrapGAppsHook
+, wrapGAppsHook3
 , writeText
 }:
 
@@ -78,7 +78,7 @@ with mikutterPaths; stdenv.mkDerivation rec {
     sha256 = "05253nz4i1lmnq6czj48qdab2ny4vx2mznj6nsn2l1m2z6zqkwk3";
   };
 
-  nativeBuildInputs = [ copyDesktopItems wrapGAppsHook gobject-introspection ]
+  nativeBuildInputs = [ copyDesktopItems wrapGAppsHook3 gobject-introspection ]
     ++ lib.optionals stdenv.isDarwin [ libicns ];
   buildInputs = [
     atk
diff --git a/pkgs/applications/networking/instant-messengers/qq/default.nix b/pkgs/applications/networking/instant-messengers/qq/default.nix
index eea656250b93f..af5bdcc15f487 100644
--- a/pkgs/applications/networking/instant-messengers/qq/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/default.nix
@@ -20,7 +20,7 @@
 , at-spi2-core
 , autoPatchelfHook
 , makeShellWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , commandLineArgs ? ""
 }:
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     autoPatchelfHook
     makeShellWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     dpkg
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
index 737e867bf5a63..4d7c987a213be 100644
--- a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, pkgs, fetchurl, wrapGAppsHook }:
+{ lib, stdenv, pkgs, fetchurl, wrapGAppsHook3 }:
 let
   libPathNative = { packages }: lib.makeLibraryPath packages;
 in
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook #to fully work with gnome also needs programs.dconf.enable = true in your configuration.nix
+    wrapGAppsHook3 #to fully work with gnome also needs programs.dconf.enable = true in your configuration.nix
   ];
 
   buildInputs = with pkgs; [
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
index e8518c310a7c1..c1aa03d799cc9 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , autoPatchelfHook
 , dpkg
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeWrapper
 , nixosTests
 , gtk3
@@ -75,7 +75,7 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoPatchelfHook
     dpkg
-    (wrapGAppsHook.override { inherit makeWrapper; })
+    (wrapGAppsHook3.override { inherit makeWrapper; })
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
index 62b6e1c9a4847..a87d49de7621f 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop-beta";
   dir = "Signal Beta";
-  version = "7.6.0-beta.3";
+  version = "7.7.0-beta.1";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-BbXogNB2BxFQTpvHw0JVOaCV2PQHEQbafSavVcBd/Fg=";
+  hash = "sha256-oswS1aRkpiTNSpQ6CqfJnoM412RRwraeht4iqq8L1Bk=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
index 50db157ccac17..99ff0b412e2cd 100644
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, dpkg
 , alsa-lib, atk, cairo, cups, curl, dbus, expat, fontconfig, freetype, gdk-pixbuf, glib, glibc, gnome
-, gtk3, libappindicator-gtk3, libnotify, libpulseaudio, libsecret, libv4l, nspr, nss, pango, systemd, wrapGAppsHook, xorg
+, gtk3, libappindicator-gtk3, libnotify, libpulseaudio, libsecret, libv4l, nspr, nss, pango, systemd, wrapGAppsHook3, xorg
 , at-spi2-atk, libuuid, at-spi2-core, libdrm, mesa, libxkbcommon, libxshmfence }:
 
 let
@@ -82,7 +82,7 @@ in stdenv.mkDerivation {
   inherit src;
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     glib # For setup hook populating GSETTINGS_SCHEMA_PATH
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
index 906736be49774..952c13f0e6d30 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@@ -7,7 +7,7 @@
 , ninja
 , python3
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 , extra-cmake-modules
 , qtbase
@@ -110,7 +110,7 @@ stdenv.mkDerivation rec {
     wrapQtAppsHook
   ] ++ lib.optionals stdenv.isLinux [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
     extra-cmake-modules
   ] ++ lib.optionals stdenv.isDarwin [
     lld
diff --git a/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix b/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix
index 0d320485fe74c..50be0777ae4eb 100644
--- a/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix
+++ b/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, rpmextract, undmg, autoPatchelfHook
 , xorg, gtk3, nss, alsa-lib, udev, libnotify
-, wrapGAppsHook }:
+, wrapGAppsHook3 }:
 
 let
   pname = "vk-messenger";
@@ -33,7 +33,7 @@ let
   linux = stdenv.mkDerivation {
     inherit pname version src meta;
 
-    nativeBuildInputs = [ rpmextract autoPatchelfHook wrapGAppsHook ];
+    nativeBuildInputs = [ rpmextract autoPatchelfHook wrapGAppsHook3 ];
     buildInputs = (with xorg; [
       libXdamage libXtst libXScrnSaver libxkbfile
     ]) ++ [ gtk3 nss alsa-lib ];
diff --git a/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix
index 366dcbeffaea4..7022cc282f662 100644
--- a/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix
@@ -21,25 +21,25 @@
 , pcre2
 , pkg-config
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , xorg
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "whatsapp-for-linux";
   version = "1.6.4";
 
   src = fetchFromGitHub {
     owner = "eneshecan";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-DU9tvIvDfOtBydR68yeRMFYdMjiBrOobCDXIZMmm7pQ=";
+    repo = "whatsapp-for-linux";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-DU9tvIvDfOtBydR68yeRMFYdMjiBrOobCDXIZMmm7pQ=";
   };
 
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -68,12 +68,12 @@ stdenv.mkDerivation rec {
     xorg.libXtst
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/eneshecan/whatsapp-for-linux";
     description = "Whatsapp desktop messaging app";
     mainProgram = "whatsapp-for-linux";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ bartuka ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ bartuka ];
     platforms = [ "x86_64-linux" ];
   };
-}
+})
diff --git a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
index 4109c5f04cf27..0dcacc526d103 100644
--- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
@@ -6,7 +6,7 @@
 , stdenv
 , lib
 , udev
-, wrapGAppsHook
+, wrapGAppsHook3
 , cpio
 , xar
 , libdbusmenu
@@ -98,7 +98,7 @@ let
       autoPatchelfHook
       dpkg
       makeWrapper
-      wrapGAppsHook
+      wrapGAppsHook3
     ];
 
     buildInputs = [
diff --git a/pkgs/applications/networking/irc/srain/default.nix b/pkgs/applications/networking/irc/srain/default.nix
index 42fd7e1fb6530..3493fa5497b4d 100644
--- a/pkgs/applications/networking/irc/srain/default.nix
+++ b/pkgs/applications/networking/irc/srain/default.nix
@@ -16,7 +16,7 @@
 , python3Packages
 , meson
 , ninja
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     appstream-glib
-    wrapGAppsHook
+    wrapGAppsHook3
     python3Packages.sphinx
   ];
 
diff --git a/pkgs/applications/networking/mailreaders/astroid/default.nix b/pkgs/applications/networking/mailreaders/astroid/default.nix
index 249d262fe1e90..e56697be4f995 100644
--- a/pkgs/applications/networking/mailreaders/astroid/default.nix
+++ b/pkgs/applications/networking/mailreaders/astroid/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config, gnome, gmime3, webkitgtk, ronn
-, libsass, notmuch, boost, wrapGAppsHook, glib-networking, protobuf
+, libsass, notmuch, boost, wrapGAppsHook3, glib-networking, protobuf
 , gtkmm3, libpeas, gsettings-desktop-schemas, gobject-introspection, python3
 
 # vim to be used, should support the GUI mode.
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    cmake ronn pkg-config wrapGAppsHook gobject-introspection
+    cmake ronn pkg-config wrapGAppsHook3 gobject-introspection
     python3 python3.pkgs.wrapPython
   ];
 
diff --git a/pkgs/applications/networking/mailreaders/ayatana-webmail/default.nix b/pkgs/applications/networking/mailreaders/ayatana-webmail/default.nix
index 14be9ab4f3d6c..8adb3acfe407a 100644
--- a/pkgs/applications/networking/mailreaders/ayatana-webmail/default.nix
+++ b/pkgs/applications/networking/mailreaders/ayatana-webmail/default.nix
@@ -7,7 +7,7 @@
 , libnotify
 , glib
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 # BTW libappindicator is also supported, but upstream recommends their
 # implementation, see:
 # https://github.com/AyatanaIndicators/ayatana-webmail/issues/24#issuecomment-1050352862
@@ -47,7 +47,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
     glib # For compiling gsettings-schemas
   ];
 
diff --git a/pkgs/applications/networking/mailreaders/balsa/default.nix b/pkgs/applications/networking/mailreaders/balsa/default.nix
index 876a690de5a50..3602ef602fe1e 100644
--- a/pkgs/applications/networking/mailreaders/balsa/default.nix
+++ b/pkgs/applications/networking/mailreaders/balsa/default.nix
@@ -19,7 +19,7 @@
 , pkg-config
 , sqlite
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     pkg-config
     intltool
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/bluemail/default.nix b/pkgs/applications/networking/mailreaders/bluemail/default.nix
index d7e1a4026de33..f565a5732f5dc 100644
--- a/pkgs/applications/networking/mailreaders/bluemail/default.nix
+++ b/pkgs/applications/networking/mailreaders/bluemail/default.nix
@@ -14,7 +14,7 @@
 , libxshmfence
 , makeDesktopItem
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , gcc-unwrapped
 , udev
 }:
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     copyDesktopItems
     makeWrapper
     dpkg
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/bubblemail/default.nix b/pkgs/applications/networking/mailreaders/bubblemail/default.nix
index bd5783a5c656c..3e5a6b1404ec6 100644
--- a/pkgs/applications/networking/mailreaders/bubblemail/default.nix
+++ b/pkgs/applications/networking/mailreaders/bubblemail/default.nix
@@ -7,7 +7,7 @@
 , libnotify
 , gst_all_1
 , libsecret
-, wrapGAppsHook
+, wrapGAppsHook3
 , gsettings-desktop-schemas
 , gnome-online-accounts
 , glib
@@ -45,7 +45,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
     python3Packages.pillow
     # For setup-hook
     gobject-introspection
diff --git a/pkgs/applications/networking/mailreaders/claws-mail/default.nix b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
index 16bc93304921a..db98db2b3397d 100644
--- a/pkgs/applications/networking/mailreaders/claws-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, wrapGAppsHook, autoreconfHook, bison, flex
+{ stdenv, lib, fetchurl, wrapGAppsHook3, autoreconfHook, bison, flex
 , curl, gtk3, pkg-config, python3, shared-mime-info
 , glib-networking, gsettings-desktop-schemas
 
@@ -123,7 +123,7 @@ in stdenv.mkDerivation rec {
         --subst-var-by MIMEROOTDIR ${shared-mime-info}/share
   '';
 
-  nativeBuildInputs = [ autoreconfHook pkg-config bison flex wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config bison flex wrapGAppsHook3 ];
   propagatedBuildInputs = pythonPkgs;
 
   buildInputs =
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
index a6a6efa772661..368c9f897dc79 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.50.3";
+  version = "3.52.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "4vpZQTdq1X4H0mc/hnbDH38rBo1J9o6g+4uv6rtSm+0=";
+    hash = "sha256-TR9OlipFClJnADNQiaOQfZgMB2Z/q9Vmmag06Z2HSrI=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index 252bfb08e93f8..dd7342eadc4f1 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -17,7 +17,7 @@
 , libgweather
 , glib-networking
 , gsettings-desktop-schemas
-, wrapGAppsHook
+, wrapGAppsHook3
 , itstool
 , shared-mime-info
 , libical
@@ -44,11 +44,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.50.4";
+  version = "3.52.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-4PlVyhTfsbLhaC/PoYFqA8EUuBYZmPls+daBpqOEJpg=";
+    hash = "sha256-aNrtER2t42GMpwjss8q0zZO6UC9a6dXnlwc8OhPinek=";
   };
 
   nativeBuildInputs = [
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     libxml2
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -126,7 +126,7 @@ stdenv.mkDerivation rec {
   PKG_CONFIG_LIBEDATASERVERUI_1_2_UIMODULEDIR = "${placeholder "out"}/lib/evolution-data-server/ui-modules";
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Evolution";
+    homepage = "https://gitlab.gnome.org/GNOME/evolution";
     description = "Personal information management application that provides integrated mail, calendaring and address book functionality";
     mainProgram = "evolution";
     maintainers = teams.gnome.members;
diff --git a/pkgs/applications/networking/mailreaders/mailnag/default.nix b/pkgs/applications/networking/mailreaders/mailnag/default.nix
index 4f6b3015cf34c..6c887ef66ce53 100644
--- a/pkgs/applications/networking/mailreaders/mailnag/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailnag/default.nix
@@ -8,7 +8,7 @@
 , libnotify
 , gst_all_1
 , libsecret
-, wrapGAppsHook
+, wrapGAppsHook3
 , gsettings-desktop-schemas
 , glib
 , gobject-introspection
@@ -46,7 +46,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     # To later add plugins to
     xorg.lndir
@@ -67,7 +67,7 @@ python3Packages.buildPythonApplication rec {
         # goa plugin requires gio's gnome-online-accounts which requires making sure
         # mailnag runs with GI_TYPELIB_PATH containing the path to Goa-1.0.typelib.
         # This is handled best by adding the plugins' deps to buildInputs and let
-        # wrapGAppsHook handle that.
+        # wrapGAppsHook3 handle that.
         pluginsDeps = lib.flatten (lib.catAttrs "buildInputs" plugs);
         self = mailnag;
       in
diff --git a/pkgs/applications/networking/mailreaders/mailspring/linux.nix b/pkgs/applications/networking/mailreaders/mailspring/linux.nix
index dff8796f6ce2c..47fe6697f48e4 100644
--- a/pkgs/applications/networking/mailreaders/mailspring/linux.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/linux.nix
@@ -11,7 +11,7 @@
 , dpkg
 , glib
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , libkrb5
 , libsecret
 , nss
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     autoPatchelfHook
     dpkg
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
index 984881508929d..5026afeaea0bf 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@@ -3,7 +3,7 @@
 # To update `thunderbird-bin`'s `release_sources.nix`, run from the nixpkgs root:
 #
 #     nix-shell maintainers/scripts/update.nix --argstr package pkgs.thunderbird-bin-unwrapped
-{ lib, stdenv, fetchurl, config, wrapGAppsHook
+{ lib, stdenv, fetchurl, config, wrapGAppsHook3
 , alsa-lib
 , atk
 , cairo
@@ -147,7 +147,7 @@ stdenv.mkDerivation {
 
   inherit gtk3;
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   buildInputs = [ gtk3 adwaita-icon-theme ];
 
diff --git a/pkgs/applications/networking/newsreaders/liferea/default.nix b/pkgs/applications/networking/newsreaders/liferea/default.nix
index 06ec0b3045762..8b55f12732aac 100644
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@@ -3,7 +3,7 @@
 , pkg-config
 , intltool
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , libxml2
 , libxslt
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     python3Packages.wrapPython
     intltool
     pkg-config
diff --git a/pkgs/applications/networking/p2p/deluge/default.nix b/pkgs/applications/networking/p2p/deluge/default.nix
index 35db62ef8e4e5..8c3d76d755f75 100644
--- a/pkgs/applications/networking/p2p/deluge/default.nix
+++ b/pkgs/applications/networking/p2p/deluge/default.nix
@@ -7,7 +7,7 @@
 , glib
 , gobject-introspection
 , librsvg
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -54,7 +54,7 @@ let
         glib
       ] ++ optionals withGUI [
         gobject-introspection
-        wrapGAppsHook
+        wrapGAppsHook3
       ];
 
       nativeCheckInputs = with pypkgs; [
diff --git a/pkgs/applications/networking/p2p/gnunet/gtk.nix b/pkgs/applications/networking/p2p/gnunet/gtk.nix
index 640ffeef75880..633a8da08778a 100644
--- a/pkgs/applications/networking/p2p/gnunet/gtk.nix
+++ b/pkgs/applications/networking/p2p/gnunet/gtk.nix
@@ -8,7 +8,7 @@
 , libsodium
 , libxml2
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs= [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/p2p/qbittorrent/default.nix b/pkgs/applications/networking/p2p/qbittorrent/default.nix
index 672a0c79fb04b..07c4ca3392f97 100644
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@@ -10,7 +10,7 @@
 , qtbase
 , qtsvg
 , qttools
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 
 , guiSupport ? true
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix b/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix
index 35c368a826f74..059a7371ebbf8 100644
--- a/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix
+++ b/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix
@@ -17,7 +17,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/p2p/transmission/4.nix b/pkgs/applications/networking/p2p/transmission/4.nix
index 75515ef414b0e..ebd8260776b98 100644
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@@ -26,7 +26,7 @@
 , enableGTK3 ? false
 , gtkmm3
 , xorg
-, wrapGAppsHook
+, wrapGAppsHook3
 , enableQt5 ? false
 , enableQt6 ? false
 , qt5
@@ -105,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     python3
   ]
-  ++ optionals enableGTK3 [ wrapGAppsHook ]
+  ++ optionals enableGTK3 [ wrapGAppsHook3 ]
   ++ optionals enableQt5 [ qt5.wrapQtAppsHook ]
   ++ optionals enableQt6 [ qt6Packages.wrapQtAppsHook ]
   ;
diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index 58de6fa9754f3..2804f76f8ef96 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -21,7 +21,7 @@
 , enableGTK3 ? false
 , gtk3
 , xorg
-, wrapGAppsHook
+, wrapGAppsHook3
 , enableQt ? false
 , qt5
 , nixosTests
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     cmake
   ]
-  ++ lib.optionals enableGTK3 [ wrapGAppsHook ]
+  ++ lib.optionals enableGTK3 [ wrapGAppsHook3 ]
   ++ lib.optionals enableQt [ qt5.wrapQtAppsHook ]
   ;
 
diff --git a/pkgs/applications/networking/protonvpn-gui/default.nix b/pkgs/applications/networking/protonvpn-gui/default.nix
index 2930ef450ea25..19081bd138631 100644
--- a/pkgs/applications/networking/protonvpn-gui/default.nix
+++ b/pkgs/applications/networking/protonvpn-gui/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , gobject-introspection
 , setuptools
-, wrapGAppsHook
+, wrapGAppsHook3
 , dbus-python
 , packaging
 , proton-core
@@ -41,7 +41,7 @@ buildPythonApplication rec {
     # Needed for the NM namespace
     gobject-introspection
     setuptools
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = lib.optionals withIndicator [
diff --git a/pkgs/applications/networking/protonvpn-gui/legacy.nix b/pkgs/applications/networking/protonvpn-gui/legacy.nix
index 7464a279cf8a9..32828b5590f67 100644
--- a/pkgs/applications/networking/protonvpn-gui/legacy.nix
+++ b/pkgs/applications/networking/protonvpn-gui/legacy.nix
@@ -2,7 +2,7 @@
 , buildPythonApplication
 , fetchFromGitHub
 , setuptools
-, wrapGAppsHook
+, wrapGAppsHook3
 , gdk-pixbuf
 , glib-networking
 , gobject-introspection
@@ -35,7 +35,7 @@ buildPythonApplication rec {
     gobject-introspection
     imagemagick
     setuptools
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/networking/remote/anydesk/default.nix b/pkgs/applications/networking/remote/anydesk/default.nix
index 5053de0ecb352..ef1c08ef2dcc7 100644
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@@ -5,14 +5,14 @@
 
 let
   description = "Desktop sharing application, providing remote support and online meetings";
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation (finalAttrs: {
   pname = "anydesk";
   version = "6.3.2";
 
   src = fetchurl {
     urls = [
-      "https://download.anydesk.com/linux/anydesk-${version}-amd64.tar.gz"
-      "https://download.anydesk.com/linux/generic-linux/anydesk-${version}-amd64.tar.gz"
+      "https://download.anydesk.com/linux/anydesk-${finalAttrs.version}-amd64.tar.gz"
+      "https://download.anydesk.com/linux/generic-linux/anydesk-${finalAttrs.version}-amd64.tar.gz"
     ];
     hash = "sha256-nSY4qHRsEvQk4M3JDHalAk3C6Y21WlfDQ2Gpp6/jjMs=";
   };
@@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
   postFixup = ''
     patchelf \
       --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-      --set-rpath "${lib.makeLibraryPath buildInputs}" \
+      --set-rpath "${lib.makeLibraryPath finalAttrs.buildInputs}" \
       $out/bin/anydesk
 
     # pangox is not actually necessary (it was only added as a part of gtkglext)
@@ -77,12 +77,12 @@ in stdenv.mkDerivation rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     inherit description;
     homepage = "https://www.anydesk.com";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ shyim cheriimoya ];
+    maintainers = with lib.maintainers; [ shyim cheriimoya ];
   };
-}
+})
diff --git a/pkgs/applications/networking/remote/citrix-workspace/generic.nix b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
index f751f3237e412..96074b3fd7da0 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, requireFile, makeWrapper, autoPatchelfHook, wrapGAppsHook, which, more
+{ lib, stdenv, requireFile, makeWrapper, autoPatchelfHook, wrapGAppsHook3, which, more
 , file, atk, alsa-lib, cairo, fontconfig, gdk-pixbuf, glib, webkitgtk, gtk2-x11, gtk3
 , heimdal, krb5, libsoup, libvorbis, speex, openssl, zlib, xorg, pango, gtk2
 , gnome2, mesa, nss, nspr, gtk_engines, freetype, dconf, libpng12, libxml2
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     makeWrapper
     more
     which
-    wrapGAppsHook
+    wrapGAppsHook3
     libfaketime
   ];
 
diff --git a/pkgs/applications/networking/remote/freerdp/3.nix b/pkgs/applications/networking/remote/freerdp/3.nix
new file mode 100644
index 0000000000000..45bb8db9d9d89
--- /dev/null
+++ b/pkgs/applications/networking/remote/freerdp/3.nix
@@ -0,0 +1,209 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, docbook-xsl-nons
+, libxslt
+, pkg-config
+, alsa-lib
+, faac
+, faad2
+, ffmpeg
+, fuse3
+, glib
+, openh264
+, openssl
+, p11-kit
+, pcre2
+, pkcs11helper
+, uriparser
+, zlib
+, libX11
+, libXcursor
+, libXdamage
+, libXdmcp
+, libXext
+, libXi
+, libXinerama
+, libXrandr
+, libXrender
+, libXtst
+, libXv
+, libxkbcommon
+, libxkbfile
+, wayland
+, wayland-scanner
+, icu
+, libunwind
+, orc
+, cairo
+, cjson
+, libusb1
+, libpulseaudio
+, cups
+, pcsclite
+, SDL2
+, SDL2_ttf
+, SDL2_image
+, systemd
+, libjpeg_turbo
+, libkrb5
+, libopus
+, buildServer ? true
+, nocaps ? false
+, AudioToolbox
+, AVFoundation
+, Carbon
+, Cocoa
+, CoreMedia
+, withUnfree ? false
+
+  # tries to compile and run generate_argument_docbook.c
+, withManPages ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
+
+, buildPackages
+}:
+
+let
+  cmFlag = flag: if flag then "ON" else "OFF";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "freerdp";
+  version = "3.4.0";
+
+  src = fetchFromGitHub {
+    owner = "FreeRDP";
+    repo = "FreeRDP";
+    rev = finalAttrs.version;
+    hash = "sha256-ZOYHhldTdV8DrOHoXS42NXB6JHBJMGRswgTczn1S6BE=";
+  };
+
+  postPatch = ''
+    export HOME=$TMP
+
+    # skip NIB file generation on darwin
+    substituteInPlace "client/Mac/CMakeLists.txt" "client/Mac/cli/CMakeLists.txt" \
+      --replace-fail "if (NOT IS_XCODE)" "if (FALSE)"
+
+    substituteInPlace "libfreerdp/freerdp.pc.in" \
+      --replace-fail "Requires:" "Requires: @WINPR_PKG_CONFIG_FILENAME@"
+  '' + lib.optionalString (pcsclite != null) ''
+    substituteInPlace "winpr/libwinpr/smartcard/smartcard_pcsc.c" \
+      --replace-fail "libpcsclite.so" "${lib.getLib pcsclite}/lib/libpcsclite.so"
+  '' + lib.optionalString nocaps ''
+    substituteInPlace "libfreerdp/locale/keyboard_xkbfile.c" \
+      --replace-fail "RDP_SCANCODE_CAPSLOCK" "RDP_SCANCODE_LCONTROL"
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    libxslt
+    docbook-xsl-nons
+    pkg-config
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    cairo
+    cjson
+    cups
+    faad2
+    ffmpeg
+    glib
+    icu
+    libX11
+    libXcursor
+    libXdamage
+    libXdmcp
+    libXext
+    libXi
+    libXinerama
+    libXrandr
+    libXrender
+    libXtst
+    libXv
+    libjpeg_turbo
+    libkrb5
+    libopus
+    libpulseaudio
+    libunwind
+    libusb1
+    libxkbcommon
+    libxkbfile
+    openh264
+    openssl
+    orc
+    pcre2
+    pcsclite
+    pkcs11helper
+    SDL2
+    SDL2_ttf
+    SDL2_image
+    uriparser
+    zlib
+  ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    fuse3
+    systemd
+    wayland
+  ] ++ lib.optionals stdenv.isDarwin [
+    AudioToolbox
+    AVFoundation
+    Carbon
+    Cocoa
+    CoreMedia
+  ] ++ lib.optionals withUnfree [
+    faac
+  ];
+
+  # https://github.com/FreeRDP/FreeRDP/issues/8526#issuecomment-1357134746
+  cmakeFlags = [
+    "-Wno-dev"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DDOCBOOKXSL_DIR=${docbook-xsl-nons}/xml/xsl/docbook"
+    "-DWAYLAND_SCANNER=${buildPackages.wayland-scanner}/bin/wayland-scanner"
+  ] ++ lib.mapAttrsToList (k: v: "-D${k}=${cmFlag v}") {
+    BUILD_TESTING = false; # false is recommended by upstream
+    WITH_CAIRO = (cairo != null);
+    WITH_CUPS = (cups != null);
+    WITH_FAAC = (withUnfree && faac != null);
+    WITH_FAAD2 = (faad2 != null);
+    WITH_FUSE = (stdenv.isLinux && fuse3 != null);
+    WITH_JPEG = (libjpeg_turbo != null);
+    WITH_KRB5 = (libkrb5 != null);
+    WITH_OPENH264 = (openh264 != null);
+    WITH_OPUS = (libopus != null);
+    WITH_OSS = false;
+    WITH_MANPAGES = withManPages;
+    WITH_PCSC = (pcsclite != null);
+    WITH_PULSE = (libpulseaudio != null);
+    WITH_SERVER = buildServer;
+    WITH_WEBVIEW = false; # avoid introducing webkit2gtk-4.0
+    WITH_VAAPI = false; # false is recommended by upstream
+    WITH_X11 = true;
+  };
+
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
+    "-DTARGET_OS_IPHONE=0"
+    "-DTARGET_OS_WATCH=0"
+    "-include AudioToolbox/AudioToolbox.h"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error=incompatible-function-pointer-types"
+  ]);
+
+  env.NIX_LDFLAGS = toString (lib.optionals stdenv.isDarwin [
+    "-framework AudioToolbox"
+  ]);
+
+  meta = with lib; {
+    description = "A Remote Desktop Protocol Client";
+    longDescription = ''
+      FreeRDP is a client-side implementation of the Remote Desktop Protocol (RDP)
+      following the Microsoft Open Specifications.
+    '';
+    homepage = "https://www.freerdp.com/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ peterhoeg lheckemann ];
+    platforms = platforms.unix;
+  };
+})
diff --git a/pkgs/applications/networking/remote/freerdp/default.nix b/pkgs/applications/networking/remote/freerdp/default.nix
index fc3cbbcd1109f..c47baaf3602f7 100644
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@@ -76,13 +76,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "freerdp";
-  version = "2.11.5";
+  version = "2.11.7";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = version;
-    hash = "sha256-WyYBIiIQNDHydJqU3jWNItJU2/sYnRpGHCXE9Xhom5M=";
+    hash = "sha256-w+xyMNFmKylSheK0yAGl8J6MXly/HUjjAfR9Qq3s/kA=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/remote/nice-dcv-client/default.nix b/pkgs/applications/networking/remote/nice-dcv-client/default.nix
index 0722561cb6f3b..6898d0f66d47c 100644
--- a/pkgs/applications/networking/remote/nice-dcv-client/default.nix
+++ b/pkgs/applications/networking/remote/nice-dcv-client/default.nix
@@ -20,7 +20,7 @@
 , python3Packages
 , cpio
 , autoPatchelfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-iLz25SB5v7ghkAZOMGPmpNaPihd8ikzCQS//r1xBNRU=";
     };
 
-  nativeBuildInputs = [ autoPatchelfHook wrapGAppsHook python3Packages.rpm ];
+  nativeBuildInputs = [ autoPatchelfHook wrapGAppsHook3 python3Packages.rpm ];
   unpackPhase = ''
     rpm2cpio $src | ${cpio}/bin/cpio -idm
   '';
diff --git a/pkgs/applications/networking/remote/remmina/default.nix b/pkgs/applications/networking/remote/remmina/default.nix
index 0fd2de49dac3e..a2455330c2225 100644
--- a/pkgs/applications/networking/remote/remmina/default.nix
+++ b/pkgs/applications/networking/remote/remmina/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, cmake, ninja, pkg-config, wrapGAppsHook
+{ lib, stdenv, fetchFromGitLab, cmake, ninja, pkg-config, wrapGAppsHook3
 , desktopToDarwinBundle
 , glib, gtk3, gettext, libxkbfile, libX11, python3
 , freerdp, libssh, libgcrypt, gnutls, vte
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-3HyG2PBnTq/fVsvWA81fQ2gCOoAxINWeUDwzKcOuECk=";
   };
 
-  nativeBuildInputs = [ cmake ninja pkg-config wrapGAppsHook ]
+  nativeBuildInputs = [ cmake ninja pkg-config wrapGAppsHook3 ]
     ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/remote/rustdesk/default.nix b/pkgs/applications/networking/remote/rustdesk/default.nix
index d220b87f2a22d..d1b0facf7f5b9 100644
--- a/pkgs/applications/networking/remote/rustdesk/default.nix
+++ b/pkgs/applications/networking/remote/rustdesk/default.nix
@@ -2,7 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , atk
 , bzip2
 , cairo
@@ -87,7 +87,7 @@ rustPlatform.buildRustPackage rec {
     copyDesktopItems
     pkg-config
     rustPlatform.bindgenHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildFeatures = lib.optionals stdenv.isLinux [ "linux-pkg-config" ];
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index d91b2540f7645..d7d9d68bf3327 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -42,7 +42,7 @@
 , spandsp3
 , speexdsp
 , SystemConfiguration
-, wrapGAppsHook
+, wrapGAppsHook3
 , zlib
 , zstd
 
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
     python3
   ] ++ lib.optionals withQt [
     qt6.wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch b/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch
deleted file mode 100644
index 3305653d025ff..0000000000000
--- a/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -rup rsync-3.2.7/configure.sh rsync-3.2.7-fixed/configure.sh
---- rsync-3.2.7/configure.sh	2022-10-20 17:57:22
-+++ rsync-3.2.7-fixed/configure.sh	2024-01-01 19:51:58
-@@ -7706,7 +7706,7 @@ else $as_nop
- #include <stdlib.h>
- #include <sys/types.h>
- #include <sys/socket.h>
--main()
-+int main()
- {
-    if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
-      exit(1);
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index 8fb607979100d..8846bea0a49b4 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -20,24 +20,16 @@
 
 stdenv.mkDerivation rec {
   pname = "rsync";
-  version = "3.2.7";
+  version = "3.3.0";
 
   src = fetchurl {
     # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
     url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
-    sha256 = "sha256-Tn2dP27RCHjFjF+3JKZ9rPS2qsc0CxPkiPstxBNG8rs=";
+    hash = "sha256-c5nppnCMMtZ4pypjIZ6W8jvgviM25Q/RNISY0HBB35A=";
   };
 
   nativeBuildInputs = [ perl ];
 
-  patches = [
-    # https://github.com/WayneD/rsync/issues/511#issuecomment-1774612577
-    # original source: https://build.opensuse.org/package/view_file/network/rsync/rsync-fortified-strlcpy-fix.patch?expand=1&rev=3f8dd2f4a404c96c0f69176e60893714
-    ./rsync-fortified-strlcpy-fix.patch
-    # https://github.com/WayneD/rsync/pull/558
-    ./configure.ac-fix-failing-IPv6-check.patch
-  ];
-
   buildInputs = [ libiconv zlib popt ]
     ++ lib.optional enableACLs acl
     ++ lib.optional enableZstd zstd
diff --git a/pkgs/applications/networking/sync/rsync/rsync-fortified-strlcpy-fix.patch b/pkgs/applications/networking/sync/rsync/rsync-fortified-strlcpy-fix.patch
deleted file mode 100644
index 296445b4bb563..0000000000000
--- a/pkgs/applications/networking/sync/rsync/rsync-fortified-strlcpy-fix.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 1f83963f59960150e8c46112daa8411324c1f209 Mon Sep 17 00:00:00 2001
-From: Jiri Slaby <jslaby@suse.cz>
-Date: Fri, 18 Aug 2023 08:26:20 +0200
-Subject: [PATCH] exclude: fix crashes with fortified strlcpy()
-
-Fortified (-D_FORTIFY_SOURCE=2 for gcc) builds make strlcpy() crash when
-its third parameter (size) is larger than the buffer:
-  $ rsync -FFXHav '--filter=merge global-rsync-filter' Align-37-43/ xxx
-  sending incremental file list
-  *** buffer overflow detected ***: terminated
-
-It's in the exclude code in setup_merge_file():
-  strlcpy(y, save, MAXPATHLEN);
-
-Note the 'y' pointer was incremented, so it no longer points to memory
-with MAXPATHLEN "owned" bytes.
-
-Fix it by remembering the number of copied bytes into the 'save' buffer
-and use that instead of MAXPATHLEN which is clearly incorrect.
-
-Fixes #511.
----
- exclude.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/exclude.c b/exclude.c
-index ffe55b167..1a5de3b9e 100644
---- a/exclude.c
-+++ b/exclude.c
-@@ -720,7 +720,8 @@ static BOOL setup_merge_file(int mergelist_num, filter_rule *ex,
- 	parent_dirscan = True;
- 	while (*y) {
- 		char save[MAXPATHLEN];
--		strlcpy(save, y, MAXPATHLEN);
-+		/* copylen is strlen(y) which is < MAXPATHLEN. +1 for \0 */
-+		size_t copylen = strlcpy(save, y, MAXPATHLEN) + 1;
- 		*y = '\0';
- 		dirbuf_len = y - dirbuf;
- 		strlcpy(x, ex->pattern, MAXPATHLEN - (x - buf));
-@@ -734,7 +735,7 @@ static BOOL setup_merge_file(int mergelist_num, filter_rule *ex,
- 			lp->head = NULL;
- 		}
- 		lp->tail = NULL;
--		strlcpy(y, save, MAXPATHLEN);
-+		strlcpy(y, save, copylen);
- 		while ((*x++ = *y++) != '/') {}
- 	}
- 	parent_dirscan = False;
-
diff --git a/pkgs/applications/networking/termius/default.nix b/pkgs/applications/networking/termius/default.nix
index deaa49e4f66d5..0f16865ac8e3c 100644
--- a/pkgs/applications/networking/termius/default.nix
+++ b/pkgs/applications/networking/termius/default.nix
@@ -9,7 +9,7 @@
 , libsecret
 , mesa
 , udev
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   dontWrapGApps = true;
 
   # TODO: migrate off autoPatchelfHook and use nixpkgs' electron
-  nativeBuildInputs = [ autoPatchelfHook squashfsTools makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ autoPatchelfHook squashfsTools makeWrapper wrapGAppsHook3 ];
 
   buildInputs = [
     alsa-lib
diff --git a/pkgs/applications/networking/upnp-router-control/default.nix b/pkgs/applications/networking/upnp-router-control/default.nix
index 761975a277bc4..8991e66b7c24f 100644
--- a/pkgs/applications/networking/upnp-router-control/default.nix
+++ b/pkgs/applications/networking/upnp-router-control/default.nix
@@ -6,7 +6,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gssdp_1_6
 , gtk3
 , gupnp_1_6
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/weather/meteo/default.nix b/pkgs/applications/networking/weather/meteo/default.nix
index 9b64e8e6c1cb7..ddee458a0569f 100644
--- a/pkgs/applications/networking/weather/meteo/default.nix
+++ b/pkgs/applications/networking/weather/meteo/default.nix
@@ -9,7 +9,7 @@
 , pkg-config
 , python3
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gtk3
 , json-glib
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/yaup/default.nix b/pkgs/applications/networking/yaup/default.nix
index cc6ba09076cd0..f3854cecd6a8e 100644
--- a/pkgs/applications/networking/yaup/default.nix
+++ b/pkgs/applications/networking/yaup/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , intltool
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , miniupnpc
 }:
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     intltool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/office/abiword/default.nix b/pkgs/applications/office/abiword/default.nix
index 0ca18f8e360b5..d03b60da6e733 100644
--- a/pkgs/applications/office/abiword/default.nix
+++ b/pkgs/applications/office/abiword/default.nix
@@ -17,7 +17,7 @@
 , boost
 , libxslt
 , goffice
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     perl
   ];
 
diff --git a/pkgs/applications/office/agenda/default.nix b/pkgs/applications/office/agenda/default.nix
index bcffa8ebf7888..8957df0bad194 100644
--- a/pkgs/applications/office/agenda/default.nix
+++ b/pkgs/applications/office/agenda/default.nix
@@ -11,7 +11,7 @@
 , glib
 , gtk3
 , libgee
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/office/autokey/default.nix b/pkgs/applications/office/autokey/default.nix
index af8ceeb4b7bed..d05c83cb19992 100644
--- a/pkgs/applications/office/autokey/default.nix
+++ b/pkgs/applications/office/autokey/default.nix
@@ -1,7 +1,7 @@
 { lib
 , python3Packages
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , gtksourceview3
 , libappindicator-gtk3
@@ -24,7 +24,7 @@ python3Packages.buildPythonApplication rec {
   # Tests appear to be broken with import errors within the project structure
   doCheck = false;
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
 
   buildInputs = [
     gtksourceview3
diff --git a/pkgs/applications/office/banana-accounting/default.nix b/pkgs/applications/office/banana-accounting/default.nix
index e1c5f7fdeb40a..a0213e05f60ce 100644
--- a/pkgs/applications/office/banana-accounting/default.nix
+++ b/pkgs/applications/office/banana-accounting/default.nix
@@ -10,7 +10,7 @@
 , lib
 , stdenv
 , libgcrypt
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation {
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   installPhase = ''
diff --git a/pkgs/applications/office/beamerpresenter/default.nix b/pkgs/applications/office/beamerpresenter/default.nix
index c3e080ad3d524..65fe907c27668 100644
--- a/pkgs/applications/office/beamerpresenter/default.nix
+++ b/pkgs/applications/office/beamerpresenter/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 , gst_all_1
 , qtbase
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/applications/office/bookworm/default.nix b/pkgs/applications/office/bookworm/default.nix
index 13d3c46c946d1..c64c3389d95d8 100644
--- a/pkgs/applications/office/bookworm/default.nix
+++ b/pkgs/applications/office/bookworm/default.nix
@@ -24,7 +24,7 @@
 , unzip
 , vala
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/office/gnote/default.nix b/pkgs/applications/office/gnote/default.nix
index 29c72b24cdcef..a4262de9937f7 100644
--- a/pkgs/applications/office/gnote/default.nix
+++ b/pkgs/applications/office/gnote/default.nix
@@ -5,6 +5,7 @@
 , gettext
 , gtkmm4
 , itstool
+, libadwaita
 , libsecret
 , libuuid
 , libxml2
@@ -18,15 +19,16 @@
 
 stdenv.mkDerivation rec {
   pname = "gnote";
-  version = "45.1";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-nuwn+MsKENL9uRSkUei4QYwmDni/BzYHgaeKXkGM+UE=";
+    hash = "sha256-ht9YoVlbIVN0aRq0S/wWE7Sf28p3CEI6PVZY3NOgFe0=";
   };
 
   buildInputs = [
     gtkmm4
+    libadwaita
     libsecret
     libuuid
     libxml2
@@ -50,7 +52,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Gnote";
+    homepage = "https://gitlab.gnome.org/GNOME/gnote";
     description = "A note taking application";
     mainProgram = "gnote";
     maintainers = with maintainers; [ jfvillablanca ];
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index da94f9674ca28..1551f2cad4287 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -23,7 +23,7 @@
 , pkg-config
 , swig
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     cmake
     gettext
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     pkg-config
   ];
 
@@ -117,11 +117,11 @@ stdenv.mkDerivation rec {
     )
   '';
 
-  # wrapGAppsHook would wrap all binaries including the cli utils which need
+  # wrapGAppsHook3 would wrap all binaries including the cli utils which need
   # Perl wrapping
   dontWrapGApps = true;
 
-  # gnucash is wrapped using the args constructed for wrapGAppsHook.
+  # gnucash is wrapped using the args constructed for wrapGAppsHook3.
   # gnc-fq-* are cli utils written in Perl hence the extra wrapping
   postFixup = ''
     wrapProgram $out/bin/gnucash "''${gappsWrapperArgs[@]}"
diff --git a/pkgs/applications/office/gnumeric/default.nix b/pkgs/applications/office/gnumeric/default.nix
index 7e351afadf536..a3c16d5d86fe1 100644
--- a/pkgs/applications/office/gnumeric/default.nix
+++ b/pkgs/applications/office/gnumeric/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, intltool, perlPackages
-, goffice, gnome, wrapGAppsHook, gtk3, bison, python3Packages
+, goffice, gnome, wrapGAppsHook3, gtk3, bison, python3Packages
 , itstool
 }:
 
@@ -16,7 +16,7 @@ in stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-component" ];
 
-  nativeBuildInputs = [ pkg-config intltool bison itstool wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config intltool bison itstool wrapGAppsHook3 ];
 
   # ToDo: optional libgda, introspection?
   buildInputs = [
diff --git a/pkgs/applications/office/grisbi/default.nix b/pkgs/applications/office/grisbi/default.nix
index b0242fc4ae436..586777ccf41e0 100644
--- a/pkgs/applications/office/grisbi/default.nix
+++ b/pkgs/applications/office/grisbi/default.nix
@@ -5,7 +5,7 @@
 , libgsf
 , libofx
 , intltool
-, wrapGAppsHook
+, wrapGAppsHook3
 , libsoup
 , gnome
 }:
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vTrbq/xLTfwF7/YtKzZFiiSw8A0HzzWin2ry8gPHej8=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 intltool ];
   buildInputs = [
     gtk
     libgsf
diff --git a/pkgs/applications/office/gtg/default.nix b/pkgs/applications/office/gtg/default.nix
index d7bad1d133901..39c4353cb72cb 100644
--- a/pkgs/applications/office/gtg/default.nix
+++ b/pkgs/applications/office/gtg/default.nix
@@ -5,7 +5,7 @@
 , python3Packages
 , ninja
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gtksourceview4
 , itstool
@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
     ninja
     itstool
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
@@ -77,7 +77,7 @@ python3Packages.buildPythonApplication rec {
       "Getting Things GNOME" (GTG) is a personal tasks and ToDo list organizer inspired by the "Getting Things Done" (GTD) methodology.
       GTG is intended to help you track everything you need to do and need to know, from small tasks to large projects.
     '';
-    homepage = "https://wiki.gnome.org/Apps/GTG";
+    homepage = "https://github.com/getting-things-gnome/gtg";
     downloadPage = "https://github.com/getting-things-gnome/gtg/releases";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ oyren ];
diff --git a/pkgs/applications/office/homebank/default.nix b/pkgs/applications/office/homebank/default.nix
index 023a5729ed801..116909d9842c6 100644
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, gtk, pkg-config, libofx, intltool, wrapGAppsHook
+{ fetchurl, lib, stdenv, gtk, pkg-config, libofx, intltool, wrapGAppsHook3
 , libsoup_3, gnome }:
 
 stdenv.mkDerivation rec {
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-Qs5xRsh16gyjyTORtqm/RxTbRiHGP0oJTcxviYW7VOQ=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 intltool ];
   buildInputs = [ gtk libofx libsoup_3 gnome.adwaita-icon-theme];
 
   meta = with lib; {
diff --git a/pkgs/applications/office/jabref/default.nix b/pkgs/applications/office/jabref/default.nix
index 282e62584cff4..d49e8c8a98e89 100644
--- a/pkgs/applications/office/jabref/default.nix
+++ b/pkgs/applications/office/jabref/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeDesktopItem
 , copyDesktopItems
 , unzip
@@ -125,7 +125,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     jdk
     gradle
-    wrapGAppsHook
+    wrapGAppsHook3
     copyDesktopItems
     unzip
   ];
diff --git a/pkgs/applications/office/jameica/default.nix b/pkgs/applications/office/jameica/default.nix
index 66d2a80c55550..f87eaf6d9e4d4 100644
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , makeDesktopItem
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , stripJavaArchivesHook
 , ant
 , jdk
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-MSVSd5DyVL+dcfTDv1M99hxickPwT2Pt6QGNsu6DGZI=";
   };
 
-  nativeBuildInputs = [ ant jdk wrapGAppsHook makeWrapper stripJavaArchivesHook ];
+  nativeBuildInputs = [ ant jdk wrapGAppsHook3 makeWrapper stripJavaArchivesHook ];
   buildInputs = lib.optionals stdenv.isLinux [ gtk2 glib libXtst ]
     ++ lib.optional stdenv.isDarwin Cocoa;
 
diff --git a/pkgs/applications/office/libreoffice/wrapper.nix b/pkgs/applications/office/libreoffice/wrapper.nix
index 2f3927146f801..013a2ee5575ef 100644
--- a/pkgs/applications/office/libreoffice/wrapper.nix
+++ b/pkgs/applications/office/libreoffice/wrapper.nix
@@ -6,7 +6,7 @@
 , xorg # for lndir
 , runCommand
 , substituteAll
-# For Emulating wrapGAppsHook
+# For Emulating wrapGAppsHook3
 , gsettings-desktop-schemas
 , hicolor-icon-theme
 , dconf
diff --git a/pkgs/applications/office/mmex/default.nix b/pkgs/applications/office/mmex/default.nix
index e1f39e8964c5e..c4508df84b7b6 100644
--- a/pkgs/applications/office/mmex/default.nix
+++ b/pkgs/applications/office/mmex/default.nix
@@ -7,7 +7,7 @@
 , makeWrapper
 , lsb-release
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , curl
 , sqlite
 , wxGTK32
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     git
     makeWrapper
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optionals stdenv.isLinux [
     lsb-release
   ];
diff --git a/pkgs/applications/office/notes-up/default.nix b/pkgs/applications/office/notes-up/default.nix
index ca1f1c15952a4..4bc6060cfa6b2 100644
--- a/pkgs/applications/office/notes-up/default.nix
+++ b/pkgs/applications/office/notes-up/default.nix
@@ -8,7 +8,7 @@
 , pkg-config
 , python3
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , discount
 , glib
 , gtk3
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/office/osmo/default.nix b/pkgs/applications/office/osmo/default.nix
index 8f73d9c6b2e84..7dc7444379cc7 100644
--- a/pkgs/applications/office/osmo/default.nix
+++ b/pkgs/applications/office/osmo/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, gtk3, libxml2, gettext, libical, libnotify
-, libarchive, gspell, webkitgtk, libgringotts, wrapGAppsHook }:
+, libarchive, gspell, webkitgtk, libgringotts, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "osmo";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "19h3dnjgqbawnvgnycyp4n5b6mjsp5zghn3b69b6f3xa3fyi32qy";
   };
 
-  nativeBuildInputs = [ pkg-config gettext wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config gettext wrapGAppsHook3 ];
   buildInputs = [ gtk3 libxml2 libical libnotify libarchive
     gspell webkitgtk libgringotts ];
 
diff --git a/pkgs/applications/office/paperwork/paperwork-gtk.nix b/pkgs/applications/office/paperwork/paperwork-gtk.nix
index e783e8f4966fe..9e6beb5053a40 100644
--- a/pkgs/applications/office/paperwork/paperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/paperwork-gtk.nix
@@ -7,7 +7,7 @@
 , xvfb-run
 , dbus
 , libnotify
-, wrapGAppsHook
+, wrapGAppsHook3
 , fetchFromGitLab
 , which
 , gettext
@@ -80,7 +80,7 @@ python3Packages.buildPythonApplication rec {
   nativeCheckInputs = [ dbus ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     python3Packages.setuptools-scm
     (lib.getBin gettext)
diff --git a/pkgs/applications/office/pinpoint/default.nix b/pkgs/applications/office/pinpoint/default.nix
index 99a45371b63c3..ca91b33ecae6e 100644
--- a/pkgs/applications/office/pinpoint/default.nix
+++ b/pkgs/applications/office/pinpoint/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
                   cairo clutter-gtk ];
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/action/show/Apps/Pinpoint";
+    homepage = "https://gitlab.gnome.org/Archive/pinpoint";
     description = "A tool for making hackers do excellent presentations";
     license = licenses.lgpl21;
     platforms = platforms.linux;
diff --git a/pkgs/applications/office/planify/default.nix b/pkgs/applications/office/planify/default.nix
index 1f6ccbf10f487..595b12bf9ab24 100644
--- a/pkgs/applications/office/planify/default.nix
+++ b/pkgs/applications/office/planify/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.6";
+  version = "4.7";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-vyw8SjI8EM9giYpAsCNppgSydPEBNz2sbFahEKmKe6w=";
+    hash = "sha256-5hiVTU1w3Rk/BdxYwDB0Y+EZFnSAaEWtx19IB1ak1yY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/planner/default.nix b/pkgs/applications/office/planner/default.nix
index 0beb4825ddd4f..e27fd037df446 100644
--- a/pkgs/applications/office/planner/default.nix
+++ b/pkgs/applications/office/planner/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Project management tool for the GNOME desktop";
     mainProgram = "planner";
-    homepage = "https://wiki.gnome.org/Apps/Planner";
+    homepage = "https://gitlab.gnome.org/World/planner";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ amiloradovsky ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/applications/office/portfolio/default.nix b/pkgs/applications/office/portfolio/default.nix
index a7b5835184901..c320729ee9ee6 100644
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@@ -10,7 +10,7 @@
 , libsecret
 , makeDesktopItem
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , writeScript
 }:
 let
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/office/pympress/default.nix b/pkgs/applications/office/pympress/default.nix
index 353e46e067dac..eb28bf2dfd920 100644
--- a/pkgs/applications/office/pympress/default.nix
+++ b/pkgs/applications/office/pympress/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , python3Packages
 , fetchPypi
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , gobject-introspection
 , libcanberra-gtk3
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/office/spice-up/default.nix b/pkgs/applications/office/spice-up/default.nix
index 93376ed2922b9..f8a7f3a7c268c 100644
--- a/pkgs/applications/office/spice-up/default.nix
+++ b/pkgs/applications/office/spice-up/default.nix
@@ -7,7 +7,7 @@
 , pkg-config
 , python3
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gtk3
 , json-glib
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/office/ticktick/default.nix b/pkgs/applications/office/ticktick/default.nix
index 3a768c702acdf..a7b88321a82d6 100644
--- a/pkgs/applications/office/ticktick/default.nix
+++ b/pkgs/applications/office/ticktick/default.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchurl
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 , dpkg
 , autoPatchelfHook
 , glibc
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     autoPatchelfHook
     dpkg
   ];
diff --git a/pkgs/applications/office/timeline/default.nix b/pkgs/applications/office/timeline/default.nix
index 9f8bb5b563d57..8aedc4854006b 100644
--- a/pkgs/applications/office/timeline/default.nix
+++ b/pkgs/applications/office/timeline/default.nix
@@ -4,7 +4,7 @@
 , gettext
 , makeDesktopItem
 , copyDesktopItems
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "sha256-qwH2mt3Va62QJKJGOpt5WV3QksqQaRGEif4CcPC5F2E=";
   };
 
-  nativeBuildInputs = [ python3.pkgs.wrapPython copyDesktopItems wrapGAppsHook ];
+  nativeBuildInputs = [ python3.pkgs.wrapPython copyDesktopItems wrapGAppsHook3 ];
 
   pythonPath = with python3.pkgs; [
     wxpython
diff --git a/pkgs/applications/office/timeular/default.nix b/pkgs/applications/office/timeular/default.nix
index 59af6868b7dfe..bf08311bad980 100644
--- a/pkgs/applications/office/timeular/default.nix
+++ b/pkgs/applications/office/timeular/default.nix
@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "6.7.5";
+  version = "6.7.6";
   pname = "timeular";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/timeular-desktop-packages/linux/production/Timeular-${version}.AppImage";
-    hash = "sha256-b/I34f8fGgPr4+fZJ+2cb+Xi/AvotxNHYg7IaLTByPk=";
+    hash = "sha256-wQUR2jLJi1peXqXJJj/72X9xNaD2DzNiB0mGFiaEWBE=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/office/treesheets/default.nix b/pkgs/applications/office/treesheets/default.nix
index c67f53949ce72..fc88bf6b58817 100644
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , cmake
 , ninja
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeWrapper
 , wxGTK
 , Cocoa
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
     makeWrapper
   ];
 
diff --git a/pkgs/applications/office/trilium/desktop.nix b/pkgs/applications/office/trilium/desktop.nix
index 55b99bf71b794..e2ad6d5d5f826 100644
--- a/pkgs/applications/office/trilium/desktop.nix
+++ b/pkgs/applications/office/trilium/desktop.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, unzip, autoPatchelfHook
 , fetchurl, makeWrapper
 , alsa-lib, mesa, nss, nspr, systemd
-, makeDesktopItem, copyDesktopItems, wrapGAppsHook
+, makeDesktopItem, copyDesktopItems, wrapGAppsHook3
 , metaCommon
 }:
 
@@ -29,7 +29,7 @@ let
     nativeBuildInputs = [
       autoPatchelfHook
       makeWrapper
-      wrapGAppsHook
+      wrapGAppsHook3
       copyDesktopItems
     ];
 
diff --git a/pkgs/applications/office/tryton/default.nix b/pkgs/applications/office/tryton/default.nix
index e1a236e5db8bc..e62d26b3c9fcc 100644
--- a/pkgs/applications/office/tryton/default.nix
+++ b/pkgs/applications/office/tryton/default.nix
@@ -14,7 +14,7 @@
 , pango
 , fontconfig
 , freetype
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 with lib;
@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     pkg-config
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/office/zim/default.nix b/pkgs/applications/office/zim/default.nix
index b21f3edaa5322..9680748287b9b 100644
--- a/pkgs/applications/office/zim/default.nix
+++ b/pkgs/applications/office/zim/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python3Packages, gtk3, gobject-introspection, wrapGAppsHook, gnome }:
+{ lib, stdenv, fetchurl, python3Packages, gtk3, gobject-introspection, wrapGAppsHook3, gnome }:
 
 # TODO: Declare configuration options for the following optional dependencies:
 #  -  File stores: hg, git, bzr
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication rec {
 
   buildInputs = [ gtk3 gnome.adwaita-icon-theme ];
   propagatedBuildInputs = with python3Packages; [ pyxdg pygobject3 ];
-  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+  nativeBuildInputs = [ gobject-introspection wrapGAppsHook3 ];
 
   dontWrapGApps = true;
 
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index e343790da2c7d..b31ce7f8c2de7 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeDesktopItem
 , atk
 , cairo
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-HAVLmamEPuFf0548/iEXes+f4XnQ7kU1u9hyOYhVyZ0=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
   buildInputs =
     [ gsettings-desktop-schemas glib gtk3 gnome.adwaita-icon-theme dconf ];
 
diff --git a/pkgs/applications/office/zotero/zotero_7.nix b/pkgs/applications/office/zotero/zotero_7.nix
index 4d4ea36c5acf8..ae8cc9e9fa6f6 100644
--- a/pkgs/applications/office/zotero/zotero_7.nix
+++ b/pkgs/applications/office/zotero/zotero_7.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, wrapGAppsHook
+, wrapGAppsHook3
 , autoPatchelfHook
 , makeDesktopItem
 , atk
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     autoPatchelfHook
   ];
   buildInputs = [
diff --git a/pkgs/applications/radio/chirp/default.nix b/pkgs/applications/radio/chirp/default.nix
index 0bb054e3d52ed..cab870c5e588f 100644
--- a/pkgs/applications/radio/chirp/default.nix
+++ b/pkgs/applications/radio/chirp/default.nix
@@ -5,7 +5,7 @@
 , gsettings-desktop-schemas
 , python3
 , unstableGitUpdater
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -23,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
     gsettings-desktop-schemas
   ];
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   propagatedBuildInputs = with python3.pkgs; [
     future
diff --git a/pkgs/applications/radio/cqrlog/default.nix b/pkgs/applications/radio/cqrlog/default.nix
index af1e283249d86..7c973e097d533 100644
--- a/pkgs/applications/radio/cqrlog/default.nix
+++ b/pkgs/applications/radio/cqrlog/default.nix
@@ -16,7 +16,7 @@
 , xdg-utils
 , xplanet
 , autoPatchelfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     ! grep -C src -RC0 "/usr"
   '';
 
-  nativeBuildInputs = [ lazarus fpc autoPatchelfHook wrapGAppsHook ];
+  nativeBuildInputs = [ lazarus fpc autoPatchelfHook wrapGAppsHook3 ];
   buildInputs = [
     atk
     cairo
diff --git a/pkgs/applications/radio/gnuradio/wrapper.nix b/pkgs/applications/radio/gnuradio/wrapper.nix
index ac08d17397fa7..9e2430334231c 100644
--- a/pkgs/applications/radio/gnuradio/wrapper.nix
+++ b/pkgs/applications/radio/gnuradio/wrapper.nix
@@ -11,7 +11,7 @@
 , xorg
 # To define a the gnuradio.pkgs scope
 , newScope
-# For Emulating wrapGAppsHook
+# For Emulating wrapGAppsHook3
 , gsettings-desktop-schemas
 , glib
 , hicolor-icon-theme
@@ -72,7 +72,7 @@ let
   inherit (unwrapped) version;
   makeWrapperArgs = builtins.concatStringsSep " " ([
   ]
-    # Emulating wrapGAppsHook & wrapQtAppsHook working together
+    # Emulating wrapGAppsHook3 & wrapQtAppsHook working together
     ++ lib.optionals (
       (unwrapped.hasFeature "gnuradio-companion")
       || (unwrapped.hasFeature "gr-qtgui")
diff --git a/pkgs/applications/radio/gqrx/default.nix b/pkgs/applications/radio/gqrx/default.nix
index a574066045718..14675124b0edd 100644
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@@ -11,7 +11,7 @@
 , fftwFloat
 , alsa-lib
 , libjack2
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 # drivers (optional):
 , rtl-sdr
@@ -40,7 +40,7 @@ gnuradioMinimal.pkgs.mkDerivation rec {
     cmake
     pkg-config
     wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   buildInputs = [
     gnuradioMinimal.unwrapped.logLib
diff --git a/pkgs/applications/radio/gridtracker/default.nix b/pkgs/applications/radio/gridtracker/default.nix
index 5769fbbdf1c86..645aed7fffd6f 100644
--- a/pkgs/applications/radio/gridtracker/default.nix
+++ b/pkgs/applications/radio/gridtracker/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, nix-update-script, nwjs, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitLab, nix-update-script, nwjs, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "gridtracker";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-p3PdYOk0yvG3QkM17grzZmf9upK1n0zo4aOrlhGTvTU=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   postPatch = ''
     substituteInPlace Makefile \
diff --git a/pkgs/applications/radio/grig/default.nix b/pkgs/applications/radio/grig/default.nix
index b288317c03c7b..84664d897203a 100644
--- a/pkgs/applications/radio/grig/default.nix
+++ b/pkgs/applications/radio/grig/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , autoreconfHook
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk2
 , hamlib_4 }:
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-OgIgHW9NMW/xSSti3naIR8AQWUtNSv5bYdOcObStBlM=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook3 ];
   buildInputs = [ hamlib_4 gtk2 ];
 
   meta = with lib; {
diff --git a/pkgs/applications/radio/tqsl/default.nix b/pkgs/applications/radio/tqsl/default.nix
index 321536f71ab52..bf6ee947785e9 100644
--- a/pkgs/applications/radio/tqsl/default.nix
+++ b/pkgs/applications/radio/tqsl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, expat, openssl, zlib, lmdb, curl, sqlite, wxGTK32, wrapGAppsHook }:
+{ lib, stdenv, fetchurl, cmake, expat, openssl, zlib, lmdb, curl, sqlite, wxGTK32, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "tqsl";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-T4NBCUTYHT6ugSg1gSfjQBOBndqwSwyWLr/qlDPQGKI=";
   };
 
-  nativeBuildInputs = [ cmake wrapGAppsHook ];
+  nativeBuildInputs = [ cmake wrapGAppsHook3 ];
   buildInputs = [
     expat
     openssl
diff --git a/pkgs/applications/science/astronomy/gpredict/default.nix b/pkgs/applications/science/astronomy/gpredict/default.nix
index 56c5a92460dd5..467f478da96b3 100644
--- a/pkgs/applications/science/astronomy/gpredict/default.nix
+++ b/pkgs/applications/science/astronomy/gpredict/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, pkg-config, intltool
 , gtk3, glib, curl, goocanvas2, gpsd
-, hamlib, wrapGAppsHook
+, hamlib, wrapGAppsHook3
 }:
 
 let
@@ -24,7 +24,7 @@ in stdenv.mkDerivation {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config intltool wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config intltool wrapGAppsHook3 ];
   buildInputs = [ curl glib gtk3 goocanvas2 gpsd hamlib ];
 
   meta = with lib; {
diff --git a/pkgs/applications/science/astronomy/phd2/default.nix b/pkgs/applications/science/astronomy/phd2/default.nix
index 9c66df83dd4b3..b463a2845bdcc 100644
--- a/pkgs/applications/science/astronomy/phd2/default.nix
+++ b/pkgs/applications/science/astronomy/phd2/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK32
-, curl, gettext, glib, indi-full, libnova, wrapGAppsHook }:
+, curl, gettext, glib, indi-full, libnova, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "phd2";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/science/astronomy/siril/default.nix b/pkgs/applications/science/astronomy/siril/default.nix
index 255927d893d28..f039d056ec677 100644
--- a/pkgs/applications/science/astronomy/siril/default.nix
+++ b/pkgs/applications/science/astronomy/siril/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitLab, fetchpatch, pkg-config, meson, ninja, cmake
 , git, criterion, gtk3, libconfig, gnuplot, opencv, json-glib
 , fftwFloat, cfitsio, gsl, exiv2, librtprocess, wcslib, ffmpeg
-, libraw, libtiff, libpng, libjpeg, libheif, ffms, wrapGAppsHook
+, libraw, libtiff, libpng, libjpeg, libheif, ffms, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    meson ninja cmake pkg-config git criterion wrapGAppsHook
+    meson ninja cmake pkg-config git criterion wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/applications/science/astronomy/stellarium/default.nix
index 35d6bd8aba925..687c0b3a2dda2 100644
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@@ -4,7 +4,7 @@
 , fetchpatch
 , cmake
 , perl
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 , qtbase
 , qtcharts
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     perl
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
     qttools
   ];
diff --git a/pkgs/applications/science/biology/igv/default.nix b/pkgs/applications/science/biology/igv/default.nix
index 0d8d87ac4109b..219792326b685 100644
--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@@ -1,11 +1,11 @@
-{ lib, stdenv, fetchzip, jdk17, testers, wrapGAppsHook, igv }:
+{ lib, stdenv, fetchzip, jdk17, testers, wrapGAppsHook3, igv }:
 
 stdenv.mkDerivation rec {
   pname = "igv";
-  version = "2.17.3";
+  version = "2.17.4";
   src = fetchzip {
     url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor version}/IGV_${version}.zip";
-    sha256 = "sha256-SGqkWBv4nol0+lnGN7wBHJvndcIqZ5+Wt1wAcXA42cU=";
+    sha256 = "sha256-LF/rwm/XlLHAJjiAlQVTmx5l+5Np2b5rPjoCdN/qERU=";
   };
 
   installPhase = ''
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     chmod +x $out/bin/igv
     chmod +x $out/bin/igvtools
   '';
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   passthru.tests.version = testers.testVersion {
     package = igv;
diff --git a/pkgs/applications/science/biology/jbrowse/default.nix b/pkgs/applications/science/biology/jbrowse/default.nix
index c4c8966aa50d5..46a8c85d3a066 100644
--- a/pkgs/applications/science/biology/jbrowse/default.nix
+++ b/pkgs/applications/science/biology/jbrowse/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, appimageTools, wrapGAppsHook }:
+{ lib, fetchurl, appimageTools, wrapGAppsHook3 }:
 
 let
   pname = "jbrowse";
diff --git a/pkgs/applications/science/biology/last/default.nix b/pkgs/applications/science/biology/last/default.nix
index 3bc84e414bb75..85fb1ca80ac65 100644
--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1542";
+  version = "1543";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = "refs/tags/${version}";
-    hash = "sha256-ZzvyyecYiBscogfN9/FnDbHg/lqb8y14n9C2KLIqhFA=";
+    hash = "sha256-APHPv7Q64JITfHsvjCThZ6hvGHerk6wjOm32KdTv4k8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/chemistry/chemtool/default.nix b/pkgs/applications/science/chemistry/chemtool/default.nix
index fe2d658b5a44f..82b1834671619 100644
--- a/pkgs/applications/science/chemistry/chemtool/default.nix
+++ b/pkgs/applications/science/chemistry/chemtool/default.nix
@@ -5,7 +5,7 @@
 , libX11
 , gtk2
 , fig2dev
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     sha256 = "hhYaBGE4azNKX/sXzfCUpJGUGIRngnL0V0mBNRTdr8s=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = [
     libX11
     gtk2
diff --git a/pkgs/applications/science/electronics/gtkwave/default.nix b/pkgs/applications/science/electronics/gtkwave/default.nix
index 7b7b54201bf7d..3e0f3613ba903 100644
--- a/pkgs/applications/science/electronics/gtkwave/default.nix
+++ b/pkgs/applications/science/electronics/gtkwave/default.nix
@@ -10,20 +10,20 @@
 , stdenv
 , tcl
 , tk
-, wrapGAppsHook
+, wrapGAppsHook3
 , xz
 }:
 
 stdenv.mkDerivation rec {
   pname = "gtkwave";
-  version = "3.3.118";
+  version = "3.3.119";
 
   src = fetchurl {
     url = "mirror://sourceforge/gtkwave/${pname}-gtk3-${version}.tar.gz";
-    sha256 = "sha256-D0MwwCiiqz0vTUzur222kl2wEMS2/VLRECLQ5d6gSGo=";
+    sha256 = "sha256-6rPgnnZBEVwHhIv7MPfdDDu+K4y+RQF+leB327pqwDg=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = [ bzip2 glib gperf gtk3 judy tcl tk xz ]
     ++ lib.optional stdenv.isDarwin gtk-mac-integration;
 
diff --git a/pkgs/applications/science/electronics/horizon-eda/default.nix b/pkgs/applications/science/electronics/horizon-eda/default.nix
index 1fbc92f06115f..40a91937f07f5 100644
--- a/pkgs/applications/science/electronics/horizon-eda/default.nix
+++ b/pkgs/applications/science/electronics/horizon-eda/default.nix
@@ -4,7 +4,7 @@
 , coreutils
 , libspnav
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = base.nativeBuildInputs ++ [
     boost.dev
-    wrapGAppsHook
+    wrapGAppsHook3
     python3
   ];
 
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index 99670eee8a46b..1cec011fae33f 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -193,14 +193,14 @@ stdenv.mkDerivation rec {
       "${symbols}/share/kicad/template"
     ];
   };
-  # We are emulating wrapGAppsHook, along with other variables to the wrapper
+  # We are emulating wrapGAppsHook3, along with other variables to the wrapper
   makeWrapperArgs = with passthru.libraries; [
     "--prefix XDG_DATA_DIRS : ${base}/share"
     "--prefix XDG_DATA_DIRS : ${hicolor-icon-theme}/share"
     "--prefix XDG_DATA_DIRS : ${gnome.adwaita-icon-theme}/share"
     "--prefix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}"
     "--prefix XDG_DATA_DIRS : ${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}"
-    # wrapGAppsHook did these two as well, no idea if it matters...
+    # wrapGAppsHook3 did these two as well, no idea if it matters...
     "--prefix XDG_DATA_DIRS : ${cups}/share"
     "--prefix GIO_EXTRA_MODULES : ${dconf}/lib/gio/modules"
     # required to open a bug report link in firefox-wayland
diff --git a/pkgs/applications/science/electronics/openboardview/default.nix b/pkgs/applications/science/electronics/openboardview/default.nix
index 4eaf29133a440..4aa9ab2b66f29 100644
--- a/pkgs/applications/science/electronics/openboardview/default.nix
+++ b/pkgs/applications/science/electronics/openboardview/default.nix
@@ -9,7 +9,7 @@
 , SDL2
 , fontconfig
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , darwin
 }:
 
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ cmake pkg-config python3 wrapGAppsHook ];
+  nativeBuildInputs = [ cmake pkg-config python3 wrapGAppsHook3 ];
   buildInputs = [ SDL2 fontconfig gtk3 ] ++ lib.optionals stdenv.isDarwin [
     Cocoa
   ];
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index 37a8aba7d8c7a..68b424b32fb4a 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -11,7 +11,7 @@
 , ocamlPackages_4_14
 , ncurses
 , buildIde ? null # default is true for Coq < 8.14 and false for Coq >= 8.14
-, glib, gnome, wrapGAppsHook, makeDesktopItem, copyDesktopItems
+, glib, gnome, wrapGAppsHook3, makeDesktopItem, copyDesktopItems
 , csdp ? null
 , version, coq-version ? null
 }@args:
@@ -147,7 +147,7 @@ self = stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config ]
     ++ ocamlNativeBuildInputs
     ++ optional buildIde copyDesktopItems
-    ++ optional (buildIde && coqAtLeast "8.10") wrapGAppsHook
+    ++ optional (buildIde && coqAtLeast "8.10") wrapGAppsHook3
     ++ optional (!coqAtLeast "8.6") gnumake42;
   buildInputs = [ ncurses ]
     ++ optionals buildIde
diff --git a/pkgs/applications/science/logic/tlaplus/toolbox.nix b/pkgs/applications/science/logic/tlaplus/toolbox.nix
index 288ddc06806a8..1d5cfa5c5d93c 100644
--- a/pkgs/applications/science/logic/tlaplus/toolbox.nix
+++ b/pkgs/applications/science/logic/tlaplus/toolbox.nix
@@ -7,7 +7,7 @@
 , libXtst
 , glib
 , zlib
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     makeShellWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/science/logic/why3/default.nix b/pkgs/applications/science/logic/why3/default.nix
index 74659a58f13ee..42256ae70aa69 100644
--- a/pkgs/applications/science/logic/why3/default.nix
+++ b/pkgs/applications/science/logic/why3/default.nix
@@ -2,7 +2,7 @@
 , ocamlPackages, coqPackages, rubber, hevea, emacs
 , version ? "1.7.2"
 , ideSupport ? true
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   nativeBuildInputs = lib.optional ideSupport
-    wrapGAppsHook
+    wrapGAppsHook3
   ++ (with ocamlPackages;  [
     ocaml findlib menhir
   ]) ++ [
diff --git a/pkgs/applications/science/math/nasc/default.nix b/pkgs/applications/science/math/nasc/default.nix
index d25f0ad344966..b544d5fc6b145 100644
--- a/pkgs/applications/science/math/nasc/default.nix
+++ b/pkgs/applications/science/math/nasc/default.nix
@@ -15,7 +15,7 @@
 , libqalculate
 , intltool
 , gnuplot
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/science/math/qalculate-gtk/default.nix b/pkgs/applications/science/math/qalculate-gtk/default.nix
index 2a2b4617d24b4..9673d7d479d02 100644
--- a/pkgs/applications/science/math/qalculate-gtk/default.nix
+++ b/pkgs/applications/science/math/qalculate-gtk/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, intltool, autoreconfHook, pkg-config, libqalculate, gtk3, curl, wrapGAppsHook, desktopToDarwinBundle }:
+{ lib, stdenv, fetchFromGitHub, intltool, autoreconfHook, pkg-config, libqalculate, gtk3, curl, wrapGAppsHook3, desktopToDarwinBundle }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qalculate-gtk";
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   hardeningDisable = [ "format" ];
 
-  nativeBuildInputs = [ intltool pkg-config autoreconfHook wrapGAppsHook ]
+  nativeBuildInputs = [ intltool pkg-config autoreconfHook wrapGAppsHook3 ]
     ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
   buildInputs = [ libqalculate gtk3 curl ];
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/math/rofi-calc/default.nix b/pkgs/applications/science/math/rofi-calc/default.nix
index be126e5fa3974..14f8fe734bd68 100644
--- a/pkgs/applications/science/math/rofi-calc/default.nix
+++ b/pkgs/applications/science/math/rofi-calc/default.nix
@@ -7,7 +7,7 @@
 , glib
 , cairo
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
     pkg-config
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/science/math/wxmaxima/default.nix b/pkgs/applications/science/math/wxmaxima/default.nix
index 4d2815d129974..0009a04af6ac7 100644
--- a/pkgs/applications/science/math/wxmaxima/default.nix
+++ b/pkgs/applications/science/math/wxmaxima/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , cmake
 , gettext
 , maxima
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs:{
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     cmake
     gettext
   ];
diff --git a/pkgs/applications/science/medicine/xmedcon/default.nix b/pkgs/applications/science/medicine/xmedcon/default.nix
index b09183f71b960..e5c5bf68d53a7 100644
--- a/pkgs/applications/science/medicine/xmedcon/default.nix
+++ b/pkgs/applications/science/medicine/xmedcon/default.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , libpng
 , zlib
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     zlib
   ];
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   meta = with lib; {
     description = "An open source toolkit for medical image conversion ";
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 9548db1c7c479..59bb9415b37d9 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -53,12 +53,11 @@
 , Cocoa
 , CoreSymbolication
 , OpenGL
-, noSplash ? false
 }:
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "6.30.04";
+  version = "6.30.06";
 
   passthru = {
     tests = import ./tests { inherit callPackage; };
@@ -66,7 +65,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    hash = "sha256-K0GAtpjznMZdkQhNgzqIRRWzJbxfZzyOOavoGLAl2Mw=";
+    hash = "sha256-MA237RtnjtL7ljXKZ1khoZRcfCED2oQAM7STCR9VcAw=";
   };
 
   nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
@@ -143,8 +142,6 @@ stdenv.mkDerivation rec {
       -e '1iset(nlohmann_json_DIR "${nlohmann_json}/lib/cmake/nlohmann_json/")'
 
     patchShebangs build/unix/
-  '' + lib.optionalString noSplash ''
-    substituteInPlace rootx/src/rootx.cxx --replace "gNoLogo = false" "gNoLogo = true"
   '' + lib.optionalString stdenv.isDarwin ''
     # Eliminate impure reference to /System/Library/PrivateFrameworks
     substituteInPlace core/macosx/CMakeLists.txt \
@@ -163,10 +160,6 @@ stdenv.mkDerivation rec {
     "-Dbuiltin_gtest=OFF"
     "-Dbuiltin_nlohmannjson=OFF"
     "-Dbuiltin_openui5=ON"
-    "-Dalien=OFF"
-    "-Dbonjour=OFF"
-    "-Dcastor=OFF"
-    "-Dchirp=OFF"
     "-Dclad=OFF"
     "-Ddavix=ON"
     "-Ddcache=OFF"
@@ -176,21 +169,13 @@ stdenv.mkDerivation rec {
     "-Dfortran=OFF"
     "-Dgnuinstall=ON"
     "-Dimt=ON"
-    "-Dgfal=OFF"
     "-Dgviz=OFF"
-    "-Dhdfs=OFF"
     "-Dhttp=ON"
-    "-Dkrb5=OFF"
-    "-Dldap=OFF"
-    "-Dmonalisa=OFF"
     "-Dmysql=OFF"
     "-Dodbc=OFF"
     "-Dopengl=ON"
-    "-Doracle=OFF"
     "-Dpgsql=OFF"
-    "-Dpythia6=OFF"
     "-Dpythia8=OFF"
-    "-Drfio=OFF"
     "-Droot7=ON"
     "-Dsqlite=OFF"
     "-Dssl=ON"
@@ -204,16 +189,12 @@ stdenv.mkDerivation rec {
   ++ lib.optional (stdenv.cc.libc != null) "-DC_INCLUDE_DIRS=${lib.getDev stdenv.cc.libc}/include"
   ++ lib.optionals stdenv.isDarwin [
     "-DOPENGL_INCLUDE_DIR=${OpenGL}/Library/Frameworks"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_Python2=TRUE"
 
     # fatal error: module map file '/nix/store/<hash>-Libsystem-osx-10.12.6/include/module.modulemap' not found
     # fatal error: could not build module '_Builtin_intrinsics'
     "-Druntime_cxxmodules=OFF"
   ];
 
-  # suppress warnings from compilation of the vendored clang to avoid running into log limits on the Hydra
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [ "-Wno-shadow" "-Wno-maybe-uninitialized" ];
-
   postInstall = ''
     for prog in rootbrowse rootcp rooteventselector rootls rootmkdir rootmv rootprint rootrm rootslimtree; do
       wrapProgram "$out/bin/$prog" \
@@ -273,7 +254,7 @@ stdenv.mkDerivation rec {
     homepage = "https://root.cern.ch/";
     description = "A data analysis framework";
     platforms = platforms.unix;
-    maintainers = [ maintainers.veprbl ];
+    maintainers = [ maintainers.guitargeek maintainers.veprbl ];
     license = licenses.lgpl21;
   };
 }
diff --git a/pkgs/applications/science/physics/crystfel/default.nix b/pkgs/applications/science/physics/crystfel/default.nix
index 92b48ec863091..e7eb69fb4e1c1 100644
--- a/pkgs/applications/science/physics/crystfel/default.nix
+++ b/pkgs/applications/science/physics/crystfel/default.nix
@@ -6,18 +6,19 @@
 , fetchzip
 , cmake
 , lz4
+, gfortran
 , bzip2
-, m4
 , hdf5
 , gsl
 , unzip
 , makeWrapper
+, zlib
 , meson
-, git
 , ninja
+, pandoc
 , eigen
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , flex
 , bison
 , doxygen
@@ -40,7 +41,7 @@ let
     pname = "libccp4";
     version = "8.0.0";
     src = fetchurl {
-      url = "https://ftp.ccp4.ac.uk/opensource/${pname}-${version}.tar.gz";
+      url = "https://ftp.ccp4.ac.uk/opensource/libccp4-${version}.tar.gz";
       hash = "sha256-y4E66GYSoIZjKd6rfO6W6sVz2BvlskA0HUD5rVMi/y0=";
     };
     nativeBuildInputs = [ meson ninja ];
@@ -87,7 +88,7 @@ let
           };
       mosflmBinary = if stdenv.isDarwin then "bin/mosflm" else "mosflm-linux-64-noX11";
     in
-    stdenv.mkDerivation rec {
+    stdenv.mkDerivation {
       pname = "mosflm";
 
       inherit version src;
@@ -111,7 +112,7 @@ let
     pname = "xgandalf";
     version = "c6c5003ff1086e8c0fb5313660b4f02f3a3aab7b";
     src = fetchurl {
-      url = "https://gitlab.desy.de/thomas.white/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
+      url = "https://gitlab.desy.de/thomas.white/xgandalf/-/archive/${version}/xgandalf-${version}.tar.gz";
       hash = "sha256-/uZlBwAINSoYqgLQFTMz8rS1Rpadu79JkO6Bu/+Nx9E=";
     };
 
@@ -121,10 +122,10 @@ let
 
   pinkIndexer = stdenv.mkDerivation rec {
     pname = "pinkindexer";
-    version = "5d4e016941eb2a9e50a10df96ded7ff1e2464503";
+    version = "15caa21191e27e989b750b29566e4379bc5cd21a";
     src = fetchurl {
       url = "https://gitlab.desy.de/thomas.white/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-VnJOJJ247dNoBlos4Fu3GQBlAnTk9el+yZDRiicJtu0=";
+      hash = "sha256-v/SCJiHAV05Lc905y/dE8uBXlW+lLX9wau4XORYdbQg=";
     };
 
     nativeBuildInputs = [ meson pkg-config ninja ];
@@ -169,16 +170,30 @@ let
       "-DENABLE_BZIP2_PLUGIN=yes"
     ];
   };
+
+  millepede-ii = stdenv.mkDerivation rec {
+    pname = "millepede-ii";
+    version = "04-13-06";
+    src = fetchurl {
+      url = "https://gitlab.desy.de/claus.kleinwort/millepede-ii/-/archive/V${version}/millepede-ii-V${version}.tar.gz";
+      hash = "sha256-aFoo8AGBsUEN2u3AmnSpTqJ6JeNV6j9vkAFTZ34I+sI=";
+    };
+
+    nativeBuildInputs = [ gfortran ];
+    buildInputs = [ zlib ];
+
+    makeFlags = [ "PREFIX=$(out)" ];
+  };
 in
 stdenv.mkDerivation rec {
   pname = "crystfel";
-  version = "0.10.2";
+  version = "0.11.0";
   src = fetchurl {
-    url = "https://www.desy.de/~twhite/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-nCO9ndDKS54bVN9IhFBiCVNzqk7BsCljXFrOmlx+sP4=";
+    url = "https://www.desy.de/~twhite/crystfel/crystfel-${version}.tar.gz";
+    sha256 = "sha256-ogNHWYfbxRmB5TdK8K0JpcCnYOOyXapQGSPh8mfp+Tc=";
   };
   nativeBuildInputs = [ meson pkg-config ninja flex bison doxygen opencl-headers makeWrapper ]
-    ++ lib.optionals withGui [ wrapGAppsHook ];
+    ++ lib.optionals withGui [ wrapGAppsHook3 ];
   buildInputs = [
     hdf5
     gsl
@@ -192,6 +207,7 @@ stdenv.mkDerivation rec {
     mosflm
     pinkIndexer
     xgandalf
+    pandoc
   ] ++ lib.optionals withGui [ gtk3 gdk-pixbuf ]
   ++ lib.optionals stdenv.isDarwin [
     argp-standalone
@@ -201,12 +217,12 @@ stdenv.mkDerivation rec {
   ++ lib.optionals withBitshuffle [ hdf5-external-filter-plugins ];
 
   patches = [
+    # on darwin at least, we need to link to a separate argp library;
+    # this patch adds a test for this and the necessary linker options
     ./link-to-argp-standalone-if-needed.patch
-    ./disable-fmemopen-on-aarch64-darwin.patch
-    (fetchpatch {
-      url = "https://gitlab.desy.de/thomas.white/crystfel/-/commit/3c54d59e1c13aaae716845fed2585770c3ca9d14.diff";
-      hash = "sha256-oaJNBQQn0c+z4p1pnW4osRJA2KdKiz4hWu7uzoKY7wc=";
-    })
+    # hotfix for an issue that occurs (at least) on NixOS:
+    # if the temporary path is too long, we get a segfault
+    ./gui-path-issue.patch
   ];
 
   # CrystFEL calls mosflm by searching PATH for it. We could've create a wrapper script that sets the PATH, but
@@ -218,7 +234,9 @@ stdenv.mkDerivation rec {
 
   postInstall = lib.optionalString withBitshuffle ''
     for file in $out/bin/*; do
-      wrapProgram $file --set HDF5_PLUGIN_PATH ${hdf5-external-filter-plugins}/lib/plugins
+      wrapProgram $file \
+        --set HDF5_PLUGIN_PATH ${hdf5-external-filter-plugins}/lib/plugins \
+        --prefix PATH ":" ${lib.makeBinPath [ millepede-ii ]}
     done
   '';
 
diff --git a/pkgs/applications/science/physics/crystfel/gui-path-issue.patch b/pkgs/applications/science/physics/crystfel/gui-path-issue.patch
new file mode 100644
index 0000000000000..28cd0280e8f67
--- /dev/null
+++ b/pkgs/applications/science/physics/crystfel/gui-path-issue.patch
@@ -0,0 +1,27 @@
+diff --git a/src/gui_index.c b/src/gui_index.c
+index 2cc8e8db..13be77d5 100644
+--- a/src/gui_index.c
++++ b/src/gui_index.c
+@@ -540,6 +540,7 @@ static void delete_gui_tempdir(char *tmpdir)
+ {
+ 	char *path;
+ 	int i;
++	size_t pathlen;
+ 
+ 	/* List of files which it's safe to delete */
+ 	char *files[] = {"gmon.out", "mosflm.lp", "SUMMARY", "XDS.INP",
+@@ -552,11 +553,12 @@ static void delete_gui_tempdir(char *tmpdir)
+ 
+ 	if ( tmpdir == NULL ) return;
+ 
+-	path = calloc(strlen(tmpdir)+64, 1);
++	pathlen = strlen(tmpdir)+64;
++	path = calloc(pathlen, 1);
+ 	if ( path == NULL ) return;
+ 
+ 	for ( i=0; i<n_files; i++ ) {
+-		snprintf(path, 127, "%s/%s", tmpdir, files[i]);
++		snprintf(path, pathlen, "%s/%s", tmpdir, files[i]);
+ 		unlink(path);
+ 	}
+ 
diff --git a/pkgs/applications/science/physics/crystfel/link-to-argp-standalone-if-needed.patch b/pkgs/applications/science/physics/crystfel/link-to-argp-standalone-if-needed.patch
index 8314be29ac006..edadb750ac57f 100644
--- a/pkgs/applications/science/physics/crystfel/link-to-argp-standalone-if-needed.patch
+++ b/pkgs/applications/science/physics/crystfel/link-to-argp-standalone-if-needed.patch
@@ -1,8 +1,8 @@
 diff --git a/meson.build b/meson.build
-index 59bbcfb7..dd75d4e2 100644
+index 4717bb2a..38d8693f 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -80,6 +80,12 @@ if cc.has_function('clock_gettime', prefix: '#include <time.h>')
+@@ -70,6 +70,12 @@ if cc.has_function('clock_gettime', prefix: '#include <time.h>')
    conf_data.set10('HAVE_CLOCK_GETTIME', true)
  endif
  
@@ -12,15 +12,15 @@ index 59bbcfb7..dd75d4e2 100644
 +    argpdep = dependency('', required : false)
 +endif
 +
- # ************************ libcrystfel (subdir) ************************
- 
- subdir('libcrystfel')
-@@ -180,7 +186,7 @@ endif
+ if cc.has_function('sched_setaffinity',
+                    prefix: '#include <sched.h>',
+                    args: '-D_GNU_SOURCE')
+@@ -186,7 +192,7 @@ endif
  
  indexamajig = executable('indexamajig', indexamajig_sources,
                           dependencies: [mdep, libcrystfeldep, gsldep,
--                                        pthreaddep, zmqdep, asapodep],
-+                                        pthreaddep, zmqdep, asapodep, argpdep],
+-                                        pthreaddep, zmqdep, asapodep, asapoproddep],
++                                        pthreaddep, zmqdep, asapodep, asapoproddep, argpdep],
                           install: true,
-                          install_rpath: '$ORIGIN/../lib64/:$ORIGIN/../lib')
+                          install_rpath: crystfel_rpath)
  
diff --git a/pkgs/applications/science/physics/xnec2c/default.nix b/pkgs/applications/science/physics/xnec2c/default.nix
index 60afa09ecc8cd..ffdd4b6d0b07f 100644
--- a/pkgs/applications/science/physics/xnec2c/default.nix
+++ b/pkgs/applications/science/physics/xnec2c/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchurl
 , autoreconfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , which
 , gtk3
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoreconfHook
-    wrapGAppsHook
+    wrapGAppsHook3
     pkg-config
     which
   ];
diff --git a/pkgs/applications/science/robotics/betaflight-configurator/default.nix b/pkgs/applications/science/robotics/betaflight-configurator/default.nix
index 0792d3375d0a4..84f94102da136 100644
--- a/pkgs/applications/science/robotics/betaflight-configurator/default.nix
+++ b/pkgs/applications/science/robotics/betaflight-configurator/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, unzip, makeDesktopItem, nwjs, wrapGAppsHook, gsettings-desktop-schemas, gtk3 }:
+{lib, stdenv, fetchurl, unzip, makeDesktopItem, nwjs, wrapGAppsHook3, gsettings-desktop-schemas, gtk3 }:
 
 let
   pname = "betaflight-configurator";
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     find -name "lib*.so" -delete
   '';
 
-  nativeBuildInputs = [ wrapGAppsHook unzip ];
+  nativeBuildInputs = [ wrapGAppsHook3 unzip ];
 
   buildInputs = [ gsettings-desktop-schemas gtk3 ];
 
diff --git a/pkgs/applications/science/robotics/emuflight-configurator/default.nix b/pkgs/applications/science/robotics/emuflight-configurator/default.nix
index 2c51355eb54f0..62592b0cc3fc9 100644
--- a/pkgs/applications/science/robotics/emuflight-configurator/default.nix
+++ b/pkgs/applications/science/robotics/emuflight-configurator/default.nix
@@ -1,5 +1,5 @@
 {lib, stdenv, fetchurl, unzip, makeDesktopItem, copyDesktopItems, nwjs
-, wrapGAppsHook, gsettings-desktop-schemas, gtk3 }:
+, wrapGAppsHook3, gsettings-desktop-schemas, gtk3 }:
 
 stdenv.mkDerivation rec {
   pname = "emuflight-configurator";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-e4HNg5yr9V5LyT0hYP6gzw0tZm4dLidJg5MQtH3L3JI=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook unzip copyDesktopItems ];
+  nativeBuildInputs = [ wrapGAppsHook3 unzip copyDesktopItems ];
 
   buildInputs = [ gsettings-desktop-schemas gtk3 ];
 
diff --git a/pkgs/applications/science/robotics/inav-configurator/default.nix b/pkgs/applications/science/robotics/inav-configurator/default.nix
index f5216eaf6c921..1a6f5951ed348 100644
--- a/pkgs/applications/science/robotics/inav-configurator/default.nix
+++ b/pkgs/applications/science/robotics/inav-configurator/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeDesktopItem, copyDesktopItems, nwjs, wrapGAppsHook, gsettings-desktop-schemas, gtk3 }:
+{ lib, stdenv, fetchurl, makeDesktopItem, copyDesktopItems, nwjs, wrapGAppsHook3, gsettings-desktop-schemas, gtk3 }:
 
 stdenv.mkDerivation rec {
   pname = "inav-configurator";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "1i844dzzc5s5cr4vfpi6k2kdn8jiqq2n6c0fjqvsp4wdidwjahzw";
   };
 
-  nativeBuildInputs = [ copyDesktopItems wrapGAppsHook ];
+  nativeBuildInputs = [ copyDesktopItems wrapGAppsHook3 ];
 
   buildInputs = [ gsettings-desktop-schemas gtk3 ];
 
diff --git a/pkgs/applications/system/monitor/default.nix b/pkgs/applications/system/monitor/default.nix
index 2ad01f2aa26f1..fdf353646717e 100644
--- a/pkgs/applications/system/monitor/default.nix
+++ b/pkgs/applications/system/monitor/default.nix
@@ -20,7 +20,7 @@
 , libhandy
 , sassc
 , udisks2
-, wrapGAppsHook
+, wrapGAppsHook3
 , libX11
 , libXext
 , libXNVCtrl
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     vala
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/system/thumbdrives/default.nix b/pkgs/applications/system/thumbdrives/default.nix
index d70ea95806293..89711e996831f 100644
--- a/pkgs/applications/system/thumbdrives/default.nix
+++ b/pkgs/applications/system/thumbdrives/default.nix
@@ -10,7 +10,7 @@
 , gettext
 , glib
 , desktop-file-utils
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -38,7 +38,7 @@ python3.pkgs.buildPythonApplication rec {
     glib
     gtk3
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/terminal-emulators/gnome-console/default.nix b/pkgs/applications/terminal-emulators/gnome-console/default.nix
index 2141effcf015f..5884f65c61edc 100644
--- a/pkgs/applications/terminal-emulators/gnome-console/default.nix
+++ b/pkgs/applications/terminal-emulators/gnome-console/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-console";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-console/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "50YhKNLfIySh10gGLEBCnNBQSvCeQHBnsz86nQxZyOE=";
+    hash = "sha256-FhnOcBdzssDJA3GPVHaMGS6lB0UU1VoXdKkslyMdbD4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/terminal-emulators/guake/default.nix b/pkgs/applications/terminal-emulators/guake/default.nix
index 667da3ec229fd..9342e1833ac26 100644
--- a/pkgs/applications/terminal-emulators/guake/default.nix
+++ b/pkgs/applications/terminal-emulators/guake/default.nix
@@ -3,7 +3,7 @@
 , python3
 , glibcLocales
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , keybinder3
 , libnotify
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
     python3.pkgs.pip
   ];
 
diff --git a/pkgs/applications/terminal-emulators/lxterminal/default.nix b/pkgs/applications/terminal-emulators/lxterminal/default.nix
index 90483efc89a51..76f375e43f62e 100644
--- a/pkgs/applications/terminal-emulators/lxterminal/default.nix
+++ b/pkgs/applications/terminal-emulators/lxterminal/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, automake, autoconf, intltool, pkg-config, gtk3, vte, wrapGAppsHook
+{ lib, stdenv, fetchFromGitHub, automake, autoconf, intltool, pkg-config, gtk3, vte, wrapGAppsHook3
 , libxslt, docbook_xml_dtd_412, docbook_xsl, libxml2, findXMLCatalogs, nixosTests
 , pcre2
 }:
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    automake autoconf intltool pkg-config wrapGAppsHook
+    automake autoconf intltool pkg-config wrapGAppsHook3
     libxslt docbook_xml_dtd_412 docbook_xsl libxml2 findXMLCatalogs
   ];
 
diff --git a/pkgs/applications/terminal-emulators/mlterm/default.nix b/pkgs/applications/terminal-emulators/mlterm/default.nix
index f11c456d43760..28f027401bd74 100644
--- a/pkgs/applications/terminal-emulators/mlterm/default.nix
+++ b/pkgs/applications/terminal-emulators/mlterm/default.nix
@@ -14,7 +14,7 @@
 , fcitx5-gtk
 , ibus
 , uim #IME
-, wrapGAppsHook #color picker in mlconfig
+, wrapGAppsHook3 #color picker in mlconfig
 , gdk-pixbuf
 , gtk3
 , gtk ? gtk3
@@ -111,7 +111,7 @@ in stdenv.mkDerivation (finalAttrs: {
     pkg-config
     autoconf
   ] ++ lib.optionals enableTools.mlconfig [
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   buildInputs = [
     gtk
diff --git a/pkgs/applications/terminal-emulators/terminator/default.nix b/pkgs/applications/terminal-emulators/terminator/default.nix
index 4dee206be28df..3eb374af71abb 100644
--- a/pkgs/applications/terminal-emulators/terminator/default.nix
+++ b/pkgs/applications/terminal-emulators/terminator/default.nix
@@ -7,7 +7,7 @@
 , gtk3
 , gobject-introspection
 , libnotify
-, wrapGAppsHook
+, wrapGAppsHook3
 , vte
 , nixosTests
 }:
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
     file
     intltool
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
     python3.pkgs.pytest-runner
   ];
 
diff --git a/pkgs/applications/terminal-emulators/termite/default.nix b/pkgs/applications/terminal-emulators/termite/default.nix
index ab854a2f99069..a47423390ba21 100644
--- a/pkgs/applications/terminal-emulators/termite/default.nix
+++ b/pkgs/applications/terminal-emulators/termite/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, vte, gtk3, ncurses, pcre2, wrapGAppsHook, nixosTests }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, vte, gtk3, ncurses, pcre2, wrapGAppsHook3, nixosTests }:
 
 let
 
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ vte-ng gtk3 ncurses pcre2 ];
 
-  nativeBuildInputs = [ wrapGAppsHook pkg-config ];
+  nativeBuildInputs = [ wrapGAppsHook3 pkg-config ];
 
   outputs = [ "out" "terminfo" ];
 
diff --git a/pkgs/applications/version-management/deepgit/default.nix b/pkgs/applications/version-management/deepgit/default.nix
index 8a778526b4ad8..c5744d073ce00 100644
--- a/pkgs/applications/version-management/deepgit/default.nix
+++ b/pkgs/applications/version-management/deepgit/default.nix
@@ -7,7 +7,7 @@
 , lib
 , makeDesktopItem
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     copyDesktopItems
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/version-management/gerrit/default.nix b/pkgs/applications/version-management/gerrit/default.nix
index 7a9a01ea255bc..41179dfd0bcda 100644
--- a/pkgs/applications/version-management/gerrit/default.nix
+++ b/pkgs/applications/version-management/gerrit/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gerrit";
-  version = "3.9.2";
+  version = "3.9.4";
 
   src = fetchurl {
     url = "https://gerrit-releases.storage.googleapis.com/gerrit-${version}.war";
-    hash = "sha256-KsuuwFKdpXHDVAZZ2JiX781mgqDQyyEILo4lmNn+8YE=";
+    hash = "sha256-pjrWXfae1momJRTfdIPalsLynAGwqp1VtX9M9uqzJwM=";
   };
 
   buildCommand = ''
diff --git a/pkgs/applications/version-management/gitkraken/default.nix b/pkgs/applications/version-management/gitkraken/default.nix
index a3160f1ce3a53..7a660dedad81f 100644
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@@ -2,7 +2,7 @@
 , libXfixes, atk, gtk3, libXrender, pango, gnome, cairo, freetype, fontconfig
 , libX11, libXi, libxcb, libXext, libXcursor, glib, libXScrnSaver, libxkbfile, libXtst
 , nss, nspr, cups, fetchzip, expat, gdk-pixbuf, libXdamage, libXrandr, dbus
-, makeDesktopItem, openssl, wrapGAppsHook, makeShellWrapper, at-spi2-atk, at-spi2-core, libuuid
+, makeDesktopItem, openssl, wrapGAppsHook3, makeShellWrapper, at-spi2-atk, at-spi2-core, libuuid
 , e2fsprogs, krb5, libdrm, mesa, unzip, copyDesktopItems, libxshmfence, libxkbcommon, git
 , libGL, zlib, cacert
 }:
@@ -106,7 +106,7 @@ let
       comment = "Graphical Git client from Axosoft";
     }) ];
 
-    nativeBuildInputs = [ copyDesktopItems (wrapGAppsHook.override { makeWrapper = makeShellWrapper; }) ];
+    nativeBuildInputs = [ copyDesktopItems (wrapGAppsHook3.override { makeWrapper = makeShellWrapper; }) ];
     buildInputs = [ gtk3 gnome.adwaita-icon-theme ];
 
     # avoid double-wrapping
diff --git a/pkgs/applications/version-management/meld/default.nix b/pkgs/applications/version-management/meld/default.nix
index 3b2f52f007741..f5e66083553cb 100644
--- a/pkgs/applications/version-management/meld/default.nix
+++ b/pkgs/applications/version-management/meld/default.nix
@@ -5,7 +5,7 @@
 , python3
 , meson
 , ninja
-, wrapGAppsHook
+, wrapGAppsHook3
 , libxml2
 , pkg-config
 , desktop-file-utils
@@ -36,7 +36,7 @@ python3.pkgs.buildPythonApplication rec {
     pkg-config
     desktop-file-utils
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
     gtk3 # for gtk-update-icon-cache
   ];
 
diff --git a/pkgs/applications/version-management/sublime-merge/common.nix b/pkgs/applications/version-management/sublime-merge/common.nix
index 39157edf809ba..811bed7694c1e 100644
--- a/pkgs/applications/version-management/sublime-merge/common.nix
+++ b/pkgs/applications/version-management/sublime-merge/common.nix
@@ -18,7 +18,7 @@
   pango,
   libredirect,
   makeWrapper,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   pkexecPath ? "/run/wrappers/bin/pkexec",
   writeShellScript,
   common-updater-scripts,
@@ -77,7 +77,7 @@ let
     ];
     nativeBuildInputs = [
       makeWrapper
-      wrapGAppsHook
+      wrapGAppsHook3
     ];
 
     buildPhase = ''
diff --git a/pkgs/applications/video/bombono/default.nix b/pkgs/applications/video/bombono/default.nix
index 8ad77a6680191..87545d5bceecb 100644
--- a/pkgs/applications/video/bombono/default.nix
+++ b/pkgs/applications/video/bombono/default.nix
@@ -15,7 +15,7 @@
 , libdvdread
 , libxmlxx
 , mjpegtools
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
       --replace "lib_mbase_env['CPPDEFINES']" "list(lib_mbase_env['CPPDEFINES'])"
   '';
 
-  nativeBuildInputs = [ wrapGAppsHook scons pkg-config gettext ];
+  nativeBuildInputs = [ wrapGAppsHook3 scons pkg-config gettext ];
 
   buildInputs = [
     boost
diff --git a/pkgs/applications/video/byzanz/default.nix b/pkgs/applications/video/byzanz/default.nix
index e3a97197d1049..bc88c24814678 100644
--- a/pkgs/applications/video/byzanz/default.nix
+++ b/pkgs/applications/video/byzanz/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv
 , fetchgit
-, wrapGAppsHook
+, wrapGAppsHook3
 , cairo
 , glib
 , gnome
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
     gst-plugins-good
     gst-plugins-ugly
     gst-libav
-    wrapGAppsHook
+    wrapGAppsHook3
   ]);
 
   meta = with lib; {
diff --git a/pkgs/applications/video/devede/default.nix b/pkgs/applications/video/devede/default.nix
index 22689e27d6e9a..f17638d42e3b7 100644
--- a/pkgs/applications/video/devede/default.nix
+++ b/pkgs/applications/video/devede/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitLab, python3Packages, ffmpeg, mplayer, vcdimager, cdrkit, dvdauthor
-, gtk3, gettext, wrapGAppsHook, gdk-pixbuf, gobject-introspection }:
+, gtk3, gettext, wrapGAppsHook3, gdk-pixbuf, gobject-introspection }:
 
 let
   inherit (python3Packages) dbus-python buildPythonApplication pygobject3 urllib3 setuptools;
@@ -16,7 +16,7 @@ in buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    gettext wrapGAppsHook
+    gettext wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/video/dvdstyler/default.nix b/pkgs/applications/video/dvdstyler/default.nix
index 18018f88d0256..e25bdf877a844 100644
--- a/pkgs/applications/video/dvdstyler/default.nix
+++ b/pkgs/applications/video/dvdstyler/default.nix
@@ -16,7 +16,7 @@
 , libexif
 , libjpeg
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , wxGTK32
 , wxSVG
 , xine-ui
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec {
     gettext
     gobject-introspection
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     xmlto
     zip
   ];
diff --git a/pkgs/applications/video/entangle/default.nix b/pkgs/applications/video/entangle/default.nix
index cfab93dbcd71a..c06513a0fc0c4 100644
--- a/pkgs/applications/video/entangle/default.nix
+++ b/pkgs/applications/video/entangle/default.nix
@@ -9,7 +9,7 @@
 , perl
 , python3
 , pkgconf
-, wrapGAppsHook
+, wrapGAppsHook3
 , at-spi2-core
 , dbus
 , elfutils
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     perl # for pod2man and build scripts
     python3 # for build scripts
     pkgconf
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/video/flowblade/default.nix b/pkgs/applications/video/flowblade/default.nix
index 937f5865d4043..fff387881ccad 100644
--- a/pkgs/applications/video/flowblade/default.nix
+++ b/pkgs/applications/video/flowblade/default.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub, stdenv
 , ffmpeg, frei0r, sox, gtk3, python3, ladspaPlugins
-, gobject-introspection, makeWrapper, wrapGAppsHook
+, gobject-introspection, makeWrapper, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     (python3.withPackages (ps: with ps; [ mlt pygobject3 dbus-python numpy pillow libusb1 ]))
   ];
 
-  nativeBuildInputs = [ gobject-introspection makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ gobject-introspection makeWrapper wrapGAppsHook3 ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/video/gnome-mplayer/default.nix b/pkgs/applications/video/gnome-mplayer/default.nix
index 09ed7efaf0c0b..436f31ac5a01d 100644
--- a/pkgs/applications/video/gnome-mplayer/default.nix
+++ b/pkgs/applications/video/gnome-mplayer/default.nix
@@ -1,5 +1,5 @@
 {lib, stdenv, substituteAll, fetchFromGitHub, pkg-config, gettext, glib, gtk3, gmtk, dbus, dbus-glib
-, libnotify, libpulseaudio, mplayer, wrapGAppsHook }:
+, libnotify, libpulseaudio, mplayer, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-mplayer";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0qvy9fllvg1mad6y1j79iaqa6khs0q2cb0z62yfg4srbr07fi8xr";
   };
 
-  nativeBuildInputs = [ pkg-config gettext wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config gettext wrapGAppsHook3 ];
   buildInputs = [ glib gtk3 gmtk dbus dbus-glib libnotify libpulseaudio ];
 
   patches = [
diff --git a/pkgs/applications/video/gnomecast/default.nix b/pkgs/applications/video/gnomecast/default.nix
index 9d0bfa9e966e3..cb6e4a80510a3 100644
--- a/pkgs/applications/video/gnomecast/default.nix
+++ b/pkgs/applications/video/gnomecast/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, python3Packages, fetchFromGitHub, gtk3, gobject-introspection, ffmpeg, wrapGAppsHook }:
+{ stdenv, lib, python3Packages, fetchFromGitHub, gtk3, gobject-introspection, ffmpeg, wrapGAppsHook3 }:
 
 with python3Packages;
 buildPythonApplication rec {
@@ -12,7 +12,7 @@ buildPythonApplication rec {
     sha256 = "sha256-CJpbBuRzEjWb8hsh3HMW4bZA7nyDAwjrERCS5uGdwn8=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
   propagatedBuildInputs = [
     pychromecast
     bottle
diff --git a/pkgs/applications/video/gpu-screen-recorder/gpu-screen-recorder-gtk.nix b/pkgs/applications/video/gpu-screen-recorder/gpu-screen-recorder-gtk.nix
index 86bfebad3860b..678881faec444 100644
--- a/pkgs/applications/video/gpu-screen-recorder/gpu-screen-recorder-gtk.nix
+++ b/pkgs/applications/video/gpu-screen-recorder/gpu-screen-recorder-gtk.nix
@@ -8,7 +8,7 @@
 , libdrm
 , gpu-screen-recorder
 , libglvnd
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     pkg-config
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index da7170ca5f381..f3f6dacd4a540 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -73,7 +73,7 @@
 , desktop-file-utils
 , meson
 , ninja
-, wrapGAppsHook
+, wrapGAppsHook3
 , intltool
 , glib
 , gtk3
@@ -220,7 +220,7 @@ let
       pkg-config
       python3
     ]
-    ++ optionals useGtk [ desktop-file-utils intltool meson ninja wrapGAppsHook ];
+    ++ optionals useGtk [ desktop-file-utils intltool meson ninja wrapGAppsHook3 ];
 
     buildInputs = [
       a52dec
diff --git a/pkgs/applications/video/hypnotix/default.nix b/pkgs/applications/video/hypnotix/default.nix
index 5c2e4812501c8..a3b1e25de48c0 100644
--- a/pkgs/applications/video/hypnotix/default.nix
+++ b/pkgs/applications/video/hypnotix/default.nix
@@ -8,7 +8,7 @@
 , gobject-introspection
 , mpv
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , yt-dlp
 }:
 
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     gettext
     gobject-introspection
     python3.pkgs.wrapPython
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/video/imagination/default.nix b/pkgs/applications/video/imagination/default.nix
index 8d1d6ac305f9e..6dd9793b8b977 100644
--- a/pkgs/applications/video/imagination/default.nix
+++ b/pkgs/applications/video/imagination/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, autoreconfHook, docbook_xsl, ffmpeg-full, glib, gtk3
-, intltool, libxslt, pkg-config, sox, wrapGAppsHook }:
+, intltool, libxslt, pkg-config, sox, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "imagination";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     intltool
     libxslt
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [ ffmpeg-full glib gtk3 sox ];
diff --git a/pkgs/applications/video/jellyfin-mpv-shim/default.nix b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
index dad9a52402495..70f28ab72077c 100644
--- a/pkgs/applications/video/jellyfin-mpv-shim/default.nix
+++ b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
@@ -13,7 +13,7 @@
 , python-mpv-jsonipc
 , pywebview
 , tkinter
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication rec {
@@ -27,7 +27,7 @@ buildPythonApplication rec {
 
   nativeBuildInputs = [
     copyDesktopItems
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/video/kazam/default.nix b/pkgs/applications/video/kazam/default.nix
index 8ca3b813663f4..cf392a143d7dc 100644
--- a/pkgs/applications/video/kazam/default.nix
+++ b/pkgs/applications/video/kazam/default.nix
@@ -3,7 +3,7 @@
 , substituteAll
 , python3Packages
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , gtk3
 , libwnck
@@ -26,7 +26,7 @@ python3Packages.buildPythonApplication rec {
     sha256 = "1jk6khwgdv3nmagdgp5ivz3156pl0ljhf7b6i4b52w1h5ywsg9ah";
   };
 
-  nativeBuildInputs = [ gobject-introspection python3Packages.distutils-extra intltool wrapGAppsHook ];
+  nativeBuildInputs = [ gobject-introspection python3Packages.distutils-extra intltool wrapGAppsHook3 ];
   buildInputs = [
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
diff --git a/pkgs/applications/video/mpv/scripts/default.nix b/pkgs/applications/video/mpv/scripts/default.nix
index 85cbd8233426a..8b740d1ded325 100644
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@@ -77,6 +77,7 @@ let
     mpv-cheatsheet = callPackage ./mpv-cheatsheet.nix { };
     mpv-osc-modern = callPackage ./mpv-osc-modern.nix { };
     mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { };
+    mpv-slicing = callPackage ./mpv-slicing.nix { };
     mpv-webm = callPackage ./mpv-webm.nix { };
     mpvacious = callPackage ./mpvacious.nix { };
     quack = callPackage ./quack.nix { };
@@ -88,6 +89,7 @@ let
     thumbfast = callPackage ./thumbfast.nix { };
     thumbnail = callPackage ./thumbnail.nix { };
     uosc = callPackage ./uosc.nix { };
+    videoclip = callPackage ./videoclip.nix { };
     visualizer = callPackage ./visualizer.nix { };
     vr-reversal = callPackage ./vr-reversal.nix { };
     webtorrent-mpv-hook = callPackage ./webtorrent-mpv-hook.nix { };
diff --git a/pkgs/applications/video/mpv/scripts/mpv-cheatsheet.nix b/pkgs/applications/video/mpv/scripts/mpv-cheatsheet.nix
index 56013b1fceeb4..a15f54d01ef22 100644
--- a/pkgs/applications/video/mpv/scripts/mpv-cheatsheet.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-cheatsheet.nix
@@ -1,4 +1,9 @@
-{ lib, fetchFromGitHub, nodePackages, stdenvNoCC }:
+{ lib
+, fetchFromGitHub
+, gitUpdater
+, nodePackages
+, stdenvNoCC
+}:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mpv-cheatsheet";
   version = "0.30.0.2";
@@ -9,6 +14,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     rev = "v${finalAttrs.version}";
     hash = "sha256-MWK0CYto3zgn3fivmL43tvgZn6XrjPxKLp0lgTFdplM=";
   };
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
   nativeBuildInputs = [
     nodePackages.browserify
diff --git a/pkgs/applications/video/mpv/scripts/mpv-slicing.nix b/pkgs/applications/video/mpv/scripts/mpv-slicing.nix
new file mode 100644
index 0000000000000..cf66a6c78a297
--- /dev/null
+++ b/pkgs/applications/video/mpv/scripts/mpv-slicing.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildLua,
+  fetchFromGitHub,
+  ffmpeg,
+  unstableGitUpdater,
+}:
+
+buildLua {
+  pname = "mpv-slicing";
+  version = "0-unstable-2017-11-25";
+
+  src = fetchFromGitHub {
+    owner = "Kagami";
+    repo = "mpv_slicing";
+    rev = "d09c11227704c8d5bdaa2c799ef64dce881c63a7";
+    hash = "sha256-MKoM0f74/XoctiHQVOB3LzFWtJXpsREfQh5icaebCJo=";
+  };
+  passthru.updateScript = unstableGitUpdater { };
+
+  postPatch = ''
+    substituteInPlace slicing.lua \
+        --replace-fail ffmpeg ${lib.getExe ffmpeg}
+  '';
+
+  passthru.scriptName = "slicing.lua";
+
+  meta = {
+    description = "A lua script to cut fragments of the video in uncompressed RGB format";
+    homepage = "https://github.com/Kagami/mpv_slicing";
+    license = lib.licenses.cc0;
+    maintainers = with lib.maintainers; [ tomasajt ];
+  };
+}
diff --git a/pkgs/applications/video/mpv/scripts/videoclip.nix b/pkgs/applications/video/mpv/scripts/videoclip.nix
new file mode 100644
index 0000000000000..fff5b788b0286
--- /dev/null
+++ b/pkgs/applications/video/mpv/scripts/videoclip.nix
@@ -0,0 +1,40 @@
+{ lib
+, fetchFromGitHub
+, curl
+, xclip
+, wl-clipboard
+, stdenv
+, buildLua
+, unstableGitUpdater
+}:
+buildLua {
+  pname = "videoclip";
+  version = "0-unstable-2024-03-08";
+
+  src = fetchFromGitHub {
+    owner = "Ajatt-Tools";
+    repo = "videoclip";
+    rev = "0e3f2245b03e888c14c093a50261e0f54ecdf8e8";
+    hash = "sha256-Sg6LHU9OVmVx3cTs8Y0WL8wACb5BlVyeBRccoX+7BXY=";
+  };
+
+  patchPhase = ''
+    substituteInPlace platform.lua \
+    --replace \'curl\' \'${lib.getExe curl}\' \
+  '' + lib.optionalString stdenv.isLinux ''
+    --replace xclip ${lib.getExe xclip} \
+    --replace wl-copy ${lib.getExe' wl-clipboard "wl-copy"}
+  '';
+
+  scriptPath = ".";
+  passthru.scriptName = "videoclip";
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "Easily create videoclips with mpv";
+    homepage = "https://github.com/Ajatt-Tools/videoclip";
+    license = licenses.gpl3Plus;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ BatteredBunny ];
+  };
+}
diff --git a/pkgs/applications/video/obs-studio/default.nix b/pkgs/applications/video/obs-studio/default.nix
index f278d832958ed..418d9adf8263b 100644
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@@ -24,7 +24,7 @@
 , libvlc
 , libGL
 , mbedtls
-, wrapGAppsHook
+, wrapGAppsHook3
 , scriptingSupport ? true
 , luajit
 , swig4
@@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
     addOpenGLRunpath
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
   ]
   ++ optional scriptingSupport swig4;
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-webkitgtk.nix b/pkgs/applications/video/obs-studio/plugins/obs-webkitgtk.nix
index fcf426bde635d..41b33b528a9fc 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-webkitgtk.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-webkitgtk.nix
@@ -8,7 +8,7 @@
 , cmake
 , pkg-config
 , ninja
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/video/openshot-qt/default.nix b/pkgs/applications/video/openshot-qt/default.nix
index fdd96d1aa3ded..4a8208d8bbb6e 100644
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@@ -11,7 +11,7 @@
 , qtwayland
 , wayland
 , waylandSupport ? stdenv.isLinux
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -31,7 +31,7 @@ mkDerivationWith python3.pkgs.buildPythonApplication {
 
   nativeBuildInputs = [
     doxygen
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/video/peek/default.nix b/pkgs/applications/video/peek/default.nix
index 105a86fbf4a7b..a2817d10edcaa 100644
--- a/pkgs/applications/video/peek/default.nix
+++ b/pkgs/applications/video/peek/default.nix
@@ -11,7 +11,7 @@
 , pkg-config
 , txt2man
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , gsettings-desktop-schemas
 , gtk3
 , glib
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     txt2man
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/video/pipe-viewer/default.nix b/pkgs/applications/video/pipe-viewer/default.nix
index 5d3256931f12e..3f7f89a7b30cd 100644
--- a/pkgs/applications/video/pipe-viewer/default.nix
+++ b/pkgs/applications/video/pipe-viewer/default.nix
@@ -3,7 +3,7 @@
 , perl
 , buildPerlModule
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , withGtk3 ? false
 , ffmpeg
 , mpv
@@ -48,10 +48,10 @@ buildPerlModule rec {
   };
 
   nativeBuildInputs = [ makeWrapper ]
-    ++ lib.optionals withGtk3 [ wrapGAppsHook ];
+    ++ lib.optionals withGtk3 [ wrapGAppsHook3 ];
 
   buildInputs = [ perlEnv ]
-    # Can't be in perlEnv for wrapGAppsHook to work correctly
+    # Can't be in perlEnv for wrapGAppsHook3 to work correctly
     ++ lib.optional withGtk3 Gtk3;
 
   # Not supported by buildPerlModule
diff --git a/pkgs/applications/video/pitivi/default.nix b/pkgs/applications/video/pitivi/default.nix
index eb00353b83d1e..85ee9c0e7ef8d 100644
--- a/pkgs/applications/video/pitivi/default.nix
+++ b/pkgs/applications/video/pitivi/default.nix
@@ -4,7 +4,7 @@
 , gettext
 , itstool
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gst_all_1
 , gtk3
 , gobject-introspection
@@ -44,7 +44,7 @@ python3.pkgs.buildPythonApplication rec {
     gettext
     itstool
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/video/plex-mpv-shim/default.nix b/pkgs/applications/video/plex-mpv-shim/default.nix
index 2e71c4668356e..7d862fb216d7b 100644
--- a/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/pkgs/applications/video/plex-mpv-shim/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonApplication, fetchFromGitHub, fetchpatch, python, mpv, requests, python-mpv-jsonipc, pystray, tkinter
-, wrapGAppsHook, gobject-introspection, mpv-shim-default-shaders }:
+, wrapGAppsHook3, gobject-introspection, mpv-shim-default-shaders }:
 
 buildPythonApplication rec {
   pname = "plex-mpv-shim";
@@ -21,7 +21,7 @@ buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/video/recapp/default.nix b/pkgs/applications/video/recapp/default.nix
index c15a0680a9333..b6cb8c6377bba 100644
--- a/pkgs/applications/video/recapp/default.nix
+++ b/pkgs/applications/video/recapp/default.nix
@@ -14,7 +14,7 @@
 , ninja
 , pkg-config
 , slop
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -43,7 +43,7 @@ python3.pkgs.buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/applications/video/rtabmap/default.nix b/pkgs/applications/video/rtabmap/default.nix
index 1147d1ef1d949..b44389045187c 100644
--- a/pkgs/applications/video/rtabmap/default.nix
+++ b/pkgs/applications/video/rtabmap/default.nix
@@ -20,7 +20,7 @@
 , libGL
 , libGLU
 , vtkWithQt5
-, wrapGAppsHook
+, wrapGAppsHook3
 , liblapack
 , xorg
 }:
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-HrIATYRuhFfTlO4oTRZo7CM30LFVyatZJON31Fe4HTQ=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook wrapGAppsHook ];
+  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook wrapGAppsHook3 ];
   buildInputs = [
     ## Required
     opencv
diff --git a/pkgs/applications/video/screenkey/default.nix b/pkgs/applications/video/screenkey/default.nix
index 90cf5e7dcf247..301fc3e30f82c 100644
--- a/pkgs/applications/video/screenkey/default.nix
+++ b/pkgs/applications/video/screenkey/default.nix
@@ -1,6 +1,6 @@
 { lib
 , fetchFromGitLab
-, wrapGAppsHook
+, wrapGAppsHook3
 , xorg
 , gobject-introspection
 , gtk3
@@ -21,7 +21,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     # for setup hook
     gobject-introspection
   ];
@@ -38,7 +38,7 @@ python3.pkgs.buildPythonApplication rec {
     dbus-python
   ];
 
-  # Prevent double wrapping because of wrapGAppsHook
+  # Prevent double wrapping because of wrapGAppsHook3
   dontWrapGApps = true;
 
   preFixup = ''
diff --git a/pkgs/applications/video/streamlink-twitch-gui/bin.nix b/pkgs/applications/video/streamlink-twitch-gui/bin.nix
index 543b2b524708f..ac1490345c29c 100644
--- a/pkgs/applications/video/streamlink-twitch-gui/bin.nix
+++ b/pkgs/applications/video/streamlink-twitch-gui/bin.nix
@@ -5,7 +5,7 @@
 , makeDesktopItem
 , makeWrapper
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 , at-spi2-core
 , atk
 , alsa-lib
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     libXScrnSaver
     libXtst
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [ streamlink ];
diff --git a/pkgs/applications/video/subtitleeditor/default.nix b/pkgs/applications/video/subtitleeditor/default.nix
index fd8e03963dca0..b440c187403e5 100644
--- a/pkgs/applications/video/subtitleeditor/default.nix
+++ b/pkgs/applications/video/subtitleeditor/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, intltool, file,
   desktop-file-utils, enchant, gtk3, gtkmm3, gst_all_1, hicolor-icon-theme,
-  libsigcxx, libxmlxx, xdg-utils, isocodes, wrapGAppsHook
+  libsigcxx, libxmlxx, xdg-utils, isocodes, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     pkg-config
     intltool
     file
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs =  [
diff --git a/pkgs/applications/video/tartube/default.nix b/pkgs/applications/video/tartube/default.nix
index 5b62399a04651..73f6946f6baaf 100644
--- a/pkgs/applications/video/tartube/default.nix
+++ b/pkgs/applications/video/tartube/default.nix
@@ -6,7 +6,7 @@
 , libnotify
 , pango
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 , youtube-dl
 , glib
 , ffmpeg
@@ -26,7 +26,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   strictDeps = false;
diff --git a/pkgs/applications/video/timelens/default.nix b/pkgs/applications/video/timelens/default.nix
index bd38a4c2f76af..c5d2ff7c4c5ad 100644
--- a/pkgs/applications/video/timelens/default.nix
+++ b/pkgs/applications/video/timelens/default.nix
@@ -4,7 +4,7 @@
 , pkg-config
 , glib
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/video/vdr/softhddevice/default.nix b/pkgs/applications/video/vdr/softhddevice/default.nix
index 23c6433f9ebbd..caccdc6ed39a8 100644
--- a/pkgs/applications/video/vdr/softhddevice/default.nix
+++ b/pkgs/applications/video/vdr/softhddevice/default.nix
@@ -14,12 +14,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vdr-softhddevice";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "ua0lnj";
     repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-y6b0nOf597uxS9zDh0NQOwLN81nk4U7lHK2CalyVi8s=";
+    sha256 = "sha256-1yCDNfUdQLgJ0WWyx0q3Hi0yxb6zxaK7wMzLD9jXweI=";
     rev = "v${version}";
   };
 
diff --git a/pkgs/applications/video/xplayer/default.nix b/pkgs/applications/video/xplayer/default.nix
index baa8fcb95be0b..929d9d2952c48 100644
--- a/pkgs/applications/video/xplayer/default.nix
+++ b/pkgs/applications/video/xplayer/default.nix
@@ -21,7 +21,7 @@
 , libxplayer-plparser
 , pkg-config
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , xapp
 , yelp-tools }:
 
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoreconfHook
-    wrapGAppsHook
+    wrapGAppsHook3
     autoconf-archive
     gettext
     gtk-doc
diff --git a/pkgs/applications/virtualization/conmon-rs/default.nix b/pkgs/applications/virtualization/conmon-rs/default.nix
index 3a8c5a5593237..89c6d46d2ccf0 100644
--- a/pkgs/applications/virtualization/conmon-rs/default.nix
+++ b/pkgs/applications/virtualization/conmon-rs/default.nix
@@ -7,19 +7,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "conmon-rs";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+htd9RJGSFzzyEQSBJGIzurQDQgpJ+sJHLPe3aPH0cg=";
+    hash = "sha256-+RKjJtI01Y56+cFDdOSAL4BodI7R/rM3B3ht3p6+xzs=";
   };
 
   nativeBuildInputs = [ capnproto protobuf ];
   doCheck = false;
 
-  cargoHash = "sha256-CcWji/qMd7eX0O3cR9/FLID17WpSfz4kEAhDgKb3jds=";
+  cargoHash = "sha256-4VOse+y0EO9IORyeAO/j1t6ssQARJp7lK21TUJVuH78=";
 
   meta = with lib; {
     description = "An OCI container runtime monitor written in Rust";
diff --git a/pkgs/applications/virtualization/conmon/default.nix b/pkgs/applications/virtualization/conmon/default.nix
index 124647e6ab7be..6b65ab58dc63c 100644
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "conmon";
-  version = "2.1.10";
+  version = "2.1.11";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-WUXyx5OWIJDamzHUahN+0/rcn2pxQgCgYAE/d0mxk2A=";
+    hash = "sha256-QQgpvvk7S6ARzBct/4AQP66End30EXcUPqv8a4Udoas=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals (!stdenv.hostPlatform.isMusl) [ glibc glibc.static ];
 
   # manpage requires building the vendored go-md2man
-  makeFlags = [ "bin/conmon" ];
+  makeFlags = [ "bin/conmon" "VERSION=${version}" ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 3e344a653614b..d2eb61bb893db 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.26.1";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    hash = "sha256-R/AFjJM4rcu2JbdfTNhxIIVhaP7LzFrDAU93hbuXSXs=";
+    hash = "sha256-YM/9ijwxDAjFZk/ku33b/pMYri5V1h0wPd2YS7qJgCw=";
   };
 
   postPatch = ''
@@ -16,7 +16,7 @@ buildGoModule rec {
     rm -rf e2e/
   '';
 
-  vendorHash = "sha256-SzySXS0s0p1EXcO5RQyATBG9gtoJ4wPxZKGU62fAOHw=";
+  vendorHash = "sha256-ztqWSoDsN8qdm6Jq8Wo7r16zuXENQDp2JvwSN+6Jbxw=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 3b1eb3b9908cb..cf8012b2a3e08 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -13,7 +13,7 @@
 , pipewireSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, pipewire
 , sdlSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, SDL2, SDL2_image
 , jackSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, libjack2
-, gtkSupport ? !stdenv.isDarwin && !xenSupport && !nixosTestRunner && !toolsOnly, gtk3, gettext, vte, wrapGAppsHook
+, gtkSupport ? !stdenv.isDarwin && !xenSupport && !nixosTestRunner && !toolsOnly, gtk3, gettext, vte, wrapGAppsHook3
 , vncSupport ? !nixosTestRunner && !toolsOnly, libjpeg, libpng
 , smartcardSupport ? !nixosTestRunner && !toolsOnly, libcacard
 , spiceSupport ? true && !nixosTestRunner && !toolsOnly, spice, spice-protocol
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Don't change this to python3 and python3.pkgs.*, breaks cross-compilation
     python3Packages.python python3Packages.sphinx python3Packages.sphinx-rtd-theme
   ]
-    ++ lib.optionals gtkSupport [ wrapGAppsHook ]
+    ++ lib.optionals gtkSupport [ wrapGAppsHook3 ]
     ++ lib.optionals hexagonSupport [ glib ]
     ++ lib.optionals stdenv.isDarwin [ sigtool ];
 
diff --git a/pkgs/applications/virtualization/quickgui/default.nix b/pkgs/applications/virtualization/quickgui/default.nix
index 9c4de021f2560..f4420c6aeac3e 100644
--- a/pkgs/applications/virtualization/quickgui/default.nix
+++ b/pkgs/applications/virtualization/quickgui/default.nix
@@ -1,12 +1,14 @@
-{ stdenv
+{ stdenvNoCC
 , lib
 , fetchurl
 , autoPatchelfHook
 , dpkg
-, wrapGAppsHook
+, wrapGAppsHook3
+, quickemu
+, gnome
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "quickgui";
   version = "1.2.8";
 
@@ -18,31 +20,48 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoPatchelfHook
     dpkg
+    wrapGAppsHook3
   ];
 
   buildInputs = [
-    wrapGAppsHook
+    quickemu
+    gnome.zenity
   ];
 
+  strictDeps = true;
+
   unpackCmd = "dpkg-deb -x $curSrc source";
 
   installPhase = ''
     runHook preInstall
 
     mv usr $out
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : ${lib.makeBinPath [ quickemu gnome.zenity ]}
+    )
+  '';
+
+  postFixup = ''
     substituteInPlace $out/share/applications/quickgui.desktop \
       --replace "/usr" $out
 
-    runHook postInstall
+    # quickgui PR 88
+    echo "Categories=System;" >> $out/share/applications/quickgui.desktop
   '';
 
-  meta = {
+  meta = with lib; {
     description = "A Flutter frontend for quickemu";
     homepage = "https://github.com/quickemu-project/quickgui";
     changelog = "https://github.com/quickemu-project/quickgui/releases/tag/v${version}";
-    maintainers = [ lib.maintainers.heyimnova ];
-    platforms = lib.platforms.linux;
-    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = licenses.mit;
+    maintainers = with maintainers; [ heyimnova ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ sourceTypes.binaryNativeCode ];
     mainProgram = "quickgui";
   };
 }
diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
index 813e77db435cf..3cbc285076fee 100644
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, python3, intltool, file, wrapGAppsHook, gtk-vnc
+{ lib, fetchFromGitHub, python3, intltool, file, wrapGAppsHook3, gtk-vnc
 , vte, avahi, dconf, gobject-introspection, libvirt-glib, system-libvirt
 , gsettings-desktop-schemas, gst_all_1, libosinfo, gnome, gtksourceview4, docutils, cpio
 , e2fsprogs, findutils, gzip, cdrtools, xorriso, fetchpatch
@@ -34,7 +34,7 @@ python3.pkgs.buildPythonApplication rec {
     intltool file
     gobject-introspection # for setup hook populating GI_TYPELIB_PATH
     docutils
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optional stdenv.isDarwin desktopToDarwinBundle;
 
   buildInputs = [
diff --git a/pkgs/applications/virtualization/virt-viewer/default.nix b/pkgs/applications/virtualization/virt-viewer/default.nix
index 1aca58af5c77b..b0bf423605f37 100644
--- a/pkgs/applications/virtualization/virt-viewer/default.nix
+++ b/pkgs/applications/virtualization/virt-viewer/default.nix
@@ -30,7 +30,7 @@
 , spice-protocol
 , spiceSupport ? true
 , vte
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 with lib;
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     shared-mime-info
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/window-managers/wayfire/wcm.nix b/pkgs/applications/window-managers/wayfire/wcm.nix
index fec3b1bfc7163..df1b1cfea9b83 100644
--- a/pkgs/applications/window-managers/wayfire/wcm.nix
+++ b/pkgs/applications/window-managers/wayfire/wcm.nix
@@ -4,7 +4,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , wayfire
 , wf-shell
 , wayland-scanner
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     wayland-scanner
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 7ac3dec91f7f4..0f41cbd6a265d 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -166,7 +166,7 @@ checkout_hash(){
     clean_git fetch -t ${builder:+--progress} origin || return 1
 
     local object_type=$(git cat-file -t "$hash")
-    if [[ "$object_type" == "commit" ]]; then
+    if [[ "$object_type" == "commit" || "$object_type" == "tag" ]]; then
         clean_git checkout -b "$branchName" "$hash" || return 1
     elif [[ "$object_type" == "tree" ]]; then
         clean_git config user.email "nix-prefetch-git@localhost"
diff --git a/pkgs/build-support/fetchgit/tests.nix b/pkgs/build-support/fetchgit/tests.nix
index 23e5fa299010d..f3fcd9a578de4 100644
--- a/pkgs/build-support/fetchgit/tests.nix
+++ b/pkgs/build-support/fetchgit/tests.nix
@@ -72,4 +72,11 @@
     leaveDotGit = true;
     fetchSubmodules = true;
   };
+
+  dumb-http-signed-tag = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "dumb-http-signed-tag-source";
+    url = "https://git.scottworley.com/pub/git/pinch";
+    rev = "v3.0.14";
+    sha256 = "sha256-bd0Lx75Gd1pcBJtwz5WGki7XoYSpqhinCT3a77wpY2c=";
+  };
 }
diff --git a/pkgs/build-support/flutter/default.nix b/pkgs/build-support/flutter/default.nix
index 5d7cd7d984c17..2af03d5f98e3c 100644
--- a/pkgs/build-support/flutter/default.nix
+++ b/pkgs/build-support/flutter/default.nix
@@ -2,7 +2,7 @@
 , callPackage
 , runCommand
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , buildDartApplication
 , cacert
 , glib
@@ -86,7 +86,7 @@ let
       outputs = universal.outputs or [ ] ++ [ "debug" ];
 
       nativeBuildInputs = (universal.nativeBuildInputs or [ ]) ++ [
-        wrapGAppsHook
+        wrapGAppsHook3
 
         # Flutter requires pkg-config for Linux desktop support, and many plugins
         # attempt to use it.
diff --git a/pkgs/build-support/rust/hooks/cargo-build-hook.sh b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
index ed982c7ff30a3..0ac9bf51a8334 100644
--- a/pkgs/build-support/rust/hooks/cargo-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
@@ -25,7 +25,14 @@ cargoBuildHook() {
     fi
 
     if [ -n "${cargoBuildFeatures-}" ]; then
-        cargoBuildFeaturesFlag="--features=${cargoBuildFeatures// /,}"
+        if [ -n "$__structuredAttrs" ]; then
+            OLDIFS="$IFS"
+            IFS=','; cargoBuildFeaturesFlag="--features=${cargoBuildFeatures[*]}"
+            IFS="$OLDIFS"
+            unset OLDIFS
+        else
+            cargoBuildFeaturesFlag="--features=${cargoBuildFeatures// /,}"
+        fi
     fi
 
     (
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
index 3c5199be31322..69f9f3b145d7c 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@@ -3,12 +3,12 @@
 , makeSetupHook
 , makeWrapper
 , gobject-introspection
-, isGraphical ? true
+, isGraphical ? false
 , gtk3
 , librsvg
 , dconf
 , callPackage
-, wrapGAppsHook
+, wrapGAppsHook3
 , targetPackages
 }:
 
@@ -24,9 +24,9 @@ makeSetupHook {
     librsvg
   ];
 
-  # depsTargetTargetPropagated will essentially be buildInputs when wrapGAppsHook is placed into nativeBuildInputs
+  # depsTargetTargetPropagated will essentially be buildInputs when wrapGAppsHook3 is placed into nativeBuildInputs
   # the librsvg and gtk3 above should be removed but kept to not break anything that implicitly depended on its binaries
-  depsTargetTargetPropagated = assert (lib.assertMsg (!targetPackages ? raw) "wrapGAppsHook must be in nativeBuildInputs"); lib.optionals isGraphical [
+  depsTargetTargetPropagated = assert (lib.assertMsg (!targetPackages ? raw) "wrapGAppsHook3 must be in nativeBuildInputs"); lib.optionals isGraphical [
     # librsvg provides a module for gdk-pixbuf to allow rendering
     # SVG icons. Most icon themes are SVG-based and so are some
     # graphics in GTK (e.g. cross for closing window in window title bar)
@@ -59,7 +59,7 @@ makeSetupHook {
         src = sample-project;
 
         strictDeps = true;
-        nativeBuildInputs = [ wrapGAppsHook ];
+        nativeBuildInputs = [ wrapGAppsHook3 ];
 
         installFlags = [ "bin-foo" "libexec-bar" ];
       };
@@ -103,7 +103,7 @@ makeSetupHook {
         strictDeps = true;
         nativeBuildInputs = [
           gobject-introspection
-          wrapGAppsHook
+          wrapGAppsHook3
         ];
 
         buildInputs = [
@@ -150,7 +150,7 @@ makeSetupHook {
         strictDeps = true;
         nativeBuildInputs = [
           gobject-introspection
-          wrapGAppsHook
+          wrapGAppsHook3
         ];
 
         buildInputs = [
@@ -181,7 +181,7 @@ makeSetupHook {
         strictDeps = true;
         nativeBuildInputs = [
           gobject-introspection
-          wrapGAppsHook
+          wrapGAppsHook3
         ];
 
         installFlags = [ "typelib-Cow" "bin-foo" "libexec-bar" ];
diff --git a/pkgs/by-name/ae/aegisub/package.nix b/pkgs/by-name/ae/aegisub/package.nix
index 6c68fff2bb630..cdec1259fd08b 100644
--- a/pkgs/by-name/ae/aegisub/package.nix
+++ b/pkgs/by-name/ae/aegisub/package.nix
@@ -33,7 +33,7 @@
   portaudio,
   stdenv,
   which,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   wxGTK,
   zlib,
   # Boolean guard flags
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     which
-    wrapGAppsHook
+    wrapGAppsHook3
     wxGTK
   ];
 
diff --git a/pkgs/by-name/ag/ags/package.nix b/pkgs/by-name/ag/ags/package.nix
index 0076e5b0ba298..218d8fd7780d1 100644
--- a/pkgs/by-name/ag/ags/package.nix
+++ b/pkgs/by-name/ag/ags/package.nix
@@ -14,7 +14,7 @@
 , networkmanager
 , upower
 , typescript
-, wrapGAppsHook
+, wrapGAppsHook3
 , linux-pam
 }:
 
@@ -43,7 +43,7 @@ buildNpmPackage rec {
     gjs
     gobject-introspection
     typescript
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   # Most of the build inputs here are basically needed for their typelibs.
diff --git a/pkgs/by-name/al/alsa-ucm-conf/package.nix b/pkgs/by-name/al/alsa-ucm-conf/package.nix
index 76e90f6720180..b2e2889ee21ed 100644
--- a/pkgs/by-name/al/alsa-ucm-conf/package.nix
+++ b/pkgs/by-name/al/alsa-ucm-conf/package.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "alsa-ucm-conf";
@@ -9,6 +9,21 @@ stdenv.mkDerivation rec {
     hash = "sha256-OHwBzzDioWdte49ysmgc8hmrynDdHsKp4zrdW/P+roE=";
   };
 
+  patches = [
+    (fetchpatch {
+      # TODO: Remove this patch in the next package upgrade
+      name = "rt1318-fix-one.patch";
+      url = "https://github.com/alsa-project/alsa-ucm-conf/commit/7e22b7c214d346bd156131f3e6c6a5900bbf116d.patch";
+      hash = "sha256-5X0ANXTSRnC9jkvMLl7lA5TBV3d1nwWE57DP6TwliII=";
+    })
+    (fetchpatch {
+      # TODO: Remove this patch in the next package upgrade
+      name = "rt1318-fix-two.patch";
+      url = "https://github.com/alsa-project/alsa-ucm-conf/commit/4e0fcc79b7d517a957e12f02ecae5f3c69fa94dc.patch";
+      hash = "sha256-cuZPEEqb8+d1Ak2tA+LVEh6gtGt1X+LiAnfFYMIDCXY=";
+    })
+  ];
+
   dontBuild = true;
 
   installPhase = ''
diff --git a/pkgs/by-name/am/am2rlauncher/package.nix b/pkgs/by-name/am/am2rlauncher/package.nix
index d3893eefb3952..049725881e3d2 100644
--- a/pkgs/by-name/am/am2rlauncher/package.nix
+++ b/pkgs/by-name/am/am2rlauncher/package.nix
@@ -17,7 +17,7 @@
 , fetchFromGitHub
 , buildFHSEnv
 , glib-networking
-, wrapGAppsHook
+, wrapGAppsHook3
 , gsettings-desktop-schemas
 }:
 let
@@ -71,7 +71,7 @@ buildDotnetModule {
     openssl
   ];
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   buildInputs = [ gtk3 gsettings-desktop-schemas glib-networking ];
 
diff --git a/pkgs/by-name/an/annotator/package.nix b/pkgs/by-name/an/annotator/package.nix
index 3d2498e335009..115d6db2d8cb5 100644
--- a/pkgs/by-name/an/annotator/package.nix
+++ b/pkgs/by-name/an/annotator/package.nix
@@ -5,7 +5,7 @@
 , meson
 , ninja
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktop-file-utils
 , libgee
 , pantheon
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils
   ];
 
diff --git a/pkgs/by-name/an/ansel/package.nix b/pkgs/by-name/an/ansel/package.nix
index 82cafc40bd74c..39c59017ab3af 100644
--- a/pkgs/by-name/an/ansel/package.nix
+++ b/pkgs/by-name/an/ansel/package.nix
@@ -54,7 +54,7 @@
 , libgpg-error
 , libxkbcommon
 , osm-gps-map
-, wrapGAppsHook
+, wrapGAppsHook3
 , rav1e
 , dav1d
 , libgcrypt
@@ -98,7 +98,7 @@ stdenv.mkDerivation {
     pkg-config
     perlPackages.perl
     python3Packages.jsonschema
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/an/anyrun/package.nix b/pkgs/by-name/an/anyrun/package.nix
index 8d0ee80d7e8a7..69362904f4123 100644
--- a/pkgs/by-name/an/anyrun/package.nix
+++ b/pkgs/by-name/an/anyrun/package.nix
@@ -2,7 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , atk
 , cairo
 , gdk-pixbuf
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/an/anytype/package.nix b/pkgs/by-name/an/anytype/package.nix
index 5d526ea0725d5..53c2996834f7b 100644
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "anytype";
-  version = "0.40.2";
+  version = "0.40.8";
   name = "Anytype-${version}";
   src = fetchurl {
     url = "https://github.com/anyproto/anytype-ts/releases/download/v${version}/${name}.AppImage";
     name = "Anytype-${version}.AppImage";
-    hash = "sha256-RO8rYH0wHPxwey1ICAVK1jURs7b+oxLXRlychgi6c1c=";
+    hash = "sha256-Rvl52nKrOWQfT2qgssEpFjQCjva54zPvm6aEXmO0NTc=";
   };
   appimageContents = appimageTools.extractType2 { inherit name src; };
 in appimageTools.wrapType2 {
diff --git a/pkgs/by-name/ap/apt/package.nix b/pkgs/by-name/ap/apt/package.nix
index 230e82e28a74e..945be641d8550 100644
--- a/pkgs/by-name/ap/apt/package.nix
+++ b/pkgs/by-name/ap/apt/package.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "2.7.14";
+  version = "2.9.2";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/a/apt/apt_${finalAttrs.version}.tar.xz";
-    hash = "sha256-egF4PwW32Q82rqeHHMBnV0ma6K3pM0l6rrbFCCdOc1g=";
+    hash = "sha256-gKp0RmsTLlDtjQFZ8Q5kpEi2psZHI9YsQrg6UZnKA6c=";
   };
 
   # cycle detection; lib can't be split
diff --git a/pkgs/by-name/ap/apvlv/package.nix b/pkgs/by-name/ap/apvlv/package.nix
index 5771769323512..77ad5a034daae 100644
--- a/pkgs/by-name/ap/apvlv/package.nix
+++ b/pkgs/by-name/ap/apvlv/package.nix
@@ -22,7 +22,7 @@
   stdenv,
   testers,
   webkitgtk,
-  wrapGAppsHook,
+  wrapGAppsHook3,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     installShellFiles
     man
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ay/ayatana-indicator-datetime/package.nix b/pkgs/by-name/ay/ayatana-indicator-datetime/package.nix
index 7888fc3b9ffe4..06ba4efc13863 100644
--- a/pkgs/by-name/ay/ayatana-indicator-datetime/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-datetime/package.nix
@@ -23,7 +23,7 @@
 , python3
 , systemd
 , tzdata
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     glib # for schema hook
     intltool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ay/ayatana-indicator-messages/package.nix b/pkgs/by-name/ay/ayatana-indicator-messages/package.nix
index c630b1b4e4ad2..7973291d3db18 100644
--- a/pkgs/by-name/ay/ayatana-indicator-messages/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-messages/package.nix
@@ -20,7 +20,7 @@
 , python3
 , systemd
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -50,6 +50,10 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace libmessaging-menu/messaging-menu.pc.in \
       --replace "\''${exec_prefix}/@CMAKE_INSTALL_LIBDIR@" '@CMAKE_INSTALL_FULL_LIBDIR@' \
       --replace "\''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@" '@CMAKE_INSTALL_FULL_INCLUDEDIR@'
+
+    # Fix tests with gobject-introspection 1.80 not installing GLib introspection data
+    substituteInPlace tests/CMakeLists.txt \
+      --replace-fail 'GI_TYPELIB_PATH=\"' 'GI_TYPELIB_PATH=\"$GI_TYPELIB_PATH$\{GI_TYPELIB_PATH\:+\:\}'
   '' + lib.optionalString (!withDocumentation) ''
     sed -i CMakeLists.txt \
       '/add_subdirectory(doc)/d'
@@ -63,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
     intltool
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optionals withDocumentation [
     docbook_xsl
     docbook_xml_dtd_45
diff --git a/pkgs/by-name/ay/ayatana-indicator-session/package.nix b/pkgs/by-name/ay/ayatana-indicator-session/package.nix
index 4b3d33ea81be6..d2a5860098b4c 100644
--- a/pkgs/by-name/ay/ayatana-indicator-session/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-session/package.nix
@@ -16,7 +16,7 @@
 , mate
 , pkg-config
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     intltool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/bi/biglybt/package.nix b/pkgs/by-name/bi/biglybt/package.nix
index a4b2d2f1a346e..8e0b98bdc766b 100644
--- a/pkgs/by-name/bi/biglybt/package.nix
+++ b/pkgs/by-name/bi/biglybt/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   jre,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   nix-update-script,
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-a7g9sB3orO2m0X7qNwQ1dDygYPhs/b6kX0RDSG8Wq2U=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   configurePhase = ''
     runHook preConfigure
diff --git a/pkgs/by-name/bo/boehmgc/package.nix b/pkgs/by-name/bo/boehmgc/package.nix
index 4402b3af57bf7..213d0ec9e3e32 100644
--- a/pkgs/by-name/bo/boehmgc/package.nix
+++ b/pkgs/by-name/bo/boehmgc/package.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , autoreconfHook
-# doc: https://github.com/ivmai/bdwgc/blob/v8.2.4/doc/README.macros (LARGE_CONFIG)
+# doc: https://github.com/ivmai/bdwgc/blob/v8.2.6/doc/README.macros (LARGE_CONFIG)
 , enableLargeConfig ? false
 , enableMmap ? true
 , enableStatic ? false
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "boehm-gc";
-  version = "8.2.4";
+  version = "8.2.6";
 
   src = fetchFromGitHub {
     owner = "ivmai";
     repo = "bdwgc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KHijT4BBKfDvTpHpwognN+3ZXoC6JabBTFSYFyOUT9o=";
+    hash = "sha256-y6hU5qU4qO9VvQvKNH9dvReCrf3+Ih2HHbF6IS1V3WQ=";
   };
 
   outputs = [ "out" "dev" "doc" ];
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   # not fix the problem the test failure will be a reminder to
   # extend the set of versions requiring the workaround).
   makeFlags = lib.optionals (stdenv.hostPlatform.isPower64 &&
-                  finalAttrs.version == "8.2.4")
+                  finalAttrs.version == "8.2.6")
     [
       # do not use /proc primitives to track dirty bits; see:
       # https://github.com/ivmai/bdwgc/issues/479#issuecomment-1279687537
diff --git a/pkgs/by-name/bu/bustle/package.nix b/pkgs/by-name/bu/bustle/package.nix
new file mode 100644
index 0000000000000..1e57c9122f8a5
--- /dev/null
+++ b/pkgs/by-name/bu/bustle/package.nix
@@ -0,0 +1,61 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, cargo
+, meson
+, ninja
+, pkg-config
+, desktop-file-utils
+, rustPlatform
+, rustc
+, wrapGAppsHook4
+, glib
+, gtk4
+, libadwaita
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bustle";
+  version = "0.9.2";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "bustle";
+    rev = finalAttrs.version;
+    hash = "sha256-/B1rY8epcP0OFv+kVgv4Jx6x/oK3XpNnZcpSGvdIPx0=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit (finalAttrs) src;
+    name = "bustle-${finalAttrs.version}";
+    hash = "sha256-r29Z+6P+yuCpOBUE3vkESd15lcGXs5+ZTBiQ9nW6DJ4=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    meson
+    ninja
+    pkg-config
+    desktop-file-utils
+    rustPlatform.cargoSetupHook
+    rustc
+    wrapGAppsHook4
+    glib
+  ];
+
+  buildInputs = [
+    glib
+    gtk4
+    libadwaita
+  ];
+
+  meta = with lib; {
+    description = "Graphical D-Bus message analyser and profiler";
+    homepage = "https://gitlab.gnome.org/World/bustle";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ jtojnar ];
+    mainProgram = "bustle";
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/by-name/bu/buttermanager/package.nix b/pkgs/by-name/bu/buttermanager/package.nix
index fe738b3712195..80c3dd4e3084e 100644
--- a/pkgs/by-name/bu/buttermanager/package.nix
+++ b/pkgs/by-name/bu/buttermanager/package.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchFromGitHub
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 , qt5
 }:
 
@@ -25,7 +25,7 @@ python3Packages.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     qt5.wrapQtAppsHook
   ];
 
diff --git a/pkgs/by-name/cl/clamtk/package.nix b/pkgs/by-name/cl/clamtk/package.nix
index b34850c92599a..67c82e52a400a 100644
--- a/pkgs/by-name/cl/clamtk/package.nix
+++ b/pkgs/by-name/cl/clamtk/package.nix
@@ -1,7 +1,7 @@
 { lib
 , perlPackages
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , perl
 , clamav
@@ -18,7 +18,7 @@ perlPackages.buildPerlPackage rec {
     hash = "sha256-ClBsBXbGj67zgrkA9EjgK7s3OmXOJA+xV5xLGOcMsbI=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
   buildInputs = [ perl clamav ];
   propagatedBuildInputs = with perlPackages; [ Glib LWP LWPProtocolHttps TextCSV JSON LocaleGettext Gtk3 ];
 
diff --git a/pkgs/by-name/cl/clash-verge/package.nix b/pkgs/by-name/cl/clash-verge/package.nix
index 1a8d6a99198e8..83318a36f3f69 100644
--- a/pkgs/by-name/cl/clash-verge/package.nix
+++ b/pkgs/by-name/cl/clash-verge/package.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchurl
 , dpkg
-, wrapGAppsHook
+, wrapGAppsHook3
 , autoPatchelfHook
 , clash-meta
 , openssl
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     dpkg
-    wrapGAppsHook
+    wrapGAppsHook3
     autoPatchelfHook
   ];
 
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index f47265ca09c9f..ce5ec0803a902 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -47,11 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.29.1";
+  version = "3.29.2";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-f7Auj1e2Kzmqa0z3HoIBSLoaI3JIiElHNQIeMqsO78w=";
+    hash = "sha256-NttLaSaqt0G6bksuotmckZMiITIwi03IJNQSPLcwNS4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/co/connman-gtk/package.nix b/pkgs/by-name/co/connman-gtk/package.nix
index 46dce2aa29303..181c43bcde208 100644
--- a/pkgs/by-name/co/connman-gtk/package.nix
+++ b/pkgs/by-name/co/connman-gtk/package.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, autoconf, automake, intltool, pkg-config,
-gtk3, connman, openconnect, wrapGAppsHook }:
+gtk3, connman, openconnect, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "connman-gtk";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     automake
     intltool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/co/connman-notify/package.nix b/pkgs/by-name/co/connman-notify/package.nix
index c8df6bc893527..4b9002441a926 100644
--- a/pkgs/by-name/co/connman-notify/package.nix
+++ b/pkgs/by-name/co/connman-notify/package.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitLab, python3Packages, glib, gobject-introspection, wrapGAppsHook }:
+{ lib, fetchFromGitLab, python3Packages, glib, gobject-introspection, wrapGAppsHook3 }:
 
 python3Packages.buildPythonApplication {
   pname = "connman-notify";
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication {
 
   format = "other";
 
-  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+  nativeBuildInputs = [ gobject-introspection wrapGAppsHook3 ];
 
   buildInputs = [ glib ];
 
diff --git a/pkgs/by-name/cp/cpu-x/package.nix b/pkgs/by-name/cp/cpu-x/package.nix
index d8db8212ba760..1f8df689b79a9 100644
--- a/pkgs/by-name/cp/cpu-x/package.nix
+++ b/pkgs/by-name/cp/cpu-x/package.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, gtk3, ncurses
-, libcpuid, pciutils, procps, wrapGAppsHook, nasm, makeWrapper
+, libcpuid, pciutils, procps, wrapGAppsHook3, nasm, makeWrapper
 , opencl-headers, ocl-icd
 , vulkan-headers, vulkan-loader, glfw
 , libXdmcp, pcre, util-linux
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-iaqqBeoack41D07Bbr0Fo1JXfF2ksXbqS5V5Ymt6Qvg=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook nasm makeWrapper ];
+  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 nasm makeWrapper ];
   buildInputs = [
     gtk3 ncurses libcpuid pciutils procps
     vulkan-headers vulkan-loader glfw
diff --git a/pkgs/by-name/cr/cryptor/package.nix b/pkgs/by-name/cr/cryptor/package.nix
index b47edbbab5722..edbaa0903b0a8 100644
--- a/pkgs/by-name/cr/cryptor/package.nix
+++ b/pkgs/by-name/cr/cryptor/package.nix
@@ -6,7 +6,7 @@
 , ninja
 , pkg-config
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , gocryptfs
 , gtk3
 , json-glib
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/di/digikam/package.nix b/pkgs/by-name/di/digikam/package.nix
index 8100b835e44ac..9e1de9bbde35f 100644
--- a/pkgs/by-name/di/digikam/package.nix
+++ b/pkgs/by-name/di/digikam/package.nix
@@ -1,4 +1,4 @@
-{ stdenv, config, lib, fetchurl, cmake, doxygen, extra-cmake-modules, wrapGAppsHook
+{ stdenv, config, lib, fetchurl, cmake, doxygen, extra-cmake-modules, wrapGAppsHook3
 
 # For `digitaglinktree`
 , perl, sqlite
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     extra-cmake-modules
     libsForQt5.kdoctools
     libsForQt5.wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optionals cudaSupport (with cudaPackages; [
     cuda_nvcc
   ]);
diff --git a/pkgs/by-name/di/discover-overlay/package.nix b/pkgs/by-name/di/discover-overlay/package.nix
index fe52106ea530c..89e3b531e8eec 100644
--- a/pkgs/by-name/di/discover-overlay/package.nix
+++ b/pkgs/by-name/di/discover-overlay/package.nix
@@ -1,5 +1,4 @@
-{ lib, python3, fetchFromGitHub, gtk3, gobject-introspection, gtk-layer-shell
-, wrapGAppsHook }:
+{ lib, python3, fetchFromGitHub, gtk3, gobject-introspection, gtk-layer-shell, wrapGAppsHook3 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "discover-overlay";
   version = "0.7.3";
@@ -16,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/di/displaycal/package.nix b/pkgs/by-name/di/displaycal/package.nix
index a48355fbb8250..80e7b256b2977 100644
--- a/pkgs/by-name/di/displaycal/package.nix
+++ b/pkgs/by-name/di/displaycal/package.nix
@@ -1,7 +1,7 @@
 { lib
 , python3
 , fetchPypi
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , librsvg
 , xorg
@@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gtk3
   ];
 
diff --git a/pkgs/by-name/dm/dmarc-report-converter/package.nix b/pkgs/by-name/dm/dmarc-report-converter/package.nix
index 5fff732e84fc5..488ce0a92d648 100644
--- a/pkgs/by-name/dm/dmarc-report-converter/package.nix
+++ b/pkgs/by-name/dm/dmarc-report-converter/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "dmarc-report-converter";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "tierpod";
     repo = "dmarc-report-converter";
     rev = "v${version}";
-    hash = "sha256-cP96tiBpMFNEHuIF0sovi+Q4yW8wMUqr138RyMOFoho=";
+    hash = "sha256-93sNEBV7MxZr6tqPaFKgY0KA1J3W0HoCiIDZg268Smc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/do/dorion/package.nix b/pkgs/by-name/do/dorion/package.nix
index 32529e8fcf2ef..004e94fda27df 100644
--- a/pkgs/by-name/do/dorion/package.nix
+++ b/pkgs/by-name/do/dorion/package.nix
@@ -8,7 +8,7 @@
 , libappindicator
 , libayatana-appindicator
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     autoPatchelfHook
     dpkg
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/du/dune3d/package.nix b/pkgs/by-name/du/dune3d/package.nix
index 797819354a1b9..afe3a05f59384 100644
--- a/pkgs/by-name/du/dune3d/package.nix
+++ b/pkgs/by-name/du/dune3d/package.nix
@@ -16,7 +16,7 @@
   pkg-config,
   python3,
   stdenv,
-  wrapGAppsHook,
+  wrapGAppsHook3,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   buildInputs = [
     cmake
diff --git a/pkgs/by-name/ed/eduvpn-client/package.nix b/pkgs/by-name/ed/eduvpn-client/package.nix
index e3b5b9d8a04c3..8a4fd7db89e82 100644
--- a/pkgs/by-name/ed/eduvpn-client/package.nix
+++ b/pkgs/by-name/ed/eduvpn-client/package.nix
@@ -7,7 +7,7 @@
 , libsecret
 , networkmanager
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     gdk-pixbuf
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ew/eww/package.nix b/pkgs/by-name/ew/eww/package.nix
index d4dc0eec2f9ff..e60ad71ae9c2b 100644
--- a/pkgs/by-name/ew/eww/package.nix
+++ b/pkgs/by-name/ew/eww/package.nix
@@ -2,7 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , librsvg
 , gtk-layer-shell
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-n9nd5E/VO+0BgkhrfQpeihlIkoVQRf6CMiPCK5opvvw=";
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   buildInputs = [
     gtk3
diff --git a/pkgs/by-name/fi/firefoxpwa/Cargo.lock b/pkgs/by-name/fi/firefoxpwa/Cargo.lock
index 191f6d2a5ab6f..66005e4280993 100644
--- a/pkgs/by-name/fi/firefoxpwa/Cargo.lock
+++ b/pkgs/by-name/fi/firefoxpwa/Cargo.lock
@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "ab_glyph"
-version = "0.2.23"
+version = "0.2.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80179d7dd5d7e8c285d67c4a1e652972a92de7475beddfb92028c76463b13225"
+checksum = "6f90148830dac590fac7ccfe78ec4a8ea404c60f75a24e16407a71f0f40de775"
 dependencies = [
  "ab_glyph_rasterizer",
  "owned_ttf_parser",
@@ -41,14 +41,20 @@ checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
+name = "aligned-vec"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aa90d7ce82d4be67b64039a3d588d38dbcc6736577de4a847025ce5b0c468d1"
+
+[[package]]
 name = "alloc-no-stdlib"
 version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -80,9 +86,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.11"
+version = "0.6.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e2e1ebcb11de5c03c67de28a7df593d32191b44939c482e97702baaaa6ab6a5"
+checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -94,9 +100,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.4"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7079075b41f533b8c61d2a4d073c4676e1f8b249ff94a393b0595db304e0dd87"
+checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
 
 [[package]]
 name = "anstyle-parse"
@@ -128,9 +134,26 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.79"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "080e9890a082662b09c1ad45f567faeeb47f22b5fb23895fbe1e651e718e25ca"
+checksum = "f538837af36e6f6a9be0faa67f9a314f8119e4e4b5867c6ab40ed60360142519"
+
+[[package]]
+name = "arbitrary"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5a26814d8dcb93b0e5a0ff3c6d80a8843bafb21b39e8e18a6f05471870e110"
+
+[[package]]
+name = "arg_enum_proc_macro"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ae92a5119aa49cdbcf6b9f893fe4e1d98b04ccbf82ee0584ad948a44a734dea"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
 
 [[package]]
 name = "arrayref"
@@ -146,9 +169,9 @@ checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
 
 [[package]]
 name = "async-compression"
-version = "0.4.6"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a116f46a969224200a0a97f29cfd4c50e7534e4b4826bd23ea2c3c533039c82c"
+checksum = "4e9eabd7a98fe442131a17c316bd9349c43695e49e730c3c8e12cfb5f4da2693"
 dependencies = [
  "brotli",
  "flate2",
@@ -156,25 +179,50 @@ dependencies = [
  "memchr",
  "pin-project-lite",
  "tokio",
+ "zstd",
+ "zstd-safe",
 ]
 
 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
+
+[[package]]
+name = "av1-grain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6678909d8c5d46a42abcf571271e15fdbc0a225e3646cf23762cd415046c78bf"
+dependencies = [
+ "anyhow",
+ "arrayvec",
+ "log",
+ "nom",
+ "num-rational",
+ "v_frame",
+]
+
+[[package]]
+name = "avif-serialize"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "876c75a42f6364451a033496a14c44bffe41f5f4a8236f697391f11024e596d2"
+dependencies = [
+ "arrayvec",
+]
 
 [[package]]
 name = "backtrace"
-version = "0.3.69"
+version = "0.3.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
+checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
 dependencies = [
  "addr2line",
  "cc",
  "cfg-if",
  "libc",
- "miniz_oxide 0.7.1",
+ "miniz_oxide 0.7.2",
  "object",
  "rustc-demangle",
 ]
@@ -186,6 +234,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
 name = "bit_field"
 version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -199,15 +253,34 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.2"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
+
+[[package]]
+name = "bitstream-io"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+checksum = "06c9989a51171e2e81038ab168b6ae22886fe9ded214430dbb4f41c28cf176da"
+
+[[package]]
+name = "blake3"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30cca6d3674597c30ddf2c587bf8d9d65c9a84d2326d941cc79c9842dfe0ef52"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "cc",
+ "cfg-if",
+ "constant_time_eq",
+]
 
 [[package]]
 name = "brotli"
-version = "3.4.0"
+version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "516074a47ef4bce09577a3b379392300159ce5b1ba2e501ff1c819950066100f"
+checksum = "19483b140a7ac7174d34b5a581b406c64f84da5409d3e09cf4fff604f9270e67"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -216,25 +289,31 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "2.5.1"
+version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e2e4afe60d7dd600fdd3de8d0f08c2b7ec039712e3b6137ff98b7004e82de4f"
+checksum = "e6221fe77a248b9117d431ad93761222e1cf8ff282d9d1d5d9f53d6299a1cf76"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
 ]
 
 [[package]]
+name = "built"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41bfbdb21256b87a8b5e80fab81a8eed158178e812fd7ba451907518b2742f16"
+
+[[package]]
 name = "bumpalo"
-version = "3.14.0"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "bytemuck"
-version = "1.14.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "374d28ec25809ee0e23827c2ab573d729e293f281dfe393500e7ad618baa61c6"
+checksum = "5d6d68c57235a3a081186990eca2867354726650f42f7516ca50c28d6281fd15"
 
 [[package]]
 name = "byteorder"
@@ -243,10 +322,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
+name = "byteorder-lite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
+
+[[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "bzip2"
@@ -271,11 +356,23 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.96"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+checksum = "065a29261d53ba54260972629f9ca6bffa69bac13cd1fed61420f7fa68b9f8bd"
 dependencies = [
+ "jobserver",
  "libc",
+ "once_cell",
+]
+
+[[package]]
+name = "cfg-expr"
+version = "0.15.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d067ad48b8650848b989a59a86c6c36a995d02d2bf778d45c3c5d57bc2718f02"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
 ]
 
 [[package]]
@@ -292,22 +389,22 @@ checksum = "77e53693616d3075149f4ead59bdeecd204ac6b8192d8969757601b74bddf00f"
 
 [[package]]
 name = "chrono"
-version = "0.4.31"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f2c685bad3eb3d45a01354cedb7d5faa66194d1d58ba6e267a8de788f79db38"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
  "num-traits",
  "serde",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
 name = "clap"
-version = "4.4.18"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e578d6ec4194633722ccf9544794b71b1385c3c027efe0c55db226fc880865c"
+checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -315,30 +412,30 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.18"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4df4df40ec50c46000231c914968278b1eb05098cf8f1b3a518a95030e71d1c7"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
 dependencies = [
  "anstream",
  "anstyle",
  "clap_lex",
- "strsim",
+ "strsim 0.11.1",
 ]
 
 [[package]]
 name = "clap_complete"
-version = "4.4.8"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaf7dcb7c21d8ca1a2482ee0f1d341f437c9a7af6ca6da359dc5e1b164e98215"
+checksum = "dd79504325bf38b10165b02e89b4347300f855f273c4cb30c4a3209e6583275e"
 dependencies = [
  "clap",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.4.7"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
+checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -348,9 +445,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
+checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
 
 [[package]]
 name = "color_quant"
@@ -391,6 +488,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "constant_time_eq"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7144d30dcf0fafbce74250a3963025d8d52177934239851c917d29f1df280c2"
+
+[[package]]
 name = "core-foundation"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -408,9 +511,9 @@ checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "crc32fast"
-version = "1.3.2"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+checksum = "b3855a8a784b474f333699ef2bbca9db2c4a1f6d9088a90a2d25b1eb53111eaa"
 dependencies = [
  "cfg-if",
 ]
@@ -458,9 +561,9 @@ dependencies = [
 
 [[package]]
 name = "darling"
-version = "0.20.3"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0209d94da627ab5605dcccf08bb18afa5009cfbef48d8a8b7d7bdbc79be25c5e"
+checksum = "54e36fcd13ed84ffdfda6f5be89b31287cbb80c439841fe69e04841435464391"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -468,23 +571,23 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.20.3"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "177e3443818124b357d8e76f53be906d60937f0d3a90773a664fa63fa253e621"
+checksum = "9c2cf1c23a687a1feeb728783b993c4e1ad83d99f351801977dd809b48d0a70f"
 dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim",
+ "strsim 0.10.0",
  "syn",
 ]
 
 [[package]]
 name = "darling_macro"
-version = "0.20.3"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836a9bbc7ad63342d6d6e7b815ccab164bc77a2d95d84bc3117a8c0d5c98e2d5"
+checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
 dependencies = [
  "darling_core",
  "quote",
@@ -550,15 +653,15 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.9.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.33"
+version = "0.8.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+checksum = "b45de904aa0b010bce2ab45264d0631681847fa7b6f2eaa7dab7619943bc4f59"
 dependencies = [
  "cfg-if",
 ]
@@ -581,15 +684,15 @@ dependencies = [
 
 [[package]]
 name = "exr"
-version = "1.71.0"
+version = "1.72.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "832a761f35ab3e6664babfbdc6cef35a4860e816ec3916dcfd0882954e98a8a8"
+checksum = "887d93f60543e9a9362ef8a21beedd0a833c5d9610e18c67abe15a5963dcb1a4"
 dependencies = [
  "bit_field",
  "flume",
  "half",
  "lebe",
- "miniz_oxide 0.7.1",
+ "miniz_oxide 0.7.2",
  "rayon-core",
  "smallvec",
  "zune-inflate",
@@ -597,9 +700,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.0.1"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
+checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
 
 [[package]]
 name = "fdeflate"
@@ -639,6 +742,7 @@ version = "0.0.0"
 dependencies = [
  "ab_glyph",
  "anyhow",
+ "blake3",
  "byteorder",
  "bzip2",
  "cfg-if",
@@ -679,12 +783,12 @@ dependencies = [
 
 [[package]]
 name = "flate2"
-version = "1.0.28"
+version = "1.0.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
+checksum = "5f54427cfd1c7829e2a139fcefea601bf088ebca651d2bf53ebc600eac295dae"
 dependencies = [
  "crc32fast",
- "miniz_oxide 0.7.1",
+ "miniz_oxide 0.7.2",
 ]
 
 [[package]]
@@ -710,18 +814,18 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "fontconfig-parser"
-version = "0.5.3"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "674e258f4b5d2dcd63888c01c68413c51f565e8af99d2f7701c7b81d79ef41c4"
+checksum = "6a595cb550439a117696039dfc69830492058211b771a2a165379f2a1a53d84d"
 dependencies = [
- "roxmltree 0.18.1",
+ "roxmltree",
 ]
 
 [[package]]
 name = "fontdb"
-version = "0.16.0"
+version = "0.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98b88c54a38407f7352dd2c4238830115a6377741098ffd1f997c813d0e088a6"
+checksum = "b0299020c3ef3f60f526a4f64ab4a3d4ce116b1acbf24cdd22da0068e5d81dc3"
 dependencies = [
  "fontconfig-parser",
  "log",
@@ -768,6 +872,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
 dependencies = [
  "futures-core",
+ "futures-sink",
 ]
 
 [[package]]
@@ -802,6 +907,7 @@ checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
 dependencies = [
  "futures-core",
  "futures-io",
+ "futures-sink",
  "futures-task",
  "memchr",
  "pin-project-lite",
@@ -821,20 +927,22 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.12"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi",
+ "wasm-bindgen",
 ]
 
 [[package]]
 name = "gif"
-version = "0.12.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80792593675e051cf94a4b111980da2ba60d4a83e43e0048c5693baab3977045"
+checksum = "3fb2d69b19215e18bb912fa30f7ce15846e301408695e44e0ef719f1da9e19f2"
 dependencies = [
  "color_quant",
  "weezl",
@@ -854,9 +962,9 @@ checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
 
 [[package]]
 name = "h2"
-version = "0.3.24"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
+checksum = "816ec7294445779408f36fe57bc5b7fc1cf59664059096c65f905c1c61f58069"
 dependencies = [
  "bytes",
  "fnv",
@@ -864,7 +972,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http",
- "indexmap 2.1.0",
+ "indexmap 2.2.6",
  "slab",
  "tokio",
  "tokio-util",
@@ -873,10 +981,11 @@ dependencies = [
 
 [[package]]
 name = "half"
-version = "2.2.1"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02b4af3693f1b705df946e9fe5631932443781d0aabb423b62fcd4d73f6d2fd0"
+checksum = "6dd08c532ae367adf81c312a4580bc67f1d0fe8bc9c460520283f4c0ff277888"
 dependencies = [
+ "cfg-if",
  "crunchy",
 ]
 
@@ -888,21 +997,21 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.14.3"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
 [[package]]
 name = "heck"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.4"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d3d0e0f38255e7fa3cf31335b3a56f05febd18025f4db5ef7a0cfb4f8da651f"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
 [[package]]
 name = "hex"
@@ -912,9 +1021,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "http"
-version = "0.2.11"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
 dependencies = [
  "bytes",
  "fnv",
@@ -923,12 +1032,24 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.6"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643"
 dependencies = [
  "bytes",
  "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -939,53 +1060,66 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
 
 [[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
-[[package]]
 name = "hyper"
-version = "0.14.28"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
+checksum = "fe575dd17d0862a9a33781c8c4696a55c320909004a67a00fb286ba8b1bc496d"
 dependencies = [
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
  "h2",
  "http",
  "http-body",
  "httparse",
- "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2",
+ "smallvec",
  "tokio",
- "tower-service",
- "tracing",
  "want",
 ]
 
 [[package]]
 name = "hyper-tls"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
+ "http-body-util",
  "hyper",
+ "hyper-util",
  "native-tls",
  "tokio",
  "tokio-native-tls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca38ef113da30126bbff9cd1705f9273e15d45498615d138b0c20279ac7a76aa"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower",
+ "tower-service",
+ "tracing",
 ]
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.59"
+version = "0.1.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6a67363e2aa4443928ce15e57ebae94fd8949958fd1223c4cfc0cd473ad7539"
+checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -1032,20 +1166,35 @@ dependencies = [
 
 [[package]]
 name = "image"
-version = "0.24.8"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "034bbe799d1909622a74d1193aa50147769440040ff36cb2baa947609b0a4e23"
+checksum = "fd54d660e773627692c524beaad361aca785a4f9f5730ce91f42aabe5bce3d11"
 dependencies = [
  "bytemuck",
  "byteorder",
  "color_quant",
  "exr",
  "gif",
- "jpeg-decoder",
+ "image-webp",
  "num-traits",
- "png 0.17.11",
+ "png 0.17.13",
  "qoi",
+ "ravif",
+ "rayon",
+ "rgb",
  "tiff",
+ "zune-core",
+ "zune-jpeg",
+]
+
+[[package]]
+name = "image-webp"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d730b085583c4d789dfd07fdcf185be59501666a90c97c40162b37e4fdad272d"
+dependencies = [
+ "byteorder-lite",
+ "thiserror",
 ]
 
 [[package]]
@@ -1055,6 +1204,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "029d73f573d8e8d63e6d5020011d3255b28c3ba85d6cf870a07184ed23de9284"
 
 [[package]]
+name = "imgref"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44feda355f4159a7c757171a77de25daf6411e217b4cabd03bd6650690468126"
+
+[[package]]
 name = "indexmap"
 version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1067,52 +1222,79 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.1.0"
+version = "2.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
+checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.3",
+ "hashbrown 0.14.5",
  "serde",
 ]
 
 [[package]]
+name = "interpolate_name"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c34819042dc3d3971c46c2190835914dfbe0c3c13f61449b2997f4e9722dfa60"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
 name = "ipnet"
 version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
+name = "itertools"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+dependencies = [
+ "either",
+]
+
+[[package]]
 name = "itoa"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
+name = "jobserver"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2b099aaa34a9751c5bf0878add70444e1ed2dd73f347be99003d4577277de6e"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "jpeg-decoder"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f5d4a7da358eff58addd2877a45865158f0d78c911d43a5784ceb7bbf52833b0"
-dependencies = [
- "rayon",
-]
 
 [[package]]
 name = "js-sys"
-version = "0.3.67"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a1d36f1235bc969acba30b7f5990b864423a6068a10f7c90ae8f0112e3a59d1"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
 dependencies = [
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "kurbo"
-version = "0.9.5"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd85a5776cd9500c2e2059c8c76c3b01528566b7fcbaf8098b55a33fc298849b"
+checksum = "6e5aa9f0f96a938266bdb12928a67169e8d22c6a786fda8ed984b85e6ba93c3c"
 dependencies = [
  "arrayvec",
+ "smallvec",
 ]
 
 [[package]]
@@ -1138,29 +1320,36 @@ checksum = "03087c2bad5e1034e8cace5926dec053fb3790248370865f5117a7d0213354c8"
 
 [[package]]
 name = "libc"
-version = "0.2.152"
+version = "0.2.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
+checksum = "ae743338b92ff9146ce83992f766a31066a91a8c84a45e0e9f21e7cf6de6d346"
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a96cfd5557eb82f2b83fed4955246c988d331975a002961b07c81584d107e7f7"
+dependencies = [
+ "arbitrary",
+ "cc",
+ "once_cell",
+]
 
 [[package]]
 name = "libredox"
-version = "0.0.1"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85c833ca1e66078851dba29046874e38f08b2c883700aa29a03ddd3b23814ee8"
+checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "libc",
- "redox_syscall",
 ]
 
 [[package]]
 name = "line-wrap"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30344350a2a51da54c1d53be93fade8a237e545dbcc4bdbe635413f2117cab9"
-dependencies = [
- "safemem",
-]
+checksum = "dd1bc4d24ad230d21fb898d1116b1801d7adfc449d42026475862ab48b11e70e"
 
 [[package]]
 name = "linux-raw-sys"
@@ -1170,9 +1359,9 @@ checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
 name = "lock_api"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1180,21 +1369,40 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
+
+[[package]]
+name = "loop9"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fae87c125b03c1d2c0150c90365d7d6bcc53fb73a9acaef207d2d065860f062"
+dependencies = [
+ "imgref",
+]
+
+[[package]]
+name = "maybe-rayon"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "8ea1f30cedd69f0a2954655f7188c6a834246d2bcf1e315e2ac40c4b24dc9519"
+dependencies = [
+ "cfg-if",
+ "rayon",
+]
 
 [[package]]
 name = "memchr"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "memmap2"
-version = "0.9.3"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45fd3a57831bf88bc63f8cebc0cf956116276e97fef3966103e96416209f7c92"
+checksum = "fe751422e4a8caa417e13c3ea66452215d7d63e19e604f4980461212f3ae1322"
 dependencies = [
  "libc",
 ]
@@ -1221,6 +1429,12 @@ version = "0.0.0"
 source = "git+https://github.com/filips123/mime?branch=implement-eq-partialeq#57416f447a10c3343df7fe80deb0ae8a7c77cf0a"
 
 [[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
 name = "miniz_oxide"
 version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1231,9 +1445,9 @@ dependencies = [
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
 dependencies = [
  "adler",
  "simd-adler32",
@@ -1269,10 +1483,81 @@ dependencies = [
 ]
 
 [[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "noop_proc_macro"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0676bb32a98c1a483ce53e500a81ad9c3d5b3f7c920c28c24e9cb0980d0b5bc8"
+
+[[package]]
+name = "num-bigint"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "num-derive"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+dependencies = [
+ "autocfg",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
 name = "num-traits"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
+checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
 dependencies = [
  "autocfg",
 ]
@@ -1289,9 +1574,9 @@ dependencies = [
 
 [[package]]
 name = "num_threads"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2819ce041d2ee131036f4fc9d6ae7ae125a3a40e97ba64d04fe799ad9dabbb44"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
 dependencies = [
  "libc",
 ]
@@ -1313,11 +1598,11 @@ checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "openssl"
-version = "0.10.63"
+version = "0.10.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15c9d69dd87a29568d4d017cfe8ec518706046a05184e5aea92d0af890b803c8"
+checksum = "95a0481286a310808298130d22dd1fef0fa571e05a8f44ec801801e84b216b1f"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -1345,18 +1630,18 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-src"
-version = "300.2.1+3.2.0"
+version = "300.2.3+3.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fe476c29791a5ca0d1273c697e96085bbabbbea2ef7afd5617e78a4b40332d3"
+checksum = "5cff92b6f71555b61bb9315f7c64da3ca43d87531622120fea0195fc761b4843"
 dependencies = [
  "cc",
 ]
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.99"
+version = "0.9.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e1bf214306098e4832460f797824c05d25aacdf896f64a985fb0fd992454ae"
+checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
 dependencies = [
  "cc",
  "libc",
@@ -1407,6 +1692,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "paste"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
+
+[[package]]
 name = "percent-encoding"
 version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1451,7 +1742,7 @@ version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90fcb95eef784c2ac79119d1dd819e162b5da872ce6f3c3abe1e8ca1c082f72b"
 dependencies = [
- "siphasher",
+ "siphasher 0.3.11",
 ]
 
 [[package]]
@@ -1461,10 +1752,30 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5be167a7af36ee22fe3115051bc51f6e6c7054c9348e28deb4f49bd6f705a315"
 
 [[package]]
+name = "pin-project"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
 name = "pin-project-lite"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 
 [[package]]
 name = "pin-utils"
@@ -1480,18 +1791,18 @@ checksum = "5de5067af0cd27add969cdb4ef2eecc955f59235f3b7a75a3c6ac9562cfb6b81"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2900ede94e305130c13ddd391e0ab7cbaeb783945ae07a279c268cb05109c6cb"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
 
 [[package]]
 name = "plist"
-version = "1.6.0"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5699cc8a63d1aa2b1ee8e12b9ad70ac790d65788cd36101fa37f87ea46c4cef"
+checksum = "d9d34169e64b3c7a80c8621a48adaf44e0cf62c78a9b25dd9dd35f1881a17cf9"
 dependencies = [
- "base64",
- "indexmap 2.1.0",
+ "base64 0.21.7",
+ "indexmap 2.2.6",
  "line-wrap",
  "quick-xml",
  "serde",
@@ -1512,15 +1823,15 @@ dependencies = [
 
 [[package]]
 name = "png"
-version = "0.17.11"
+version = "0.17.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f6c3c3e617595665b8ea2ff95a86066be38fb121ff920a9c0eb282abcd1da5a"
+checksum = "06e4b0d3d1312775e782c86c91a111aa1f910cbb65e1337f9975b5f9a554b5e1"
 dependencies = [
  "bitflags 1.3.2",
  "crc32fast",
  "fdeflate",
  "flate2",
- "miniz_oxide 0.7.1",
+ "miniz_oxide 0.7.2",
 ]
 
 [[package]]
@@ -1537,14 +1848,33 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.78"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
+name = "profiling"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d84d1d7a6ac92673717f9f6d1518374ef257669c24ebc5ac25d5033828be58"
+dependencies = [
+ "profiling-procmacros",
+]
+
+[[package]]
+name = "profiling-procmacros"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8021cf59c8ec9c432cfc2526ac6b8aa508ecaf29cd415f271b8406c1b851c3fd"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
 name = "qoi"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1560,6 +1890,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
+name = "quick-error"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
+
+[[package]]
 name = "quick-xml"
 version = "0.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1570,9 +1906,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -1583,7 +1919,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9586f8867f39941d8e796c18340a9cb5221a018df021169dc3e61c87d9f5f567"
 dependencies = [
- "quick-error",
+ "quick-error 1.2.3",
 ]
 
 [[package]]
@@ -1617,10 +1953,60 @@ dependencies = [
 ]
 
 [[package]]
+name = "rav1e"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd87ce80a7665b1cce111f8a16c1f3929f6547ce91ade6addf4ec86a8dda5ce9"
+dependencies = [
+ "arbitrary",
+ "arg_enum_proc_macro",
+ "arrayvec",
+ "av1-grain",
+ "bitstream-io",
+ "built",
+ "cfg-if",
+ "interpolate_name",
+ "itertools",
+ "libc",
+ "libfuzzer-sys",
+ "log",
+ "maybe-rayon",
+ "new_debug_unreachable",
+ "noop_proc_macro",
+ "num-derive",
+ "num-traits",
+ "once_cell",
+ "paste",
+ "profiling",
+ "rand",
+ "rand_chacha",
+ "simd_helpers",
+ "system-deps",
+ "thiserror",
+ "v_frame",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "ravif"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc13288f5ab39e6d7c9d501759712e6969fcc9734220846fc9ed26cae2cc4234"
+dependencies = [
+ "avif-serialize",
+ "imgref",
+ "loop9",
+ "quick-error 2.0.1",
+ "rav1e",
+ "rayon",
+ "rgb",
+]
+
+[[package]]
 name = "rayon"
-version = "1.8.1"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7237101a77a10773db45d62004a272517633fbcc3df19d96455ede1122e051"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
 dependencies = [
  "either",
  "rayon-core",
@@ -1637,12 +2023,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "rctree"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b42e27ef78c35d3998403c1d26f3efd9e135d3e5121b0a4845cc5cc27547f4f"
-
-[[package]]
 name = "redox_syscall"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1653,9 +2033,9 @@ dependencies = [
 
 [[package]]
 name = "redox_users"
-version = "0.4.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a18479200779601e498ada4e8c1e1f50e3ee19deb0259c25825a98b5603b2cb4"
+checksum = "bd283d9651eeda4b2a83a43c1c91b266c40fd76ecd39a50a8c630ae69dc72891"
 dependencies = [
  "getrandom",
  "libredox",
@@ -1664,25 +2044,25 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.10.2"
+version = "1.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
+checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
 dependencies = [
  "aho-corasick",
  "memchr",
  "regex-automata",
- "regex-syntax 0.8.2",
+ "regex-syntax 0.8.3",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.4.3"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.8.2",
+ "regex-syntax 0.8.3",
 ]
 
 [[package]]
@@ -1693,27 +2073,30 @@ checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "reqwest"
-version = "0.11.23"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37b1ae8d9ac08420c66222fb9096fc5de435c3c48542bc5336c51892cffafb41"
+checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
 dependencies = [
  "async-compression",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "encoding_rs",
+ "futures-channel",
  "futures-core",
  "futures-util",
  "h2",
  "http",
  "http-body",
+ "http-body-util",
  "hyper",
  "hyper-tls",
+ "hyper-util",
  "ipnet",
  "js-sys",
  "log",
@@ -1722,9 +2105,11 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
+ "rustls-pemfile",
  "serde",
  "serde_json",
  "serde_urlencoded",
+ "sync_wrapper",
  "system-configuration",
  "tokio",
  "tokio-native-tls",
@@ -1740,15 +2125,15 @@ dependencies = [
 
 [[package]]
 name = "resvg"
-version = "0.37.0"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cadccb3d99a9efb8e5e00c16fbb732cbe400db2ec7fc004697ee7d97d86cf1f4"
+checksum = "c2327ced609dadeed3e9702fec3e6b2ddd208758a9268d13e06566c6101ba533"
 dependencies = [
  "gif",
  "jpeg-decoder",
  "log",
  "pico-args",
- "png 0.17.11",
+ "png 0.17.13",
  "rgb",
  "svgtypes",
  "tiny-skia",
@@ -1766,15 +2151,6 @@ dependencies = [
 
 [[package]]
 name = "roxmltree"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "862340e351ce1b271a378ec53f304a5558f7db87f3769dc655a8f6ecbb68b302"
-dependencies = [
- "xmlparser",
-]
-
-[[package]]
-name = "roxmltree"
 version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3cd14fd5e3b777a7422cca79358c57a8f6e3a703d9ac187448d0daf220c2407f"
@@ -1787,11 +2163,11 @@ checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
 name = "rustix"
-version = "0.38.30"
+version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "322394588aaf33c24007e8bb3238ee3e4c5c09c084ab32bc73890b99ff326bca"
+checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -1799,12 +2175,28 @@ dependencies = [
 ]
 
 [[package]]
+name = "rustls-pemfile"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
+dependencies = [
+ "base64 0.22.1",
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "beb461507cee2c2ff151784c52762cf4d9ff6a61f3e80968600ed24fa837fa54"
+
+[[package]]
 name = "rustybuzz"
-version = "0.12.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0ae5692c5beaad6a9e22830deeed7874eae8a4e3ba4076fb48e12c56856222c"
+checksum = "88117946aa1bfb53c2ae0643ceac6506337f44887f8c9fbfb43587b1cc52ba49"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "bytemuck",
  "smallvec",
  "ttf-parser",
@@ -1816,15 +2208,9 @@ dependencies = [
 
 [[package]]
 name = "ryu"
-version = "1.0.16"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f98d2aa92eebf49b69786be48e4477826b256916e84a57ff2a4f21923b48eb4c"
-
-[[package]]
-name = "safemem"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef703b7cb59335eae2eb93ceb664c0eb7ea6bf567079d843e09420219668e072"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 
 [[package]]
 name = "sanitize-filename"
@@ -1853,9 +2239,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "security-framework"
-version = "2.9.2"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05b64fb303737d99b81884b2c63433e9ae28abebe5eb5045dcdd175dc2ecf4de"
+checksum = "770452e37cad93e0a50d5abc3990d2bc351c36d0328f86cefec2f2fb206eaef6"
 dependencies = [
  "bitflags 1.3.2",
  "core-foundation",
@@ -1866,9 +2252,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.9.1"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
+checksum = "41f3cc463c0ef97e11c3461a9d3787412d30e8e7eb907c79180c4a57bf7c04ef"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1876,18 +2262,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.195"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63261df402c67811e9ac6def069e4786148c4563f4b50fd4bf30aa370d626b02"
+checksum = "0c9f6e76df036c77cd94996771fb40db98187f096dd0b9af39c6c6e452ba966a"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.195"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46fe8f8603d81ba86327b23a2e9cdf49e1255fb94a4c5f297f6ee0547178ea2c"
+checksum = "11bd257a6541e141e42ca6d24ae26f7714887b47e89aa739099104c7e4d3b7fc"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1896,9 +2282,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.111"
+version = "1.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "176e46fa42316f18edd598015a5166857fc835ec732f5215eac6b7bdbf0a84f4"
+checksum = "3e17db7126d17feb94eb3fad46bf1a96b034e8aacbc2e775fe81505f8b0b2813"
 dependencies = [
  "itoa",
  "ryu",
@@ -1906,6 +2292,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "serde_spanned"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1919,16 +2314,17 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.5.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f58c3a1b3e418f61c25b2aeb43fc6c95eaa252b8cecdda67f401943e9e08d33f"
+checksum = "0ad483d2ab0149d5a5ebcd9972a3852711e0153d863bf5a5d0391d28883c4a20"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.1.0",
+ "indexmap 2.2.6",
  "serde",
+ "serde_derive",
  "serde_json",
  "serde_with_macros",
  "time",
@@ -1936,9 +2332,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.5.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2068b437a31fc68f25dd7edc296b078f04b45145c199d8eed9866e45f1ff274"
+checksum = "65569b702f41443e8bc8bbb1c5779bd0450bbe723b56198980e80ec45780bce2"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -1953,6 +2349,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
 
 [[package]]
+name = "simd_helpers"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95890f873bec569a0362c235787f3aca6e1e887302ba4840839bcc6459c42da6"
+dependencies = [
+ "quote",
+]
+
+[[package]]
 name = "simplecss"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1963,9 +2368,9 @@ dependencies = [
 
 [[package]]
 name = "simplelog"
-version = "0.12.1"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acee08041c5de3d5048c8b3f6f13fafb3026b24ba43c6a695a0c76179b844369"
+checksum = "16257adbfaef1ee58b1363bdc0664c9b8e1e30aed86049635fb5f147d065a9c0"
 dependencies = [
  "log",
  "termcolor",
@@ -1979,6 +2384,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
 
 [[package]]
+name = "siphasher"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
+
+[[package]]
 name = "slab"
 version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1998,9 +2409,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "smart-default"
@@ -2015,12 +2426,12 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.5.5"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b5fac59a5cb5dd637972e5fca70daf0523c9067fcdc4842f053dae04a18f8e9"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
 dependencies = [
  "libc",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2048,6 +2459,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
 name = "structmeta"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2072,19 +2489,19 @@ dependencies = [
 
 [[package]]
 name = "svgtypes"
-version = "0.13.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e44e288cd960318917cbd540340968b90becc8bc81f171345d706e7a89d9d70"
+checksum = "d97ca9a891c9c70da8139ac9d8e8ea36a210fa21bb50eccd75d4a9561c83e87f"
 dependencies = [
  "kurbo",
- "siphasher",
+ "siphasher 1.0.1",
 ]
 
 [[package]]
 name = "syn"
-version = "2.0.48"
+version = "2.0.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
+checksum = "909518bc7b1c9b779f1bbf07f2929d35af9f0f37e47c6e9ef7f9dddc1e1821f3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2092,6 +2509,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "sync_wrapper"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+
+[[package]]
 name = "system-configuration"
 version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2113,6 +2536,19 @@ dependencies = [
 ]
 
 [[package]]
+name = "system-deps"
+version = "6.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3e535eb8dded36d55ec13eddacd30dec501792ff23a0b1682c38601b8cf2349"
+dependencies = [
+ "cfg-expr",
+ "heck",
+ "pkg-config",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
 name = "tar"
 version = "0.4.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2124,41 +2560,46 @@ dependencies = [
 ]
 
 [[package]]
+name = "target-lexicon"
+version = "0.12.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
+
+[[package]]
 name = "tempfile"
-version = "3.9.0"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01ce4141aa927a6d1bd34a041795abd0db1cccba5d5f24b009f694bdf3a1f3fa"
+checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
 dependencies = [
  "cfg-if",
  "fastrand",
- "redox_syscall",
  "rustix",
  "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "termcolor"
-version = "1.1.3"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
 dependencies = [
  "winapi-util",
 ]
 
 [[package]]
 name = "thiserror"
-version = "1.0.56"
+version = "1.0.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d54378c645627613241d077a3a79db965db602882668f9136ac42af9ecb730ad"
+checksum = "f0126ad08bff79f29fc3ae6a55cc72352056dfff61e3ff8bb7129476d44b23aa"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.56"
+version = "1.0.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa0faa943b50f3db30a20aa7e265dbc66076993efed8463e8de414e5d06d3471"
+checksum = "d1cd413b5d558b4c5bf3680e324a6fa5014e7b7c067a51e69dbdf47eb7148b66"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2178,13 +2619,14 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.31"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
  "libc",
+ "num-conv",
  "num_threads",
  "powerfmt",
  "serde",
@@ -2200,33 +2642,34 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 
 [[package]]
 name = "tiny-skia"
-version = "0.11.3"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6a067b809476893fce6a254cf285850ff69c847e6cfbade6a20b655b6c7e80d"
+checksum = "83d13394d44dae3207b52a326c0c85a8bf87f1541f23b0d143811088497b09ab"
 dependencies = [
  "arrayref",
  "arrayvec",
  "bytemuck",
  "cfg-if",
  "log",
- "png 0.17.11",
+ "png 0.17.13",
  "tiny-skia-path",
 ]
 
 [[package]]
 name = "tiny-skia-path"
-version = "0.11.3"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5de35e8a90052baaaf61f171680ac2f8e925a1e43ea9d2e3a00514772250e541"
+checksum = "9c9e7fc0c2e86a30b117d0462aa261b72b7a99b7ebd7deb3a14ceda95c5bdc93"
 dependencies = [
  "arrayref",
  "bytemuck",
@@ -2250,9 +2693,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.35.1"
+version = "1.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c89b4efa943be685f629b149f53829423f8f5531ea21249408e8e2f8671ec104"
+checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2301,6 +2744,62 @@ dependencies = [
 ]
 
 [[package]]
+name = "toml"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9dd1545e8208b4a5af1aa9bbd0b4cf7e9ea08fabc5d0a5c67fcaafa17433aa3"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3328d4f68a705b2a4498da1d580585d39a6510f98318a2cec3018a7ec61ddef"
+dependencies = [
+ "indexmap 2.2.6",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow",
+]
+
+[[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project",
+ "pin-project-lite",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
+
+[[package]]
 name = "tower-service"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2312,6 +2811,7 @@ version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-core",
 ]
@@ -2339,12 +2839,14 @@ checksum = "17f77d76d837a7830fe1d4f12b7b4ba4192c1888001c7164257e4bc6d21d96b4"
 
 [[package]]
 name = "ulid"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e37c4b6cbcc59a8dcd09a6429fbc7890286bcbb79215cea7b38a3c4c0921d93"
+checksum = "34778c17965aa2a08913b57e1f34db9b4a63f5de31768b55bf20d2795f921259"
 dependencies = [
+ "getrandom",
  "rand",
  "serde",
+ "web-time",
 ]
 
 [[package]]
@@ -2355,15 +2857,15 @@ checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
 
 [[package]]
 name = "unicode-bidi-mirroring"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56d12260fb92d52f9008be7e4bca09f584780eb2266dc8fecc6a192bec561694"
+checksum = "23cb788ffebc92c5948d0e997106233eeb1d8b9512f93f41651f52b6c5f5af86"
 
 [[package]]
 name = "unicode-ccc"
-version = "0.1.2"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2520efa644f8268dce4dcd3050eaa7fc044fca03961e9998ac7e2e92b77cf1"
+checksum = "1df77b101bcc4ea3d78dafc5ad7e4f58ceffe0b2b16bf446aeb50b6cb4157656"
 
 [[package]]
 name = "unicode-ident"
@@ -2373,9 +2875,9 @@ checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
 dependencies = [
  "tinyvec",
 ]
@@ -2388,9 +2890,9 @@ checksum = "e4259d9d4425d9f0661581b804cb85fe66a4c631cadd8f490d1c13a35d5d9291"
 
 [[package]]
 name = "unicode-script"
-version = "0.5.5"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d817255e1bed6dfd4ca47258685d14d2bdcfbc64fdc9e3819bd5848057b8ecc"
+checksum = "ad8d71f5726e5f285a935e9fe8edfd53f0491eb6e9a5774097fdabee7cd8c9cd"
 
 [[package]]
 name = "unicode-vo"
@@ -2424,63 +2926,29 @@ checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
 [[package]]
 name = "usvg"
-version = "0.37.0"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38b0a51b72ab80ca511d126b77feeeb4fb1e972764653e61feac30adc161a756"
-dependencies = [
- "base64",
- "log",
- "pico-args",
- "usvg-parser",
- "usvg-text-layout",
- "usvg-tree",
- "xmlwriter",
-]
-
-[[package]]
-name = "usvg-parser"
-version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bd4e3c291f45d152929a31f0f6c819245e2921bfd01e7bd91201a9af39a2bdc"
+checksum = "5c704361d822337cfc00387672c7b59eaa72a1f0744f62b2a68aa228a0c6927d"
 dependencies = [
+ "base64 0.22.1",
  "data-url",
  "flate2",
+ "fontdb",
  "imagesize",
  "kurbo",
  "log",
- "roxmltree 0.19.0",
+ "pico-args",
+ "roxmltree",
+ "rustybuzz",
  "simplecss",
- "siphasher",
+ "siphasher 1.0.1",
+ "strict-num",
  "svgtypes",
- "usvg-tree",
-]
-
-[[package]]
-name = "usvg-text-layout"
-version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d383a3965de199d7f96d4e11a44dd859f46e86de7f3dca9a39bf82605da0a37c"
-dependencies = [
- "fontdb",
- "kurbo",
- "log",
- "rustybuzz",
+ "tiny-skia-path",
  "unicode-bidi",
  "unicode-script",
  "unicode-vo",
- "usvg-tree",
-]
-
-[[package]]
-name = "usvg-tree"
-version = "0.37.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ee3d202ebdb97a6215604b8f5b4d6ef9024efd623cf2e373a6416ba976ec7d3"
-dependencies = [
- "rctree",
- "strict-num",
- "svgtypes",
- "tiny-skia-path",
+ "xmlwriter",
 ]
 
 [[package]]
@@ -2490,12 +2958,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
+name = "v_frame"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f32aaa24bacd11e488aa9ba66369c7cd514885742c9fe08cfe85884db3e92b"
+dependencies = [
+ "aligned-vec",
+ "num-traits",
+ "wasm-bindgen",
+]
+
+[[package]]
 name = "vcpkg"
 version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
 [[package]]
+name = "version-compare"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "852e951cb7832cb45cb1169900d19760cfa39b82bc0ea9c0e5a14ae88411c98b"
+
+[[package]]
 name = "version_check"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2518,9 +3003,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.90"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1223296a201415c7fad14792dbefaace9bd52b62d33453ade1c5b5f07555406"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -2528,9 +3013,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.90"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcdc935b63408d58a32f8cc9738a0bffd8f05cc7c002086c6ef20b7312ad9dcd"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
 dependencies = [
  "bumpalo",
  "log",
@@ -2543,9 +3028,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.40"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bde2032aeb86bdfaecc8b261eef3cba735cc426c1f3a3416d1e0791be95fc461"
+checksum = "76bc14366121efc8dbb487ab05bcc9d346b3b5ec0eaa76e46594cabbe51762c0"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -2555,9 +3040,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.90"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e4c238561b2d428924c49815533a8b9121c664599558a5d9ec51f8a1740a999"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2565,9 +3050,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.90"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bae1abb6806dc1ad9e560ed242107c0f6c84335f1749dd4e8ddb012ebd5e25a7"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2578,15 +3063,25 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.90"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d91413b1c31d7539ba5ef2451af3f0b833a005eb27a631cec32bc0635a8602b"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
 
 [[package]]
 name = "web-sys"
-version = "0.3.67"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58cd2333b6e0be7a39605f0e255892fd7418a682d8da8fe042fe25128794d2ed"
+checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -2610,9 +3105,9 @@ dependencies = [
 
 [[package]]
 name = "weezl"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9193164d4de03a926d909d3bc7c30543cecb35400c02114792c2cae20d5e2dbb"
+checksum = "53a85b86a771b1c87058196170769dd264f66c0782acf1ae6cc51bfd64b39082"
 
 [[package]]
 name = "winapi"
@@ -2632,11 +3127,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
 dependencies = [
- "winapi",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2652,7 +3147,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be"
 dependencies = [
  "windows-core",
- "windows-targets 0.52.0",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -2661,7 +3156,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.0",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -2679,7 +3174,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.0",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -2699,17 +3194,18 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.0",
- "windows_aarch64_msvc 0.52.0",
- "windows_i686_gnu 0.52.0",
- "windows_i686_msvc 0.52.0",
- "windows_x86_64_gnu 0.52.0",
- "windows_x86_64_gnullvm 0.52.0",
- "windows_x86_64_msvc 0.52.0",
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]
 
 [[package]]
@@ -2720,9 +3216,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -2732,9 +3228,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -2744,9 +3240,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -2756,9 +3258,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -2768,9 +3270,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -2780,9 +3282,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -2792,15 +3294,24 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
+
+[[package]]
+name = "winnow"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14b9415ee827af173ebb3f15f9083df5a122eb93572ec28741fb153356ea2578"
+dependencies = [
+ "memchr",
+]
 
 [[package]]
 name = "winreg"
-version = "0.50.0"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5"
 dependencies = [
  "cfg-if",
  "windows-sys 0.48.0",
@@ -2818,18 +3329,46 @@ dependencies = [
 ]
 
 [[package]]
-name = "xmlparser"
-version = "0.13.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
-
-[[package]]
 name = "xmlwriter"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec7a2a501ed189703dba8b08142f057e887dfc4b2cc4db2d343ac6376ba3e0b9"
 
 [[package]]
+name = "zstd"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d789b1514203a1120ad2429eae43a7bd32b90976a7bb8a05f7ec02fa88cc23a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cd99b45c6bc03a018c8b8a86025678c87e55526064e38f9df301989dce7ec0a"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.10+zstd.1.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c253a4914af5bafc8fa8c86ee400827e83cf6ec01195ec1f1ed8441bf00d65aa"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
+[[package]]
+name = "zune-core"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f423a2c17029964870cfaabb1f13dfab7d092a62a29a89264f4d36990ca414a"
+
+[[package]]
 name = "zune-inflate"
 version = "0.2.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2837,3 +3376,12 @@ checksum = "73ab332fe2f6680068f3582b16a24f90ad7096d5d39b974d1c0aff0125116f02"
 dependencies = [
  "simd-adler32",
 ]
+
+[[package]]
+name = "zune-jpeg"
+version = "0.4.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec866b44a2a1fd6133d363f073ca1b179f438f99e7e5bfb1e33f7181facfe448"
+dependencies = [
+ "zune-core",
+]
diff --git a/pkgs/by-name/fi/firefoxpwa/package.nix b/pkgs/by-name/fi/firefoxpwa/package.nix
index b75d6694c19df..3564ce0296c23 100644
--- a/pkgs/by-name/fi/firefoxpwa/package.nix
+++ b/pkgs/by-name/fi/firefoxpwa/package.nix
@@ -25,13 +25,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "firefoxpwa";
-  version = "2.11.1";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "filips123";
     repo = "PWAsForFirefox";
     rev = "v${version}";
-    hash = "sha256-ZD/bTziVmHtQVKejzj+fUXVazCm2PaulS2NZjTribSk=";
+    hash = "sha256-T2X+41ScE8FDZGJdgAjZCp1MQX51UACuNsWFk+6cR3A=";
   };
 
   sourceRoot = "${src.name}/native";
@@ -119,7 +119,7 @@ rustPlatform.buildRustPackage rec {
 
   passthru.tests.firefoxpwa = nixosTests.firefoxpwa;
 
-  meta = with lib; {
+  meta = {
     description = "A tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)";
     longDescription = ''
       Progressive Web Apps (PWAs) are web apps that use web APIs and features along
@@ -149,9 +149,9 @@ rustPlatform.buildRustPackage rec {
     '';
     homepage = "https://pwasforfirefox.filips.si/";
     changelog = "https://github.com/filips123/PWAsForFirefox/releases/tag/v${version}";
-    license = licenses.mpl20;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
+    license = lib.licenses.mpl20;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
       adamcstephens
       camillemndn
       pasqui23
diff --git a/pkgs/by-name/fo/forge-sparks/package.nix b/pkgs/by-name/fo/forge-sparks/package.nix
index 5a1601004706b..f7fb36ad2c606 100644
--- a/pkgs/by-name/fo/forge-sparks/package.nix
+++ b/pkgs/by-name/fo/forge-sparks/package.nix
@@ -17,15 +17,15 @@
 , wrapGAppsHook4
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "forge-sparks";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "rafaelmardojai";
-    repo = pname;
-    rev = version;
-    hash = "sha256-kUvUAJLCqIQpjm8RzAZaHVkdDCD9uKSQz9cYN60xS+4=";
+    repo = "forge-sparks";
+    rev = finalAttrs.version;
+    hash = "sha256-1Aq9Bv1UEckoA9IkQ9++rM6623GD41hgBJoeXKr2ipM=";
     fetchSubmodules = true;
   };
 
@@ -59,12 +59,12 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/rafaelmardojai/forge-sparks/releases/tag/${finalAttrs.version}";
     description = "Get Git forges notifications";
     homepage = "https://github.com/rafaelmardojai/forge-sparks";
-    changelog = "https://github.com/rafaelmardojai/forge-sparks/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ michaelgrahamevans ];
     mainProgram = "forge-sparks";
+    maintainers = with maintainers; [ michaelgrahamevans ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/networking/p2p/fragments/default.nix b/pkgs/by-name/fr/fragments/package.nix
index edb31ba669577..7976a2add11b4 100644
--- a/pkgs/applications/networking/p2p/fragments/default.nix
+++ b/pkgs/by-name/fr/fragments/package.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , appstream-glib
 , cargo
 , dbus
@@ -17,36 +16,26 @@
 , rustPlatform
 , rustc
 , sqlite
-, transmission
+, transmission_4
 , wrapGAppsHook4
 }:
 
-let
-  patchedTransmission = transmission.overrideAttrs (oldAttrs: {
-    patches = (oldAttrs.patches or []) ++ [
-      (fetchpatch {
-        url = "https://raw.githubusercontent.com/flathub/de.haeckerfelix.Fragments/2aee477c8e26a24570f8dbbdbd1c49e017ae32eb/transmission_pdeathsig.patch";
-        sha256 = "sha256-/rCoA566tMmzqcIfffC082Y56TwEyyQJ0knxymtscbA=";
-      })
-    ];
-  });
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "fragments";
-  version = "2.1.1";
+  version = "3.0.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "Fragments";
     rev = version;
-    sha256 = "sha256-tZcVw4rxmNPcKKgyRB+alEktktZfKK+7FYUVAAGA9bw=";
+    hash = "sha256-HtulyB1XYBsA595ghJN0EmyJT7DjGUbtJKaMGM3f0I8=";
   };
 
-  patches = [];
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src patches;
+    inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-nqVaYnL3jKGBsAsakIkgwksjH4yuMhwCQe0zq3jgjnA=";
+    hash = "sha256-EUE+Qc+MqsKPqHMYJflZQ6zm3ErW+KLuJq/7HEBf8VM=";
   };
 
   nativeBuildInputs = [
@@ -71,9 +60,9 @@ in stdenv.mkDerivation rec {
     sqlite
   ];
 
-  preFixup =  ''
+  preFixup = ''
     gappsWrapperArgs+=(
-      --prefix PATH : "${lib.makeBinPath [ patchedTransmission ]}"
+      --prefix PATH : "${lib.makeBinPath [ transmission_4 ]}"
     )
   '';
 
diff --git a/pkgs/by-name/fr/freecad/package.nix b/pkgs/by-name/fr/freecad/package.nix
index 436d94bd0f985..61fa9a395e406 100644
--- a/pkgs/by-name/fr/freecad/package.nix
+++ b/pkgs/by-name/fr/freecad/package.nix
@@ -27,7 +27,7 @@
 , stdenv
 , swig
 , vtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , xercesc
 , zlib
 }:
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     pyside2-tools
     gfortran
     wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/fr/freefilesync/package.nix b/pkgs/by-name/fr/freefilesync/package.nix
index 529516bb0da97..87674942c917d 100644
--- a/pkgs/by-name/fr/freefilesync/package.nix
+++ b/pkgs/by-name/fr/freefilesync/package.nix
@@ -5,7 +5,7 @@
 , fetchDebianPatch
 , copyDesktopItems
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , unzip
 , curl
 , glib
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     copyDesktopItems
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     unzip
   ];
 
diff --git a/pkgs/by-name/fr/fretboard/package.nix b/pkgs/by-name/fr/fretboard/package.nix
index fa772d61867fa..a4582832ae2d9 100644
--- a/pkgs/by-name/fr/fretboard/package.nix
+++ b/pkgs/by-name/fr/fretboard/package.nix
@@ -16,21 +16,21 @@
 , wrapGAppsHook4
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fretboard";
-  version = "5.4";
+  version = "6.1";
 
   src = fetchFromGitHub {
     owner = "bragefuglseth";
     repo = "fretboard";
-    rev = "v${version}";
-    hash = "sha256-GqnwAB7hmg2QLwSWqrZtTp6+FybK8/v4GZx/lMi0dGY=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Jr7DxoOmggcAxU1y+2jXZvMgAf9SDSA7t5Jr2AYZV7s=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-sGvb1+HKIqNSgCV9UzkCrkGrpjA34Pe9eq2/w3K/w/E=";
+    src = finalAttrs.src;
+    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    hash = "sha256-P7dafWBaHVrxh30YxKiraKPMjtmGTTNd8qvoJ1M2vKI=";
   };
 
   nativeBuildInputs = [
@@ -58,12 +58,12 @@ stdenv.mkDerivation rec {
   ]);
 
   meta = with lib; {
+    changelog = "https://github.com/bragefuglseth/fretboard/releases/tag/v${finalAttrs.version}";
     description = "Look up guitar chords";
-    homepage = "https://github.com/bragefuglseth/fretboard";
-    changelog = "https://github.com/bragefuglseth/fretboard/releases/tag/v${version}";
+    homepage = "https://apps.gnome.org/Fretboard/";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ michaelgrahamevans ];
     mainProgram = "fretboard";
+    maintainers = with maintainers; [ michaelgrahamevans ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index b4683af8912eb..a76420c3c6e43 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -228,7 +228,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dplugin_msr=disabled"
   ];
 
-  # TODO: wrapGAppsHook wraps efi capsule even though it is not ELF
+  # TODO: wrapGAppsHook3 wraps efi capsule even though it is not ELF
   dontWrapGApps = true;
 
   doCheck = true;
diff --git a/pkgs/by-name/ge/gema/package.nix b/pkgs/by-name/ge/gema/package.nix
new file mode 100644
index 0000000000000..564941444dd74
--- /dev/null
+++ b/pkgs/by-name/ge/gema/package.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchurl
+, installShellFiles
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gema";
+  version = "2.0";
+
+  src = fetchurl {
+    url = "https://sourceforge.net/projects/gema/files/gema/gema-${finalAttrs.version}/gema-${finalAttrs.version}-source.tar.gz";
+    hash = "sha256-c7qxgZYk/QaqocjRXVlgJxUWCgf3T1JBY7v9Fg9YfIU=";
+  };
+
+  makeFlags = [ "--directory=src" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 src/gema -t $out/bin
+    installManPage doc/gema.1
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "General purpose text processing utility based on the concept of pattern matching.";
+    longDescription = "Reads an input file and copies it to an output file transforming the data as specified by the patterns defined by the user.";
+    homepage = "https://gema.sourceforge.net/";
+    license = lib.licenses.mit;
+    mainProgram = "gema";
+    maintainers = with lib.maintainers; [ quag ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ge/germinal/package.nix b/pkgs/by-name/ge/germinal/package.nix
index 4d7409bf4a43d..d38e31aea8f32 100644
--- a/pkgs/by-name/ge/germinal/package.nix
+++ b/pkgs/by-name/ge/germinal/package.nix
@@ -9,7 +9,7 @@
 , pkg-config
 , tmux
 , vte
-, wrapGAppsHook
+, wrapGAppsHook3
 , nixosTests
 }:
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/gh/ghciwatch/package.nix b/pkgs/by-name/gh/ghciwatch/package.nix
new file mode 100644
index 0000000000000..62b11f975f7a4
--- /dev/null
+++ b/pkgs/by-name/gh/ghciwatch/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, nix-update-script
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ghciwatch";
+  version = "0.5.10";
+
+  src = fetchFromGitHub {
+    owner = "MercuryTechnologies";
+    repo = "ghciwatch";
+    rev = "v${version}";
+    hash = "sha256-6afUHLPrSWhgN5LA346tAZ1+gROr+i/ZyCNVnyCd5Tc=";
+  };
+
+  cargoHash = "sha256-og7S3W+DCBlFIvKLZghLT+msBLnS1o7Rea7v2VPsDYA=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreFoundation
+    darwin.apple_sdk.frameworks.CoreServices
+  ];
+
+  # integration tests are not run but the macros need this variable to be set
+  GHC_VERSIONS = "";
+  checkFlags = "--test \"unit\"";
+
+  meta = with lib; {
+    description = "Ghci-based file watching recompiler for Haskell development";
+    homepage = "https://github.com/MercuryTechnologies/ghciwatch";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mangoiv _9999years ];
+    mainProgram = "ghciwatch";
+  };
+
+  passthru.updateScript = nix-update-script { };
+}
diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 7ada2ddb663b4..1ac8deb248619 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchurl
 , autoPatchelfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeWrapper
 , gnome
 , libsecret
@@ -43,7 +43,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    (wrapGAppsHook.override { inherit makeWrapper; })
+    (wrapGAppsHook3.override { inherit makeWrapper; })
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/gl/glycin-loaders/fix-glycin-paths.patch b/pkgs/by-name/gl/glycin-loaders/fix-glycin-paths.patch
index 87a6e4cab1769..f05edf96a72a9 100644
--- a/pkgs/by-name/gl/glycin-loaders/fix-glycin-paths.patch
+++ b/pkgs/by-name/gl/glycin-loaders/fix-glycin-paths.patch
@@ -1,13 +1,24 @@
-diff --git a/vendor/glycin/src/dbus.rs b/vendor/glycin/src/dbus.rs
-index aa5a876..4f37420 100644
---- a/vendor/glycin/src/dbus.rs
-+++ b/vendor/glycin/src/dbus.rs
-@@ -43,7 +43,7 @@ impl<'a> DecoderProcess<'a> {
+diff --git a/vendor/glycin/src/sandbox.rs b/vendor/glycin/src/sandbox.rs
+index 7d00b36..aa70dc7 100644
+--- a/vendor/glycin/src/sandbox.rs
++++ b/vendor/glycin/src/sandbox.rs
+@@ -165,7 +165,7 @@ impl Sandbox {
  
-         let (bin, args, final_arg) = match sandbox_mechanism {
-             SandboxMechanism::Bwrap => (
--                "bwrap".into(),
-+                "@bwrap@".into(),
-                 vec![
-                     "--unshare-all",
-                     "--die-with-parent",
+                 args.push(self.command);
+ 
+-                ("bwrap".into(), args, Some(seccomp_memfd))
++                ("@bwrap@".into(), args, Some(seccomp_memfd))
+             }
+             SandboxMechanism::FlatpakSpawn => {
+                 let memory_limit = Self::memory_limit();
+@@ -233,8 +233,8 @@ impl Sandbox {
+                 "/",
+                 // Make /usr available as read only
+                 "--ro-bind",
+-                "/usr",
+-                "/usr",
++                "/nix/store",
++                "/nix/store",
+                 // Make tmpfs dev available
+                 "--dev",
+                 "/dev",
diff --git a/pkgs/by-name/gl/glycin-loaders/package.nix b/pkgs/by-name/gl/glycin-loaders/package.nix
index 6509f4c66e2f6..7804acd778f75 100644
--- a/pkgs/by-name/gl/glycin-loaders/package.nix
+++ b/pkgs/by-name/gl/glycin-loaders/package.nix
@@ -9,20 +9,23 @@
 , ninja
 , pkg-config
 , rustc
+, rustPlatform
 , gtk4
 , cairo
 , libheif
 , libxml2
+, libseccomp
+, libjxl
 , gnome
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glycin-loaders";
-  version = "0.1.2";
+  version = "1.0.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glycin-loaders/${lib.versions.majorMinor finalAttrs.version}/glycin-loaders-${finalAttrs.version}.tar.xz";
-    hash = "sha256-x2wBklq9BwF0WJzLkWpEpXOrZbHp1JPxVOQnVkMebdc=";
+    hash = "sha256-0PAiRi/1VYVuheqUBHRHC7NrN8n/y8umOgP+XpVDcM8=";
   };
 
   patches = [
@@ -40,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     rustc
+    rustPlatform.bindgenHook # for libheif-sys
   ];
 
   buildInputs = [
@@ -47,6 +51,8 @@ stdenv.mkDerivation (finalAttrs: {
     cairo
     libheif
     libxml2 # for librsvg crate
+    libseccomp
+    libjxl
   ];
 
   passthru = {
diff --git a/pkgs/by-name/gm/gmetronome/package.nix b/pkgs/by-name/gm/gmetronome/package.nix
index 64d0c19a966c4..adebcf9a6bc94 100644
--- a/pkgs/by-name/gm/gmetronome/package.nix
+++ b/pkgs/by-name/gm/gmetronome/package.nix
@@ -3,7 +3,7 @@
 , fetchFromGitLab
 , pkg-config
 , autoreconfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtkmm3
 , libpulseaudio
 }:
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix b/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix
new file mode 100644
index 0000000000000..0cf51ced6f5d5
--- /dev/null
+++ b/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix
@@ -0,0 +1,48 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook4
+, glib
+, glib-networking
+, gnome-online-accounts
+, gtk4
+, libadwaita
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gnome-online-accounts-gtk";
+  version = "3.50.1";
+
+  src = fetchFromGitHub {
+    owner = "xapp-project";
+    repo = "gnome-online-accounts-gtk";
+    rev = finalAttrs.version;
+    hash = "sha256-lirL1bsAZfuE669BdPo03M85O5eZzU/D/hfGp+LxvSo=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    glib
+    glib-networking
+    gnome-online-accounts
+    gtk4
+    libadwaita # for goa-backend
+  ];
+
+  meta = with lib; {
+    description = "Online accounts configuration utility";
+    homepage = "https://github.com/xapp-project/gnome-online-accounts-gtk";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.cinnamon.members;
+  };
+})
diff --git a/pkgs/by-name/gp/gpscorrelate/package.nix b/pkgs/by-name/gp/gpscorrelate/package.nix
index 6e029d4113713..e50f160e54156 100644
--- a/pkgs/by-name/gp/gpscorrelate/package.nix
+++ b/pkgs/by-name/gp/gpscorrelate/package.nix
@@ -9,7 +9,7 @@
 , docbook_xsl
 , docbook_xml_dtd_42
 , desktop-file-utils
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktopToDarwinBundle
 }:
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     docbook_xsl
     libxslt
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optional stdenv.isDarwin desktopToDarwinBundle;
 
   buildInputs = [
diff --git a/pkgs/by-name/gp/gpt4all/package.nix b/pkgs/by-name/gp/gpt4all/package.nix
index 83705d3906379..0d3d41a551822 100644
--- a/pkgs/by-name/gp/gpt4all/package.nix
+++ b/pkgs/by-name/gp/gpt4all/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpt4all";
-  version = "2.7.3";
+  version = "2.7.4";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
-    hash = "sha256-hIfeADP3tiooGZr/OMVFIkOAniMWXj9AsVzMPlVbucE=";
+    hash = "sha256-G22d2Q6z7DmPHM/DEE7iyJ8SWRZdoVdSWw+gnPVHdEg=";
     owner = "nomic-ai";
     repo = "gpt4all";
     rev = "v${finalAttrs.version}";
@@ -23,11 +23,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/gpt4all-chat";
 
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail 'set(CMAKE_INSTALL_PREFIX ''${CMAKE_BINARY_DIR}/install)' ""
-  '';
-
   nativeBuildInputs = [
     cmake
     qt6.wrapQtAppsHook
diff --git a/pkgs/by-name/gt/gtimelog/package.nix b/pkgs/by-name/gt/gtimelog/package.nix
index 1385751329452..471a0fd890b89 100644
--- a/pkgs/by-name/gt/gtimelog/package.nix
+++ b/pkgs/by-name/gt/gtimelog/package.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, python3Packages, wrapGAppsHook
+{ lib, fetchFromGitHub, python3Packages, wrapGAppsHook3
 , glibcLocales, gobject-introspection, gtk3, libsoup_3, libsecret
 }:
 
@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-+iBHfbUJtAtI/vcHj0Y8f9OxAp1SnhQyMqedVzSYPZQ=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
   buildInputs = [ glibcLocales gtk3 libsoup_3 libsecret ];
   propagatedBuildInputs = with python3Packages; [
     pygobject3
diff --git a/pkgs/by-name/gt/gtkhash/package.nix b/pkgs/by-name/gt/gtkhash/package.nix
index 63d0c788c976b..87cfcf374bd07 100644
--- a/pkgs/by-name/gt/gtkhash/package.nix
+++ b/pkgs/by-name/gt/gtkhash/package.nix
@@ -5,7 +5,7 @@
 , ninja
 , cmake
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , glib
 , openssl
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     ninja
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ho/hoppscotch/package.nix b/pkgs/by-name/ho/hoppscotch/package.nix
index ba08dbcc24233..c076f484a84b7 100644
--- a/pkgs/by-name/ho/hoppscotch/package.nix
+++ b/pkgs/by-name/ho/hoppscotch/package.nix
@@ -7,20 +7,20 @@
 
 let
   pname = "hoppscotch";
-  version = "24.3.1-2";
+  version = "24.3.2-1";
 
   src = fetchurl {
     aarch64-darwin = {
       url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";
-      hash = "sha256-F4vQwdNObIE8Fx75TfwI0QxbY5n2syT4sEIhgAu2Z5c=";
+      hash = "sha256-/Sa51x/Hy4mOxNL+6r+5sk/cF4iBbup9UBaWqzsnrBM=";
     };
     x86_64-darwin = {
       url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";
-      hash = "sha256-itC6PdNdzcw5Lv/hQkT0AsTGQ8kmTwT6cipyaAynph8=";
+      hash = "sha256-6vm3pQPg5OKRtP6W1CNQxy4fi9niw4Y4nXjargwHxuA=";
     };
     x86_64-linux = {
       url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";
-      hash = "sha256-vj9UYizRmyIK9mLNSW/qFc/QmnWNhniqJf3gG66WPb0=";
+      hash = "sha256-iGD/9alVwSsIhbSl9HZXdB5MQNSjn18YdgebyoizriE=";
     };
   }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
 
diff --git a/pkgs/by-name/ir/ironbar/package.nix b/pkgs/by-name/ir/ironbar/package.nix
index 1576f06528c6b..6844a5ae26ec9 100644
--- a/pkgs/by-name/ir/ironbar/package.nix
+++ b/pkgs/by-name/ir/ironbar/package.nix
@@ -7,7 +7,7 @@
 , glib
 , shared-mime-info
 , gsettings-desktop-schemas
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk-layer-shell
 , gnome
 , libxkbcommon
@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/by-name/je/jetbrains-toolbox/package.nix b/pkgs/by-name/je/jetbrains-toolbox/package.nix
index f996385268607..2d197e472d440 100644
--- a/pkgs/by-name/je/jetbrains-toolbox/package.nix
+++ b/pkgs/by-name/je/jetbrains-toolbox/package.nix
@@ -9,11 +9,11 @@
 }:
 let
   pname = "jetbrains-toolbox";
-  version = "2.2.3.20090";
+  version = "2.3.1.31116";
 
   src = fetchzip {
     url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}.tar.gz";
-    sha256 = "sha256-SqxQF5pG61CySsDzdZ1P2C9cCe/B145D0S+T4NByif8=";
+    sha256 = "sha256-mrTeUp9DBSO1S6Nxx077lqtY847CiCBCCi/vboZ8ADs=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ke/keydb/package.nix b/pkgs/by-name/ke/keydb/package.nix
index 3fc085b40ad9f..3be46ff770a09 100644
--- a/pkgs/by-name/ke/keydb/package.nix
+++ b/pkgs/by-name/ke/keydb/package.nix
@@ -18,14 +18,14 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "keydb";
   version = "6.3.4";
 
   src = fetchFromGitHub {
     owner = "snapchat";
     repo = "keydb";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-j6qgK6P3Fv+b6k9jwKQ5zW7XLkKbXXcmHKBCQYvwEIU=";
   };
 
@@ -94,13 +94,13 @@ stdenv.mkDerivation rec {
   passthru.tests.redis = nixosTests.redis;
   passthru.serverBin = "keydb-server";
 
-  meta = with lib; {
+  meta = {
     homepage = "https://keydb.dev";
     description = "A Multithreaded Fork of Redis";
-    license = licenses.bsd3;
-    platforms = platforms.all;
-    changelog = "https://github.com/Snapchat/KeyDB/raw/v${version}/00-RELEASENOTES";
-    maintainers = teams.helsinki-systems.members;
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    changelog = "https://github.com/Snapchat/KeyDB/raw/v${finalAttrs.version}/00-RELEASENOTES";
+    maintainers = lib.teams.helsinki-systems.members;
     mainProgram = "keydb-cli";
   };
-}
+})
diff --git a/pkgs/by-name/ko/konbucase/package.nix b/pkgs/by-name/ko/konbucase/package.nix
index 56a977eeeb138..a846bc775a7a8 100644
--- a/pkgs/by-name/ko/konbucase/package.nix
+++ b/pkgs/by-name/ko/konbucase/package.nix
@@ -5,7 +5,7 @@
 , ninja
 , vala
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , pantheon
 , gtksourceview5
 }:
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     vala
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ko/koodo-reader/package.nix b/pkgs/by-name/ko/koodo-reader/package.nix
index 6386cece98efa..059dfeda02eea 100644
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@@ -8,7 +8,7 @@
   makeDesktopItem,
   copyDesktopItems,
   makeWrapper,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   electron,
 }:
 
@@ -39,7 +39,7 @@ mkYarnPackage rec {
   nativeBuildInputs = [
     copyDesktopItems
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/ko/kor/package.nix b/pkgs/by-name/ko/kor/package.nix
index ee9d43af7c592..09abafc69d7cc 100644
--- a/pkgs/by-name/ko/kor/package.nix
+++ b/pkgs/by-name/ko/kor/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kor";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "yonahd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-wjq4IkF3agmculIH+WfBAGd0ciJBX9aj4EsmUvje9Aw=";
+    hash = "sha256-4lXLmh8BP7h6k8Tt/oklvv7fmDvmdKQP0P7gaCM2TK0=";
   };
 
-  vendorHash = "sha256-UN3Zf8eo6kMNNzkGsnqyDVMgE2QXRn4wg+XULu/uBGE=";
+  vendorHash = "sha256-ScV12Xb+tVluXC2Jat44atkKXZIzIcUdZ+lyD1Y3dIM=";
 
   preCheck = ''
     HOME=$(mktemp -d)
diff --git a/pkgs/by-name/la/labwc-gtktheme/package.nix b/pkgs/by-name/la/labwc-gtktheme/package.nix
index dd2e9ca254951..2d4dd33518403 100644
--- a/pkgs/by-name/la/labwc-gtktheme/package.nix
+++ b/pkgs/by-name/la/labwc-gtktheme/package.nix
@@ -3,7 +3,7 @@
 , gobject-introspection
 , gtk3
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 , unstableGitUpdater
 }:
 
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/la/labwc-tweaks-gtk/package.nix b/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
index 84c71665ea9c7..c8f6fdca999d4 100644
--- a/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
+++ b/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
@@ -7,7 +7,7 @@
 , gtk3
 , libxml2
 , xkeyboard_config
-, wrapGAppsHook
+, wrapGAppsHook3
 , unstableGitUpdater
 }:
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/la/lager/package.nix b/pkgs/by-name/la/lager/package.nix
index 11b7595fcccb3..1786e0cc503d1 100644
--- a/pkgs/by-name/la/lager/package.nix
+++ b/pkgs/by-name/la/lager/package.nix
@@ -8,15 +8,17 @@
 , zug
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lager";
   version = "0.1.0";
+
   src = fetchFromGitHub {
     owner = "arximboldi";
     repo = "lager";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-KTHrVV/186l4klwlcfDwFsKVoOVqWCUPzHnIbWuatbg=";
   };
+
   buildInputs = [
     boost
     immer
@@ -28,10 +30,11 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-Dlager_BUILD_EXAMPLES=OFF"
   ];
-  meta = with lib; {
-    homepage    = "https://github.com/arximboldi/lager";
+
+  meta = {
+    homepage = "https://github.com/arximboldi/lager";
     description = "C++ library for value-oriented design using the unidirectional data-flow architecture — Redux for C++";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ nek0 ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nek0 ];
   };
-}
+})
diff --git a/pkgs/by-name/li/libation/package.nix b/pkgs/by-name/li/libation/package.nix
index cad371b8919f2..75cc9c128187f 100644
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@@ -3,7 +3,7 @@
 , buildDotnetModule
 , fetchFromGitHub
 , dotnetCorePackages
-, wrapGAppsHook
+, wrapGAppsHook3
 
 , libX11
 , libICE
@@ -43,7 +43,7 @@ buildDotnetModule rec {
     "HangoverAvalonia/HangoverAvalonia.csproj"
   ];
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   runtimeDeps = [
     # For Avalonia UI
diff --git a/pkgs/by-name/li/libcpuid/package.nix b/pkgs/by-name/li/libcpuid/package.nix
index 7e63d25a53f36..cf4afd8df7d5e 100644
--- a/pkgs/by-name/li/libcpuid/package.nix
+++ b/pkgs/by-name/li/libcpuid/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcpuid";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "anrieff";
     repo = "libcpuid";
     rev = "v${version}";
-    sha256 = "sha256-Zs5GKvSasdfLqo8oErDQNAuXRG27Bm9vNwyooqbol0Q=";
+    sha256 = "sha256-Bq16UH4IUR7dU57bGHKq8P6JsjaB4arOJ4zFeNyxXSg=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/by-name/li/libiff/package.nix b/pkgs/by-name/li/libiff/package.nix
new file mode 100644
index 0000000000000..40138dc2d6619
--- /dev/null
+++ b/pkgs/by-name/li/libiff/package.nix
@@ -0,0 +1,34 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+  autoreconfHook,
+  help2man,
+}:
+
+stdenv.mkDerivation {
+  pname = "libiff";
+  version = "0-unstable-2024-03-02";
+  src = fetchFromGitHub {
+    owner = "svanderburg";
+    repo = "libiff";
+    rev = "b5f542a83c824f26e0816770c9a17c22bd388606";
+    sha256 = "sha256-Arh3Ihd5TWg5tdemodrxz2EDxh/hwz9b2/AvrTONFy8=";
+  };
+  nativeBuildInputs = [
+    autoreconfHook
+    help2man
+  ];
+  meta = with lib; {
+    description = "Parser for the Interchange File Format (IFF)";
+    longDescription = ''
+      libiff is a portable, extensible parser library implemented in
+      ANSI C, for EA-IFF 85: Electronic Arts' Interchange File Format
+      (IFF).
+    '';
+    homepage = "https://github.com/svanderburg/libiff";
+    maintainers = with maintainers; [ _414owen ];
+    platforms = platforms.all;
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/by-name/li/libilbm/package.nix b/pkgs/by-name/li/libilbm/package.nix
new file mode 100644
index 0000000000000..4d145a00021ca
--- /dev/null
+++ b/pkgs/by-name/li/libilbm/package.nix
@@ -0,0 +1,38 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+  libiff,
+  autoreconfHook,
+  pkg-config,
+  help2man,
+}:
+
+stdenv.mkDerivation {
+  pname = "libilbm";
+  version = "0-unstable-2024-03-02";
+  src = fetchFromGitHub {
+    owner = "svanderburg";
+    repo = "libilbm";
+    rev = "586f5822275ef5780509a851cb90c7407b2633d9";
+    sha256 = "sha256-EcsrspL/N40yFE15UFWGienpJHhoq1zd8zZe6x4nK6o=";
+  };
+  buildInputs = [ libiff ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    help2man
+  ];
+  meta = with lib; {
+    description = "Parser for the ILBM: IFF Interleaved BitMap format";
+    longDescription = ''
+      libilbm is a portable parser library built on top of libiff,
+      for ILBM: IFF Interleaved BitMap format, which is used by programs
+      such as Deluxe Paint and Graphicraft to read and write images.
+    '';
+    homepage = "https://github.com/svanderburg/libilbm";
+    maintainers = with maintainers; [ _414owen ];
+    platforms = platforms.all;
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/by-name/li/libmsgraph/package.nix b/pkgs/by-name/li/libmsgraph/package.nix
new file mode 100644
index 0000000000000..a3cb929f8041c
--- /dev/null
+++ b/pkgs/by-name/li/libmsgraph/package.nix
@@ -0,0 +1,73 @@
+{ stdenv
+, lib
+, fetchurl
+, gi-docgen
+, gobject-introspection
+, meson
+, ninja
+, pkg-config
+, uhttpmock_1_0
+, glib
+, gnome-online-accounts
+, json-glib
+, librest_1_0
+, libsoup_3
+, gnome
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libmsgraph";
+  version = "0.2.1";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/msgraph/${lib.versions.majorMinor finalAttrs.version}/msgraph-${finalAttrs.version}.tar.xz";
+    hash = "sha256-4OWeqorj4KSOwKbC/tBHCFanCSSOkhK2odA33leS7Ls=";
+  };
+
+  nativeBuildInputs = [
+    gi-docgen
+    gobject-introspection
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    uhttpmock_1_0
+  ];
+
+  propagatedBuildInputs = [
+    glib
+    gnome-online-accounts
+    json-glib
+    librest_1_0
+    libsoup_3
+  ];
+
+  mesonFlags = [
+    # https://gitlab.gnome.org/GNOME/msgraph/-/merge_requests/9
+    "-Dc_args=-Wno-error=format-security"
+  ];
+
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc/msgraph-0" "$devdoc"
+  '';
+
+  passthru = {
+    updateScript = gnome.updateScript {
+      attrPath = "libmsgraph";
+      packageName = "msgraph";
+    };
+  };
+
+  meta = with lib; {
+    description = "Library to access MS Graph API for Office 365";
+    homepage = "https://gitlab.gnome.org/GNOME/msgraph";
+    license = licenses.lgpl3Plus;
+    maintainers = teams.gnome.members;
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/li/live555/package.nix b/pkgs/by-name/li/live555/package.nix
index 1d8091bba7ab9..2c9f13520eb7f 100644
--- a/pkgs/by-name/li/live555/package.nix
+++ b/pkgs/by-name/li/live555/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "live555";
-  version = "2024.04.14";
+  version = "2024.04.19";
 
   src = fetchurl {
     urls = [
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
       "https://download.videolan.org/contrib/live555/live.${finalAttrs.version}.tar.gz"
       "mirror://sourceforge/slackbuildsdirectlinks/live.${finalAttrs.version}.tar.gz"
     ];
-    hash = "sha256-mR5rKGKtTwMq3p+xAAGdo0DNNnIe4KHladLPlnhVhNY=";
+    hash = "sha256-5sLr/sZ3LB83CEJx5OUjarx/Dh/ESJ+YaXY0QCAN3MI=";
   };
 
   patches = [
@@ -54,8 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
       config.linux
   ''
   # condition from icu/base.nix
-  + lib.optionalString (stdenv.hostPlatform.libc == "glibc"
-                        || stdenv.hostPlatform.libc == "musl") ''
+  + lib.optionalString (lib.elem stdenv.hostPlatform.libc [ "glibc" "musl" ]) ''
     substituteInPlace liveMedia/include/Locale.hh \
       --replace '<xlocale.h>' '<locale.h>'
   '';
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 9b2d5b15dab7e..8e1e0efd842b7 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -78,12 +78,21 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ggerganov";
     repo = "llama.cpp";
     rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-V+QDymEzXpw78Ezd2DInRLE0F6mXpLRhCK8iI8prq8I=";
+    hash = "sha256-KrIeZEq6RAz3N47wgtQjlfNzoGcTh3DqOhYBOxJPGzs=";
+    leaveDotGit = true;
+    postFetch = ''
+      git -C "$out" rev-parse --short HEAD > $out/COMMIT
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
   };
 
   postPatch = ''
     substituteInPlace ./ggml-metal.m \
-      --replace '[bundle pathForResource:@"ggml-metal" ofType:@"metal"];' "@\"$out/bin/ggml-metal.metal\";"
+      --replace-fail '[bundle pathForResource:@"ggml-metal" ofType:@"metal"];' "@\"$out/bin/ggml-metal.metal\";"
+
+    substituteInPlace ./scripts/build-info.cmake \
+      --replace-fail 'set(BUILD_NUMBER 0)' 'set(BUILD_NUMBER ${finalAttrs.version})' \
+      --replace-fail 'set(BUILD_COMMIT "unknown")' "set(BUILD_COMMIT \"$(cat COMMIT)\")"
   '';
 
   nativeBuildInputs = [ cmake ninja pkg-config git ]
diff --git a/pkgs/by-name/lo/lorem/package.nix b/pkgs/by-name/lo/lorem/package.nix
index d024aeaf614ac..05200e2ef690c 100644
--- a/pkgs/by-name/lo/lorem/package.nix
+++ b/pkgs/by-name/lo/lorem/package.nix
@@ -14,22 +14,22 @@
 , wrapGAppsHook4
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lorem";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World/design";
-    repo = pname;
-    rev = version;
-    hash = "sha256-+Dp/o1rZSHWihLLLe6CzV6c7uUnSsE8Ct3tbLNqlGF0=";
+    repo = "lorem";
+    rev = finalAttrs.version;
+    hash = "sha256-6+kDKKK1bkIOZlqzKWpzpjAS5o7bkbVFITMZVmJijuU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-YYjPhlPp211i+ECPu1xgDumz8nVqWRO8YzcZXy8uunI=";
+    src = finalAttrs.src;
+    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    hash = "sha256-nzP2Jp9l1QgL7Wk9SWlsSVNaeVe3t48MmeX7Xuz+PKM=";
   };
 
   nativeBuildInputs = [
@@ -50,12 +50,12 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
+    changelog = "https://gitlab.gnome.org/World/design/lorem/-/releases/${finalAttrs.version}";
     description = "Generate placeholder text";
-    homepage = "https://gitlab.gnome.org/World/design/lorem";
-    changelog = "https://gitlab.gnome.org/World/design/lorem/-/releases/${version}";
+    homepage = "https://apps.gnome.org/Lorem/";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ michaelgrahamevans ];
     mainProgram = "lorem";
+    maintainers = with maintainers; [ michaelgrahamevans ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/lo/loupe/package.nix b/pkgs/by-name/lo/loupe/package.nix
index 06820aa28a195..346da941ba2ec 100644
--- a/pkgs/by-name/lo/loupe/package.nix
+++ b/pkgs/by-name/lo/loupe/package.nix
@@ -15,17 +15,18 @@
 , lcms2
 , libadwaita
 , libgweather
+, libseccomp
 , glycin-loaders
 , gnome
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "loupe";
-  version = "45.3";
+  version = "46.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/loupe/${lib.versions.major finalAttrs.version}/loupe-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9l8tEgjQhatf+pmN1DyS/pUictTVm1HP7MEevf/KLYY=";
+    hash = "sha256-OhWj+c+PiJp+ZC45AimfeSGKkAHAjFY3TgWRT/71qzA=";
   };
 
   patches = [
@@ -51,13 +52,14 @@ stdenv.mkDerivation (finalAttrs: {
     lcms2
     libadwaita
     libgweather
+    libseccomp
   ];
 
   postPatch = ''
     # Replace hash of file we patch in vendored glycin.
     jq \
-      --arg hash "$(sha256sum vendor/glycin/src/dbus.rs | cut -d' ' -f 1)" \
-      '.files."src/dbus.rs" = $hash' \
+      --arg hash "$(sha256sum vendor/glycin/src/sandbox.rs | cut -d' ' -f 1)" \
+      '.files."src/sandbox.rs" = $hash' \
       vendor/glycin/.cargo-checksum.json \
       | sponge vendor/glycin/.cargo-checksum.json
   '';
diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index 180abae393373..f507a4dbc3117 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -6,11 +6,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunar-client";
-  version = "3.2.5";
+  version = "3.2.6";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}.AppImage";
-    hash = "sha512-flve07l13w4aRPPMhbf1Nbaxy6i1ljxx2J/9vg4WLQK4k09PVJKGn6b8nxe5d90LCYMhwEHfEvrHFB/tNFKJ9w==";
+    hash = "sha512-JZ6fXUDurLxe6acRRXTHot2GTUqMaSwy7N5K4cmFmOn4s8W2aXek+o8med3ytaxoTd6FmibXmCxrjnOVMHBRGA==";
   };
 
   extraInstallCommands =
diff --git a/pkgs/by-name/mc/mcomix/package.nix b/pkgs/by-name/mc/mcomix/package.nix
index 170386de3e4c0..900b40fed4b0d 100644
--- a/pkgs/by-name/mc/mcomix/package.nix
+++ b/pkgs/by-name/mc/mcomix/package.nix
@@ -6,7 +6,7 @@
 , mcomix
 , python3
 , testers
-, wrapGAppsHook
+, wrapGAppsHook3
 
   # Recommended Dependencies:
 , p7zip
@@ -34,7 +34,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [
     gobject-introspection
     python3.pkgs.setuptools
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/me/mednaffe/package.nix b/pkgs/by-name/me/mednaffe/package.nix
index 5625c380eaa7a..572275490800d 100644
--- a/pkgs/by-name/me/mednaffe/package.nix
+++ b/pkgs/by-name/me/mednaffe/package.nix
@@ -6,7 +6,7 @@
   mednafen,
   pkg-config,
   stdenv,
-  wrapGAppsHook,
+  wrapGAppsHook3,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/me/menulibre/package.nix b/pkgs/by-name/me/menulibre/package.nix
index 134c7cc98cc90..414f591965eb9 100644
--- a/pkgs/by-name/me/menulibre/package.nix
+++ b/pkgs/by-name/me/menulibre/package.nix
@@ -5,7 +5,7 @@
 , gtk3
 , intltool
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , nix-update-script
 , testers
 , menulibre
@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
     gtk3
     intltool
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/mg/mgba/package.nix b/pkgs/by-name/mg/mgba/package.nix
index 8f23998f01e00..6eaf56419d654 100644
--- a/pkgs/by-name/mg/mgba/package.nix
+++ b/pkgs/by-name/mg/mgba/package.nix
@@ -14,7 +14,7 @@
   minizip,
   pkg-config,
   stdenv,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   enableDiscordRpc ? false,
 }:
 
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     SDL2
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/by-name/my/myxer/package.nix b/pkgs/by-name/my/myxer/package.nix
index 200ca4bce15c4..61dd704db6774 100644
--- a/pkgs/by-name/my/myxer/package.nix
+++ b/pkgs/by-name/my/myxer/package.nix
@@ -2,7 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , libpulseaudio
 , glib
 , pango
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-IH+SLIHO/wu+przH+mgOEnH9m+iAE5s/BJhh0UUHR/0=";
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   buildInputs = [ libpulseaudio glib pango gtk3 ];
 
diff --git a/pkgs/by-name/ne/nestopia-ue/package.nix b/pkgs/by-name/ne/nestopia-ue/package.nix
index 78c15e6dfe833..34ba7112e43f0 100644
--- a/pkgs/by-name/ne/nestopia-ue/package.nix
+++ b/pkgs/by-name/ne/nestopia-ue/package.nix
@@ -14,7 +14,7 @@
 , pkg-config
 , stdenv
 , unzip
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 }:
 
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     fltk
     pkg-config
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     unzip
   ];
 
diff --git a/pkgs/by-name/no/normcap/package.nix b/pkgs/by-name/no/normcap/package.nix
index f6e4af16e6b14..0f6e21671de32 100644
--- a/pkgs/by-name/no/normcap/package.nix
+++ b/pkgs/by-name/no/normcap/package.nix
@@ -40,7 +40,7 @@ ps.buildPythonApplication rec {
   postPatch = ''
     # disable coverage testing
     substituteInPlace pyproject.toml \
-      --replace "addopts = [" "addopts_ = ["
+      --replace-fail "addopts = [" "addopts_ = ["
   '';
 
   pythonRemoveDeps = [
@@ -57,7 +57,7 @@ ps.buildPythonApplication rec {
     ps.babel
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     ps.pyside6
     ps.jeepney
   ];
diff --git a/pkgs/by-name/nw/nwg-drawer/package.nix b/pkgs/by-name/nw/nwg-drawer/package.nix
index 42a69d5949740..647ca14b3c2b7 100644
--- a/pkgs/by-name/nw/nwg-drawer/package.nix
+++ b/pkgs/by-name/nw/nwg-drawer/package.nix
@@ -6,7 +6,7 @@
 , gtk-layer-shell
 , gtk3
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 }:
 
@@ -29,7 +29,7 @@ buildGoModule {
   nativeBuildInputs = [
     gobject-introspection
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/nw/nwg-hello/package.nix b/pkgs/by-name/nw/nwg-hello/package.nix
index cae3fd2d25218..8efe84411f501 100644
--- a/pkgs/by-name/nw/nwg-hello/package.nix
+++ b/pkgs/by-name/nw/nwg-hello/package.nix
@@ -4,7 +4,7 @@
 , gtk-layer-shell
 , gtk3
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ol/olvid/package.nix b/pkgs/by-name/ol/olvid/package.nix
index bd0eb63a9af71..ec90fcb72fe9f 100644
--- a/pkgs/by-name/ol/olvid/package.nix
+++ b/pkgs/by-name/ol/olvid/package.nix
@@ -13,7 +13,7 @@
 , openjfx21
 , autoPatchelfHook
 , makeBinaryWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     autoPatchelfHook
     makeBinaryWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/on/onedriver/package.nix b/pkgs/by-name/on/onedriver/package.nix
index 348f4b658b4cd..ae2ad038d58e2 100644
--- a/pkgs/by-name/on/onedriver/package.nix
+++ b/pkgs/by-name/on/onedriver/package.nix
@@ -6,7 +6,7 @@
 , glib
 , fuse
 , installShellFiles
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapperDir ? "/run/wrappers/bin"
 }:
 let
@@ -24,7 +24,7 @@ buildGoModule {
   inherit pname version src;
   vendorHash = "sha256-OOiiKtKb+BiFkoSBUQQfqm4dMfDW3Is+30Kwcdg8LNA=";
 
-  nativeBuildInputs = [ pkg-config installShellFiles wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config installShellFiles wrapGAppsHook3 ];
   buildInputs = [ webkitgtk_4_1 glib fuse ];
 
   ldflags = [ "-X github.com/jstaf/onedriver/cmd/common.commit=v${version}" ];
diff --git a/pkgs/by-name/on/onlyoffice-bin/package.nix b/pkgs/by-name/on/onlyoffice-bin/package.nix
index 8abf0909e6b33..4c9c0cd1e3263 100644
--- a/pkgs/by-name/on/onlyoffice-bin/package.nix
+++ b/pkgs/by-name/on/onlyoffice-bin/package.nix
@@ -28,7 +28,7 @@
 , nss
 , pulseaudio
 , qt5
-, wrapGAppsHook
+, wrapGAppsHook3
 , xkeyboard_config
 , xorg
 }:
@@ -86,7 +86,7 @@ stdenv.mkDerivation rec {
     autoPatchelfHook
     dpkg
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/on/onlyoffice-bin_latest/package.nix b/pkgs/by-name/on/onlyoffice-bin_latest/package.nix
index 0b54203008140..538e55b8bb25e 100644
--- a/pkgs/by-name/on/onlyoffice-bin_latest/package.nix
+++ b/pkgs/by-name/on/onlyoffice-bin_latest/package.nix
@@ -31,7 +31,7 @@
 , nss
 , pulseaudio
 , qt5
-, wrapGAppsHook
+, wrapGAppsHook3
 , xkeyboard_config
 , xorg
 }:
@@ -76,7 +76,7 @@ let
       autoPatchelfHook
       dpkg
       makeWrapper
-      wrapGAppsHook
+      wrapGAppsHook3
     ];
 
     buildInputs = [
diff --git a/pkgs/by-name/op/openscad-unstable/package.nix b/pkgs/by-name/op/openscad-unstable/package.nix
index 4483d5271fb13..1e14580b42bb5 100644
--- a/pkgs/by-name/op/openscad-unstable/package.nix
+++ b/pkgs/by-name/op/openscad-unstable/package.nix
@@ -34,7 +34,7 @@
 , tbb_2021_11
 , wayland
 , wayland-protocols
-, wrapGAppsHook
+, wrapGAppsHook3
 , xorg
 }:
 let
@@ -97,7 +97,7 @@ clangStdenv.mkDerivation rec {
     flex
     libsForQt5.qt5.wrapQtAppsHook
     llvmPackages.bintools
-    wrapGAppsHook
+    wrapGAppsHook3
     ninja
     pkg-config
   ];
diff --git a/pkgs/by-name/op/openswitcher/package.nix b/pkgs/by-name/op/openswitcher/package.nix
index 569ed3597ea62..fb47a9f95a5a8 100644
--- a/pkgs/by-name/op/openswitcher/package.nix
+++ b/pkgs/by-name/op/openswitcher/package.nix
@@ -9,7 +9,7 @@
 , ninja
 , pkg-config
 , scdoc
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -41,7 +41,7 @@ python3Packages.buildPythonApplication rec {
     ninja
     pkg-config
     scdoc
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/or/orca/fix-paths.patch b/pkgs/by-name/or/orca/fix-paths.patch
new file mode 100644
index 0000000000000..5f5feacb33a56
--- /dev/null
+++ b/pkgs/by-name/or/orca/fix-paths.patch
@@ -0,0 +1,75 @@
+diff --git a/src/orca/debug.py b/src/orca/debug.py
+index eb939a236..4e4db2e84 100644
+--- a/src/orca/debug.py
++++ b/src/orca/debug.py
+@@ -522,7 +522,7 @@ def traceit(frame, event, arg):
+     return traceit
+ 
+ def getOpenFDCount(pid):
+-    procs = subprocess.check_output([ 'lsof', '-w', '-Ff', '-p', str(pid)])
++    procs = subprocess.check_output([ '@lsof@', '-w', '-Ff', '-p', str(pid)])
+     procs = procs.decode('UTF-8').split('\n')
+     files = list(filter(lambda s: s and s[0] == 'f' and s[1:].isdigit(), procs))
+ 
+@@ -540,7 +540,7 @@ def getCmdline(pid):
+     return cmdline
+ 
+ def pidOf(procName):
+-    openFile = subprocess.Popen(f'pgrep {procName}',
++    openFile = subprocess.Popen(f'@pgrep@ {procName}',
+                                 shell=True,
+                                 stdout=subprocess.PIPE).stdout
+     pids = openFile.read()
+diff --git a/src/orca/orca_bin.py.in b/src/orca/orca_bin.py.in
+index c6f99de14..2370204f3 100755
+--- a/src/orca/orca_bin.py.in
++++ b/src/orca/orca_bin.py.in
+@@ -62,7 +62,7 @@ class ListApps(argparse.Action):
+                 name = "[DEAD]"
+ 
+             try:
+-                cmdline = subprocess.getoutput('cat /proc/%s/cmdline' % pid)
++                cmdline = subprocess.getoutput('@cat@ /proc/%s/cmdline' % pid)
+             except Exception:
+                 cmdline = '(exception encountered)'
+             else:
+@@ -195,7 +195,7 @@ def inGraphicalDesktop():
+ def otherOrcas():
+     """Returns the pid of any other instances of Orca owned by this user."""
+ 
+-    openFile = subprocess.Popen('pgrep -u %s -x orca' % os.getuid(),
++    openFile = subprocess.Popen('@pgrep@ -u %s -x orca' % os.getuid(),
+                                 shell=True,
+                                 stdout=subprocess.PIPE).stdout
+     pids = openFile.read()
+diff --git a/src/orca/orca_modifier_manager.py b/src/orca/orca_modifier_manager.py
+index c45cd4a5b..3f2ec59f0 100644
+--- a/src/orca/orca_modifier_manager.py
++++ b/src/orca/orca_modifier_manager.py
+@@ -115,7 +115,7 @@ class OrcaModifierManager:
+         debug.printMessage(debug.LEVEL_INFO, msg, True)
+ 
+         self.unset_orca_modifiers(reason)
+-        self._original_xmodmap = subprocess.check_output(['xkbcomp', os.environ['DISPLAY'], '-'])
++        self._original_xmodmap = subprocess.check_output(['@xkbcomp@', os.environ['DISPLAY'], '-'])
+         self._create_orca_xmodmap()
+ 
+     def update_key_map(self, keyboard_event):
+@@ -162,7 +162,7 @@ class OrcaModifierManager:
+             return
+ 
+         self._caps_lock_cleared = False
+-        p = subprocess.Popen(['xkbcomp', '-w0', '-', os.environ['DISPLAY']],
++        p = subprocess.Popen(['@xkbcomp@', '-w0', '-', os.environ['DISPLAY']],
+             stdin=subprocess.PIPE, stdout=None, stderr=None)
+         p.communicate(self._original_xmodmap)
+ 
+@@ -223,7 +223,7 @@ class OrcaModifierManager:
+         if modified:
+             msg = "ORCA MODIFIER MANAGER: Updating xmodmap"
+             debug.printMessage(debug.LEVEL_INFO, msg, True)
+-            p = subprocess.Popen(['xkbcomp', '-w0', '-', os.environ['DISPLAY']],
++            p = subprocess.Popen(['@xkbcomp@', '-w0', '-', os.environ['DISPLAY']],
+                 stdin=subprocess.PIPE, stdout=None, stderr=None)
+             p.communicate(bytes('\n'.join(lines), 'UTF-8'))
+         else:
diff --git a/pkgs/applications/misc/orca/default.nix b/pkgs/by-name/or/orca/package.nix
index dcb578dd56789..edc89bbaf2ba6 100644
--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/by-name/or/orca/package.nix
@@ -1,24 +1,20 @@
 { lib
 , pkg-config
 , fetchurl
-, buildPythonApplication
-, autoreconfHook
-, wrapGAppsHook
+, meson
+, ninja
+, wrapGAppsHook3
 , gobject-introspection
 , gettext
 , yelp-tools
 , itstool
-, python
-, pygobject3
+, python3
 , gtk3
 , gnome
 , substituteAll
 , at-spi2-atk
 , at-spi2-core
-, pyatspi
 , dbus
-, dbus-python
-, pyxdg
 , xkbcomp
 , procps
 , lsof
@@ -27,20 +23,18 @@
 , speechd
 , brltty
 , liblouis
-, setproctitle
 , gst_all_1
-, gst-python
 }:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "orca";
-  version = "45.2";
+  version = "46.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "8PLFeaW+7f5WU7x/4kSBxNaqxd0fccHnoghZXzx473Y=";
+    hash = "sha256-z2deNQwYrA+ilDbGVZ0dqXX3///vqAjr5HbY+enRERQ=";
   };
 
   patches = [
@@ -54,8 +48,9 @@ buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    autoreconfHook
-    wrapGAppsHook
+    meson
+    ninja
+    wrapGAppsHook3
     pkg-config
     gettext
     yelp-tools
@@ -63,13 +58,13 @@ buildPythonApplication rec {
     gobject-introspection
   ];
 
-  pythonPath = [
+  pythonPath = with python3.pkgs; [
     pygobject3
-    pyatspi
     dbus-python
     pyxdg
     brltty
     liblouis
+    psutil
     speechd
     gst-python
     setproctitle
@@ -78,7 +73,7 @@ buildPythonApplication rec {
   strictDeps = false;
 
   buildInputs = [
-    python
+    python3
     gtk3
     at-spi2-atk
     at-spi2-core
@@ -89,6 +84,12 @@ buildPythonApplication rec {
     gst_all_1.gst-plugins-good
   ];
 
+  dontWrapGApps = true; # Prevent double wrapping
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/by-name/pa/pablodraw/package.nix b/pkgs/by-name/pa/pablodraw/package.nix
index 418b9a9c01513..1f1d4ccd7935d 100644
--- a/pkgs/by-name/pa/pablodraw/package.nix
+++ b/pkgs/by-name/pa/pablodraw/package.nix
@@ -2,7 +2,7 @@
 , buildDotnetModule
 , fetchFromGitHub
 , dotnetCorePackages
-, wrapGAppsHook
+, wrapGAppsHook3
 , copyDesktopItems
 , gtk3
 , libnotify
@@ -35,7 +35,7 @@ buildDotnetModule rec {
 
   nugetDeps = ./deps.nix;
 
-  nativeBuildInputs = [ wrapGAppsHook copyDesktopItems ];
+  nativeBuildInputs = [ wrapGAppsHook3 copyDesktopItems ];
 
   runtimeDeps = [ gtk3 libnotify ];
 
diff --git a/pkgs/by-name/pa/paper-clip/package.nix b/pkgs/by-name/pa/paper-clip/package.nix
index bd1d78b8e4c49..032bb9b5dbc42 100644
--- a/pkgs/by-name/pa/paper-clip/package.nix
+++ b/pkgs/by-name/pa/paper-clip/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "paper-clip";
-  version = "5.0";
+  version = "5.5";
 
   src = fetchFromGitHub {
     owner = "Diego-Ivan";
     repo = "Paper-Clip";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lkPX8S/0e7qEAfRiq0MyacDrqSWllncd9STxR7NKUFw=";
+    hash = "sha256-WCnWWVYaKq4U2RG3S4Xfja0NvreJIqU2VUJzpX7KI/E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/paper-plane/package.nix b/pkgs/by-name/pa/paper-plane/package.nix
index de900ef102827..dcbee261c4610 100644
--- a/pkgs/by-name/pa/paper-plane/package.nix
+++ b/pkgs/by-name/pa/paper-plane/package.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchFromGitHub
 , gtk4
-, wrapGAppsHook
+, wrapGAppsHook3
 , libadwaita
 , tdlib
 , rlottie
@@ -35,7 +35,7 @@ let
   gtk4-paperplane = gtk4.overrideAttrs (prev: {
     patches = (prev.patches or []) ++ [ "${src}/build-aux/gtk-reversed-list.patch" ];
   });
-  wrapPaperPlaneHook = wrapGAppsHook.override {
+  wrapPaperPlaneHook = wrapGAppsHook3.override {
     gtk3 = gtk4-paperplane;
   };
   # libadwaita has gtk4 in propagatedBuildInputs so it must be overrided
diff --git a/pkgs/by-name/pa/papers/Cargo.lock b/pkgs/by-name/pa/papers/Cargo.lock
new file mode 100644
index 0000000000000..39f0481e5d64c
--- /dev/null
+++ b/pkgs/by-name/pa/papers/Cargo.lock
@@ -0,0 +1,1251 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ahash"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b79b82693f705137f8fb9b37871d99e4f9a7df12b917eed79c3d3954830a60b"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
+
+[[package]]
+name = "anyhow"
+version = "1.0.80"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ad32ce52e4161730f7098c077cd2ed6229b5804ccf99e5366be1ab72a98b4e1"
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "2.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+
+[[package]]
+name = "block"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d8c1fef690941d3e7788d328517591fecc684c084084702d6ff1641e993699a"
+
+[[package]]
+name = "cairo-rs"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "bitflags",
+ "cairo-sys-rs",
+ "glib",
+ "libc",
+ "thiserror",
+]
+
+[[package]]
+name = "cairo-sys-rs"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "cc"
+version = "1.0.88"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02f341c093d19155a6e41631ce5971aac4e9a868262212153124c15fa22d1cdc"
+
+[[package]]
+name = "cfg-expr"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa50868b64a9a6fda9d593ce778849ea8715cd2a3d2cc17ffdb4a2f2f2f1961d"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "env_logger"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd405aab171cb85d6735e5c8d9db038c17d3ca007a4d2c25f337935c3d90580"
+dependencies = [
+ "humantime",
+ "is-terminal",
+ "log",
+ "regex",
+ "termcolor",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "errno"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
+
+[[package]]
+name = "field-offset"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f"
+dependencies = [
+ "memoffset",
+ "rustc_version",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.52",
+]
+
+[[package]]
+name = "futures-task"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
+
+[[package]]
+name = "futures-util"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
+dependencies = [
+ "futures-core",
+ "futures-macro",
+ "futures-task",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "gdk-pixbuf"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "gdk-pixbuf-sys",
+ "gio",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "gdk-pixbuf-sys"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gdk4"
+version = "0.9.0"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=master#4136ba2de5fc6190821ec1ec126ba3cf2d9db18e"
+dependencies = [
+ "cairo-rs",
+ "gdk-pixbuf",
+ "gdk4-sys",
+ "gio",
+ "glib",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gdk4-sys"
+version = "0.9.0"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=master#4136ba2de5fc6190821ec1ec126ba3cf2d9db18e"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "gettext-rs"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e49ea8a8fad198aaa1f9655a2524b64b70eb06b2f3ff37da407566c93054f364"
+dependencies = [
+ "gettext-sys",
+ "locale_config",
+]
+
+[[package]]
+name = "gettext-sys"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c63ce2e00f56a206778276704bbe38564c8695249fdc8f354b4ef71c57c3839d"
+dependencies = [
+ "cc",
+ "temp-dir",
+]
+
+[[package]]
+name = "gio"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "gio-sys",
+ "glib",
+ "libc",
+ "pin-project-lite",
+ "smallvec",
+ "thiserror",
+]
+
+[[package]]
+name = "gio-sys"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+ "windows-sys",
+]
+
+[[package]]
+name = "glib"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "bitflags",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-task",
+ "futures-util",
+ "gio-sys",
+ "glib-macros",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "memchr",
+ "smallvec",
+ "thiserror",
+]
+
+[[package]]
+name = "glib-macros"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "heck",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.52",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gobject-sys"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "graphene-rs"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "glib",
+ "graphene-sys",
+ "libc",
+]
+
+[[package]]
+name = "graphene-sys"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "gsk4"
+version = "0.9.0"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=master#4136ba2de5fc6190821ec1ec126ba3cf2d9db18e"
+dependencies = [
+ "cairo-rs",
+ "gdk4",
+ "glib",
+ "graphene-rs",
+ "gsk4-sys",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gsk4-sys"
+version = "0.9.0"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=master#4136ba2de5fc6190821ec1ec126ba3cf2d9db18e"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk4-sys",
+ "glib-sys",
+ "gobject-sys",
+ "graphene-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk4"
+version = "0.9.0"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=master#4136ba2de5fc6190821ec1ec126ba3cf2d9db18e"
+dependencies = [
+ "cairo-rs",
+ "field-offset",
+ "futures-channel",
+ "gdk-pixbuf",
+ "gdk4",
+ "gio",
+ "glib",
+ "graphene-rs",
+ "gsk4",
+ "gtk4-macros",
+ "gtk4-sys",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gtk4-macros"
+version = "0.9.0"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=master#4136ba2de5fc6190821ec1ec126ba3cf2d9db18e"
+dependencies = [
+ "anyhow",
+ "proc-macro-crate",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "gtk4-sys"
+version = "0.9.0"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=master#4136ba2de5fc6190821ec1ec126ba3cf2d9db18e"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk4-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "graphene-sys",
+ "gsk4-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "hermit-abi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+
+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
+[[package]]
+name = "indexmap"
+version = "2.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b0b929d511467233429c45a44ac1dcaa21ba0f5ba11e4879e6ed28ddb4f9df4"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "is-terminal"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f23ff5ef2b80d608d61efee834934d862cd92461afc0560dedf493e4c033738b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libadwaita"
+version = "0.7.0"
+source = "git+https://gitlab.gnome.org/World/Rust/libadwaita-rs.git?branch=master#9f9b3e8026f3cf7d7f1095fe5d0599f4fa78f625"
+dependencies = [
+ "gdk4",
+ "gio",
+ "glib",
+ "gtk4",
+ "libadwaita-sys",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "libadwaita-sys"
+version = "0.7.0"
+source = "git+https://gitlab.gnome.org/World/Rust/libadwaita-rs.git?branch=master#9f9b3e8026f3cf7d7f1095fe5d0599f4fa78f625"
+dependencies = [
+ "gdk4-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "gtk4-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.153"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
+
+[[package]]
+name = "locale_config"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d2c35b16f4483f6c26f0e4e9550717a2f6575bcd6f12a53ff0c490a94a6934"
+dependencies = [
+ "lazy_static",
+ "objc",
+ "objc-foundation",
+ "regex",
+ "winapi",
+]
+
+[[package]]
+name = "log"
+version = "0.4.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
+
+[[package]]
+name = "lru"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3262e75e648fce39813cb56ac41f3c3e3f65217ebf3844d818d1f9398cfb0dc"
+dependencies = [
+ "hashbrown",
+]
+
+[[package]]
+name = "malloc_buf"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62bb907fe88d54d8d9ce32a3cceab4218ed2f6b7d35617cafe9adf84e43919cb"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "memchr"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+
+[[package]]
+name = "memoffset"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "objc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "915b1b472bc21c53464d6c8461c9d3af805ba1ef837e1cac254428f4a77177b1"
+dependencies = [
+ "malloc_buf",
+]
+
+[[package]]
+name = "objc-foundation"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1add1b659e36c9607c7aab864a76c7a4c2760cd0cd2e120f3fb8b952c7e22bf9"
+dependencies = [
+ "block",
+ "objc",
+ "objc_id",
+]
+
+[[package]]
+name = "objc_id"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c92d4ddb4bd7b50d730c215ff871754d0da6b2178849f8a2a2ab69712d0c073b"
+dependencies = [
+ "objc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "pango"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "gio",
+ "glib",
+ "libc",
+ "pango-sys",
+]
+
+[[package]]
+name = "pango-sys"
+version = "0.20.0"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=master#8e5054e4daea31be1fe2843d4003a00ccc8b6451"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "papers"
+version = "0.1.0"
+dependencies = [
+ "env_logger",
+ "gdk-pixbuf",
+ "gdk4",
+ "gettext-rs",
+ "gio",
+ "glib",
+ "gtk4",
+ "libadwaita",
+ "log",
+ "lru",
+ "papers-document",
+ "papers-shell",
+ "papers-view",
+]
+
+[[package]]
+name = "papers-document"
+version = "0.1.0"
+dependencies = [
+ "bitflags",
+ "gdk-pixbuf",
+ "gdk4",
+ "gio",
+ "glib",
+ "gtk4",
+ "libc",
+ "papers-document-sys",
+]
+
+[[package]]
+name = "papers-document-sys"
+version = "0.0.1"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk4-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "gtk4-sys",
+ "libc",
+ "pango-sys",
+ "shell-words",
+ "system-deps",
+ "tempfile",
+]
+
+[[package]]
+name = "papers-shell"
+version = "0.1.0"
+dependencies = [
+ "bitflags",
+ "gdk-pixbuf",
+ "gdk4",
+ "gio",
+ "glib",
+ "gtk4",
+ "libadwaita",
+ "libc",
+ "papers-document",
+ "papers-shell-sys",
+ "papers-view",
+]
+
+[[package]]
+name = "papers-shell-sys"
+version = "0.0.1"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk4-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "gtk4-sys",
+ "libadwaita-sys",
+ "libc",
+ "pango-sys",
+ "papers-document-sys",
+ "papers-view-sys",
+ "shell-words",
+ "system-deps",
+ "tempfile",
+]
+
+[[package]]
+name = "papers-view"
+version = "0.1.0"
+dependencies = [
+ "bitflags",
+ "gdk-pixbuf",
+ "gdk4",
+ "gio",
+ "glib",
+ "gtk4",
+ "libc",
+ "papers-document",
+ "papers-view-sys",
+]
+
+[[package]]
+name = "papers-view-sys"
+version = "0.0.1"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk4-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "gtk4-sys",
+ "libc",
+ "pango-sys",
+ "papers-document-sys",
+ "shell-words",
+ "system-deps",
+ "tempfile",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d37c51ca738a55da99dc0c4a34860fd675453b8b36209178c2249bb13651284"
+dependencies = [
+ "toml_edit 0.21.1",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "regex"
+version = "1.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5bb987efffd3c6d0d8f5f89510bb458559eab11e4f869acb20bf845e016259cd"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
+
+[[package]]
+name = "serde"
+version = "1.0.197"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.197"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.52",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "shell-words"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24188a676b6ae68c3b2cb3a01be17fbf7240ce009799bb56d5b1409051e78fde"
+
+[[package]]
+name = "slab"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b699d15b36d1f02c3e7c69f8ffef53de37aefae075d8488d4ba1a7788d574a07"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "system-deps"
+version = "6.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a2d580ff6a20c55dfb86be5f9c238f67835d0e81cbdea8bf5680e0897320331"
+dependencies = [
+ "cfg-expr",
+ "heck",
+ "pkg-config",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
+
+[[package]]
+name = "temp-dir"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd16aa9ffe15fe021c6ee3766772132c6e98dfa395a167e16864f61a9cfb71d6"
+
+[[package]]
+name = "tempfile"
+version = "3.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "rustix",
+ "windows-sys",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e45bcbe8ed29775f228095caf2cd67af7a4ccf756ebff23a306bf3e8b47b24b"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a953cb265bef375dae3de6663da4d3804eee9682ea80d8e2542529b73c531c81"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.52",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a9aad4a3066010876e8dcf5a8a06e70a558751117a145c6ce2b82c2e2054290"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit 0.22.6",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8534fd7f78b5405e860340ad6575217ce99f38d4d5c8f2442cb5ecb50090e1"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c1b5fd4128cc8d3e0cb74d4ed9a9cc7c7284becd4df68f5f940e1ad123606f6"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow 0.6.5",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "version-compare"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "579a42fc0b8e0c63b76519a339be31bed574929511fa53c1a3acae26eb258f29"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
+
+[[package]]
+name = "winnow"
+version = "0.5.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dffa400e67ed5a4dd237983829e66475f0a4a26938c4b04c21baede6262215b8"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.52",
+]
diff --git a/pkgs/by-name/pa/papers/package.nix b/pkgs/by-name/pa/papers/package.nix
new file mode 100644
index 0000000000000..e599b4a779d15
--- /dev/null
+++ b/pkgs/by-name/pa/papers/package.nix
@@ -0,0 +1,133 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, appstream
+, desktop-file-utils
+, gtk4
+, glib
+, pango
+, atk
+, gdk-pixbuf
+, shared-mime-info
+, itstool
+, poppler
+, ghostscriptX
+, djvulibre
+, libspectre
+, libarchive
+, libsecret
+, wrapGAppsHook4
+, librsvg
+, gobject-introspection
+, yelp-tools
+, gsettings-desktop-schemas
+, dbus
+, gi-docgen
+, libgxps
+, supportXPS ? true # Open XML Paper Specification via libgxps
+, withLibsecret ? true
+, libadwaita
+, exempi
+, cargo
+, rustPlatform
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "papers";
+  version = "45.0-unstable-2024-03-27";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME/Incubator";
+    repo = "papers";
+    rev = "4374535f4f5e5cea613b2df7b3dc99e97da27d99";
+    hash = "sha256-wjLRGENJ+TjXV3JPn/lcqv3DonAsJrC0OiLs1DoNHkc=";
+  };
+
+  cargoRoot = "shell-rs";
+
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+
+    outputHashes = {
+      "cairo-rs-0.20.0" = "sha256-aCG9rh/tXqmcCIijuqJZJEgrGdG/IygcdWlvKYzVPhU=";
+      "gdk4-0.9.0" = "sha256-KYisC8nm6KVfowiKXtMoimXzB3UjHarH+2ZLhvW8oMU=";
+      "libadwaita-0.7.0" = "sha256-gfkaj/BIqvWj1UNVAGNNXww4aoJPlqvBwIRGmDiv48E=";
+    };
+  };
+
+  nativeBuildInputs = [
+    appstream
+    desktop-file-utils
+    gobject-introspection
+    gi-docgen
+    itstool
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+    yelp-tools
+    cargo
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    atk
+    dbus # only needed to find the service directory
+    djvulibre
+    exempi
+    gdk-pixbuf
+    ghostscriptX
+    glib
+    gtk4
+    gsettings-desktop-schemas
+    libadwaita
+    libarchive
+    librsvg
+    libspectre
+    pango
+    poppler
+  ] ++ lib.optionals withLibsecret [
+    libsecret
+  ] ++ lib.optionals supportXPS [
+    libgxps
+  ];
+
+  mesonFlags = [
+    "-Dnautilus=false"
+    "-Dps=enabled"
+  ] ++ lib.optionals (!withLibsecret) [
+    "-Dkeyring=disabled"
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
+  '';
+
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
+  meta = with lib; {
+    homepage = "https://wiki.gnome.org/Apps/papers";
+    description = "GNOME's document viewer";
+
+    longDescription = ''
+      papers is a document viewer for multiple document formats.  It
+      currently supports PDF, PostScript, DjVu, and TIFF (not DVI anymore).
+      The goal of papers is to replace the evince document viewer that exist
+      on the GNOME Desktop with a more modern interface.
+    '';
+
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    mainProgram = "papers";
+    maintainers = teams.gnome.members;
+  };
+})
diff --git a/pkgs/by-name/pg/pgmoneta/package.nix b/pkgs/by-name/pg/pgmoneta/package.nix
index 552f828f9238d..535eff92fb229 100644
--- a/pkgs/by-name/pg/pgmoneta/package.nix
+++ b/pkgs/by-name/pg/pgmoneta/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgmoneta";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "pgmoneta";
     repo = "pgmoneta";
     rev = version;
-    hash = "sha256-sFH8sYTQ10bR+TDNbyIJiAIcp24CA9E5zrRjyV9mGBU=";
+    hash = "sha256-+2pS3KG5wwP7bnaV+x8WxvDvQuXqmiMbuLScMNLqBtI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ph/photocollage/package.nix b/pkgs/by-name/ph/photocollage/package.nix
index f02efb9f2e901..46c6bedd77104 100644
--- a/pkgs/by-name/ph/photocollage/package.nix
+++ b/pkgs/by-name/ph/photocollage/package.nix
@@ -4,7 +4,7 @@
 , gettext
 , gdk-pixbuf
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -31,7 +31,7 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     gettext
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/pi/pinact/package.nix b/pkgs/by-name/pi/pinact/package.nix
index a5cee76cd9c6a..7e710c8f270ec 100644
--- a/pkgs/by-name/pi/pinact/package.nix
+++ b/pkgs/by-name/pi/pinact/package.nix
@@ -7,18 +7,18 @@
 
 let
   pname = "pinact";
-  version = "0.1.2";
+  version = "0.1.3";
   src = fetchFromGitHub {
     owner = "suzuki-shunsuke";
     repo = "pinact";
     rev = "v${version}";
-    hash = "sha256-OQo21RHk0c+eARKrA2qB4NAWWanb94DOZm4b9lqDz8o=";
+    hash = "sha256-ifUnF7u4/vMy89xb7sk4tPKQYdFBYAIHc0GYVBMWvWM=";
   };
 in
 buildGoModule {
   inherit pname version src;
 
-  vendorHash = "sha256-g7rdIE+w/pn70i8fOmAo/QGjpla3AUWm7a9MOhNmrgE=";
+  vendorHash = "sha256-ht4eV62w9AWKYahrd83LmBI+Tu2Q64YA3t90N4BR1e4=";
 
   doCheck = true;
 
diff --git a/pkgs/by-name/pl/plasticity/package.nix b/pkgs/by-name/pl/plasticity/package.nix
index 672dc986d06b1..0c7128724e281 100644
--- a/pkgs/by-name/pl/plasticity/package.nix
+++ b/pkgs/by-name/pl/plasticity/package.nix
@@ -27,7 +27,7 @@
 , systemd
 , trash-cli
 , vulkan-loader
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 , xorg
 }:
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec  {
 
   passthru.updateScript = ./update.sh;
 
-  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook rpmextract mesa ];
+  nativeBuildInputs = [ wrapGAppsHook3 autoPatchelfHook rpmextract mesa ];
 
   buildInputs = [
     alsa-lib
diff --git a/pkgs/by-name/po/popcorntime/package.nix b/pkgs/by-name/po/popcorntime/package.nix
index 240836d600491..7cf0d3c3c3078 100644
--- a/pkgs/by-name/po/popcorntime/package.nix
+++ b/pkgs/by-name/po/popcorntime/package.nix
@@ -10,7 +10,7 @@
 , stdenv
 , unzip
 , udev
-, wrapGAppsHook
+, wrapGAppsHook3
 , copyDesktopItems
 }:
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     autoPatchelfHook
     makeWrapper
     unzip
-    wrapGAppsHook
+    wrapGAppsHook3
     copyDesktopItems
   ];
 
diff --git a/pkgs/by-name/po/pot/package.nix b/pkgs/by-name/po/pot/package.nix
index aac04e5a0bcce..0547e72f48198 100644
--- a/pkgs/by-name/po/pot/package.nix
+++ b/pkgs/by-name/po/pot/package.nix
@@ -3,7 +3,7 @@
 , stdenvNoCC
 , rustPlatform
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , cargo
 , rustc
 , cargo-tauri
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     cargo
     rustc
     cargo-tauri
-    wrapGAppsHook
+    wrapGAppsHook3
     nodePackages.pnpm
     pkg-config
   ];
diff --git a/pkgs/by-name/po/powersupply/package.nix b/pkgs/by-name/po/powersupply/package.nix
index ce86cf2da7d0c..31216d84675a3 100644
--- a/pkgs/by-name/po/powersupply/package.nix
+++ b/pkgs/by-name/po/powersupply/package.nix
@@ -8,7 +8,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/pu/puppet-bolt/package.nix b/pkgs/by-name/pu/puppet-bolt/package.nix
index 23047c3cff479..7340ed9eb751e 100644
--- a/pkgs/by-name/pu/puppet-bolt/package.nix
+++ b/pkgs/by-name/pu/puppet-bolt/package.nix
@@ -7,7 +7,7 @@
   testers,
 }:
 
-bundlerApp {
+(bundlerApp {
   pname = "bolt";
 
   gemdir = ./.;
@@ -42,4 +42,6 @@ bundlerApp {
     maintainers = with lib.maintainers; [ uvnikita anthonyroussel ];
     platforms = lib.platforms.unix;
   };
-}
+}).overrideAttrs (old: {
+  name = "puppet-bolt-${(import ./gemset.nix).bolt.version}";
+})
diff --git a/pkgs/by-name/pw/pw3270/package.nix b/pkgs/by-name/pw/pw3270/package.nix
index 4e35f393dbcb1..657a218069506 100644
--- a/pkgs/by-name/pw/pw3270/package.nix
+++ b/pkgs/by-name/pw/pw3270/package.nix
@@ -14,7 +14,7 @@
 , gettext
 , desktop-file-utils
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     automake
     libtool
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/qu/quark-goldleaf/package.nix b/pkgs/by-name/qu/quark-goldleaf/package.nix
index 71321a76fbd5f..353bca5fea9f3 100644
--- a/pkgs/by-name/qu/quark-goldleaf/package.nix
+++ b/pkgs/by-name/qu/quark-goldleaf/package.nix
@@ -6,7 +6,7 @@
 , makeDesktopItem
 , copyDesktopItems
 , imagemagick
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 }:
 
@@ -46,7 +46,7 @@ maven'.buildMavenPackage rec {
   nativeBuildInputs = [
     imagemagick # for icon conversion
     copyDesktopItems
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [ gtk3 ];
diff --git a/pkgs/by-name/rm/rmenu/package.nix b/pkgs/by-name/rm/rmenu/package.nix
index a7a11f750540d..f5abbc9dd65ab 100644
--- a/pkgs/by-name/rm/rmenu/package.nix
+++ b/pkgs/by-name/rm/rmenu/package.nix
@@ -7,7 +7,7 @@
 , pkg-config
 , rustPlatform
 , webkitgtk_4_1
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 rustPlatform.buildRustPackage rec {
   pname = "rmenu";
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ro/roxterm/package.nix b/pkgs/by-name/ro/roxterm/package.nix
index 8b4f2e79c2be1..bf4d5ec499960 100644
--- a/pkgs/by-name/ro/roxterm/package.nix
+++ b/pkgs/by-name/ro/roxterm/package.nix
@@ -25,7 +25,7 @@
 , stdenv
 , util-linuxMinimal
 , vte
-, wrapGAppsHook
+, wrapGAppsHook3
 , xmlto
 }:
 
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     libxslt
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/sa/satellite/package.nix b/pkgs/by-name/sa/satellite/package.nix
index ad3afe454b65a..70b7f84c1290b 100644
--- a/pkgs/by-name/sa/satellite/package.nix
+++ b/pkgs/by-name/sa/satellite/package.nix
@@ -5,7 +5,7 @@
 , gtk3
 , libhandy
 , modemmanager
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [
     gobject-introspection
     python3.pkgs.setuptools
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/science/math/scotch/default.nix b/pkgs/by-name/sc/scotch/package.nix
index 1eb057cfc7c5c..7a93705cd9140 100644
--- a/pkgs/applications/science/math/scotch/default.nix
+++ b/pkgs/by-name/sc/scotch/package.nix
@@ -1,24 +1,39 @@
-{ lib, stdenv, fetchurl, bison, mpi, flex, zlib}:
-
-stdenv.mkDerivation rec {
-  version = "6.1.1";
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  bison,
+  mpi,
+  flex,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "scotch";
-  src_name = "scotch_${version}";
-
-  buildInputs = [ bison mpi flex zlib ];
+  version = "6.1.1";
 
-  src = fetchurl {
-    url = "https://gforge.inria.fr/frs/download.php/file/34618/${src_name}.tar.gz";
-    sha256 = "sha256-OQUvWf9HSkppzvwlzzyvhClACIneugEO5kA8oYj4sxE=";
+  buildInputs = [
+    bison
+    mpi
+    flex
+    zlib
+  ];
+
+  src = fetchFromGitLab {
+    domain = "gitlab.inria.fr";
+    owner = "scotch";
+    repo = "scotch";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-GUV6s+P56OAJq9AMe+LZOMPICQO/RuIi+hJAecmO5Wc=";
   };
 
-  sourceRoot = "${src_name}/src";
-
   preConfigure = ''
+    cd src
     ln -s Make.inc/Makefile.inc.x86-64_pc_linux2 Makefile.inc
   '';
 
   buildFlags = [ "scotch ptscotch" ];
+
   installFlags = [ "prefix=\${out}" ];
 
   meta = {
@@ -32,5 +47,4 @@ stdenv.mkDerivation rec {
     maintainers = [ lib.maintainers.bzizou ];
     platforms = lib.platforms.linux;
   };
-}
-
+})
diff --git a/pkgs/by-name/sh/shell-gpt/package.nix b/pkgs/by-name/sh/shell-gpt/package.nix
new file mode 100644
index 0000000000000..92f451b24088f
--- /dev/null
+++ b/pkgs/by-name/sh/shell-gpt/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "shell-gpt";
+  version = "1.4.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "TheR1D";
+    repo = "shell_gpt";
+    rev = "refs/tags/${version}";
+    hash = "sha256-T37L4U1kOrrIQJ2znq2UupD3pyit9xd8rAsEwUvGiQ8=";
+  };
+
+  pythonRelaxDeps = [
+    "requests"
+    "rich"
+    "distro"
+    "typer"
+    "instructor"
+  ];
+
+  build-system = with python3.pkgs; [ hatchling ];
+
+  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    click
+    distro
+    instructor
+    openai
+    rich
+    typer
+  ];
+
+  # Tests want to read the OpenAI API key from stdin
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Access ChatGPT from your terminal";
+    homepage = "https://github.com/TheR1D/shell_gpt";
+    changelog = "https://github.com/TheR1D/shell_gpt/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mglolenstine ];
+    mainProgram = "sgpt";
+  };
+}
diff --git a/pkgs/by-name/si/silverbullet/package.nix b/pkgs/by-name/si/silverbullet/package.nix
index b8732b4c69971..4a41b37014277 100644
--- a/pkgs/by-name/si/silverbullet/package.nix
+++ b/pkgs/by-name/si/silverbullet/package.nix
@@ -6,11 +6,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "silverbullet";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchurl {
     url = "https://github.com/silverbulletmd/silverbullet/releases/download/${finalAttrs.version}/silverbullet.js";
-    hash = "sha256-bnD9iZVRIg6otgDi4yNWySqmJsJJIVnjFGsTrGCMw/o=";
+    hash = "sha256-EhHPysliRi1bv/skS4+ljQW6qFsijmSup1+7/fVfFdg=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/sm/smartgithg/package.nix b/pkgs/by-name/sm/smartgithg/package.nix
index 4693511951a1f..57625a97b14a6 100644
--- a/pkgs/by-name/sm/smartgithg/package.nix
+++ b/pkgs/by-name/sm/smartgithg/package.nix
@@ -6,7 +6,7 @@
 , gtk3
 , glib
 , gnome
-, wrapGAppsHook
+, wrapGAppsHook3
 , libXtst
 , which
 }:
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-gXfHmRPUhs8s7IQIhN0vQyx8NpLrS28ufNNYOMA4AXw=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   buildInputs = [ jre gnome.adwaita-icon-theme gtk3 ];
 
diff --git a/pkgs/by-name/sn/snes9x/package.nix b/pkgs/by-name/sn/snes9x/package.nix
index c3d19bac383b8..3f57aee0ed47d 100644
--- a/pkgs/by-name/sn/snes9x/package.nix
+++ b/pkgs/by-name/sn/snes9x/package.nix
@@ -23,7 +23,7 @@
   python3,
   stdenv,
   util-linuxMinimal,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   zlib,
   # Boolean flags
   withGtk ? false,
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withGtk [
     cmake
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/sn/snippetexpandergui/package.nix b/pkgs/by-name/sn/snippetexpandergui/package.nix
index c43ce82c5ea77..a5b68fbce93f1 100644
--- a/pkgs/by-name/sn/snippetexpandergui/package.nix
+++ b/pkgs/by-name/sn/snippetexpandergui/package.nix
@@ -1,7 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromSourcehut
-, wrapGAppsHook
+, wrapGAppsHook3
 , wails
 , scdoc
 , installShellFiles
@@ -28,7 +28,7 @@ buildGoModule rec {
     wails
     scdoc
     installShellFiles
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/sn/snippetexpanderx/package.nix b/pkgs/by-name/sn/snippetexpanderx/package.nix
index 50da8f05503fe..c1d7827a4cc59 100644
--- a/pkgs/by-name/sn/snippetexpanderx/package.nix
+++ b/pkgs/by-name/sn/snippetexpanderx/package.nix
@@ -3,7 +3,7 @@
 , fetchFromSourcehut
 , pkg-config
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , installShellFiles
 , scdoc
 , at-spi2-atk
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     installShellFiles
     scdoc
   ];
diff --git a/pkgs/by-name/sp/spotube/package.nix b/pkgs/by-name/sp/spotube/package.nix
index 03ee6ad8d8bb6..cc63a6b680a10 100644
--- a/pkgs/by-name/sp/spotube/package.nix
+++ b/pkgs/by-name/sp/spotube/package.nix
@@ -8,7 +8,7 @@
   makeBinaryWrapper,
   makeWrapper,
   undmg,
-  wrapGAppsHook,
+  wrapGAppsHook3,
 
   libappindicator,
   libnotify,
@@ -84,7 +84,7 @@ let
       autoPatchelfHook
       dpkg
       makeWrapper
-      wrapGAppsHook
+      wrapGAppsHook3
     ];
 
     buildInputs = [
diff --git a/pkgs/by-name/sq/squirreldisk/package.nix b/pkgs/by-name/sq/squirreldisk/package.nix
index d274abae5e358..f394cce79ada7 100644
--- a/pkgs/by-name/sq/squirreldisk/package.nix
+++ b/pkgs/by-name/sq/squirreldisk/package.nix
@@ -6,7 +6,7 @@
   gtk3,
   webkitgtk,
   pkg-config,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   parallel-disk-usage,
   fetchFromGitHub,
   buildNpmPackage,
@@ -65,7 +65,7 @@ in
       cp ${parallel-disk-usage}/bin/pdu bin/pdu-${stdenv.hostPlatform.config}
     '';
 
-    nativeBuildInputs = [pkg-config wrapGAppsHook copyDesktopItems];
+    nativeBuildInputs = [pkg-config wrapGAppsHook3 copyDesktopItems];
     buildInputs = [dbus openssl freetype libsoup gtk3 webkitgtk];
 
     # Disable checkPhase, since the project doesn't contain tests
diff --git a/pkgs/by-name/su/surrealdb/package.nix b/pkgs/by-name/su/surrealdb/package.nix
index 79c8596844498..625d9f802d540 100644
--- a/pkgs/by-name/su/surrealdb/package.nix
+++ b/pkgs/by-name/su/surrealdb/package.nix
@@ -16,16 +16,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "surrealdb";
-  version = "1.3.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "surrealdb";
     repo = "surrealdb";
     rev = "v${version}";
-    hash = "sha256-dnfgU7nTX3vvqN9Mox6USRfpFdEI/dAOKIVZ2Jd4t9o=";
+    hash = "sha256-LC/T+TkHdZ0uWaVQpR2Q9l0fShPL871rOfxxsXyJnvw=";
   };
 
-  cargoHash = "sha256-B+x+xEcwHqoYMolAuMQzSiO/QA1FiBGO3eis9kgN1S4=";
+  cargoHash = "sha256-1/l++iXiPCIwAVE8VQCSS++/9i3Kh1RNq3WnUjRy2fU=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
@@ -38,6 +38,8 @@ rustPlatform.buildRustPackage rec {
   ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
   ROCKSDB_LIB_DIR = "${rocksdb}/lib";
 
+  RUSTFLAGS = "--cfg surrealdb_unstable";
+
   nativeBuildInputs = [
     pkg-config
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/sw/sway-easyfocus/package.nix b/pkgs/by-name/sw/sway-easyfocus/package.nix
index 022770a223441..43a9f9ab1340c 100644
--- a/pkgs/by-name/sw/sway-easyfocus/package.nix
+++ b/pkgs/by-name/sw/sway-easyfocus/package.nix
@@ -2,7 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , atk
 , cairo
 , gdk-pixbuf
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/sw/sway/package.nix b/pkgs/by-name/sw/sway/package.nix
index 2ae6d3ed01546..5506447f692ec 100644
--- a/pkgs/by-name/sw/sway/package.nix
+++ b/pkgs/by-name/sw/sway/package.nix
@@ -2,7 +2,7 @@
 , sway-unwrapped
 , makeWrapper, symlinkJoin, writeShellScriptBin
 , withBaseWrapper ? true, extraSessionCommands ? "", dbus
-, withGtkWrapper ? false, wrapGAppsHook, gdk-pixbuf, glib, gtk3
+, withGtkWrapper ? false, wrapGAppsHook3, gdk-pixbuf, glib, gtk3
 , extraOptions ? [] # E.g.: [ "--verbose" ]
 # Used by the NixOS module:
 , isNixOS ? false
@@ -44,7 +44,7 @@ in symlinkJoin rec {
 
   strictDeps = false;
   nativeBuildInputs = [ makeWrapper ]
-    ++ (optional withGtkWrapper wrapGAppsHook);
+    ++ (optional withGtkWrapper wrapGAppsHook3);
 
   buildInputs = optionals withGtkWrapper [ gdk-pixbuf glib gtk3 ];
 
diff --git a/pkgs/by-name/sw/swayosd/package.nix b/pkgs/by-name/sw/swayosd/package.nix
index d3238053c0196..c6e9dc2a809f3 100644
--- a/pkgs/by-name/sw/swayosd/package.nix
+++ b/pkgs/by-name/sw/swayosd/package.nix
@@ -2,7 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , brightnessctl
 , cargo
 , coreutils
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     pkg-config
     meson
     rustc
diff --git a/pkgs/by-name/sw/switcheroo/package.nix b/pkgs/by-name/sw/switcheroo/package.nix
index 9d2327f4095a5..aa132910b1c26 100644
--- a/pkgs/by-name/sw/switcheroo/package.nix
+++ b/pkgs/by-name/sw/switcheroo/package.nix
@@ -18,19 +18,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "switcheroo";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitLab {
     owner = "adhami3310";
     repo = "Switcheroo";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hopN2ynksaYoNYjXrh7plmhfmGYyqqK75GOtbsE95ZY=";
+    hash = "sha256-AwecOA8HWGimhQyCEG3Z3hhwa9RVWssykUXsdvqqs9U=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     src = finalAttrs.src;
     name = "switcheroo-${finalAttrs.version}";
-    hash = "sha256-wN6MsiOgYFgzDzdGei0ptRbG+h+xMJiFfzCcg6Xtryw=";
+    hash = "sha256-fpI4ue30DhkeWAolyeots+LkaRyaIPhYmIqRmx08i2s=";
   };
 
   nativeBuildInputs = [
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     changelog = "https://gitlab.com/adhami3310/Switcheroo/-/releases/v${finalAttrs.version}";
     description = "An app for converting images between different formats";
-    homepage = "https://gitlab.com/adhami3310/Switcheroo";
+    homepage = "https://apps.gnome.org/Converter/";
     license = licenses.gpl3Plus;
     mainProgram = "switcheroo";
     maintainers = with maintainers; [ michaelgrahamevans ];
diff --git a/pkgs/by-name/sy/syslogng/package.nix b/pkgs/by-name/sy/syslogng/package.nix
index 8b261dcb060f9..c8f45f834a671 100644
--- a/pkgs/by-name/sy/syslogng/package.nix
+++ b/pkgs/by-name/sy/syslogng/package.nix
@@ -59,14 +59,14 @@ let
   ];
   py = python3.withPackages python-deps;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "syslog-ng";
   version = "4.7.1";
 
   src = fetchFromGitHub {
     owner = "syslog-ng";
     repo = "syslog-ng";
-    rev = "syslog-ng-${version}";
+    rev = "syslog-ng-${finalAttrs.version}";
     hash = "sha256-runFMUxQv7B023I38QfGqn89ZbzA5vMXHOOkYwMxArI=";
     fetchSubmodules = true;
   };
@@ -117,11 +117,11 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.syslog-ng.com";
     description = "Next-generation syslogd with advanced networking and filtering capabilities";
-    license = with licenses; [ gpl2Plus lgpl21Plus ];
-    maintainers = with maintainers; [ vifino ];
-    platforms = platforms.linux;
+    license = with lib.licenses; [ gpl2Plus lgpl21Plus ];
+    maintainers = with lib.maintainers; [ vifino ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/te/textsnatcher/package.nix b/pkgs/by-name/te/textsnatcher/package.nix
index 21b75c31a37f0..670c87faeba53 100644
--- a/pkgs/by-name/te/textsnatcher/package.nix
+++ b/pkgs/by-name/te/textsnatcher/package.nix
@@ -4,7 +4,7 @@
 , meson
 , ninja
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , pantheon
 , libhandy
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     vala
     pkg-config
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/th/themix-gui/package.nix b/pkgs/by-name/th/themix-gui/package.nix
index c73724a0ca272..8495234c5ca5e 100644
--- a/pkgs/by-name/th/themix-gui/package.nix
+++ b/pkgs/by-name/th/themix-gui/package.nix
@@ -8,7 +8,7 @@
 , gtk3
 , python3
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
     gobject-introspection
     py
     sassc
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ti/tilix/package.nix b/pkgs/by-name/ti/tilix/package.nix
index 2e0bdad0be8c3..4394a2a52f582 100644
--- a/pkgs/by-name/ti/tilix/package.nix
+++ b/pkgs/by-name/ti/tilix/package.nix
@@ -13,7 +13,7 @@
 , gettext
 , gtkd
 , libsecret
-, wrapGAppsHook
+, wrapGAppsHook3
 , libunwind
 , appstream
 , nixosTests
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
     appstream
   ];
 
diff --git a/pkgs/by-name/tr/treedome/package.nix b/pkgs/by-name/tr/treedome/package.nix
index 86a554b2f8aeb..07efeebccb3f6 100644
--- a/pkgs/by-name/tr/treedome/package.nix
+++ b/pkgs/by-name/tr/treedome/package.nix
@@ -13,7 +13,7 @@
 , pkg-config
 , rustPlatform
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , sqlite
 }:
 
@@ -98,7 +98,7 @@ rustPlatform.buildRustPackage {
     cmake
     pkg-config
     cargo-tauri
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/uh/uhttpmock_1_0/package.nix b/pkgs/by-name/uh/uhttpmock_1_0/package.nix
new file mode 100644
index 0000000000000..1cc16f96eb5ee
--- /dev/null
+++ b/pkgs/by-name/uh/uhttpmock_1_0/package.nix
@@ -0,0 +1,56 @@
+{ stdenv
+, lib
+, fetchFromGitLab
+, meson
+, mesonEmulatorHook
+, ninja
+, pkg-config
+, gobject-introspection
+, vala
+, gtk-doc
+, docbook-xsl-nons
+, glib
+, libsoup_3
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "uhttpmock";
+  version = "0.10.0";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "pwithnall";
+    repo = "uhttpmock";
+    rev = finalAttrs.version;
+    hash = "sha256-d3IVlPOLOLzlUDuGOLll8pOK5FMsXI/d2wbwPZ6WI34=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gobject-introspection
+    vala
+    gtk-doc
+    docbook-xsl-nons
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
+  ];
+
+  propagatedBuildInputs = [
+    glib
+    libsoup_3
+  ];
+
+  meta = with lib; {
+    description = "Project for mocking web service APIs which use HTTP or HTTPS";
+    homepage = "https://gitlab.freedesktop.org/pwithnall/uhttpmock/";
+    license = licenses.lgpl21Plus;
+    maintainers = teams.gnome.members;
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/un/unciv/package.nix b/pkgs/by-name/un/unciv/package.nix
index d548184ab7509..d55a5d06ec9a0 100644
--- a/pkgs/by-name/un/unciv/package.nix
+++ b/pkgs/by-name/un/unciv/package.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.11.8";
+  version = "4.11.9";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-iNcz6kfzlr1f1kC6xo1htyT46JjgEMeo21JIfOBxeQw=";
+    hash = "sha256-fAosJmEAQGA1QAyabcmqwuDeqUM+t3mNIfSOrAwc5hg=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/un/unison/package.nix b/pkgs/by-name/un/unison/package.nix
index 2d68ba5799b47..9aeac3fa2d3e0 100644
--- a/pkgs/by-name/un/unison/package.nix
+++ b/pkgs/by-name/un/unison/package.nix
@@ -4,7 +4,7 @@
 , ocamlPackages
 , copyDesktopItems
 , makeDesktopItem
-, wrapGAppsHook
+, wrapGAppsHook3
 , gsettings-desktop-schemas
 , enableX11 ? !stdenv.isDarwin
 }:
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   nativeBuildInputs = [ ocamlPackages.ocaml ocamlPackages.findlib ]
-    ++ lib.optionals enableX11 [ copyDesktopItems wrapGAppsHook ];
+    ++ lib.optionals enableX11 [ copyDesktopItems wrapGAppsHook3 ];
   buildInputs = lib.optionals enableX11 [ gsettings-desktop-schemas ocamlPackages.lablgtk3 ];
 
   makeFlags = [ "PREFIX=$(out)" ]
diff --git a/pkgs/by-name/va/vaults/package.nix b/pkgs/by-name/va/vaults/package.nix
index e44c3b73efecf..6e0f1078819bc 100644
--- a/pkgs/by-name/va/vaults/package.nix
+++ b/pkgs/by-name/va/vaults/package.nix
@@ -10,7 +10,7 @@
 , rustPlatform
 , rustc
 , cargo
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gtk4
 , libadwaita
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     cargo
     rustc
     rustPlatform.cargoSetupHook
diff --git a/pkgs/by-name/vl/vlc/package.nix b/pkgs/by-name/vl/vlc/package.nix
index 9b89cca9a192b..86406bdba034c 100644
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -77,7 +77,7 @@
 , unzip
 , wayland
 , wayland-protocols
-, wrapGAppsHook
+, wrapGAppsHook3
 , xcbutilkeysyms
 , zlib
 
@@ -112,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     removeReferencesTo
     unzip
-    wrapGAppsHook
+    wrapGAppsHook3
   ]
   ++ optionals chromecastSupport [ protobuf ]
   ++ optionals withQt5 [ libsForQt5.wrapQtAppsHook ]
diff --git a/pkgs/by-name/wa/waybar/package.nix b/pkgs/by-name/wa/waybar/package.nix
index a8bc66b73e12f..1b6039a38f4be 100644
--- a/pkgs/by-name/wa/waybar/package.nix
+++ b/pkgs/by-name/wa/waybar/package.nix
@@ -42,7 +42,7 @@
 , wayland
 , wayland-scanner
 , wireplumber
-, wrapGAppsHook
+, wrapGAppsHook3
 
 , cavaSupport ? true
 , enableManpages ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     wayland-scanner
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optional withMediaPlayer gobject-introspection
     ++ lib.optional enableManpages scdoc;
 
diff --git a/pkgs/by-name/wa/waycheck/package.nix b/pkgs/by-name/wa/waycheck/package.nix
index 953ed3c8443bd..73eb3146664ee 100644
--- a/pkgs/by-name/wa/waycheck/package.nix
+++ b/pkgs/by-name/wa/waycheck/package.nix
@@ -7,7 +7,7 @@
 , qt6
 , wayland
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     qt6.wrapQtAppsHook
   ];
 
diff --git a/pkgs/by-name/wh/whistle/package.nix b/pkgs/by-name/wh/whistle/package.nix
index 8f7e7386d6811..1196a9d6591ec 100644
--- a/pkgs/by-name/wh/whistle/package.nix
+++ b/pkgs/by-name/wh/whistle/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "whistle";
-  version = "2.9.68";
+  version = "2.9.70";
 
   src = fetchFromGitHub {
     owner = "avwo";
     repo = "whistle";
     rev = "v${version}";
-    hash = "sha256-8UWYh2pm0UX6tb/7DT5ZaHvmHdxk6hwE7fFHKY6pGOs=";
+    hash = "sha256-KtZZa/t/WqMSjEAET8wutIhu7sp55/CtaBnNDThkEUI=";
   };
 
-  npmDepsHash = "sha256-/WnrhtVr972Na8rpZ7dzH3998WDPsS5X6jCPkCj3hyc=";
+  npmDepsHash = "sha256-0XDfi23BktYDH58sDjaBtt6x2ZZDFqtBBL9agnHwgeo=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/xc/xclicker/package.nix b/pkgs/by-name/xc/xclicker/package.nix
index 5c2e178464f5b..e61c86c2b320b 100644
--- a/pkgs/by-name/xc/xclicker/package.nix
+++ b/pkgs/by-name/xc/xclicker/package.nix
@@ -4,7 +4,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , libXtst
 }:
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/xe/xemu/package.nix b/pkgs/by-name/xe/xemu/package.nix
index 7fc390049cb9e..e8e4a66dddcc3 100644
--- a/pkgs/by-name/xe/xemu/package.nix
+++ b/pkgs/by-name/xe/xemu/package.nix
@@ -23,7 +23,7 @@
 , stdenv
 , vte
 , which
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
     perl
     pkg-config
     which
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ (with python3Packages; [
     python
     pyyaml
diff --git a/pkgs/by-name/ye/yesplaymusic/package.nix b/pkgs/by-name/ye/yesplaymusic/package.nix
index c5292401fa833..576547669f8cd 100644
--- a/pkgs/by-name/ye/yesplaymusic/package.nix
+++ b/pkgs/by-name/ye/yesplaymusic/package.nix
@@ -4,7 +4,7 @@
 , _7zz
 , dpkg
 , autoPatchelfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeWrapper
 , alsa-lib
 , at-spi2-atk
@@ -98,7 +98,7 @@ else stdenv.mkDerivation {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    wrapGAppsHook
+    wrapGAppsHook3
     makeWrapper
   ];
 
diff --git a/pkgs/by-name/ze/zed-editor/Cargo.lock b/pkgs/by-name/ze/zed-editor/Cargo.lock
index 1ab0e76ed9d65..b45efeb690f55 100644
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@@ -372,6 +372,51 @@ dependencies = [
 ]
 
 [[package]]
+name = "assistant2"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "assets",
+ "assistant_tooling",
+ "client",
+ "editor",
+ "env_logger",
+ "feature_flags",
+ "futures 0.3.28",
+ "gpui",
+ "language",
+ "languages",
+ "log",
+ "nanoid",
+ "node_runtime",
+ "open_ai",
+ "project",
+ "rand 0.8.5",
+ "release_channel",
+ "rich_text",
+ "schemars",
+ "semantic_index",
+ "serde",
+ "serde_json",
+ "settings",
+ "theme",
+ "ui",
+ "util",
+ "workspace",
+]
+
+[[package]]
+name = "assistant_tooling"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "gpui",
+ "schemars",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
 name = "async-broadcast"
 version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2047,6 +2092,7 @@ dependencies = [
  "core-services",
  "ipc-channel",
  "plist",
+ "release_channel",
  "serde",
  "util",
 ]
@@ -2253,6 +2299,7 @@ dependencies = [
  "prost",
  "rand 0.8.5",
  "release_channel",
+ "remote_projects",
  "reqwest",
  "rpc",
  "rustc-demangle",
@@ -2298,7 +2345,6 @@ dependencies = [
  "editor",
  "emojis",
  "extensions_ui",
- "feature_flags",
  "futures 0.3.28",
  "fuzzy",
  "gpui",
@@ -3799,6 +3845,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "filedescriptor"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7199d965852c3bac31f779ef99cbb4537f80e952e2d6aa0ffeb30cce00f4f46e"
+dependencies = [
+ "libc",
+ "thiserror",
+ "winapi",
+]
+
+[[package]]
 name = "filetime"
 version = "0.2.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4002,15 +4059,12 @@ dependencies = [
  "gpui",
  "lazy_static",
  "libc",
- "log",
  "notify",
  "parking_lot",
  "rope",
  "serde",
- "serde_derive",
  "serde_json",
  "smol",
- "sum_tree",
  "tempfile",
  "text",
  "time",
@@ -4318,7 +4372,10 @@ dependencies = [
  "git2",
  "lazy_static",
  "log",
+ "parking_lot",
  "pretty_assertions",
+ "regex",
+ "rope",
  "serde",
  "serde_json",
  "smol",
@@ -4327,6 +4384,8 @@ dependencies = [
  "time",
  "unindent",
  "url",
+ "util",
+ "windows 0.53.0",
 ]
 
 [[package]]
@@ -4479,6 +4538,7 @@ dependencies = [
  "derive_more",
  "env_logger",
  "etagere",
+ "filedescriptor",
  "flume",
  "font-kit",
  "foreign-types 0.5.0",
@@ -5395,6 +5455,7 @@ dependencies = [
  "globset",
  "gpui",
  "indoc",
+ "itertools 0.11.0",
  "lazy_static",
  "log",
  "lsp",
@@ -6049,14 +6110,18 @@ dependencies = [
  "anyhow",
  "clock",
  "collections",
+ "ctor",
+ "env_logger",
  "futures 0.3.28",
  "git",
  "gpui",
+ "itertools 0.11.0",
  "language",
  "log",
  "parking_lot",
  "rand 0.8.5",
  "settings",
+ "smallvec",
  "sum_tree",
  "text",
  "theme",
@@ -7374,6 +7439,7 @@ dependencies = [
  "db",
  "editor",
  "file_icons",
+ "git",
  "gpui",
  "language",
  "menu",
@@ -7708,7 +7774,9 @@ dependencies = [
 name = "recent_projects"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "editor",
+ "feature_flags",
  "fuzzy",
  "gpui",
  "language",
@@ -7716,10 +7784,15 @@ dependencies = [
  "ordered-float 2.10.0",
  "picker",
  "project",
+ "remote_projects",
+ "rpc",
  "serde",
  "serde_json",
+ "settings",
  "smol",
+ "theme",
  "ui",
+ "ui_text_field",
  "util",
  "workspace",
 ]
@@ -7847,6 +7920,18 @@ dependencies = [
 ]
 
 [[package]]
+name = "remote_projects"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "client",
+ "gpui",
+ "rpc",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
 name = "rend"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -9411,6 +9496,7 @@ dependencies = [
  "log",
  "menu",
  "picker",
+ "project",
  "rust-embed",
  "settings",
  "simplelog",
@@ -9744,7 +9830,6 @@ dependencies = [
  "serde_json",
  "settings",
  "task",
- "terminal",
  "tree-sitter-rust",
  "tree-sitter-typescript",
  "ui",
@@ -9842,6 +9927,7 @@ dependencies = [
  "shellexpand",
  "smol",
  "task",
+ "tasks_ui",
  "terminal",
  "theme",
  "ui",
@@ -10986,8 +11072,8 @@ name = "vcs_menu"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "fs",
  "fuzzy",
+ "git",
  "gpui",
  "picker",
  "ui",
@@ -12282,6 +12368,7 @@ dependencies = [
  "parking_lot",
  "postage",
  "project",
+ "remote_projects",
  "schemars",
  "serde",
  "serde_json",
@@ -12520,12 +12607,13 @@ dependencies = [
 
 [[package]]
 name = "zed"
-version = "0.132.4"
+version = "0.133.5"
 dependencies = [
  "activity_indicator",
  "anyhow",
  "assets",
  "assistant",
+ "assistant2",
  "audio",
  "auto_update",
  "backtrace",
@@ -12580,6 +12668,7 @@ dependencies = [
  "quick_action_bar",
  "recent_projects",
  "release_channel",
+ "remote_projects",
  "rope",
  "search",
  "serde",
@@ -12641,6 +12730,13 @@ dependencies = [
 ]
 
 [[package]]
+name = "zed_deno"
+version = "0.0.1"
+dependencies = [
+ "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
 name = "zed_elm"
 version = "0.0.1"
 dependencies = [
@@ -12698,6 +12794,13 @@ dependencies = [
 ]
 
 [[package]]
+name = "zed_glsl"
+version = "0.1.0"
+dependencies = [
+ "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
 name = "zed_haskell"
 version = "0.1.0"
 dependencies = [
@@ -12755,7 +12858,7 @@ dependencies = [
 
 [[package]]
 name = "zed_terraform"
-version = "0.0.2"
+version = "0.0.3"
 dependencies = [
  "zed_extension_api 0.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index dc49348a20b9e..9c79b602b4699 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -27,13 +27,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zed";
-  version = "0.132.4";
+  version = "0.133.5";
 
   src = fetchFromGitHub {
     owner = "zed-industries";
     repo = "zed";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4jnPqfLmxp3YpUAIpc/CZ5pv040uDggjeNzJJ2v021E=";
+    hash = "sha256-52vWOlaxVcjlKLrBW+anh6i7kfBCD5cTHWcjLFiY9BA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/data/documentation/gnome-user-docs/default.nix b/pkgs/data/documentation/gnome-user-docs/default.nix
index 30382918c6d02..873346c777384 100644
--- a/pkgs/data/documentation/gnome-user-docs/default.nix
+++ b/pkgs/data/documentation/gnome-user-docs/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-user-docs";
-  version = "45.5";
+  version = "46.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-user-docs/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-dBZ/z0KgTZ5dPMEw0nvCA9h7aFzmBqhGdN8k4f9xnlQ=";
+    hash = "sha256-qXKTy+63l+tPTRadcTu2WDvRLDeR4UAoPkNW0v4YCto=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/fonts/cascadia-code/default.nix b/pkgs/data/fonts/cascadia-code/default.nix
index d6d1bbd960388..e4f92ebe71b32 100644
--- a/pkgs/data/fonts/cascadia-code/default.nix
+++ b/pkgs/data/fonts/cascadia-code/default.nix
@@ -2,12 +2,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cascadia-code";
-  version = "2111.01";
+  version = "2404.23";
 
   src = fetchzip {
     url = "https://github.com/microsoft/cascadia-code/releases/download/v${version}/CascadiaCode-${version}.zip";
     stripRoot = false;
-    hash = "sha256-v9Vm5X80wEvorMhIlRw3MnyuSOdBpTl9ibBPpmm1vig=";
+    hash = "sha256-Z2AzBeNiM6mc1OHCJRv0rUvH8WRygyQGSOvwbAISYHE=";
   };
 
   installPhase = ''
@@ -24,7 +24,7 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/microsoft/cascadia-code";
     changelog = "https://github.com/microsoft/cascadia-code/raw/v${version}/FONTLOG.txt";
     license = licenses.ofl;
-    maintainers = [ ];
+    maintainers = with maintainers; [ ryanccn ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/data/themes/matcha/default.nix b/pkgs/data/themes/matcha/default.nix
index d19ed938bf551..94408f67227a6 100644
--- a/pkgs/data/themes/matcha/default.nix
+++ b/pkgs/data/themes/matcha/default.nix
@@ -19,13 +19,13 @@ lib.checkListOfEnum "${pname}: theme variants" [ "aliz" "azul" "sea" "pueril" "a
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2023-10-30";
+  version = "2024-05-01";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "+sWYUCFp5J+fhPHxicwtsHCQkFTpKwjj9H3GAXqNaYo=";
+    sha256 = "trQwRZ/JKIS8TcRIg0eL5GmB/yymDwqqNued0ddRuqU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/themes/whitesur/default.nix b/pkgs/data/themes/whitesur/default.nix
index 8c1651fff231c..969641b487dcb 100644
--- a/pkgs/data/themes/whitesur/default.nix
+++ b/pkgs/data/themes/whitesur/default.nix
@@ -32,7 +32,7 @@ lib.checkListOfEnum "${pname}: alt variants" [ "normal" "alt" "all" ] altVariant
 lib.checkListOfEnum "${pname}: color variants" [ "Light" "Dark" ] colorVariants
 lib.checkListOfEnum "${pname}: opacity variants" [ "normal" "solid" ] opacityVariants
 lib.checkListOfEnum "${pname}: theme variants" [ "default" "blue" "purple" "pink" "red" "orange" "yellow" "green" "grey" "all" ] themeVariants
-lib.checkListOfEnum "${pname}: Activities icon variants" [ "standard" "simple" "gnome" "ubuntu" "tux" "arch" "manjaro" "fedora" "debian" "void" "opensuse" "popos" "mxlinux" "zorin" ] (single iconVariant)
+lib.checkListOfEnum "${pname}: Activities icon variants" [ "standard" "simple" "gnome" "ubuntu" "tux" "arch" "manjaro" "fedora" "debian" "void" "opensuse" "popos" "mxlinux" "zorin" "budgie" "gentoo" ] (single iconVariant)
 lib.checkListOfEnum "${pname}: nautilus style" [ "stable" "normal" "mojave" "glassy" ] (single nautilusStyle)
 lib.checkListOfEnum "${pname}: nautilus sidebar minimum width" [ "default" "180" "220" "240" "260" "280" ] (single nautilusSize)
 lib.checkListOfEnum "${pname}: panel opacity" [ "default" "30" "45" "60" "75" ] (single panelOpacity)
@@ -40,13 +40,13 @@ lib.checkListOfEnum "${pname}: panel size" [ "default" "smaller" "bigger" ] (sin
 
 stdenv.mkDerivation rec {
   pname = "whitesur-gtk-theme";
-  version = "2024-02-26";
+  version = "2024-05-01";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "sha256-9HYsORTd5n0jUYmwiObPZ90mOGhR2j+tzs6Y1NNnrn4=";
+    sha256 = "sha256-NgmFQtgVJvVXJjZUXt/BIx1hdzjHfVmmwXUCDZZD7+g=";
   };
 
   nativeBuildInputs = [
@@ -103,11 +103,11 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     description = "MacOS BigSur like Gtk+ theme based on Elegant Design";
     homepage = "https://github.com/vinceliuice/WhiteSur-gtk-theme";
-    license = licenses.mit;
-    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ romildo ];
   };
 }
diff --git a/pkgs/desktops/budgie/budgie-control-center/default.nix b/pkgs/desktops/budgie/budgie-control-center/default.nix
index aea55e66256c1..25b8b66f6082a 100644
--- a/pkgs/desktops/budgie/budgie-control-center/default.nix
+++ b/pkgs/desktops/budgie/budgie-control-center/default.nix
@@ -52,7 +52,7 @@
 , udisks2
 , upower
 , webp-pixbuf-loader
-, wrapGAppsHook
+, wrapGAppsHook3
 , enableSshSocket ? false
 }:
 
@@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     shared-mime-info
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/budgie/budgie-desktop-view/default.nix b/pkgs/desktops/budgie/budgie-desktop-view/default.nix
index a1869cfa918cc..b7be5ff42c16d 100644
--- a/pkgs/desktops/budgie/budgie-desktop-view/default.nix
+++ b/pkgs/desktops/budgie/budgie-desktop-view/default.nix
@@ -9,7 +9,7 @@
 , ninja
 , pkg-config
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/budgie/budgie-desktop/default.nix b/pkgs/desktops/budgie/budgie-desktop/default.nix
index 50068621be34a..0a15124121796 100644
--- a/pkgs/desktops/budgie/budgie-desktop/default.nix
+++ b/pkgs/desktops/budgie/budgie-desktop/default.nix
@@ -33,7 +33,7 @@
 , upower
 , vala
 , xfce
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/budgie/budgie-desktop/wrapper.nix b/pkgs/desktops/budgie/budgie-desktop/wrapper.nix
index 99b33b68cb0ec..d25643e6603f6 100644
--- a/pkgs/desktops/budgie/budgie-desktop/wrapper.nix
+++ b/pkgs/desktops/budgie/budgie-desktop/wrapper.nix
@@ -2,7 +2,7 @@
 , stdenv
 , glib
 , xorg
-, wrapGAppsHook
+, wrapGAppsHook3
 , budgie-desktop
 , plugins ? [ ]
 }:
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     glib
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = lib.forEach plugins (plugin: plugin.buildInputs) ++ plugins;
diff --git a/pkgs/desktops/budgie/budgie-gsettings-overrides/default.nix b/pkgs/desktops/budgie/budgie-gsettings-overrides/default.nix
index d853a584a7a40..a9f4274508836 100644
--- a/pkgs/desktops/budgie/budgie-gsettings-overrides/default.nix
+++ b/pkgs/desktops/budgie/budgie-gsettings-overrides/default.nix
@@ -31,9 +31,6 @@ let
     document-font-name="Noto Sans 10"
     monospace-font-name="Hack 10"
 
-    [org.gnome.desktop.peripherals.touchpad:Budgie]
-    tap-to-click=true
-
     [org.gnome.desktop.wm.preferences:Budgie]
     titlebar-font="Noto Sans Bold 10"
 
diff --git a/pkgs/desktops/budgie/budgie-screensaver/default.nix b/pkgs/desktops/budgie/budgie-screensaver/default.nix
index 68c253a2a1c67..d0c4964a04002 100644
--- a/pkgs/desktops/budgie/budgie-screensaver/default.nix
+++ b/pkgs/desktops/budgie/budgie-screensaver/default.nix
@@ -13,7 +13,7 @@
 , ninja
 , pkg-config
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 , xorg
 }:
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/budgie/magpie/default.nix b/pkgs/desktops/budgie/magpie/default.nix
index f900e82a9ce10..5f42b1986ce69 100644
--- a/pkgs/desktops/budgie/magpie/default.nix
+++ b/pkgs/desktops/budgie/magpie/default.nix
@@ -35,7 +35,7 @@
 , meson
 , xorgserver
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gi-docgen
 , sysprof
 , libsysprof-capture
@@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
     xvfb-run
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
     gi-docgen
     xorgserver
   ];
diff --git a/pkgs/desktops/cinnamon/bulky/default.nix b/pkgs/desktops/cinnamon/bulky/default.nix
index 21cd43601924c..c3927ece25485 100644
--- a/pkgs/desktops/cinnamon/bulky/default.nix
+++ b/pkgs/desktops/cinnamon/bulky/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , python3
 , gobject-introspection
 , gsettings-desktop-schemas
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gsettings-desktop-schemas
     gettext
     gobject-introspection
diff --git a/pkgs/desktops/cinnamon/cinnamon-common/default.nix b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
index 957739980746e..5ee3e5e273834 100644
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@@ -9,6 +9,7 @@
 , cjs
 , evolution-data-server
 , fetchFromGitHub
+, fetchpatch
 , gdk-pixbuf
 , gettext
 , libgnomekbd
@@ -29,7 +30,7 @@
 , polkit
 , lib
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 , libxml2
 , gtk-doc
 , gnome
@@ -83,6 +84,13 @@ stdenv.mkDerivation rec {
   patches = [
     ./use-sane-install-dir.patch
     ./libdir.patch
+
+    # Switch to GNOME Online Accounts GTK
+    (fetchpatch {
+      url = "https://github.com/linuxmint/cinnamon/commit/d22f889c376734f0ca5d904885c2772e790fbadc.patch";
+      includes = [ "files/usr/share/cinnamon/cinnamon-settings/cinnamon-settings.py" ];
+      hash = "sha256-xutJqxtzk3/BUQGZY/tnBkRyAfZZY7AckaGC6b7Sfn8=";
+    })
   ];
 
   buildInputs = [
@@ -132,7 +140,7 @@ stdenv.mkDerivation rec {
     gobject-introspection
     meson
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
     intltool
     gtk-doc
     perl
@@ -140,13 +148,6 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  # Use locales from cinnamon-translations.
-  # FIXME: Upstream does not respect localedir option from Meson currently.
-  # https://github.com/linuxmint/cinnamon/pull/11244#issuecomment-1305855783
-  postInstall = ''
-    ln -s ${cinnamon-translations}/share/locale $out/share/locale
-  '';
-
   postPatch = ''
     find . -type f -exec sed -i \
       -e s,/usr/share/cinnamon,$out/share/cinnamon,g \
@@ -173,6 +174,18 @@ stdenv.mkDerivation rec {
     patchShebangs src/data-to-c.pl
   '';
 
+  postInstall = ''
+    # Use locales from cinnamon-translations.
+    ln -s ${cinnamon-translations}/share/locale $out/share/locale
+
+    # Do not install online accounts module, with a -Donlineaccounts=false c-c-c
+    # this just shows an empty page.
+    rm -f $out/share/cinnamon/cinnamon-settings/modules/cs_online_accounts.py
+
+    # g-o-a-gtk already provides its own desktop item.
+    rm -f $out/share/applications/cinnamon-settings-online-accounts.desktop
+  '';
+
   preFixup = ''
     # https://github.com/NixOS/nixpkgs/issues/101881
     gappsWrapperArgs+=(
diff --git a/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix b/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
index e0aee4bde6403..c09bf55a3e413 100644
--- a/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
@@ -9,7 +9,6 @@
 , gtk3
 , libnotify
 , libxml2
-, gnome-online-accounts
 , colord
 , polkit
 , libxkbfile
@@ -20,7 +19,7 @@
 , libgudev
 , libwacom
 , gnome
-, wrapGAppsHook
+, wrapGAppsHook3
 , tzdata
 , glibc
 , libnma
@@ -59,7 +58,6 @@ stdenv.mkDerivation rec {
     colord
     libgudev
     libwacom
-    gnome-online-accounts
     tzdata
     networkmanager
     libnma
@@ -85,13 +83,15 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     # use locales from cinnamon-translations
     "--localedir=${cinnamon-translations}/share/locale"
+    # https://github.com/linuxmint/cinnamon-control-center/issues/326
+    "-Donlineaccounts=false"
   ];
 
   nativeBuildInputs = [
     pkg-config
     meson
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
     gettext
     python3
   ];
diff --git a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
index 0f53fbbb656a6..830abafa28538 100644
--- a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
@@ -13,7 +13,7 @@
 , systemd
 , xkeyboard_config
 , xorg
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 }:
 
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
     intltool
     pkg-config
     gobject-introspection
diff --git a/pkgs/desktops/cinnamon/cinnamon-menus/default.nix b/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
index 754a5c43a182e..693495591178a 100644
--- a/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , lib
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     meson
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
     pkg-config
     gobject-introspection
   ];
diff --git a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
index 98d1a4f39c166..6ed8c0247ba25 100644
--- a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
@@ -15,7 +15,7 @@
 , libgnomekbd
 , gnome
 , libtool
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , python3
 , pam
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gettext
     intltool
     dbus # for meson.build
diff --git a/pkgs/desktops/cinnamon/cinnamon-session/default.nix b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
index 66044ccefc4fc..bb8a4f192cf93 100644
--- a/pkgs/desktops/cinnamon/cinnamon-session/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
@@ -16,7 +16,7 @@
 , lib
 , stdenv
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 , xapp
 , xorg
 , libexecinfo
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     meson
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
     libexecinfo
     python3
     pkg-config
diff --git a/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix b/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
index 65828b3da6040..1c948d6224303 100644
--- a/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
@@ -10,7 +10,7 @@
 , libgnomekbd
 , libnotify
 , libxklavier
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , lib
 , stdenv
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     meson
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
     pkg-config
   ];
 
diff --git a/pkgs/desktops/cinnamon/muffin/default.nix b/pkgs/desktops/cinnamon/muffin/default.nix
index f00a92ddc6d48..fa054f1eaeec7 100644
--- a/pkgs/desktops/cinnamon/muffin/default.nix
+++ b/pkgs/desktops/cinnamon/muffin/default.nix
@@ -33,7 +33,7 @@
 , udev
 , wayland
 , wayland-protocols
-, wrapGAppsHook
+, wrapGAppsHook3
 , xorgserver
 , xwayland
 }:
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
     xorgserver # for cvt command
     gobject-introspection
   ];
diff --git a/pkgs/desktops/cinnamon/nemo/default.nix b/pkgs/desktops/cinnamon/nemo/default.nix
index fe61e9701d9c0..482c9b6b4193a 100644
--- a/pkgs/desktops/cinnamon/nemo/default.nix
+++ b/pkgs/desktops/cinnamon/nemo/default.nix
@@ -7,7 +7,7 @@
 , pkg-config
 , lib
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 , libxml2
 , gtk3
 , gvfs
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     meson
     pkg-config
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
     intltool
     shared-mime-info
     gobject-introspection
diff --git a/pkgs/desktops/cinnamon/pix/default.nix b/pkgs/desktops/cinnamon/pix/default.nix
index 1264ca82fc8bd..45b8da1760ba8 100644
--- a/pkgs/desktops/cinnamon/pix/default.nix
+++ b/pkgs/desktops/cinnamon/pix/default.nix
@@ -20,7 +20,7 @@
 , bison
 , flex
 , clutter-gtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , shared-mime-info
 , python3
 , desktop-file-utils
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/cinnamon/warpinator/default.nix b/pkgs/desktops/cinnamon/warpinator/default.nix
index 69a5aadb6ca9c..6f9a7e5a24d38 100644
--- a/pkgs/desktops/cinnamon/warpinator/default.nix
+++ b/pkgs/desktops/cinnamon/warpinator/default.nix
@@ -8,7 +8,7 @@
 , gtk3
 , gdk-pixbuf
 , xapp
-, wrapGAppsHook
+, wrapGAppsHook3
 , gettext
 , polkit
 , glib
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
     gettext
     polkit # for its gettext
   ];
diff --git a/pkgs/desktops/cinnamon/xapp/default.nix b/pkgs/desktops/cinnamon/xapp/default.nix
index 5c691cd40905a..14b706fbd4c37 100644
--- a/pkgs/desktops/cinnamon/xapp/default.nix
+++ b/pkgs/desktops/cinnamon/xapp/default.nix
@@ -13,7 +13,7 @@
 , lib
 , stdenv
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , inxi
 , mate
 , dbus
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/desktops/cinnamon/xreader/default.nix b/pkgs/desktops/cinnamon/xreader/default.nix
index c64f57ec3c8ee..05a4aedfb6ed6 100644
--- a/pkgs/desktops/cinnamon/xreader/default.nix
+++ b/pkgs/desktops/cinnamon/xreader/default.nix
@@ -6,7 +6,7 @@
 , intltool
 , shared-mime-info
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , libarchive
 , libxml2
 , xapp
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     shared-mime-info
-    wrapGAppsHook
+    wrapGAppsHook3
     meson
     ninja
     pkg-config
diff --git a/pkgs/desktops/cinnamon/xviewer/default.nix b/pkgs/desktops/cinnamon/xviewer/default.nix
index 47e4e331da8bd..e0ff80b74ffc3 100644
--- a/pkgs/desktops/cinnamon/xviewer/default.nix
+++ b/pkgs/desktops/cinnamon/xviewer/default.nix
@@ -20,7 +20,7 @@
 , ninja
 , pkg-config
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , xapp
 , yelp-tools
 }:
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
     yelp-tools
   ];
 
diff --git a/pkgs/desktops/deepin/core/dde-control-center/default.nix b/pkgs/desktops/deepin/core/dde-control-center/default.nix
index cbfbb34f33cef..ffb94b9b52b3f 100644
--- a/pkgs/desktops/deepin/core/dde-control-center/default.nix
+++ b/pkgs/desktops/deepin/core/dde-control-center/default.nix
@@ -6,7 +6,7 @@
 , qttools
 , doxygen
 , wrapQtAppsHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , dtkwidget
 , qt5integration
 , qt5platform-plugins
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     qttools
     doxygen
     wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   dontWrapGApps = true;
 
diff --git a/pkgs/desktops/deepin/core/dde-dock/default.nix b/pkgs/desktops/deepin/core/dde-dock/default.nix
index 9c827e96a7457..275d8e5894927 100644
--- a/pkgs/desktops/deepin/core/dde-dock/default.nix
+++ b/pkgs/desktops/deepin/core/dde-dock/default.nix
@@ -7,7 +7,7 @@
 , qttools
 , pkg-config
 , wrapQtAppsHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , qtbase
 , dtkwidget
 , qt5integration
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     qttools
     pkg-config
     wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   dontWrapGApps = true;
 
diff --git a/pkgs/desktops/deepin/core/dde-file-manager/default.nix b/pkgs/desktops/deepin/core/dde-file-manager/default.nix
index 552fa748d51f0..42d371628b3e0 100644
--- a/pkgs/desktops/deepin/core/dde-file-manager/default.nix
+++ b/pkgs/desktops/deepin/core/dde-file-manager/default.nix
@@ -23,7 +23,7 @@
 , polkit-qt
 , polkit
 , wrapQtAppsHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , lucenepp
 , boost
 , taglib
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     qttools
     pkg-config
     wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   dontWrapGApps = true;
 
diff --git a/pkgs/desktops/deepin/core/dde-session-shell/default.nix b/pkgs/desktops/deepin/core/dde-session-shell/default.nix
index b30840f74ff32..cfaa12338eb2b 100644
--- a/pkgs/desktops/deepin/core/dde-session-shell/default.nix
+++ b/pkgs/desktops/deepin/core/dde-session-shell/default.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , qttools
 , wrapQtAppsHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , qtbase
 , dtkwidget
 , qt5integration
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     pkg-config
     qttools
     wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   dontWrapGApps = true;
 
diff --git a/pkgs/desktops/deepin/go-package/dde-api/default.nix b/pkgs/desktops/deepin/go-package/dde-api/default.nix
index d86c369763023..2c7c6276cff67 100644
--- a/pkgs/desktops/deepin/go-package/dde-api/default.nix
+++ b/pkgs/desktops/deepin/go-package/dde-api/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , deepin-gettext-tools
 , wrapQtAppsHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , alsa-lib
 , gtk3
 , libcanberra
@@ -57,7 +57,7 @@ buildGoModule rec {
     pkg-config
     deepin-gettext-tools
     wrapQtAppsHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   dontWrapGApps = true;
 
diff --git a/pkgs/desktops/deepin/go-package/dde-daemon/default.nix b/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
index b79f1fe472d11..4a63b779c4c5d 100644
--- a/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
+++ b/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
@@ -7,7 +7,7 @@
 , deepin-gettext-tools
 , gettext
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , ddcutil
 , alsa-lib
 , glib
@@ -95,7 +95,7 @@ buildGoModule rec {
     deepin-gettext-tools
     gettext
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/deepin/go-package/startdde/default.nix b/pkgs/desktops/deepin/go-package/startdde/default.nix
index 2408410b2f08b..63ebea8f08abe 100644
--- a/pkgs/desktops/deepin/go-package/startdde/default.nix
+++ b/pkgs/desktops/deepin/go-package/startdde/default.nix
@@ -5,7 +5,7 @@
 , gettext
 , pkg-config
 , jq
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , libgnome-keyring
 , gtk3
@@ -47,7 +47,7 @@ buildGoModule rec {
     gettext
     pkg-config
     jq
-    wrapGAppsHook
+    wrapGAppsHook3
     glib
   ];
 
diff --git a/pkgs/desktops/enlightenment/rage/default.nix b/pkgs/desktops/enlightenment/rage/default.nix
index 2ed7384ca0e00..afe70fd9e327e 100644
--- a/pkgs/desktops/enlightenment/rage/default.nix
+++ b/pkgs/desktops/enlightenment/rage/default.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , efl
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook3
 , directoryListingUpdater
 }:
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/apps/accerciser/default.nix b/pkgs/desktops/gnome/apps/accerciser/default.nix
index e486a3b283f1a..b8f5d153467e9 100644
--- a/pkgs/desktops/gnome/apps/accerciser/default.nix
+++ b/pkgs/desktops/gnome/apps/accerciser/default.nix
@@ -3,7 +3,7 @@
 , pkg-config
 , gnome
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , itstool
 , libxml2
@@ -34,7 +34,7 @@ python3.pkgs.buildPythonApplication rec {
     libxml2
     pkg-config
     dbus
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -68,7 +68,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Accerciser";
+    homepage = "https://gitlab.gnome.org/GNOME/accerciser";
     description = "Interactive Python accessibility explorer";
     mainProgram = "accerciser";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/cheese/default.nix b/pkgs/desktops/gnome/apps/cheese/default.nix
index ce5d841c9dd81..9dd578438c502 100644
--- a/pkgs/desktops/gnome/apps/cheese/default.nix
+++ b/pkgs/desktops/gnome/apps/cheese/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , gettext
 , fetchurl
-, wrapGAppsHook
+, wrapGAppsHook3
 , gnome-video-effects
 , libcanberra-gtk3
 , pkg-config
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     glib # for glib-compile-schemas
   ];
 
@@ -98,7 +98,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Cheese";
+    homepage = "https://gitlab.gnome.org/GNOME/cheese";
     description = "Take photos and videos with your webcam, with fun graphical effects";
     mainProgram = "cheese";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/file-roller/default.nix b/pkgs/desktops/gnome/apps/file-roller/default.nix
index 650a2a2d2b0cc..d32b9bddec8e5 100644
--- a/pkgs/desktops/gnome/apps/file-roller/default.nix
+++ b/pkgs/desktops/gnome/apps/file-roller/default.nix
@@ -11,25 +11,26 @@
 , ninja
 , pkg-config
 , python3
-, wrapGAppsHook
+, wrapGAppsHook4
 , cpio
 , glib
 , gnome
-, gtk3
+, gtk4
+, libadwaita
 , libhandy
 , json-glib
 , libarchive
-, libportal-gtk3
+, libportal-gtk4
 , nautilus
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "file-roller";
-  version = "43.1";
+  version = "44.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/file-roller/${lib.versions.major finalAttrs.version}/file-roller-${finalAttrs.version}.tar.xz";
-    sha256 = "hJlAI5lyk76zRdl5Pbj18Lu0H6oVXG/7SDKPIDlXrQg=";
+    hash = "sha256-JQz1Uc/LEqZwyorflT4GgfHJt27gnZRYsgIDxiYCxIc=";
   };
 
   nativeBuildInputs = [
@@ -42,17 +43,18 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook4
   ];
 
   buildInputs = [
     cpio
     glib
-    gtk3
+    gtk4
+    libadwaita
     libhandy
     json-glib
     libarchive
-    libportal-gtk3
+    libportal-gtk4
     nautilus
   ];
 
@@ -68,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/FileRoller";
+    homepage = "https://gitlab.gnome.org/GNOME/file-roller";
     description = "Archive manager for the GNOME desktop environment";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome/apps/ghex/default.nix b/pkgs/desktops/gnome/apps/ghex/default.nix
index b2abd36af2123..f58ca108e9056 100644
--- a/pkgs/desktops/gnome/apps/ghex/default.nix
+++ b/pkgs/desktops/gnome/apps/ghex/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ghex";
-  version = "45.1";
+  version = "46.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/ghex/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "+ysII80WJJ7b6u6DAvm9UAXgFQNos18eR8JmgMrKwvo=";
+    hash = "sha256-ocRvMCDLNYuDIwJds6U5yX2ZSkxG9wH0jtxjV/f7y9E=";
   };
 
   nativeBuildInputs = [
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Ghex";
+    homepage = "https://gitlab.gnome.org/GNOME/ghex";
     description = "Hex editor for GNOME desktop environment";
     mainProgram = "ghex";
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome/apps/gnome-boxes/default.nix b/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
index 24b889fb58c34..2ef940122af0a 100644
--- a/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , meson
 , ninja
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , gettext
 , itstool
@@ -14,7 +14,6 @@
 , gtk3
 , libvirt
 , spice-gtk
-, appstream-glib
 , spice-protocol
 , libhandy
 , libsoup_3
@@ -44,15 +43,16 @@
 , vte
 , glib-networking
 , qemu-utils
+, libportal-gtk3
 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-boxes";
-  version = "45.0";
+  version = "46.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "zGMIDu+hR6hHKrGl/wh7l6J6tyOk7gBe1B6Mndd5jkE=";
+    hash = "sha256-kAwXf2diZANwpmNM+efTzYIH5Jg2eopmemtzGwQRYDY=";
   };
 
   patches = [
@@ -64,7 +64,6 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   nativeBuildInputs = [
-    appstream-glib # for appstream-util
     gettext
     gobject-introspection
     itstool
@@ -72,7 +71,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     # For post install script
     glib
     gtk3
@@ -114,6 +113,7 @@ stdenv.mkDerivation rec {
     vte
     webkitgtk_4_1
     yajl
+    libportal-gtk3
   ];
 
   preFixup = ''
@@ -130,7 +130,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Simple GNOME 3 application to access remote or virtual systems";
     mainProgram = "gnome-boxes";
-    homepage = "https://wiki.gnome.org/Apps/Boxes";
+    homepage = "https://apps.gnome.org/Boxes/";
     license = licenses.lgpl2Plus;
     platforms = platforms.linux;
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/gnome-calendar/default.nix b/pkgs/desktops/gnome/apps/gnome-calendar/default.nix
index 78829cfd74e28..d56c8114bd041 100644
--- a/pkgs/desktops/gnome/apps/gnome-calendar/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-calendar/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-calendar";
-  version = "45.1";
+  version = "46.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "f6hQdUOGWqdDK7UxmDDIcVi1RHygnMpFtgfcZ5bHEAg=";
+    hash = "sha256-mGH/e4q9W3sgaQulXrdULH7FNLVmJp4ptbHoWMFhCJc=";
   };
 
   nativeBuildInputs = [
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Calendar";
+    homepage = "https://apps.gnome.org/Calendar/";
     description = "Simple and beautiful calendar application for GNOME";
     mainProgram = "gnome-calendar";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/gnome-characters/default.nix b/pkgs/desktops/gnome/apps/gnome-characters/default.nix
index 570bdccafd82b..9a6676ad4c29a 100644
--- a/pkgs/desktops/gnome/apps/gnome-characters/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-characters/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-characters";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-characters/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "P9VPzBTSkbd//xLe7/8A2jg+CmQAr1B9FgX7y0m4x0E=";
+    hash = "sha256-pOjixRC/SCBLmZSk581TeEQkbnTIqYb52+BOIj9dgnw=";
   };
 
   nativeBuildInputs = [
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Characters";
+    homepage = "https://apps.gnome.org/Characters/";
     description = "Simple utility application to find and insert unusual characters";
     mainProgram = "gnome-characters";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/gnome-clocks/default.nix b/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
index 3e719ef12218e..5bdbe12f705a0 100644
--- a/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-clocks";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-clocks/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "/I60/ZUw8eZB3ADuIIbufTVKegCwoNFyLjBdXJqrkbU=";
+    hash = "sha256-6qPFeM3O+XVOZotWJnCbc/NSZxAjX0tyB20v9JpPmcc=";
   };
 
   nativeBuildInputs = [
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Clocks";
+    homepage = "https://apps.gnome.org/Clocks/";
     description = "Clock application designed for GNOME 3";
     mainProgram = "gnome-clocks";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/gnome-connections/default.nix b/pkgs/desktops/gnome/apps/gnome-connections/default.nix
index 933c80a9ffe92..bd501c1be9b96 100644
--- a/pkgs/desktops/gnome/apps/gnome-connections/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-connections/default.nix
@@ -7,9 +7,8 @@
 , vala
 , gettext
 , itstool
-, appstream-glib
 , desktop-file-utils
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gtk3
 , libhandy
@@ -22,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-connections";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-ufq1JbkKPifRE8FvuGjCucR7+BSTENFNuGLqGRLAb7g=";
+    hash = "sha256-+xzqaOeTC73B2yi3zQqaN80xDUtOeHL+gU9QoWqNJdM=";
   };
 
   nativeBuildInputs = [
@@ -36,10 +35,9 @@ stdenv.mkDerivation rec {
     vala
     gettext
     itstool
-    appstream-glib
     desktop-file-utils
     glib # glib-compile-resources
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/apps/gnome-logs/default.nix b/pkgs/desktops/gnome/apps/gnome-logs/default.nix
index e2dc57d67088c..77a9ba3332603 100644
--- a/pkgs/desktops/gnome/apps/gnome-logs/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-logs/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-logs";
-  version = "45.beta";
+  version = "45.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-logs/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "nbxJ/7J90jQuji/UmK8ltUENsjkQ/I7/XmiTrHa7jK4=";
+    hash = "sha256-sooG6lyYvRfyhztQfwhbDKDemBATZhH08u6wmGFOzlI=";
   };
 
   nativeBuildInputs = [
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Logs";
+    homepage = "https://apps.gnome.org/Logs/";
     description = "A log viewer for the systemd journal";
     mainProgram = "gnome-logs";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/gnome-maps/default.nix b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
index 730a98e192df3..99815109624c8 100644
--- a/pkgs/desktops/gnome/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
@@ -24,18 +24,19 @@
 , gjs
 , libadwaita
 , geocode-glib_2
+, tzdata
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-maps";
-  version = "45.5";
+  version = "46.10";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-maps/${lib.versions.major finalAttrs.version}/gnome-maps-${finalAttrs.version}.tar.xz";
-    hash = "sha256-HCD14Q3OaEre+ylhUmJmoiTmxGwW+gO5VK/6Czobt0A=";
+    hash = "sha256-XyXul6DC/t+E8M8DkrTvi+GT4/bOJfl1RntvzsBUIa8=";
   };
 
-  doCheck = true;
+  doCheck = !stdenv.isDarwin;
 
   nativeBuildInputs = [
     gettext
@@ -80,6 +81,19 @@ stdenv.mkDerivation (finalAttrs: {
   preCheck = ''
     # “time.js” included by “timeTest” and “translationsTest” depends on “org.gnome.desktop.interface” schema.
     export XDG_DATA_DIRS="${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:$XDG_DATA_DIRS"
+    export HOME=$(mktemp -d)
+    export TZDIR=${tzdata}/share/zoneinfo
+
+    # Our gobject-introspection patches make the shared library paths absolute
+    # in the GIR files. When running tests, the library is not yet installed,
+    # though, so we need to replace the absolute path with a local one during build.
+    # We are using a symlink that we will delete before installation.
+    mkdir -p $out/lib/gnome-maps
+    ln -s $PWD/lib/libgnome-maps.so.0 $out/lib/gnome-maps/libgnome-maps.so.0
+  '';
+
+  postCheck = ''
+    rm $out/lib/gnome-maps/libgnome-maps.so.0
   '';
 
   passthru = {
@@ -90,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Maps";
+    homepage = "https://apps.gnome.org/Maps/";
     description = "A map application for GNOME 3";
     mainProgram = "gnome-maps";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/gnome-music/default.nix b/pkgs/desktops/gnome/apps/gnome-music/default.nix
index 5275e6e9de6a3..7def9a535d864 100644
--- a/pkgs/desktops/gnome/apps/gnome-music/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-music/default.nix
@@ -30,13 +30,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gnome-music";
-  version = "45.1";
+  version = "46.0";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "lZWc24AkRASNUKGpHELbiyUWWgpoUzvAOJXrNyxN3gs=";
+    hash = "sha256-pFDVzgFokvavL4q3H8fDlDguIse2ILqSpuFc9mvF7F8=";
   };
 
   nativeBuildInputs = [
@@ -102,7 +102,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Music";
+    homepage = "https://apps.gnome.org/Music/";
     description = "Music player and management application for the GNOME desktop environment";
     mainProgram = "gnome-music";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/gnome-nettool/default.nix b/pkgs/desktops/gnome/apps/gnome-nettool/default.nix
index 761d55a4036c1..bf377b288aa04 100644
--- a/pkgs/desktops/gnome/apps/gnome-nettool/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-nettool/default.nix
@@ -8,7 +8,7 @@
 , ninja
 , pkg-config
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gtk3
 , libgtop
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/apps/gnome-notes/default.nix b/pkgs/desktops/gnome/apps/gnome-notes/default.nix
index 86d7253ae5604..dd474567196e0 100644
--- a/pkgs/desktops/gnome/apps/gnome-notes/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-notes/default.nix
@@ -6,7 +6,7 @@
 , fetchurl
 , fetchpatch
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , itstool
 , desktop-file-utils
 , python3
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     libxml2
     desktop-file-utils
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Note editor designed to remain simple to use";
     mainProgram = "bijiben";
-    homepage = "https://wiki.gnome.org/Apps/Notes";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-notes";
     license = licenses.gpl3;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome/apps/gnome-power-manager/default.nix b/pkgs/desktops/gnome/apps/gnome-power-manager/default.nix
index 3797f9df6f9bb..0f630593101b5 100644
--- a/pkgs/desktops/gnome/apps/gnome-power-manager/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-power-manager/default.nix
@@ -10,7 +10,7 @@
 , upower
 , python3
 , desktop-file-utils
-, wrapGAppsHook
+, wrapGAppsHook3
 , gnome
 }:
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gettext
 
     # needed by meson_post_install.sh
diff --git a/pkgs/desktops/gnome/apps/gnome-sound-recorder/default.nix b/pkgs/desktops/gnome/apps/gnome-sound-recorder/default.nix
index 5a6cab8177a9f..d112de9784b0a 100644
--- a/pkgs/desktops/gnome/apps/gnome-sound-recorder/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-sound-recorder/default.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A simple and modern sound recorder";
     mainProgram = "gnome-sound-recorder";
-    homepage = "https://wiki.gnome.org/Apps/SoundRecorder";
+    homepage = "https://gitlab.gnome.org/World/vocalis";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome/apps/gnome-text-editor/default.nix b/pkgs/desktops/gnome/apps/gnome-text-editor/default.nix
index 3dd7b2f4decb2..14f4d15a4ce6c 100644
--- a/pkgs/desktops/gnome/apps/gnome-text-editor/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-text-editor/default.nix
@@ -18,21 +18,19 @@
 , libadwaita
 , editorconfig-core-c
 , libxml2
-, appstream-glib
 , desktop-file-utils
 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-text-editor";
-  version = "45.3";
+  version = "46.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-text-editor/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8//LEakt/QS6PDs9DmZ4R9REmiHgEq428H3aBax9OlI=";
+    hash = "sha256-jr+gvqEudfXv6sxyG+O4rmUCewJKqB257KuMMSJXous=";
   };
 
   nativeBuildInputs = [
-    appstream-glib
     desktop-file-utils
     itstool
     libxml2 # for xmllint
diff --git a/pkgs/desktops/gnome/apps/gnome-weather/default.nix b/pkgs/desktops/gnome/apps/gnome-weather/default.nix
index c4b5743cb516e..f614094d623bf 100644
--- a/pkgs/desktops/gnome/apps/gnome-weather/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-weather/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-weather";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-weather/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "MMAClwKIPcjYFg5t4dYRaHfNbCW8lQ1OSQKmq0Z7L6Q=";
+    hash = "sha256-FTgmcFzPZy4U8v5N/Hgvjom3xMvkqv6VpVMvveej1J0=";
   };
 
   nativeBuildInputs = [
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Weather";
+    homepage = "https://apps.gnome.org/Weather/";
     description = "Access current weather conditions and forecasts";
     mainProgram = "gnome-weather";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/polari/default.nix b/pkgs/desktops/gnome/apps/polari/default.nix
index 31ad6c94a6a9b..65ff3851e6ae5 100644
--- a/pkgs/desktops/gnome/apps/polari/default.nix
+++ b/pkgs/desktops/gnome/apps/polari/default.nix
@@ -13,6 +13,7 @@
 , desktop-file-utils
 , pkg-config
 , gtk4
+, tracker
 , libadwaita
 , gtk3
 , glib
@@ -20,21 +21,19 @@
 , libsoup_3
 , webkitgtk_4_1
 , gobject-introspection
-, appstream-glib
 , gnome
 , wrapGAppsHook4
-, telepathy-logger
 , gspell
 , gsettings-desktop-schemas
 }:
 
 stdenv.mkDerivation rec {
   pname = "polari";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "nbfdwJSqhVfxkXfhZMQti+Fn9UckuScTC3YhyCnB1KE=";
+    hash = "sha256-0rFwnjeRiSlPU9TvFfA/i8u76MUvD0FeYvfV8Aw2CjE=";
   };
 
   patches = [
@@ -46,7 +45,6 @@ stdenv.mkDerivation rec {
 
   propagatedUserEnvPkgs = [
     telepathy-idle
-    telepathy-logger
   ];
 
   nativeBuildInputs = [
@@ -59,17 +57,16 @@ stdenv.mkDerivation rec {
     libxml2
     desktop-file-utils
     gobject-introspection
-    appstream-glib
   ];
 
   buildInputs = [
     gtk4
+    tracker
     libadwaita
     gtk3 # for thumbnailer
     glib
     gsettings-desktop-schemas
     telepathy-glib
-    telepathy-logger
     gjs
     gspell
     gdk-pixbuf
@@ -90,7 +87,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Polari";
+    homepage = "https://apps.gnome.org/Polari/";
     description = "IRC chat client designed to integrate with the GNOME desktop";
     mainProgram = "polari";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/seahorse/default.nix b/pkgs/desktops/gnome/apps/seahorse/default.nix
index c3c1aa020ad20..4cbc455c3da94 100644
--- a/pkgs/desktops/gnome/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome/apps/seahorse/default.nix
@@ -10,7 +10,7 @@
 , gtk3
 , glib
 , glib-networking
-, wrapGAppsHook
+, wrapGAppsHook3
 , itstool
 , gnupg
 , desktop-file-utils
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     pkg-config
     vala
     itstool
-    wrapGAppsHook
+    wrapGAppsHook3
     python3
     openssh
     gnupg
@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Seahorse";
+    homepage = "https://gitlab.gnome.org/GNOME/seahorse";
     description = "Application for managing encryption keys and passwords in the GnomeKeyring";
     mainProgram = "seahorse";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/apps/vinagre/default.nix b/pkgs/desktops/gnome/apps/vinagre/default.nix
index 5ef01e04fce50..72c1f7b3226c3 100644
--- a/pkgs/desktops/gnome/apps/vinagre/default.nix
+++ b/pkgs/desktops/gnome/apps/vinagre/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch, pkg-config, gtk3, gnome, vte, libxml2, gtk-vnc, intltool
-, libsecret, itstool, wrapGAppsHook, librsvg }:
+, libsecret, itstool, wrapGAppsHook3, librsvg }:
 
 stdenv.mkDerivation rec {
   pname = "vinagre";
@@ -12,15 +12,15 @@ stdenv.mkDerivation rec {
 
   patches = [
     # Pull fix pending upstream inclusion for -fno-common toolchain support:
-    #   https://gitlab.gnome.org/GNOME/vinagre/-/merge_requests/8
+    #   https://gitlab.gnome.org/Archive/vinagre/-/merge_requests/8
     (fetchpatch {
       name = "fno-common.patch";
-      url = "https://gitlab.gnome.org/GNOME/vinagre/-/commit/c51662cf4338516773d64776c3c92796917ff2bd.diff";
+      url = "https://gitlab.gnome.org/Archive/vinagre/-/commit/c51662cf4338516773d64776c3c92796917ff2bd.diff";
       sha256 = "0zn8cd93hjdz6rw2d7gfl1ghzkc9h0x40k9l0jx3n5qfwdq4sir8";
     })
   ];
 
-  nativeBuildInputs = [ pkg-config intltool itstool wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config intltool itstool wrapGAppsHook3 ];
   buildInputs = [
     gtk3 vte libxml2 gtk-vnc libsecret gnome.adwaita-icon-theme librsvg
   ];
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Remote desktop viewer for GNOME";
     mainProgram = "vinagre";
-    homepage = "https://wiki.gnome.org/Apps/Vinagre";
+    homepage = "https://gitlab.gnome.org/Archive/vinagre";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix b/pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix
index 5d287f4e6fd9f..324d439d75897 100644
--- a/pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix
+++ b/pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "adwaita-icon-theme";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "JEK/sG9ObMlb9uJoL9/5j6Xt3GiHUbnWIVxiPLTkL/E=";
+    hash = "sha256-S8tTm9ddZNo4XW+gjLqp3erOtqyOgrhbpsQRF79bpk4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/baobab/default.nix b/pkgs/desktops/gnome/core/baobab/default.nix
index aad394c2d9603..3978661baabb8 100644
--- a/pkgs/desktops/gnome/core/baobab/default.nix
+++ b/pkgs/desktops/gnome/core/baobab/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "baobab";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "p9LPMIpsg57gsL8HT49f1g1iri8GSpSzxhDWVgt1joY=";
+    hash = "sha256-zk3vXILQVnGlAJ9768+FrJhnXZ2BYNKK2RgbJppy43w=";
   };
 
   nativeBuildInputs = [
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Graphical application to analyse disk usage in any GNOME environment";
     mainProgram = "baobab";
-    homepage = "https://wiki.gnome.org/Apps/DiskUsageAnalyzer";
+    homepage = "https://apps.gnome.org/Baobab/";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/desktops/gnome/core/caribou/default.nix b/pkgs/desktops/gnome/core/caribou/default.nix
index 69afefbc94ca3..5f853efdab83b 100644
--- a/pkgs/desktops/gnome/core/caribou/default.nix
+++ b/pkgs/desktops/gnome/core/caribou/default.nix
@@ -1,6 +1,6 @@
 { fetchurl, lib, stdenv, pkg-config, gnome, glib, gtk3, clutter, dbus, python3, libxml2
 , libxklavier, libXtst, gtk2, intltool, libxslt, at-spi2-core, autoreconfHook
-, wrapGAppsHook, libgee, vala }:
+, wrapGAppsHook3, libgee, vala }:
 
 let
   pname = "caribou";
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config intltool libxslt libxml2 autoreconfHook wrapGAppsHook vala ];
+  nativeBuildInputs = [ pkg-config intltool libxslt libxml2 autoreconfHook wrapGAppsHook3 vala ];
 
   buildInputs = [
     glib gtk3 clutter at-spi2-core dbus pythonEnv python3.pkgs.pygobject3
diff --git a/pkgs/desktops/gnome/core/dconf-editor/default.nix b/pkgs/desktops/gnome/core/dconf-editor/default.nix
index 4189063c1419a..2b1b747a74a2c 100644
--- a/pkgs/desktops/gnome/core/dconf-editor/default.nix
+++ b/pkgs/desktops/gnome/core/dconf-editor/default.nix
@@ -16,7 +16,7 @@
 , libxml2
 , gettext
 , docbook-xsl-nons
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 }:
 
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     vala
     libxslt
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gettext
     docbook-xsl-nons
     libxml2
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "GSettings editor for GNOME";
     mainProgram = "dconf-editor";
-    homepage = "https://wiki.gnome.org/Apps/DconfEditor";
+    homepage = "https://apps.gnome.org/DconfEditor/";
     license = licenses.gpl3Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/desktops/gnome/core/eog/default.nix b/pkgs/desktops/gnome/core/eog/default.nix
index 095845b8acc1b..b59eb108c0149 100644
--- a/pkgs/desktops/gnome/core/eog/default.nix
+++ b/pkgs/desktops/gnome/core/eog/default.nix
@@ -20,7 +20,7 @@
 , gdk-pixbuf
 , exempi
 , shared-mime-info
-, wrapGAppsHook
+, wrapGAppsHook3
 , libjxl
 , librsvg
 , webp-pixbuf-loader
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     itstool
-    wrapGAppsHook
+    wrapGAppsHook3
     libxml2 # for xmllint for xml-stripblanks
     gobject-introspection
     gi-docgen
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "GNOME image viewer";
-    homepage = "https://wiki.gnome.org/Apps/EyeOfGnome";
+    homepage = "https://gitlab.gnome.org/GNOME/eog";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/desktops/gnome/core/epiphany/default.nix b/pkgs/desktops/gnome/core/epiphany/default.nix
index efac41be7ce57..ab1c4d6b10516 100644
--- a/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome/core/epiphany/default.nix
@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation rec {
   pname = "epiphany";
-  version = "45.3";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "bDAum91mKQyw4m9ihDzUxDWklVq9u08VHwfcgEldZzA=";
+    hash = "sha256-9DSPLPUcB8DBBtEwFy1NI/LNQGh3Hh3gB7dYyireVmA=";
   };
 
   nativeBuildInputs = [
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Epiphany";
+    homepage = "https://apps.gnome.org/Epiphany/";
     description = "WebKit based web browser for GNOME";
     mainProgram = "epiphany";
     maintainers = teams.gnome.members ++ teams.pantheon.members;
diff --git a/pkgs/desktops/gnome/core/evince/default.nix b/pkgs/desktops/gnome/core/evince/default.nix
index f02f2e323e25e..41db4063e9f60 100644
--- a/pkgs/desktops/gnome/core/evince/default.nix
+++ b/pkgs/desktops/gnome/core/evince/default.nix
@@ -23,7 +23,7 @@
 , libarchive
 , libhandy
 , libsecret
-, wrapGAppsHook
+, wrapGAppsHook3
 , librsvg
 , gobject-introspection
 , yelp-tools
@@ -42,13 +42,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evince";
-  version = "45.0";
+  version = "46.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "0YZH1Cdcvd8NMoF7HQTjBzQqhb6RTsTa0tgIKq+KpKg=";
+    hash = "sha256-r/avaTksBJVr+tl23sXRWDtB1aM06TeZX3w8oHQN4iE=";
   };
 
   depsBuildBuild = [
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     yelp-tools
   ];
 
@@ -128,7 +128,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Evince";
+    homepage = "https://apps.gnome.org/Evince/";
     description = "GNOME's document viewer";
 
     longDescription = ''
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/default.nix b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
index 286f799382498..b5326c4e7f814 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@@ -21,7 +21,7 @@
 , nss
 , libical
 , gperf
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib-networking
 , gsettings-desktop-schemas
 , pcre
@@ -50,13 +50,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.50.4";
+  version = "3.52.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-1+3/vgOgu87L7mc5MhS4McexjNiVuExNv+E4d3biV8U=";
+    hash = "sha256-gls9fVRoRApn0R3SojkzlgwHue7MeXuxJYQ8sshwo0g=";
   };
 
   patches = [
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     gettext
     python3
     gperf
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     vala
   ];
@@ -147,10 +147,6 @@ stdenv.mkDerivation rec {
       --replace "-Wl,--no-undefined" ""
     substituteInPlace src/services/evolution-alarm-notify/e-alarm-notify.c \
       --replace "G_OS_WIN32" "__APPLE__"
-  '' + lib.optionalString stdenv.cc.isClang ''
-    # https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/513
-    substituteInPlace src/addressbook/libebook-contacts/e-phone-number-private.cpp \
-      --replace "std::auto_ptr" "std::unique_ptr"
   '';
 
   postInstall = lib.optionalString stdenv.isDarwin ''
@@ -185,7 +181,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Unified backend for programs that work with contacts, tasks, and calendar information";
-    homepage = "https://wiki.gnome.org/Apps/Evolution";
+    homepage = "https://gitlab.gnome.org/GNOME/evolution-data-server";
     license = licenses.lgpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
index 6fef728193913..de8186d01c5e4 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
+++ b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
@@ -1,8 +1,8 @@
 diff --git a/src/addressbook/libebook/e-book-client.c b/src/addressbook/libebook/e-book-client.c
-index bd479d8..bd049b3 100644
+index 5e65ec8..8ca28c6 100644
 --- a/src/addressbook/libebook/e-book-client.c
 +++ b/src/addressbook/libebook/e-book-client.c
-@@ -1997,7 +1997,18 @@ e_book_client_get_self (ESourceRegistry *registry,
+@@ -1924,7 +1924,18 @@ e_book_client_get_self (ESourceRegistry *registry,
  
  	*out_client = book_client;
  
@@ -22,7 +22,7 @@ index bd479d8..bd049b3 100644
  	uid = g_settings_get_string (settings, SELF_UID_KEY);
  	g_object_unref (settings);
  
-@@ -2065,7 +2076,18 @@ e_book_client_set_self (EBookClient *client,
+@@ -1992,7 +2003,18 @@ e_book_client_set_self (EBookClient *client,
  	g_return_val_if_fail (
  		e_contact_get_const (contact, E_CONTACT_UID) != NULL, FALSE);
  
@@ -42,7 +42,7 @@ index bd479d8..bd049b3 100644
  	g_settings_set_string (
  		settings, SELF_UID_KEY,
  		e_contact_get_const (contact, E_CONTACT_UID));
-@@ -2101,8 +2123,18 @@ e_book_client_is_self (EContact *contact)
+@@ -2028,8 +2050,18 @@ e_book_client_is_self (EContact *contact)
  	 * unfortunately the API doesn't allow that.
  	 */
  	g_mutex_lock (&mutex);
@@ -128,7 +128,7 @@ index e85a56b..59d3fe2 100644
  	g_object_unref (settings);
  
 diff --git a/src/addressbook/libedata-book/e-book-meta-backend.c b/src/addressbook/libedata-book/e-book-meta-backend.c
-index 63e1016..0492756 100644
+index 5b4debf..77c8d9c 100644
 --- a/src/addressbook/libedata-book/e-book-meta-backend.c
 +++ b/src/addressbook/libedata-book/e-book-meta-backend.c
 @@ -144,7 +144,18 @@ ebmb_is_power_saver_enabled (void)
@@ -152,10 +152,10 @@ index 63e1016..0492756 100644
  	if (g_settings_get_boolean (settings, "limit-operations-in-power-saver-mode")) {
  		GPowerProfileMonitor *power_monitor;
 diff --git a/src/calendar/backends/contacts/e-cal-backend-contacts.c b/src/calendar/backends/contacts/e-cal-backend-contacts.c
-index 42f3457..b4926af 100644
+index 43bd383..4dce824 100644
 --- a/src/calendar/backends/contacts/e-cal-backend-contacts.c
 +++ b/src/calendar/backends/contacts/e-cal-backend-contacts.c
-@@ -1387,7 +1387,18 @@ e_cal_backend_contacts_init (ECalBackendContacts *cbc)
+@@ -1369,7 +1369,18 @@ e_cal_backend_contacts_init (ECalBackendContacts *cbc)
  		(GDestroyNotify) g_free,
  		(GDestroyNotify) contact_record_free);
  
@@ -202,10 +202,10 @@ index 2525856..7ecc1a8 100644
  				g_clear_object (&settings);
  			}
 diff --git a/src/calendar/libecal/e-reminder-watcher.c b/src/calendar/libecal/e-reminder-watcher.c
-index ade0a73..d7c3e73 100644
+index 44ba49c..dfac2a2 100644
 --- a/src/calendar/libecal/e-reminder-watcher.c
 +++ b/src/calendar/libecal/e-reminder-watcher.c
-@@ -2626,8 +2626,33 @@ e_reminder_watcher_init (EReminderWatcher *watcher)
+@@ -2826,8 +2826,33 @@ e_reminder_watcher_init (EReminderWatcher *watcher)
  
  	watcher->priv = e_reminder_watcher_get_instance_private (watcher);
  	watcher->priv->cancellable = g_cancellable_new ();
@@ -242,7 +242,7 @@ index ade0a73..d7c3e73 100644
  		g_signal_connect_object (
  			watcher->priv->desktop_settings,
 diff --git a/src/calendar/libedata-cal/e-cal-meta-backend.c b/src/calendar/libedata-cal/e-cal-meta-backend.c
-index 27fa153..3679d72 100644
+index b9145af..350fcd3 100644
 --- a/src/calendar/libedata-cal/e-cal-meta-backend.c
 +++ b/src/calendar/libedata-cal/e-cal-meta-backend.c
 @@ -156,7 +156,18 @@ ecmb_is_power_saver_enabled (void)
@@ -265,7 +265,7 @@ index 27fa153..3679d72 100644
  
  	if (g_settings_get_boolean (settings, "limit-operations-in-power-saver-mode")) {
  		GPowerProfileMonitor *power_monitor;
-@@ -2633,7 +2644,20 @@ ecmb_receive_object_sync (ECalMetaBackend *meta_backend,
+@@ -2632,7 +2643,20 @@ ecmb_receive_object_sync (ECalMetaBackend *meta_backend,
  			if (is_declined) {
  				GSettings *settings;
  
@@ -288,7 +288,7 @@ index 27fa153..3679d72 100644
  				g_clear_object (&settings);
  			}
 diff --git a/src/camel/camel-cipher-context.c b/src/camel/camel-cipher-context.c
-index bef9188..ce92f6c 100644
+index d5a0823..2ae03f8 100644
 --- a/src/camel/camel-cipher-context.c
 +++ b/src/camel/camel-cipher-context.c
 @@ -1631,7 +1631,18 @@ camel_cipher_can_load_photos (void)
@@ -312,7 +312,7 @@ index bef9188..ce92f6c 100644
  	g_clear_object (&settings);
  
 diff --git a/src/camel/camel-gpg-context.c b/src/camel/camel-gpg-context.c
-index 4deae76..ebe0a1b 100644
+index cecd740..9a15180 100644
 --- a/src/camel/camel-gpg-context.c
 +++ b/src/camel/camel-gpg-context.c
 @@ -747,7 +747,18 @@ gpg_ctx_get_executable_name (void)
@@ -361,10 +361,10 @@ index e61160c..b6553a4 100644
  		G_CALLBACK (mi_user_headers_settings_changed_cb), NULL);
  	G_UNLOCK (mi_user_headers);
 diff --git a/src/camel/providers/imapx/camel-imapx-server.c b/src/camel/providers/imapx/camel-imapx-server.c
-index 8518c90..6a655a9 100644
+index bbf214b..bed39d2 100644
 --- a/src/camel/providers/imapx/camel-imapx-server.c
 +++ b/src/camel/providers/imapx/camel-imapx-server.c
-@@ -5627,7 +5627,18 @@ camel_imapx_server_do_old_flags_update (CamelFolder *folder)
+@@ -5661,7 +5661,18 @@ camel_imapx_server_do_old_flags_update (CamelFolder *folder)
  	if (do_old_flags_update) {
  		GSettings *eds_settings;
  
@@ -433,10 +433,10 @@ index 188f276..939f89b 100644
  		settings, "network-monitor-gio-name",
  		object, "gio-name",
 diff --git a/src/libedataserver/e-oauth2-service-google.c b/src/libedataserver/e-oauth2-service-google.c
-index ec08afe..7b31227 100644
+index 1453410..a3f06b0 100644
 --- a/src/libedataserver/e-oauth2-service-google.c
 +++ b/src/libedataserver/e-oauth2-service-google.c
-@@ -71,7 +71,18 @@ eos_google_read_settings (EOAuth2Service *service,
+@@ -72,7 +72,18 @@ eos_google_read_settings (EOAuth2Service *service,
  	if (!value) {
  		GSettings *settings;
  
@@ -529,10 +529,10 @@ index af59b0b..0c7e75e 100644
  	g_object_unref (settings);
  
 diff --git a/src/libedataserver/e-source-registry.c b/src/libedataserver/e-source-registry.c
-index 4a9b398..e7cb404 100644
+index 1539f8b..77cf123 100644
 --- a/src/libedataserver/e-source-registry.c
 +++ b/src/libedataserver/e-source-registry.c
-@@ -1773,7 +1773,19 @@ e_source_registry_init (ESourceRegistry *registry)
+@@ -1754,7 +1754,19 @@ e_source_registry_init (ESourceRegistry *registry)
  
  	g_mutex_init (&registry->priv->sources_lock);
  
diff --git a/pkgs/desktops/gnome/core/gdm/default.nix b/pkgs/desktops/gnome/core/gdm/default.nix
index b136fa75a0398..bbbe4fbb25b31 100644
--- a/pkgs/desktops/gnome/core/gdm/default.nix
+++ b/pkgs/desktops/gnome/core/gdm/default.nix
@@ -7,6 +7,7 @@
 , ninja
 , pkg-config
 , glib
+, json-glib
 , itstool
 , xorg
 , accountsservice
@@ -42,13 +43,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdm";
-  version = "45.0.1";
+  version = "46.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdm/${lib.versions.major finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    sha256 = "ZXJXjAXjxladbtJp994qrzoDVldlRYbYJDkHu3pv+oU=";
+    hash = "sha256-jWy1IXbspItrvxz+L9rgjZZ3taDyvKYA3uRgTeDdHvw=";
   };
 
   mesonFlags = [
@@ -76,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
     accountsservice
     audit
     glib
+    json-glib
     gtk3
     keyutils
     libX11
@@ -94,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
     # https://gitlab.gnome.org/GNOME/gdm/-/merge_requests/92
     (fetchpatch {
       url = "https://gitlab.gnome.org/GNOME/gdm/-/commit/ccecd9c975d04da80db4cd547b67a1a94fa83292.patch";
-      sha256 = "5hKS9wjjhuSAYwXct5vS0dPbmPRIINJoLC0Zm1naz6Q=";
+      hash = "sha256-5hKS9wjjhuSAYwXct5vS0dPbmPRIINJoLC0Zm1naz6Q=";
       revert = true;
     })
 
diff --git a/pkgs/desktops/gnome/core/gdm/fix-paths.patch b/pkgs/desktops/gnome/core/gdm/fix-paths.patch
index 980627c78d460..4ad417285f275 100644
--- a/pkgs/desktops/gnome/core/gdm/fix-paths.patch
+++ b/pkgs/desktops/gnome/core/gdm/fix-paths.patch
@@ -1,8 +1,8 @@
 diff --git a/daemon/gdm-local-display-factory.c b/daemon/gdm-local-display-factory.c
-index 5fbbad68..739718ec 100644
+index f2d8e155b..54b998826 100644
 --- a/daemon/gdm-local-display-factory.c
 +++ b/daemon/gdm-local-display-factory.c
-@@ -233,9 +233,9 @@ struct GdmDisplayServerConfiguration {
+@@ -245,9 +245,9 @@ struct GdmDisplayServerConfiguration {
          const char *session_type;
  } display_server_configuration[] = {
  #ifdef ENABLE_WAYLAND_SUPPORT
@@ -15,10 +15,10 @@ index 5fbbad68..739718ec 100644
  };
  
 diff --git a/daemon/gdm-manager.c b/daemon/gdm-manager.c
-index cc61efc9..4c9d15af 100644
+index fc5aef6ac..c61e0046b 100644
 --- a/daemon/gdm-manager.c
 +++ b/daemon/gdm-manager.c
-@@ -148,7 +148,7 @@ plymouth_is_running (void)
+@@ -151,7 +151,7 @@ plymouth_is_running (void)
          GError  *error;
  
          error = NULL;
@@ -27,7 +27,7 @@ index cc61efc9..4c9d15af 100644
                                           NULL, NULL, &status, &error);
          if (! res) {
                  g_debug ("Could not ping plymouth: %s", error->message);
-@@ -166,7 +166,7 @@ plymouth_prepare_for_transition (void)
+@@ -169,7 +169,7 @@ plymouth_prepare_for_transition (void)
          GError  *error;
  
          error = NULL;
@@ -36,7 +36,7 @@ index cc61efc9..4c9d15af 100644
                                           NULL, NULL, NULL, &error);
          if (! res) {
                  g_warning ("Could not deactivate plymouth: %s", error->message);
-@@ -181,7 +181,7 @@ plymouth_quit_with_transition (void)
+@@ -184,7 +184,7 @@ plymouth_quit_with_transition (void)
          GError  *error;
  
          error = NULL;
@@ -45,7 +45,7 @@ index cc61efc9..4c9d15af 100644
          if (! res) {
                  g_warning ("Could not quit plymouth: %s", error->message);
                  g_error_free (error);
-@@ -197,7 +197,7 @@ plymouth_quit_without_transition (void)
+@@ -200,7 +200,7 @@ plymouth_quit_without_transition (void)
          GError  *error;
  
          error = NULL;
@@ -55,10 +55,10 @@ index cc61efc9..4c9d15af 100644
                  g_warning ("Could not quit plymouth: %s", error->message);
                  g_error_free (error);
 diff --git a/daemon/gdm-session.c b/daemon/gdm-session.c
-index 4b709731..245ac0cf 100644
+index a4c4b2dcf..67416b204 100644
 --- a/daemon/gdm-session.c
 +++ b/daemon/gdm-session.c
-@@ -2972,16 +2972,16 @@ gdm_session_start_session (GdmSession *self,
+@@ -3193,16 +3193,16 @@ gdm_session_start_session (GdmSession *self,
                   */
                  if (run_launcher) {
                          if (is_x11) {
@@ -79,7 +79,7 @@ index 4b709731..245ac0cf 100644
                  }
          }
 diff --git a/data/gdm.service.in b/data/gdm.service.in
-index 17e8a8de..afc70977 100644
+index 17e8a8de8..afc709778 100644
 --- a/data/gdm.service.in
 +++ b/data/gdm.service.in
 @@ -26,7 +26,7 @@ Restart=always
diff --git a/pkgs/desktops/gnome/core/gnome-backgrounds/default.nix b/pkgs/desktops/gnome/core/gnome-backgrounds/default.nix
index 808ff7c0c293c..f60631ac2280a 100644
--- a/pkgs/desktops/gnome/core/gnome-backgrounds/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-backgrounds/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-backgrounds";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-backgrounds/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "zuDmiPuuXvenXzNa2i0Qd54I68qURfFYbeMsWptt7i0=";
+    hash = "sha256-Td06xDmkoGeHaAWSG7dfTTyLhaIY1Hwnbd3eiShEPC4=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-bluetooth/1.0/default.nix b/pkgs/desktops/gnome/core/gnome-bluetooth/1.0/default.nix
index 9389127e578c2..526363a613938 100644
--- a/pkgs/desktops/gnome/core/gnome-bluetooth/1.0/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-bluetooth/1.0/default.nix
@@ -12,7 +12,7 @@
 , udev
 , itstool
 , libxml2
-, wrapGAppsHook
+, wrapGAppsHook3
 , libnotify
 , libcanberra-gtk3
 , gobject-introspection
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     itstool
     pkg-config
     libxml2
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     gtk-doc
     docbook-xsl-nons
diff --git a/pkgs/desktops/gnome/core/gnome-bluetooth/default.nix b/pkgs/desktops/gnome/core/gnome-bluetooth/default.nix
index b9701f3d5e11e..8b1fd59d3f8cc 100644
--- a/pkgs/desktops/gnome/core/gnome-bluetooth/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-bluetooth/default.nix
@@ -27,14 +27,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-bluetooth";
-  version = "42.8";
+  version = "46.0";
 
   # TODO: split out "lib"
   outputs = [ "out" "dev" "devdoc" "man" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "dsJB6MosmxA1NkU1yiYIT4n8XA4YKVEPiQlYMRX8wts=";
+    hash = "sha256-E/4edfMXrNvfXoDJAp0uBjLWCpzPcqQ64263VFAh++8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-calculator/default.nix b/pkgs/desktops/gnome/core/gnome-calculator/default.nix
index 0ea86b7b45118..059ca6522e835 100644
--- a/pkgs/desktops/gnome/core/gnome-calculator/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-calculator/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , lib
+, appstream
 , meson
 , ninja
 , vala
@@ -24,14 +25,15 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-calculator";
-  version = "45.0.2";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-calculator/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "fcvzI4SJcXHL5Ug+xmTZlOXnVekSrh35EWJPA8kIZ8I=";
+    hash = "sha256-RGlP2mtiM5I/XBCkjQLSz1ck4BGoqFeJB0yVMQHzO/E=";
   };
 
   nativeBuildInputs = [
+    appstream
     meson
     ninja
     pkg-config
@@ -70,7 +72,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Calculator";
+    homepage = "https://apps.gnome.org/Calculator/";
     description = "Application that solves mathematical equations and is suitable as a default application in a Desktop environment";
     maintainers = teams.gnome.members;
     license = licenses.gpl3Plus;
diff --git a/pkgs/desktops/gnome/core/gnome-color-manager/default.nix b/pkgs/desktops/gnome/core/gnome-color-manager/default.nix
index 7c9d3df9f1c02..786e19277e8de 100644
--- a/pkgs/desktops/gnome/core/gnome-color-manager/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-color-manager/default.nix
@@ -58,6 +58,7 @@ stdenv.mkDerivation rec {
     updateScript = gnome.updateScript {
       packageName = pname;
       attrPath = "gnome.${pname}";
+      freeze = true;
     };
   };
 
diff --git a/pkgs/desktops/gnome/core/gnome-contacts/default.nix b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
index 9e41193c03c56..5dd008cc5c035 100644
--- a/pkgs/desktops/gnome/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
@@ -11,7 +11,6 @@
 , gtk4
 , glib
 , libportal-gtk4
-, gnome-desktop
 , gnome-online-accounts
 , qrencode
 , wrapGAppsHook4
@@ -27,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-contacts";
-  version = "45.1";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-contacts/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "gj9WCe7NkMQk3T5khXKHvBMh+23+KJJKR0/w6azyG3U=";
+    hash = "sha256-cK606DWhx3+bzH5XotzCN22TvbYXVxYYJXRF9WxjcN8=";
   };
 
   nativeBuildInputs = [
@@ -54,7 +53,6 @@ stdenv.mkDerivation rec {
     evolution-data-server-gtk4
     gsettings-desktop-schemas
     folks
-    gnome-desktop
     libadwaita
     libxml2
     gnome-online-accounts
@@ -71,7 +69,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Contacts";
+    homepage = "https://apps.gnome.org/Contacts/";
     description = "GNOME’s integrated address book";
     mainProgram = "gnome-contacts";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/core/gnome-control-center/default.nix b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
index 48566ba66945c..b3b5d2594d219 100644
--- a/pkgs/desktops/gnome/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
@@ -7,13 +7,14 @@
 , colord
 , colord-gtk4
 , cups
+, dbus
 , docbook-xsl-nons
 , fontconfig
 , gdk-pixbuf
 , gettext
 , glib
 , glib-networking
-, gcr
+, gcr_4
 , glibc
 , gnome-bluetooth
 , gnome-color-manager
@@ -37,7 +38,9 @@
 , librsvg
 , webp-pixbuf-loader
 , libsecret
+, libsoup_3
 , libwacom
+, libXi
 , libxml2
 , libxslt
 , meson
@@ -69,11 +72,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-control-center";
-  version = "45.3";
+  version = "46.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-control-center/${lib.versions.major finalAttrs.version}/gnome-control-center-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-selJxOhsBiTsam7Q3wnJ+uKyKYPB3KYO2GrsjvCyQAQ=";
+    hash = "sha256-gXkkIwGd7aHSoHTB7Pan5u8xcsCcvm9NeZWktd6igxI=";
   };
 
   patches = [
@@ -102,12 +105,12 @@ stdenv.mkDerivation (finalAttrs: {
     adwaita-icon-theme
     colord
     colord-gtk4
-    libepoxy
+    cups
     fontconfig
     gdk-pixbuf
     glib
     glib-networking
-    gcr
+    gcr_4
     gnome-bluetooth
     gnome-desktop
     gnome-online-accounts
@@ -119,6 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
     gsound
     gtk4
     ibus
+    libepoxy
     libgtop
     libgudev
     libadwaita
@@ -128,7 +132,9 @@ stdenv.mkDerivation (finalAttrs: {
     libpwquality
     librsvg
     libsecret
+    libsoup_3
     libwacom
+    libXi
     libxml2
     modemmanager
     mutter # schemas for the keybindings
@@ -146,6 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]);
 
   nativeCheckInputs = [
+    dbus
     python3.pkgs.python-dbusmock
     setxkbmap
     xvfb-run
diff --git a/pkgs/desktops/gnome/core/gnome-control-center/paths.patch b/pkgs/desktops/gnome/core/gnome-control-center/paths.patch
index be2ca4b5e09e6..41dd5979aa4bc 100644
--- a/pkgs/desktops/gnome/core/gnome-control-center/paths.patch
+++ b/pkgs/desktops/gnome/core/gnome-control-center/paths.patch
@@ -37,10 +37,10 @@ index f6c84e3d2..cd897f8f5 100644
      gtk_widget_set_sensitive (self->toolbutton_profile_view, TRUE);
    else
      gtk_widget_set_sensitive (self->toolbutton_profile_view, FALSE);
-diff --git a/panels/datetime/tz.h b/panels/datetime/tz.h
+diff --git a/panels/system/datetime/tz.h b/panels/system/datetime/tz.h
 index feef16580..4b88ef7b1 100644
---- a/panels/datetime/tz.h
-+++ b/panels/datetime/tz.h
+--- a/panels/system/datetime/tz.h
++++ b/panels/system/datetime/tz.h
 @@ -27,11 +27,7 @@
  
  G_BEGIN_DECLS
@@ -67,37 +67,6 @@ index ec5a905a5..689fdbebe 100644
  
          if (self->is_new_connection) {
                  g_autofree gchar *type_str = NULL;
-diff --git a/panels/network/net-device-bluetooth.c b/panels/network/net-device-bluetooth.c
-index 303f4a8af..e5afc4dff 100644
---- a/panels/network/net-device-bluetooth.c
-+++ b/panels/network/net-device-bluetooth.c
-@@ -80,7 +80,7 @@ nm_device_bluetooth_refresh_ui (NetDeviceBluetooth *self)
-         update_off_switch_from_device_state (self->device_off_switch, state, self);
- 
-         /* set up the Options button */
--        path = g_find_program_in_path ("nm-connection-editor");
-+        path = g_find_program_in_path ("@networkmanagerapplet@/bin/nm-connection-editor");
-         gtk_widget_set_visible (GTK_WIDGET (self->options_button), state != NM_DEVICE_STATE_UNMANAGED && path != NULL);
- }
- 
-@@ -131,7 +131,7 @@ options_button_clicked_cb (NetDeviceBluetooth *self)
- 
-         connection = net_device_get_find_connection (self->client, self->device);
-         uuid = nm_connection_get_uuid (connection);
--        cmdline = g_strdup_printf ("nm-connection-editor --edit %s", uuid);
-+        cmdline = g_strdup_printf ("@networkmanagerapplet@/bin/nm-connection-editor --edit %s", uuid);
-         g_debug ("Launching '%s'\n", cmdline);
-         if (!g_spawn_command_line_async (cmdline, &error))
-                 g_warning ("Failed to launch nm-connection-editor: %s", error->message);
-@@ -173,7 +173,7 @@ net_device_bluetooth_init (NetDeviceBluetooth *self)
- 
-         gtk_widget_init_template (GTK_WIDGET (self));
- 
--        path = g_find_program_in_path ("nm-connection-editor");
-+        path = g_find_program_in_path ("@networkmanagerapplet@/bin/nm-connection-editor");
-         gtk_widget_set_visible (GTK_WIDGET (self->options_button), path != NULL);
- }
- 
 diff --git a/panels/network/net-device-mobile.c b/panels/network/net-device-mobile.c
 index 166670224..36f720d36 100644
 --- a/panels/network/net-device-mobile.c
@@ -133,10 +102,10 @@ index a31a606e3..ed5133d29 100644
    argv[1] = g_strdup (priv->hostname);
  
    /* Use SNMP to get printer's informations */
-diff --git a/panels/user-accounts/run-passwd.c b/panels/user-accounts/run-passwd.c
+diff --git a/panels/system/users/run-passwd.c b/panels/system/users/run-passwd.c
 index edbc99830..1e1d90141 100644
---- a/panels/user-accounts/run-passwd.c
-+++ b/panels/user-accounts/run-passwd.c
+--- a/panels/system/users/run-passwd.c
++++ b/panels/system/users/run-passwd.c
 @@ -152,7 +152,7 @@ spawn_passwd (PasswdHandler *passwd_handler, GError **error)
          gchar  **envp;
          gint    my_stdin, my_stdout;
@@ -146,10 +115,10 @@ index edbc99830..1e1d90141 100644
          argv[1] = NULL;
  
          envp = g_get_environ ();
-diff --git a/panels/user-accounts/user-utils.c b/panels/user-accounts/user-utils.c
+diff --git a/panels/system/users/user-utils.c b/panels/system/users/user-utils.c
 index 5b7bc1f02..13ffe6ca8 100644
---- a/panels/user-accounts/user-utils.c
-+++ b/panels/user-accounts/user-utils.c
+--- a/panels/system/users/user-utils.c
++++ b/panels/system/users/user-utils.c
 @@ -215,7 +215,7 @@ is_valid_username_async (const gchar *username,
           * future, so it would be nice to have some official way for this
           * instead of relying on the current "--login" implementation.
diff --git a/pkgs/desktops/gnome/core/gnome-dictionary/default.nix b/pkgs/desktops/gnome/core/gnome-dictionary/default.nix
index d5dfce9f7ed0f..0fed6638f97e7 100644
--- a/pkgs/desktops/gnome/core/gnome-dictionary/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-dictionary/default.nix
@@ -11,7 +11,7 @@
 , libxml2
 , gettext
 , itstool
-, wrapGAppsHook
+, wrapGAppsHook3
 , docbook_xsl
 , docbook_xml_dtd_43
 , gnome
@@ -33,13 +33,13 @@ stdenv.mkDerivation rec {
     # Fix test dependencies with meson 0.57, can be removed on next bump
     # We need to explicitly depend on the generated files.
     (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-dictionary/-/commit/87c026cfe4acbcfc62d15950f88a71d8d9678c7e.patch";
+      url = "https://gitlab.gnome.org/Archive/gnome-dictionary/-/commit/87c026cfe4acbcfc62d15950f88a71d8d9678c7e.patch";
       sha256 = "tKesWeOK3OqOxrXm4dZvCZHHdTD7AQbYDjtYDCsLd3A=";
     })
     # Fix build with meson 0.61, can be removed on next bump
     # data/appdata/meson.build:3:5: ERROR: Function does not take positional arguments.
     (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-dictionary/-/commit/cf3f8a67cd6f3059c555ed9cf0f5fba10abb7f68.patch";
+      url = "https://gitlab.gnome.org/Archive/gnome-dictionary/-/commit/cf3f8a67cd6f3059c555ed9cf0f5fba10abb7f68.patch";
       sha256 = "cIRM6ACqsnEo2JWYvr6EBye5o0BudugZMShCe1U5hz8=";
     })
   ];
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     libxml2
     gettext
     itstool
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Dictionary";
+    homepage = "https://gitlab.gnome.org/Archive/gnome-dictionary";
     description = "Dictionary is the GNOME application to look up definitions";
     mainProgram = "gnome-dictionary";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/core/gnome-disk-utility/default.nix b/pkgs/desktops/gnome/core/gnome-disk-utility/default.nix
index a35e6921ff257..dcd376fda1856 100644
--- a/pkgs/desktops/gnome/core/gnome-disk-utility/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-disk-utility/default.nix
@@ -11,7 +11,7 @@
 , ninja
 , gtk3
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , libnotify
 , itstool
 , gnome
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-disk-utility";
-  version = "45.1";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-disk-utility/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-VA/07JprljAAP/TNYNYk85/nDyWpVZ5TMziWA8hblSk=";
+    hash = "sha256-RkZJFIxtZ3HxrC6/5DpOUZIFsRwtkUoJ8qABgh0GlX0=";
   };
 
   nativeBuildInputs = [
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     libxslt
     docbook-xsl-nons
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
     libxml2
   ];
 
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Disks";
+    homepage = "https://apps.gnome.org/DiskUtility/";
     description = "A udisks graphical front-end";
     maintainers = teams.gnome.members;
     license = licenses.gpl2Plus;
diff --git a/pkgs/desktops/gnome/core/gnome-font-viewer/default.nix b/pkgs/desktops/gnome/core/gnome-font-viewer/default.nix
index 9e5003ae2f35d..5a0f8d82cb535 100644
--- a/pkgs/desktops/gnome/core/gnome-font-viewer/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-font-viewer/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-font-viewer";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-font-viewer/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "l8traN2mDeCrMDg4NYbx5LwdpaSPRAJb1rvnTqBcKwg=";
+    hash = "sha256-WS9AHkhdAswETUh7tcjgTJYdpoViFnaKWfH/mL0tU3w=";
   };
 
   doCheck = true;
diff --git a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
index d20700233aa76..055c811263dbe 100644
--- a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
@@ -16,14 +16,11 @@
 , geocode-glib_2
 , glib
 , gnome-desktop
-, gnome-online-accounts
-, gtk3
 , gtk4
 , libgweather
 , json-glib
 , krb5
 , libpwquality
-, librest_1_0
 , libsecret
 , networkmanager
 , pango
@@ -39,11 +36,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-initial-setup";
-  version = "45.4.1";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Nj4JqjMI5/QHTgZiU6AYKzIqtgN2dD3heLu0AOVLqO4=";
+    hash = "sha256-+O6dzqfjXnNeqjvI0QQdBrtk6/HhBG5ejkjx+0QVGEc=";
   };
 
   patches = [
@@ -72,9 +69,7 @@ stdenv.mkDerivation rec {
     geocode-glib_2
     glib
     gnome-desktop
-    gnome-online-accounts
     gsettings-desktop-schemas
-    gtk3
     gtk4
     json-glib
     krb5
@@ -82,7 +77,6 @@ stdenv.mkDerivation rec {
     libadwaita
     libnma-gtk4
     libpwquality
-    librest_1_0
     libsecret
     networkmanager
     pango
diff --git a/pkgs/desktops/gnome/core/gnome-keyring/default.nix b/pkgs/desktops/gnome/core/gnome-keyring/default.nix
index 61247a1dc75ca..472d9a413513c 100644
--- a/pkgs/desktops/gnome/core/gnome-keyring/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-keyring/default.nix
@@ -15,7 +15,7 @@
 , libselinux
 , p11-kit
 , openssh
-, wrapGAppsHook
+, wrapGAppsHook3
 , docbook-xsl-nons
 , docbook_xml_dtd_43
 , gnome
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-keyring";
-  version = "42.1";
+  version = "46.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-keyring/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "x/TQQMx2prf+Z+CO+RBpEcPIDUD8iMv8jiaEpMlG4+Y=";
+    hash = "sha256-sdOukTL/L4s/JaGQeQiSlo49Cs+VKkh+QPZEqFUM4/Y=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
     docbook-xsl-nons
     docbook_xml_dtd_43
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -60,6 +60,9 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-pkcs11-config=${placeholder "out"}/etc/pkcs11/" # installation directories
     "--with-pkcs11-modules=${placeholder "out"}/lib/pkcs11/"
+    # gnome-keyring doesn't build with ssh-agent by default anymore, we need to
+    # switch to using gcr https://github.com/NixOS/nixpkgs/issues/140824
+    "--enable-ssh-agent"
   ];
 
   # Tends to fail non-deterministically.
diff --git a/pkgs/desktops/gnome/core/gnome-online-miners/default.nix b/pkgs/desktops/gnome/core/gnome-online-miners/default.nix
index 219d32284b825..8cc2689f29448 100644
--- a/pkgs/desktops/gnome/core/gnome-online-miners/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-online-miners/default.nix
@@ -21,7 +21,7 @@
 , gmp
 , openssl
 , dleyna-server
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
 
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
index 4a46eab357618..abd6d2102679a 100644
--- a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchurl
 , cairo
 , meson
@@ -6,7 +7,7 @@
 , pkg-config
 , python3
 , asciidoc
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , libei
 , libepoxy
@@ -16,22 +17,24 @@
 , systemd
 , libsecret
 , libnotify
+, libopus
 , libxkbcommon
 , gdk-pixbuf
-, freerdp
+, freerdp3
 , fdk_aac
 , tpm2-tss
 , fuse3
 , gnome
+, polkit
 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-remote-desktop";
-  version = "45.1";
+  version = "46.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-3NnBisIwZpVjH88AqIZFw443DroFxp3zn1QCBNTq/Y0=";
+    hash = "sha256-fGKkKB/fqVIhEK/7910JlzA18q3H+kV3UR1zMYa+to8=";
   };
 
   nativeBuildInputs = [
@@ -40,12 +43,12 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     asciidoc
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
     cairo
-    freerdp
+    freerdp3
     fdk_aac
     tpm2-tss
     fuse3
@@ -56,15 +59,23 @@ stdenv.mkDerivation rec {
     libdrm
     nv-codec-headers-11
     libnotify
+    libopus
     libsecret
     libxkbcommon
     pipewire
     systemd
+    polkit # For polkit-gobject
   ];
 
   mesonFlags = [
+    "-Dconf_dir=/etc/gnome-remote-desktop"
     "-Dsystemd_user_unit_dir=${placeholder "out"}/lib/systemd/user"
+    "-Dsystemd_system_unit_dir=${placeholder "out"}/lib/systemd/system"
+    "-Dsystemd_sysusers_dir=${placeholder "out"}/lib/sysusers.d"
+    "-Dsystemd_tmpfiles_dir=${placeholder "out"}/lib/tmpfiles.d"
     "-Dtests=false" # Too deep of a rabbit hole.
+    # TODO: investigate who should be fixed here.
+    "-Dc_args=-I${freerdp3}/include/winpr3"
   ];
 
   passthru = {
diff --git a/pkgs/desktops/gnome/core/gnome-screenshot/default.nix b/pkgs/desktops/gnome/core/gnome-screenshot/default.nix
index 0a345fe0d8c9a..b8fa9a9f0c29e 100644
--- a/pkgs/desktops/gnome/core/gnome-screenshot/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-screenshot/default.nix
@@ -12,7 +12,7 @@
 , meson
 , ninja
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , appstream-glib
 , desktop-file-utils
 , gnome
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     libxml2
     desktop-file-utils
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-session/ctl.nix b/pkgs/desktops/gnome/core/gnome-session/ctl.nix
index 09fc80bf9ef88..10b59d660bef1 100644
--- a/pkgs/desktops/gnome/core/gnome-session/ctl.nix
+++ b/pkgs/desktops/gnome/core/gnome-session/ctl.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , glib
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-session/default.nix b/pkgs/desktops/gnome/core/gnome-session/default.nix
index 967fbc9478a6d..5d4504b908527 100644
--- a/pkgs/desktops/gnome/core/gnome-session/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-session/default.nix
@@ -30,13 +30,13 @@
 stdenv.mkDerivation rec {
   pname = "gnome-session";
   # Also bump ./ctl.nix when bumping major version.
-  version = "45.0";
+  version = "46.0";
 
   outputs = [ "out" "sessions" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-session/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "cG0v/KysOFU6PAGFeT9aK0qslAu154nZU8mAgWO+8vE=";
+    hash = "sha256-xuFiSvYJC8ThoZH+Imir+nqN4HgxynpX8hfmeb97mlQ=";
   };
 
   patches = [
@@ -76,11 +76,6 @@ stdenv.mkDerivation rec {
     libepoxy
   ];
 
-  mesonFlags = [
-    "-Dsystemd=true"
-    "-Dsystemd_session=default"
-  ];
-
   postPatch = ''
     chmod +x meson_post_install.py # patchShebangs requires executable file
     patchShebangs meson_post_install.py
diff --git a/pkgs/desktops/gnome/core/gnome-settings-daemon/43/default.nix b/pkgs/desktops/gnome/core/gnome-settings-daemon/43/default.nix
index 95eb6fe1d25e1..6e87a2ab6e3b5 100644
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/43/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-settings-daemon/43/default.nix
@@ -33,7 +33,7 @@
 , gnome-desktop
 , geocode-glib_2
 , docbook_xsl
-, wrapGAppsHook
+, wrapGAppsHook3
 , python3
 , tzdata
 , nss
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     libxml2
     libxslt
     docbook_xsl
-    wrapGAppsHook
+    wrapGAppsHook3
     python3
   ];
 
diff --git a/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix b/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
index 1719127a6cbcf..4284a68ee3e70 100644
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
@@ -31,7 +31,7 @@
 , gnome-desktop
 , geocode-glib_2
 , docbook_xsl
-, wrapGAppsHook
+, wrapGAppsHook3
 , python3
 , tzdata
 , gcr_4
@@ -40,11 +40,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-settings-daemon";
-  version = "45.1";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-settings-daemon/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "xiv+yYF+7luD6+kBqShhiaZ+tf8DPF3UFQZXT4Ir8JA=";
+    hash = "sha256-C5oPZPoYqOfgm0yVo/dU+gM8LNvS3DVwHwYYVywcs9c=";
   };
 
   patches = [
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
     libxml2
     libxslt
     docbook_xsl
-    wrapGAppsHook
+    wrapGAppsHook3
     python3
   ];
 
diff --git a/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix b/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix
index 6f4fdc8f77ea0..2fd711266938b 100644
--- a/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell-extensions";
-  version = "45.2";
+  version = "46.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell-extensions/${lib.versions.major finalAttrs.version}/gnome-shell-extensions-${finalAttrs.version}.tar.xz";
-    sha256 = "7jL2OHotGK2/96lWaJvHR4ZrSocS1zeQwAKr6uTMqq8=";
+    hash = "sha256-xbpQcA2nephvAGC+7az8AX5+yCKD8qY4SEKggHvEVT8=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-shell/default.nix b/pkgs/desktops/gnome/core/gnome-shell/default.nix
index d00c97a06b579..9fdffcfd8c920 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@@ -12,8 +12,7 @@
 , python3
 , polkit
 , networkmanager
-, gtk-doc
-, docbook-xsl-nons
+, gi-docgen
 , at-spi2-core
 , libstartup_notification
 , unzip
@@ -24,7 +23,6 @@
 , webp-pixbuf-loader
 , geoclue2
 , perl
-, docbook_xml_dtd_45
 , desktop-file-utils
 , libpulseaudio
 , libical
@@ -68,13 +66,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell";
-  version = "45.5";
+  version = "46.1";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major finalAttrs.version}/gnome-shell-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-vVw9PQKNRyM+QgUiPwrAKsmpc7aZvCd0OQlNQaeNarA=";
+    hash = "sha256-ZPmZhEwQHmO/KU1FsTjeVjGa0vMmKCchqtD6hgZTs2k=";
   };
 
   patches = [
@@ -101,8 +99,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Work around failing fingerprint auth
     (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/gnome-shell/raw/9a647c460b651aaec0b8a21f046cc289c1999416/f/0001-gdm-Work-around-failing-fingerprint-auth.patch";
-      sha256 = "pFvZli3TilUt6YwdZztpB8Xq7O60XfuWUuPMMVSpqLw=";
+      url = "https://src.fedoraproject.org/rpms/gnome-shell/raw/dcd112d9708954187e7490564c2229d82ba5326f/f/0001-gdm-Work-around-failing-fingerprint-auth.patch";
+      hash = "sha256-mgXty5HhiwUO1UV3/eDgWtauQKM0cRFQ0U7uocST25s=";
     })
   ];
 
@@ -111,9 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     gettext
-    docbook-xsl-nons
-    docbook_xml_dtd_45
-    gtk-doc
+    gi-docgen
     perl
     wrapGAppsHook4
     sassc
@@ -213,6 +209,9 @@ stdenv.mkDerivation (finalAttrs: {
     for svc in org.gnome.ScreenSaver org.gnome.Shell.Extensions org.gnome.Shell.Notifications org.gnome.Shell.Screencast; do
       wrapGApp $out/share/gnome-shell/$svc
     done
+
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
   '';
 
   separateDebugInfo = true;
diff --git a/pkgs/desktops/gnome/core/gnome-shell/fix-paths.patch b/pkgs/desktops/gnome/core/gnome-shell/fix-paths.patch
index e27847378bb21..a87f5129152f1 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/fix-paths.patch
+++ b/pkgs/desktops/gnome/core/gnome-shell/fix-paths.patch
@@ -56,16 +56,3 @@ index 11fb4b6b7..e00e4807b 100644
                                 NULL);
  
        if (!g_subprocess_wait_check (proc, NULL, &error))
-diff --git a/subprojects/extensions-tool/src/command-pack.c b/subprojects/extensions-tool/src/command-pack.c
-index f2cfcd51a..2a9a7efdf 100644
---- a/subprojects/extensions-tool/src/command-pack.c
-+++ b/subprojects/extensions-tool/src/command-pack.c
-@@ -168,7 +168,7 @@ extension_pack_add_schemas (ExtensionPack  *pack,
- #else
-   dstpath = g_file_get_path (dstdir);
-   proc = g_subprocess_new (G_SUBPROCESS_FLAGS_STDERR_SILENCE, error,
--                           "glib-compile-schemas", "--strict", dstpath, NULL);
-+                           "@glib_compile_schemas@", "--strict", dstpath, NULL);
- 
-   if (!g_subprocess_wait_check (proc, NULL, error))
-     return FALSE;
diff --git a/pkgs/desktops/gnome/core/gnome-shell/greeter-logo-size.patch b/pkgs/desktops/gnome/core/gnome-shell/greeter-logo-size.patch
index e58610ddc2b29..93965a475216f 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/greeter-logo-size.patch
+++ b/pkgs/desktops/gnome/core/gnome-shell/greeter-logo-size.patch
@@ -1,16 +1,16 @@
 diff --git a/js/gdm/loginDialog.js b/js/gdm/loginDialog.js
-index a3e4372b4..36f6c1f47 100644
+index 28db1a9de..805b686bf 100644
 --- a/js/gdm/loginDialog.js
 +++ b/js/gdm/loginDialog.js
-@@ -43,6 +43,7 @@ import * as UserWidget from '../ui/userWidget.js';
- const _FADE_ANIMATION_TIME = 250;
+@@ -46,6 +46,7 @@ const _FADE_ANIMATION_TIME = 250;
  const _SCROLL_ANIMATION_TIME = 500;
  const _TIMED_LOGIN_IDLE_THRESHOLD = 5.0;
+ const _CONFLICTING_SESSION_DIALOG_TIMEOUT = 60;
 +const _LOGO_ICON_HEIGHT = 48;
  
  export const UserListItem = GObject.registerClass({
      Signals: {'activate': {}},
-@@ -839,7 +840,7 @@ export const LoginDialog = GObject.registerClass({
+@@ -908,7 +909,7 @@ export const LoginDialog = GObject.registerClass({
              const scaleFactor = St.ThemeContext.get_for_stage(global.stage).scale_factor;
              const texture = this._textureCache.load_file_async(
                  this._logoFile,
diff --git a/pkgs/desktops/gnome/core/gnome-software/default.nix b/pkgs/desktops/gnome/core/gnome-software/default.nix
index f45f643cb57d8..c74dd74571dfd 100644
--- a/pkgs/desktops/gnome/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-software/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , substituteAll
 , pkg-config
 , meson
@@ -46,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnome-software";
-  version = "45.3";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "1rkkWyIjfae9FzndKMI8yPODX5n6EMEDfZ3XY1M1JRw=";
+    hash = "sha256-EYkwAru1QIKJZoNwe8OZGuVaLzBAgRp2DjqSyWVE+G4=";
   };
 
   patches = [
@@ -58,17 +57,6 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit isocodes;
     })
-
-    # Add support for AppStream 1.0.
-    # https://gitlab.gnome.org/GNOME/gnome-software/-/issues/2393
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-software/-/commit/0655f358ed0e8455e12d9634f60bc4dbaee434e3.patch";
-      hash = "sha256-8IXXUfNeha5yRlRLuxQV8whwQmyNw7Aoi/r5NNFS/zA=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-software/-/commit/e431ab003f3fabf616b6eb7dc93f8967bc9473e5.patch";
-      hash = "sha256-Y5GcC1XMbb9Bl2/VKFnrV1B/ipLKxY4guse25LhxhKM=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -130,7 +118,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Software store that lets you install and update applications and system extensions";
     mainProgram = "gnome-software";
-    homepage = "https://wiki.gnome.org/Apps/Software";
+    homepage = "https://apps.gnome.org/Software/";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome/core/gnome-system-monitor/default.nix b/pkgs/desktops/gnome/core/gnome-system-monitor/default.nix
index eef86a4603714..bc7caa3ad27b5 100644
--- a/pkgs/desktops/gnome/core/gnome-system-monitor/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-system-monitor/default.nix
@@ -3,13 +3,13 @@
 , gettext
 , fetchurl
 , pkg-config
-, gtkmm3
+, gtkmm4
 , libxml2
 , bash
-, gtk3
-, libhandy
+, gtk4
+, libadwaita
 , glib
-, wrapGAppsHook
+, wrapGAppsHook4
 , meson
 , ninja
 , gsettings-desktop-schemas
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-system-monitor";
-  version = "45.0.2";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-system-monitor/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "xeJy2Qv5mGo/hhPXbg0n+kLfrO5cAZLnOSG7lLGGii4=";
+    hash = "sha256-U3YkgVjGhsMIJVRy6MKp5MFyVWQsFJ/HGYxtA05UdZk=";
   };
 
   patches = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     itstool
-    wrapGAppsHook
+    wrapGAppsHook4
     meson
     ninja
     glib
@@ -47,11 +47,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     bash
-    gtk3
-    libhandy
+    gtk4
+    libadwaita
     glib
     libxml2
-    gtkmm3
+    gtkmm4
     libgtop
     gdk-pixbuf
     gnome.adwaita-icon-theme
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/SystemMonitor";
+    homepage = "https://apps.gnome.org/SystemMonitor/";
     description = "System Monitor shows you what programs are running and how much processor time, memory, and disk space are being used";
     mainProgram = "gnome-system-monitor";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/core/gnome-terminal/default.nix b/pkgs/desktops/gnome/core/gnome-terminal/default.nix
index 92d1a7a37ecfc..85067754f2903 100644
--- a/pkgs/desktops/gnome/core/gnome-terminal/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-terminal/default.nix
@@ -21,7 +21,7 @@
 , vala
 , desktop-file-utils
 , itstool
-, wrapGAppsHook
+, wrapGAppsHook3
 , pcre2
 , libxslt
 , docbook-xsl-nons
@@ -30,14 +30,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-terminal";
-  version = "3.50.1";
+  version = "3.52.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gnome-terminal";
     rev = version;
-    sha256 = "sha256-lJAzmz8tvEbr371VtYjlV4+z3cSy4QrmP0vmD5WiJD4=";
+    hash = "sha256-6+6/fgGlSM/57+n0SopuF0ZY9htma5usIgxy2BBAC+M=";
   };
 
   nativeBuildInputs = [
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     docbook-xsl-nons
     vala
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
     pcre2
     python3
   ];
@@ -96,7 +96,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "The GNOME Terminal Emulator";
     mainProgram = "gnome-terminal";
-    homepage = "https://wiki.gnome.org/Apps/Terminal";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-terminal";
     platforms = platforms.linux;
     license = licenses.gpl3Plus;
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/core/gnome-tour/default.nix b/pkgs/desktops/gnome/core/gnome-tour/default.nix
index c6d58c480581e..0cc5c596bb5c2 100644
--- a/pkgs/desktops/gnome/core/gnome-tour/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-tour/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-tour";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-W+S470uPTV7KzMMQSNtuCFqPe/+tqghDuOiniP8dre4=";
+    hash = "sha256-8yZSqp1+8GQ3YM5jkyCCz9NkHnczt2xCm3jQl4O3xGo=";
   };
 
   cargoVendorDir = "vendor";
diff --git a/pkgs/desktops/gnome/core/gucharmap/default.nix b/pkgs/desktops/gnome/core/gucharmap/default.nix
index 83706f36ab4b9..2d0dd7553965f 100644
--- a/pkgs/desktops/gnome/core/gucharmap/default.nix
+++ b/pkgs/desktops/gnome/core/gucharmap/default.nix
@@ -12,7 +12,7 @@
 , glib
 , desktop-file-utils
 , gtk-doc
-, wrapGAppsHook
+, wrapGAppsHook3
 , itstool
 , libxml2
 , yelp-tools
@@ -63,7 +63,7 @@ in stdenv.mkDerivation rec {
     ninja
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
     unzip
     intltool
     itstool
@@ -106,7 +106,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "GNOME Character Map, based on the Unicode Character Database";
     mainProgram = "gucharmap";
-    homepage = "https://wiki.gnome.org/Apps/Gucharmap";
+    homepage = "https://gitlab.gnome.org/GNOME/gucharmap";
     license = licenses.gpl3;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome/core/mutter/43/default.nix b/pkgs/desktops/gnome/core/mutter/43/default.nix
index 63110d9d90d3e..9d40303fad2eb 100644
--- a/pkgs/desktops/gnome/core/mutter/43/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/43/default.nix
@@ -37,7 +37,7 @@
 , gnome-settings-daemon
 , xorgserver
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gi-docgen
 , sysprof
 , libsysprof-capture
@@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     xvfb-run
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
     gi-docgen
     xorgserver
     gobject-introspection
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index 570d954766a08..0efd14124a371 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -36,6 +36,7 @@
 , libinput
 , libdrm
 , libei
+, libdisplay-info
 , gsettings-desktop-schemas
 , glib
 , atk
@@ -67,13 +68,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mutter";
-  version = "45.5";
+  version = "46.1";
 
   outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-UcMyS4qXX5luWsaTqzhWPElubxQubNM1e0lQ0lAzSHQ=";
+    hash = "sha256-Y7JmDdD6GT+mYsgO4S64sW8rjDvDiWNmIAx5lDgk1R0=";
   };
 
   mesonFlags = [
@@ -125,6 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
     libcanberra
     libdrm
     libei
+    libdisplay-info
     libgudev
     libinput
     libstartup_notification
@@ -172,7 +174,7 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
     # TODO: Move this into a directory devhelp can find.
-    moveToOutput "share/mutter-13/doc" "$devdoc"
+    moveToOutput "share/mutter-14/doc" "$devdoc"
   '';
 
   # Install udev files into our own tree.
@@ -181,7 +183,7 @@ stdenv.mkDerivation (finalAttrs: {
   separateDebugInfo = true;
 
   passthru = {
-    libdir = "${finalAttrs.finalPackage}/lib/mutter-13";
+    libdir = "${finalAttrs.finalPackage}/lib/mutter-14";
 
     tests = {
       libdirExists = runCommand "mutter-libdir-exists" {} ''
diff --git a/pkgs/desktops/gnome/core/nautilus/default.nix b/pkgs/desktops/gnome/core/nautilus/default.nix
index 9279d967ccbff..063914060dfee 100644
--- a/pkgs/desktops/gnome/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome/core/nautilus/default.nix
@@ -7,7 +7,6 @@
 , gi-docgen
 , docbook-xsl-nons
 , gettext
-, libxml2
 , desktop-file-utils
 , wrapGAppsHook4
 , gtk4
@@ -39,13 +38,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nautilus";
-  version = "45.2.1";
+  version = "46.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/nautilus/${lib.versions.major finalAttrs.version}/nautilus-${finalAttrs.version}.tar.xz";
-    sha256 = "ul1T3zmhVVYt+XHvXjHoJwdJBdDEjqseskIaEChLmQ0=";
+    hash = "sha256-zBpf3x3XL5Lp4/PHrSY3CaDeU5Golb6TRPamf0OIe9c=";
   };
 
   patches = [
@@ -63,7 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
     desktop-file-utils
     gettext
     gobject-introspection
-    libxml2
     meson
     ninja
     pkg-config
@@ -128,7 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     description = "The file manager for GNOME";
-    homepage = "https://wiki.gnome.org/Apps/Files";
+    homepage = "https://apps.gnome.org/Nautilus/";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/core/nautilus/extension_dir.patch b/pkgs/desktops/gnome/core/nautilus/extension_dir.patch
index a1bdd64f989b6..d7cd161a8dfc5 100644
--- a/pkgs/desktops/gnome/core/nautilus/extension_dir.patch
+++ b/pkgs/desktops/gnome/core/nautilus/extension_dir.patch
@@ -21,6 +21,4 @@ index cd889ff18..e2cd6468e 100644
 +        }
 +
 +        load_module_dir (extensiondir);
- 
-         eel_debug_call_at_shutdown (free_module_objects);
      }
diff --git a/pkgs/desktops/gnome/core/rygel/default.nix b/pkgs/desktops/gnome/core/rygel/default.nix
index c7d59d76525d2..9cc4e1ee8d71a 100644
--- a/pkgs/desktops/gnome/core/rygel/default.nix
+++ b/pkgs/desktops/gnome/core/rygel/default.nix
@@ -7,7 +7,7 @@
 , gettext
 , libxml2
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , python3
 , glib
 , gssdp_1_6
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     gettext
     libxml2
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
     python3
   ];
 
diff --git a/pkgs/desktops/gnome/core/simple-scan/default.nix b/pkgs/desktops/gnome/core/simple-scan/default.nix
index 3aea02678a837..e7f2954ca39f4 100644
--- a/pkgs/desktops/gnome/core/simple-scan/default.nix
+++ b/pkgs/desktops/gnome/core/simple-scan/default.nix
@@ -6,15 +6,15 @@
 , gettext
 , itstool
 , python3
-, wrapGAppsHook
+, wrapGAppsHook4
 , cairo
 , gdk-pixbuf
 , colord
 , glib
-, gtk3
+, libadwaita
+, gtk4
 , gusb
 , packagekit
-, libhandy
 , libwebp
 , libxml2
 , sane-backends
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "simple-scan";
-  version = "44.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Obhw/Ub0R/dH6uzC3yYEnvdzGFCZ8OE8Z1ZWJk3ZjpU=";
+    hash = "sha256-wW5lkBQv5WO+UUMSKzu7U/awCn2p2VL2HEf6Jve08Kk=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     itstool
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook4
     libxml2
     gobject-introspection # For setup hook
     vala
@@ -51,8 +51,8 @@ stdenv.mkDerivation rec {
     colord
     glib
     gusb
-    gtk3
-    libhandy
+    libadwaita
+    gtk4
     libwebp
     packagekit
     sane-backends
diff --git a/pkgs/desktops/gnome/core/sushi/default.nix b/pkgs/desktops/gnome/core/sushi/default.nix
index 0765b7af0be72..c6165869a34e0 100644
--- a/pkgs/desktops/gnome/core/sushi/default.nix
+++ b/pkgs/desktops/gnome/core/sushi/default.nix
@@ -11,7 +11,7 @@
 , libsoup_3
 , webkitgtk_4_1
 , icu
-, wrapGAppsHook
+, wrapGAppsHook3
 , gst_all_1
 , gdk-pixbuf
 , librsvg
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sushi";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/sushi/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "al8UsFo0cf5DhTzCsOGuVITX+fhvfqN2F5gpub9Kwd0=";
+    hash = "sha256-lghbqqQwqyFCxgaqtcR+L7sv0+two1ITfmXFmlig8sY=";
   };
 
   nativeBuildInputs = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     ninja
     gettext
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/totem/default.nix b/pkgs/desktops/gnome/core/totem/default.nix
index 1f6755002f013..56da00923f949 100644
--- a/pkgs/desktops/gnome/core/totem/default.nix
+++ b/pkgs/desktops/gnome/core/totem/default.nix
@@ -13,7 +13,7 @@
 , glib
 , gobject-introspection
 , totem-pl-parser
-, wrapGAppsHook
+, wrapGAppsHook3
 , itstool
 , libxml2
 , vala
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     python3Packages.python
     itstool
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -130,7 +130,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Videos";
+    homepage = "https://apps.gnome.org/Totem/";
     description = "Movie player for the GNOME desktop based on GStreamer";
     maintainers = teams.gnome.members;
     license = licenses.gpl2Plus; # with exception to allow use of non-GPL compatible plug-ins
diff --git a/pkgs/desktops/gnome/core/yelp-xsl/default.nix b/pkgs/desktops/gnome/core/yelp-xsl/default.nix
index 2fa3ec0ecdd40..e440df2423bf3 100644
--- a/pkgs/desktops/gnome/core/yelp-xsl/default.nix
+++ b/pkgs/desktops/gnome/core/yelp-xsl/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Yelp";
+    homepage = "https://gitlab.gnome.org/GNOME/yelp-xsl";
     description = "Yelp's universal stylesheets for Mallard and DocBook";
     maintainers = teams.gnome.members;
     license = with licenses; [
diff --git a/pkgs/desktops/gnome/core/yelp/default.nix b/pkgs/desktops/gnome/core/yelp/default.nix
index ee76194433c38..217c6afab05f3 100644
--- a/pkgs/desktops/gnome/core/yelp/default.nix
+++ b/pkgs/desktops/gnome/core/yelp/default.nix
@@ -13,7 +13,7 @@
 , libxml2
 , libxslt
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     itstool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Yelp";
+    homepage = "https://apps.gnome.org/Yelp/";
     description = "The help viewer in Gnome";
     maintainers = teams.gnome.members;
     license = licenses.gpl2;
diff --git a/pkgs/desktops/gnome/devtools/devhelp/default.nix b/pkgs/desktops/gnome/devtools/devhelp/default.nix
index 6a1bbde4f4c27..4a6577adbe256 100644
--- a/pkgs/desktops/gnome/devtools/devhelp/default.nix
+++ b/pkgs/desktops/gnome/devtools/devhelp/default.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , gnome
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gobject-introspection
 , gi-docgen
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     itstool
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     gi-docgen
     # post install script
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "API documentation browser for GNOME";
     mainProgram = "devhelp";
-    homepage = "https://wiki.gnome.org/Apps/Devhelp";
+    homepage = "https://apps.gnome.org/Devhelp/";
     license = licenses.gpl3Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome/extensions/default.nix b/pkgs/desktops/gnome/extensions/default.nix
index e6aac226f5317..85b4fc5fca001 100644
--- a/pkgs/desktops/gnome/extensions/default.nix
+++ b/pkgs/desktops/gnome/extensions/default.nix
@@ -67,7 +67,7 @@ in rec {
   gnome46Extensions = mapUuidNames (produceExtensionsList "46");
 
   # Keep the last three versions in here
-  gnomeExtensions = lib.trivial.pipe (gnome44Extensions // gnome45Extensions) [
+  gnomeExtensions = lib.trivial.pipe (gnome44Extensions // gnome45Extensions // gnome46Extensions) [
     (v: builtins.removeAttrs v [ "__attrsFailEvaluation" ])
     # Apply some custom patches for automatically packaged extensions
     (callPackage ./extensionOverrides.nix {})
diff --git a/pkgs/desktops/gnome/extensions/extensionOverrides.nix b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
index 6fd01d1b52d24..373715d357ed0 100644
--- a/pkgs/desktops/gnome/extensions/extensionOverrides.nix
+++ b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
@@ -21,7 +21,7 @@
 , touchegg
 , util-linux
 , vte
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 }:
 let
@@ -46,7 +46,7 @@ super: lib.trivial.pipe super [
   }))
 
   (patchExtension "ddterm@amezin.github.com" (old: {
-    nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+    nativeBuildInputs = [ gobject-introspection wrapGAppsHook3 ];
     buildInputs = [ vte ];
     postFixup = ''
       substituteInPlace "$out/share/gnome-shell/extensions/ddterm@amezin.github.com/bin/com.github.amezin.ddterm" --replace "gjs" "${gjs}/bin/gjs"
@@ -94,7 +94,7 @@ super: lib.trivial.pipe super [
   }))
 
   (patchExtension "gtk4-ding@smedius.gitlab.com" (old: {
-    nativeBuildInputs = [ wrapGAppsHook ];
+    nativeBuildInputs = [ wrapGAppsHook3 ];
     patches = [
       (substituteAll {
         inherit gjs util-linux xdg-utils;
diff --git a/pkgs/desktops/gnome/extensions/gsconnect/default.nix b/pkgs/desktops/gnome/extensions/gsconnect/default.nix
index b7577888df23a..d8a04e3060288 100644
--- a/pkgs/desktops/gnome/extensions/gsconnect/default.nix
+++ b/pkgs/desktops/gnome/extensions/gsconnect/default.nix
@@ -9,7 +9,7 @@
 , ninja
 , pkg-config
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , glib-networking
 , gtk3
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     gobject-introspection # for locating typelibs
-    wrapGAppsHook # for wrapping daemons
+    wrapGAppsHook3 # for wrapping daemons
     desktop-file-utils # update-desktop-database
   ];
 
diff --git a/pkgs/desktops/gnome/games/aisleriot/default.nix b/pkgs/desktops/gnome/games/aisleriot/default.nix
index e0a3722727810..e0c8ec7fb3ff4 100644
--- a/pkgs/desktops/gnome/games/aisleriot/default.nix
+++ b/pkgs/desktops/gnome/games/aisleriot/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , itstool
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , meson
 , librsvg
 , libxml2
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     meson
     ninja
     appstream-glib
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Aisleriot";
+    homepage = "https://gitlab.gnome.org/GNOME/aisleriot";
     description = "A collection of patience games written in guile scheme";
     mainProgram = "sol";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/atomix/default.nix b/pkgs/desktops/gnome/games/atomix/default.nix
index 2e72d4300970d..7b292054702bd 100644
--- a/pkgs/desktops/gnome/games/atomix/default.nix
+++ b/pkgs/desktops/gnome/games/atomix/default.nix
@@ -4,7 +4,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , python3
 , gettext
 , gnome
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
     python3
   ];
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "Puzzle game where you move atoms to build a molecule";
     mainProgram = "atomix";
-    homepage = "https://wiki.gnome.org/Apps/Atomix";
+    homepage = "https://gitlab.gnome.org/GNOME/atomix";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/desktops/gnome/games/five-or-more/default.nix b/pkgs/desktops/gnome/games/five-or-more/default.nix
index 749f0de9ac36b..099aecf7b4118 100644
--- a/pkgs/desktops/gnome/games/five-or-more/default.nix
+++ b/pkgs/desktops/gnome/games/five-or-more/default.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , gnome
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , librsvg
 , libgnome-games-support
 , gettext
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     itstool
     libxml2
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
     vala
   ];
 
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Five_or_more";
+    homepage = "https://gitlab.gnome.org/GNOME/five-or-more";
     description = "Remove colored balls from the board by forming lines";
     mainProgram = "five-or-more";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/four-in-a-row/default.nix b/pkgs/desktops/gnome/games/four-in-a-row/default.nix
index cc866abde2243..a866e3797a300 100644
--- a/pkgs/desktops/gnome/games/four-in-a-row/default.nix
+++ b/pkgs/desktops/gnome/games/four-in-a-row/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, gnome, gtk3, wrapGAppsHook
+{ lib, stdenv, fetchurl, pkg-config, gnome, gtk3, wrapGAppsHook3
 , gettext, meson, gsound, librsvg, itstool, vala
 , python3, ninja, desktop-file-utils }:
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    pkg-config wrapGAppsHook gettext meson itstool vala
+    pkg-config wrapGAppsHook3 gettext meson itstool vala
     ninja python3 desktop-file-utils
   ];
   buildInputs = [ gtk3 gsound librsvg gnome.adwaita-icon-theme ];
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Four-in-a-row";
+    homepage = "https://gitlab.gnome.org/GNOME/four-in-a-row";
     description = "Make lines of the same color to win";
     mainProgram = "four-in-a-row";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/gnome-2048/default.nix b/pkgs/desktops/gnome/games/gnome-2048/default.nix
index 563d298883ca1..fc04ee0b8f1e7 100644
--- a/pkgs/desktops/gnome/games/gnome-2048/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-2048/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchurl
 , fetchpatch
-, wrapGAppsHook
+, wrapGAppsHook3
 , meson
 , vala
 , pkg-config
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/2048";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-2048";
     description = "Obtain the 2048 tile";
     mainProgram = "gnome-2048";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/gnome-chess/default.nix b/pkgs/desktops/gnome/games/gnome-chess/default.nix
index 41599e6cf0feb..53d656b93fc38 100644
--- a/pkgs/desktops/gnome/games/gnome-chess/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-chess/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-chess";
-  version = "43.2";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-chess/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "NIUI+PbnRRwHNE/6egmpkM8dKIO8z1M0CdvgKSaNSfI=";
+    hash = "sha256-oryQ4KdUMSxXibkZi0knMDd1tiWDqOlnbSxqlztG/ec=";
   };
 
   nativeBuildInputs = [
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Chess";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-chess";
     description = "Play the classic two-player boardgame of chess";
     mainProgram = "gnome-chess";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/gnome-klotski/default.nix b/pkgs/desktops/gnome/games/gnome-klotski/default.nix
index 8545fefaa539b..3b976c633e03a 100644
--- a/pkgs/desktops/gnome/games/gnome-klotski/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-klotski/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, vala, gnome, gtk3, wrapGAppsHook, appstream-glib, desktop-file-utils
+{ lib, stdenv, fetchurl, pkg-config, vala, gnome, gtk3, wrapGAppsHook3, appstream-glib, desktop-file-utils
 , glib, librsvg, libxml2, gettext, itstool, libgee, libgnome-games-support
 , meson, ninja, python3
 }:
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    pkg-config vala meson ninja python3 wrapGAppsHook
+    pkg-config vala meson ninja python3 wrapGAppsHook3
     gettext itstool libxml2 appstream-glib desktop-file-utils
     gnome.adwaita-icon-theme
   ];
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Klotski";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-klotski";
     description = "Slide blocks to solve the puzzle";
     mainProgram = "gnome-klotski";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/gnome-mahjongg/default.nix b/pkgs/desktops/gnome/games/gnome-mahjongg/default.nix
index 993ad93cd97c3..5d21f41e60dd2 100644
--- a/pkgs/desktops/gnome/games/gnome-mahjongg/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-mahjongg/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Mahjongg";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-mahjongg";
     description = "Disassemble a pile of tiles by removing matching pairs";
     mainProgram = "gnome-mahjongg";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/gnome-mines/default.nix b/pkgs/desktops/gnome/games/gnome-mines/default.nix
index 7594b94c7aa7e..ee9509309e4c4 100644
--- a/pkgs/desktops/gnome/games/gnome-mines/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-mines/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, meson, ninja, vala, pkg-config, gnome, gtk3, wrapGAppsHook
+{ lib, stdenv, fetchurl, meson, ninja, vala, pkg-config, gnome, gtk3, wrapGAppsHook3
 , librsvg, gettext, itstool, python3, libxml2, libgnome-games-support, libgee, desktop-file-utils }:
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     meson ninja vala pkg-config gettext itstool python3
-    libxml2 wrapGAppsHook desktop-file-utils
+    libxml2 wrapGAppsHook3 desktop-file-utils
   ];
   buildInputs = [ gtk3 librsvg gnome.adwaita-icon-theme libgnome-games-support libgee ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Mines";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-mines";
     description = "Clear hidden mines from a minefield";
     mainProgram = "gnome-mines";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/gnome-nibbles/default.nix b/pkgs/desktops/gnome/games/gnome-nibbles/default.nix
index c0a9e3d2692a0..58538d24bd497 100644
--- a/pkgs/desktops/gnome/games/gnome-nibbles/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-nibbles/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-nibbles";
-  version = "4.0.2";
+  version = "4.0.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-nibbles/${lib.versions.majorMinor finalAttrs.version}/gnome-nibbles-${finalAttrs.version}.tar.xz";
-    sha256 = "SF+Mnq03/xr/ANXFfZk40PXc/xyocDHyKkrjhS6HU8U=";
+    hash = "sha256-1xKkxpQ78ylWrfuSIvHxQ2mRHlTs67DNYffCWr16Wdo=";
   };
 
   nativeBuildInputs = [
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "Guide a worm around a maze";
     mainProgram = "gnome-nibbles";
-    homepage = "https://wiki.gnome.org/Apps/Nibbles";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-nibbles";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome/games/gnome-robots/default.nix b/pkgs/desktops/gnome/games/gnome-robots/default.nix
index 75f86f2c8842e..5222fc81605cf 100644
--- a/pkgs/desktops/gnome/games/gnome-robots/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-robots/default.nix
@@ -4,7 +4,7 @@
 , pkg-config
 , gnome
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , librsvg
 , gsound
 , gettext
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     vala
     python3
     libxml2
-    wrapGAppsHook
+    wrapGAppsHook3
     gettext
     itstool
     desktop-file-utils
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Robots";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-robots";
     description = "Avoid the robots and make them crash into each other";
     mainProgram = "gnome-robots";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/gnome-sudoku/default.nix b/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
index 8cd6201b16d7d..a9f0001ae2d78 100644
--- a/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-sudoku";
-  version = "45.5";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-sudoku/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "jo4rymzaSfBdAGHD+YZgILNj74TDow9bfo7U5BpX/Q8=";
+    hash = "sha256-d8TnjYhvOxRFav7w+5aPLqAa01cDzEhSP41yR4P/pq8=";
   };
 
   nativeBuildInputs = [
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Sudoku";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-sudoku";
     description = "Test your logic skills in this number grid puzzle";
     mainProgram = "gnome-sudoku";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/gnome-taquin/default.nix b/pkgs/desktops/gnome/games/gnome-taquin/default.nix
index b2c65ecb6c2d7..75f68731cb3ca 100644
--- a/pkgs/desktops/gnome/games/gnome-taquin/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-taquin/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , gnome
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , librsvg
 , gsound
 , gettext
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     meson
     ninja
     python3
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Taquin";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-taquin";
     description = "Move tiles so that they reach their places";
     mainProgram = "gnome-taquin";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/gnome-tetravex/default.nix b/pkgs/desktops/gnome/games/gnome-tetravex/default.nix
index 3527f8b54115d..8c86a4c090a1f 100644
--- a/pkgs/desktops/gnome/games/gnome-tetravex/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-tetravex/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , gnome
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , libxml2
 , gettext
 , itstool
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     itstool
     libxml2
     gnome.adwaita-icon-theme
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Tetravex";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-tetravex";
     description = "Complete the puzzle by matching numbered tiles";
     mainProgram = "gnome-tetravex";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/hitori/default.nix b/pkgs/desktops/gnome/games/hitori/default.nix
index d22ded0e5bf4a..77cc67f41a382 100644
--- a/pkgs/desktops/gnome/games/hitori/default.nix
+++ b/pkgs/desktops/gnome/games/hitori/default.nix
@@ -8,7 +8,7 @@
 , glib
 , gtk3
 , cairo
-, wrapGAppsHook
+, wrapGAppsHook3
 , libxml2
 , python3
 , gettext
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     desktop-file-utils
     libxml2
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Hitori";
+    homepage = "https://gitlab.gnome.org/GNOME/hitori";
     description = "GTK application to generate and let you play games of Hitori";
     mainProgram = "hitori";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/iagno/default.nix b/pkgs/desktops/gnome/games/iagno/default.nix
index e409b04c0a9af..4dc3e9eabdb72 100644
--- a/pkgs/desktops/gnome/games/iagno/default.nix
+++ b/pkgs/desktops/gnome/games/iagno/default.nix
@@ -6,7 +6,7 @@
 , gnome
 , gdk-pixbuf
 , librsvg
-, wrapGAppsHook
+, wrapGAppsHook3
 , itstool
 , gsound
 , libxml2
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     vala
     desktop-file-utils
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     itstool
     libxml2
   ];
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Iagno";
+    homepage = "https://gitlab.gnome.org/GNOME/iagno";
     description = "Computer version of the game Reversi, more popularly called Othello";
     mainProgram = "iagno";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/lightsoff/default.nix b/pkgs/desktops/gnome/games/lightsoff/default.nix
index 52b2cec7e105a..1884fe869122e 100644
--- a/pkgs/desktops/gnome/games/lightsoff/default.nix
+++ b/pkgs/desktops/gnome/games/lightsoff/default.nix
@@ -1,18 +1,18 @@
-{ lib, stdenv, fetchurl, vala, pkg-config, gtk3, gnome, gdk-pixbuf, librsvg, wrapGAppsHook
+{ lib, stdenv, fetchurl, vala, pkg-config, gtk3, gnome, gdk-pixbuf, librsvg, wrapGAppsHook3
 , gettext, itstool, clutter, clutter-gtk, libxml2, appstream-glib
 , meson, ninja, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "lightsoff";
-  version = "40.0.1";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/lightsoff/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "1aziy64g15bm83zfn3ifs20z9yvscdvsxbx132xnq77i0r3qvlxc";
+    hash = "sha256-ZysVMuBkX64C8oN6ltU57c/Uw7pPcuWR3HP+R567i5I=";
   };
 
   nativeBuildInputs = [
-    vala pkg-config wrapGAppsHook itstool gettext appstream-glib libxml2
+    vala pkg-config wrapGAppsHook3 itstool gettext appstream-glib libxml2
     meson ninja python3
   ];
   buildInputs = [ gtk3 gnome.adwaita-icon-theme gdk-pixbuf librsvg clutter clutter-gtk ];
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Lightsoff";
+    homepage = "https://gitlab.gnome.org/GNOME/lightsoff";
     description = "Puzzle game, where the objective is to turn off all of the tiles on the board";
     mainProgram = "lightsoff";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/quadrapassel/default.nix b/pkgs/desktops/gnome/games/quadrapassel/default.nix
index c3a883306bd56..d867ad4f16a3c 100644
--- a/pkgs/desktops/gnome/games/quadrapassel/default.nix
+++ b/pkgs/desktops/gnome/games/quadrapassel/default.nix
@@ -14,7 +14,7 @@
   libxml2,
   clutter,
   clutter-gtk,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   meson,
   ninja,
   python3,
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     libxml2
     itstool
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Classic falling-block game, Tetris";
     mainProgram = "quadrapassel";
-    homepage = "https://wiki.gnome.org/Apps/Quadrapassel";
+    homepage = "https://gitlab.gnome.org/GNOME/quadrapassel";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome/games/swell-foop/default.nix b/pkgs/desktops/gnome/games/swell-foop/default.nix
index 98a01140fd8e6..6a8d64103509f 100644
--- a/pkgs/desktops/gnome/games/swell-foop/default.nix
+++ b/pkgs/desktops/gnome/games/swell-foop/default.nix
@@ -6,26 +6,26 @@
 , pkg-config
 , vala
 , glib
-, gtk3
-, libgnome-games-support
+, gtk4
+, libgee
+, libgnome-games-support_2_0
+, pango
 , gnome
 , desktop-file-utils
-, clutter
-, clutter-gtk
 , gettext
 , itstool
 , libxml2
-, wrapGAppsHook
+, wrapGAppsHook4
 , python3
 }:
 
 stdenv.mkDerivation rec {
   pname = "swell-foop";
-  version = "41.1";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "JD96VeXnU6UQhu7CVoMg12ktWxWmanI6tZFwXg2O9t0=";
+    hash = "sha256-BvireAfXHOyUi4aDcfR/ut7vzLXDV+E9HvPISBiR/KM=";
   };
 
   nativeBuildInputs = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     ninja
     vala
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook4
     python3
     itstool
     gettext
@@ -43,17 +43,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib
-    gtk3
-    libgnome-games-support
-    clutter
-    clutter-gtk
+    gtk4
+    libgee
+    libgnome-games-support_2_0
+    pango
   ];
 
-  postPatch = ''
-    chmod +x meson_post_install.py # patchShebangs requires executable file
-    patchShebangs meson_post_install.py
-  '';
-
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
@@ -62,7 +57,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Swell%20Foop";
+    homepage = "https://gitlab.gnome.org/GNOME/swell-foop";
     description = "Puzzle game, previously known as Same GNOME";
     mainProgram = "swell-foop";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/games/tali/default.nix b/pkgs/desktops/gnome/games/tali/default.nix
index baac54eab9c17..fac4a1fb57769 100644
--- a/pkgs/desktops/gnome/games/tali/default.nix
+++ b/pkgs/desktops/gnome/games/tali/default.nix
@@ -11,7 +11,7 @@
   gettext,
   itstool,
   libxml2,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   meson,
   ninja,
   python3,
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     libxml2
     itstool
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Tali";
+    homepage = "https://gitlab.gnome.org/GNOME/tali";
     description = "Sort of poker with dice and less money";
     mainProgram = "tali";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/misc/geary/default.nix b/pkgs/desktops/gnome/misc/geary/default.nix
index 3a89f83cb697c..e2cbaaa6da89b 100644
--- a/pkgs/desktops/gnome/misc/geary/default.nix
+++ b/pkgs/desktops/gnome/misc/geary/default.nix
@@ -5,7 +5,7 @@
 , gtk3
 , vala
 , enchant2
-, wrapGAppsHook
+, wrapGAppsHook3
 , meson
 , ninja
 , desktop-file-utils
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -148,7 +148,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Geary";
+    homepage = "https://gitlab.gnome.org/GNOME/geary";
     description = "Mail client for GNOME 3";
     maintainers = teams.gnome.members;
     license = licenses.lgpl21Plus;
diff --git a/pkgs/desktops/gnome/misc/gitg/default.nix b/pkgs/desktops/gnome/misc/gitg/default.nix
index df722bc868eda..923f1ccc28bfd 100644
--- a/pkgs/desktops/gnome/misc/gitg/default.nix
+++ b/pkgs/desktops/gnome/misc/gitg/default.nix
@@ -7,7 +7,7 @@
 , glib
 , gpgme
 , json-glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , libpeas
 , bash
 , gobject-introspection
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Gitg";
+    homepage = "https://gitlab.gnome.org/GNOME/gitg";
     description = "GNOME GUI client to view git repositories";
     mainProgram = "gitg";
     maintainers = with maintainers; [ domenkozar Luflosi ];
diff --git a/pkgs/desktops/gnome/misc/gnome-applets/default.nix b/pkgs/desktops/gnome/misc/gnome-applets/default.nix
index 06afbfe137956..0270045dad7df 100644
--- a/pkgs/desktops/gnome/misc/gnome-applets/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-applets/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-applets";
-  version = "3.50.0";
+  version = "3.52.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "b3kagx8WQ+YvOJ7sCLHqPfHzr+1DqzQJb6Ic+njcgKU=";
+    hash = "sha256-bz07QoZW/21bHT7lzLfs49Kxi1S/BFes9DtxHlXi1iw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/misc/gnome-flashback/default.nix b/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
index 3c090282bdb49..f54860ba19add 100644
--- a/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
@@ -22,7 +22,7 @@
 , systemd
 , upower
 , pam
-, wrapGAppsHook
+, wrapGAppsHook3
 , writeTextFile
 , xkeyboard_config
 , xorg
@@ -31,11 +31,11 @@
 }:
 let
   pname = "gnome-flashback";
-  version = "3.50.0";
+  version = "3.52.1";
 
   # From data/sessions/Makefile.am
   requiredComponentsCommon = enableGnomePanel:
-    [ "gnome-flashback" ]
+    [ ]
     ++ lib.optional enableGnomePanel "gnome-panel";
   requiredComponentsGsd = [
     "org.gnome.SettingsDaemon.A11ySettings"
@@ -62,13 +62,13 @@ let
 
     src = fetchurl {
       url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${name}.tar.xz";
-      sha256 = "sha256-0ExDSCICLJ+n5gh05cjNIGDI88BwPBnytAMr4lQnKv4=";
+      hash = "sha256-ugRhPNrbYr2iBkN8BHKZ4WAlzeG9gJXglKp3dpx4YDo=";
     };
 
     # make .desktop Execs absolute
     postPatch = ''
       patch -p0 <<END_PATCH
-      +++ data/applications/gnome-flashback.desktop.in.in
+      +++ data/applications/gnome-flashback.desktop.in
       @@ -4 +4 @@
       -Exec=gnome-flashback
       +Exec=$out/bin/gnome-flashback
@@ -90,7 +90,7 @@ let
       gettext
       libxml2
       pkg-config
-      wrapGAppsHook
+      wrapGAppsHook3
     ];
 
     buildInputs = [
diff --git a/pkgs/desktops/gnome/misc/gnome-packagekit/default.nix b/pkgs/desktops/gnome/misc/gnome-packagekit/default.nix
index 92b216ed2c5ef..6e2f9168e54f0 100644
--- a/pkgs/desktops/gnome/misc/gnome-packagekit/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-packagekit/default.nix
@@ -10,7 +10,7 @@
 , polkit
 , gtk3
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktop-file-utils
 }:
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils
   ];
 
diff --git a/pkgs/desktops/gnome/misc/gnome-panel/default.nix b/pkgs/desktops/gnome/misc/gnome-panel/default.nix
index 56305d8e72dbd..71bfd89d4599c 100644
--- a/pkgs/desktops/gnome/misc/gnome-panel/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-panel/default.nix
@@ -19,18 +19,18 @@
 , pkg-config
 , polkit
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-panel";
-  version = "3.50.0";
+  version = "3.52.0";
 
   outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-Al7IidBCYtQclb7oW+ZCG6OmBQ4mm5zpn2ksrUmi6xM=";
+    hash = "sha256-nim6iHPN5A1AwpNKRk+PQ7ousbUisZFEfKon3XhTxdQ=";
   };
 
   patches = [
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     itstool
     libxml2
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/misc/gnome-panel/wrapper.nix b/pkgs/desktops/gnome/misc/gnome-panel/wrapper.nix
index 6afee1051af47..10b81eaad62cd 100644
--- a/pkgs/desktops/gnome/misc/gnome-panel/wrapper.nix
+++ b/pkgs/desktops/gnome/misc/gnome-panel/wrapper.nix
@@ -5,7 +5,7 @@
 , gnome-flashback
 , xorg
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , panelModulePackages ? [ ]
 }:
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     glib
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = selectedPanelModulePackages ++
diff --git a/pkgs/desktops/gnome/misc/gnome-tweaks/default.nix b/pkgs/desktops/gnome/misc/gnome-tweaks/default.nix
index 8489198b23156..ba97b24f6c0ad 100644
--- a/pkgs/desktops/gnome/misc/gnome-tweaks/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-tweaks/default.nix
@@ -2,6 +2,7 @@
 , meson
 , ninja
 , fetchurl
+, desktop-file-utils
 , gdk-pixbuf
 , gettext
 , glib
@@ -9,26 +10,29 @@
 , gnome-desktop
 , gobject-introspection
 , gsettings-desktop-schemas
-, gtk3
+, gtk4
 , itstool
-, libhandy
+, libadwaita
+, libgudev
 , libnotify
 , libxml2
 , pkg-config
 , python3Packages
-, wrapGAppsHook }:
+, wrapGAppsHook4
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "gnome-tweaks";
-  version = "45.1";
+  version = "46.0";
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "lf+n842bHf1eTOvvt1JBn+ohzUBwITla3J8RKFRBbU8=";
+    hash = "sha256-Fnh4Y0H2ZKxFgHhCIqFkCfqb9cx6XxtG3O/SqhPdujE=";
   };
 
   nativeBuildInputs = [
+    desktop-file-utils
     gettext
     gobject-introspection
     itstool
@@ -36,7 +40,7 @@ python3Packages.buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook4
   ];
 
   buildInputs = [
@@ -49,8 +53,9 @@ python3Packages.buildPythonApplication rec {
     gnome.gnome-shell-extensions
     gnome.mutter
     gsettings-desktop-schemas
-    gtk3
-    libhandy
+    gtk4
+    libadwaita
+    libgudev
     libnotify
   ];
 
@@ -80,7 +85,7 @@ python3Packages.buildPythonApplication rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Tweaks";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-tweaks";
     description = "A tool to customize advanced GNOME 3 options";
     mainProgram = "gnome-tweaks";
     maintainers = teams.gnome.members;
diff --git a/pkgs/desktops/gnome/misc/gpaste/default.nix b/pkgs/desktops/gnome/misc/gpaste/default.nix
index e98c861f1267c..16da276b64b55 100644
--- a/pkgs/desktops/gnome/misc/gpaste/default.nix
+++ b/pkgs/desktops/gnome/misc/gpaste/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchFromGitHub
+, fetchurl
 , gjs
 , glib
 , gobject-introspection
@@ -14,18 +14,16 @@
 , pkg-config
 , vala
 , desktop-file-utils
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
-stdenv.mkDerivation rec {
-  version = "45";
+stdenv.mkDerivation (finalAttrs: {
+  version = "45.1";
   pname = "gpaste";
 
-  src = fetchFromGitHub {
-    owner = "Keruspe";
-    repo = "GPaste";
-    rev = "v${version}";
-    sha256 = "sha256-MpoeLXGdLfas/E3x5ojJW5Dd3H8XZORtFaBHgRGJXxg=";
+  src = fetchurl {
+    url = "https://www.imagination-land.org/files/gpaste/GPaste-${finalAttrs.version}.tar.xz";
+    hash = "sha256-yYLoHn3/2xlefBeErnydNfkvtJva8/9f9JHhfschBpQ=";
   };
 
   patches = [
@@ -36,7 +34,7 @@ stdenv.mkDerivation rec {
   # https://github.com/NixOS/nix/issues/1846
   postPatch = ''
     substituteInPlace src/libgpaste/gpaste/gpaste-settings.c \
-      --subst-var-by gschemasCompiled ${glib.makeSchemaPath (placeholder "out") "${pname}-${version}"}
+      --subst-var-by gschemasCompiled ${glib.makeSchemaPath (placeholder "out") "${finalAttrs.pname}-${finalAttrs.version}"}
   '';
 
   nativeBuildInputs = [
@@ -46,7 +44,7 @@ stdenv.mkDerivation rec {
     pkg-config
     vala
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -81,10 +79,10 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/Keruspe/GPaste";
-    description = "Clipboard management system with GNOME 3 integration";
+    description = "Clipboard management system with GNOME integration";
     mainProgram = "gpaste-client";
-    license = licenses.gpl3;
+    license = licenses.bsd2;
     platforms = platforms.linux;
     maintainers = teams.gnome.members;
   };
-}
+})
diff --git a/pkgs/desktops/gnome/misc/metacity/default.nix b/pkgs/desktops/gnome/misc/metacity/default.nix
index b303c6698daf1..748ac320014b9 100644
--- a/pkgs/desktops/gnome/misc/metacity/default.nix
+++ b/pkgs/desktops/gnome/misc/metacity/default.nix
@@ -12,17 +12,17 @@
 , libxml2
 , pkg-config
 , substituteAll
-, wrapGAppsHook
+, wrapGAppsHook3
 , zenity
 }:
 
 stdenv.mkDerivation rec {
   pname = "metacity";
-  version = "3.50.0";
+  version = "3.52.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "GOmxBkONRjlOQUi8uDrMY2cxK+VFWc21ZOJwwcyutg8=";
+    hash = "sha256-pyQ4rObVkDrnkzjGCYsbNauRyKl8QyNwHTvvHz7rGRw=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     gettext
     libxml2
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/misc/nautilus-python/default.nix b/pkgs/desktops/gnome/misc/nautilus-python/default.nix
index 22ea314d43817..73767f31219de 100644
--- a/pkgs/desktops/gnome/misc/nautilus-python/default.nix
+++ b/pkgs/desktops/gnome/misc/nautilus-python/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nautilus-python";
-  version = "4.0";
+  version = "4.0.1";
 
   outputs = [ "out" "dev" "doc" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/nautilus-python/${lib.versions.majorMinor version}/nautilus-python-${version}.tar.xz";
-    sha256 = "FyQ9Yut9fYOalGGrjQcBaIgFxxYaZwXmFBOljsJoKBo=";
+    hash = "sha256-/EnBBPsyoK0ZWmawE2eEzRnRDYs+jVnV7n9z6PlOko8=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/misc/pomodoro/default.nix b/pkgs/desktops/gnome/misc/pomodoro/default.nix
index 9a1697c2332b6..4261ebaec1efd 100644
--- a/pkgs/desktops/gnome/misc/pomodoro/default.nix
+++ b/pkgs/desktops/gnome/misc/pomodoro/default.nix
@@ -5,7 +5,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktop-file-utils
 , libcanberra
 , gst_all_1
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     libxml2
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils
   ];
 
diff --git a/pkgs/desktops/lomiri/applications/lomiri-system-settings/default.nix b/pkgs/desktops/lomiri/applications/lomiri-system-settings/default.nix
index 5230e85411818..3025e86f6a70d 100644
--- a/pkgs/desktops/lomiri/applications/lomiri-system-settings/default.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri-system-settings/default.nix
@@ -37,7 +37,7 @@
 , ubports-click
 , upower
 , validatePkgConfig
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 , xvfb-run
 }:
diff --git a/pkgs/desktops/lomiri/applications/lomiri-system-settings/wrapper.nix b/pkgs/desktops/lomiri/applications/lomiri-system-settings/wrapper.nix
index 74767f41d9ecb..682001b62eea8 100644
--- a/pkgs/desktops/lomiri/applications/lomiri-system-settings/wrapper.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri-system-settings/wrapper.nix
@@ -5,7 +5,7 @@
 , lndir
 , lomiri-system-settings-unwrapped
 , lomiri-system-settings-security-privacy
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 , plugins ? [ lomiri-system-settings-security-privacy ]
 }:
@@ -22,7 +22,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     lndir
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/desktops/lomiri/applications/lomiri/default.nix b/pkgs/desktops/lomiri/applications/lomiri/default.nix
index 2c1b64bf0ca8c..f9eead00dafb9 100644
--- a/pkgs/desktops/lomiri/applications/lomiri/default.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri/default.nix
@@ -54,7 +54,7 @@
 , qtmultimedia
 , qtsvg
 , telephony-service
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 , xwayland
 }:
@@ -160,7 +160,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     glib # populates GSETTINGS_SCHEMAS_PATH
     pkg-config
-    wrapGAppsHook # XDG_DATA_DIRS wrapper flags for schemas
+    wrapGAppsHook3 # XDG_DATA_DIRS wrapper flags for schemas
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/desktops/lomiri/services/content-hub/default.nix b/pkgs/desktops/lomiri/services/content-hub/default.nix
index 7cbf7f205871c..3df927d3ed2dc 100644
--- a/pkgs/desktops/lomiri/services/content-hub/default.nix
+++ b/pkgs/desktops/lomiri/services/content-hub/default.nix
@@ -25,7 +25,7 @@
 , qtfeedback
 , qtgraphicaleffects
 , validatePkgConfig
-, wrapGAppsHook
+, wrapGAppsHook3
 , xvfb-run
 }:
 
@@ -103,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     qtdeclarative # qmlplugindump
     validatePkgConfig
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix b/pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix
index e400b73a25ab3..ef9ed8f072574 100644
--- a/pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix
@@ -25,7 +25,7 @@
 , shared-mime-info
 , taglib
 , validatePkgConfig
-, wrapGAppsHook
+, wrapGAppsHook3
 , xvfb-run
 }:
 
@@ -129,7 +129,7 @@ stdenv.mkDerivation (finalAttrs: {
       tornado
     ]))
     validatePkgConfig
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/lumina/lumina/default.nix b/pkgs/desktops/lumina/lumina/default.nix
index a7c533b42ceca..74de1fbeedfb0 100644
--- a/pkgs/desktops/lumina/lumina/default.nix
+++ b/pkgs/desktops/lumina/lumina/default.nix
@@ -13,7 +13,7 @@
 , qtx11extras
 , xorg
 , xscreensaver
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 mkDerivation rec {
@@ -30,7 +30,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     qmake
     qttools
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/lxde/core/lxappearance/default.nix b/pkgs/desktops/lxde/core/lxappearance/default.nix
index 3dc93a0f3386a..0143ab595e68e 100644
--- a/pkgs/desktops/lxde/core/lxappearance/default.nix
+++ b/pkgs/desktops/lxde/core/lxappearance/default.nix
@@ -5,7 +5,7 @@
 , libX11
 , gtk2
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , withGtk3 ? true
 }:
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/lxde/core/lxsession/default.nix b/pkgs/desktops/lxde/core/lxsession/default.nix
index b30c195f636a2..056651e0390eb 100644
--- a/pkgs/desktops/lxde/core/lxsession/default.nix
+++ b/pkgs/desktops/lxde/core/lxsession/default.nix
@@ -9,7 +9,7 @@
 , libxml2
 , libxslt
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk2-x11
 , libX11
 , polkit
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     libxml2
     libxslt
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/atril/default.nix b/pkgs/desktops/mate/atril/default.nix
index 611721da36429..130bba9182f49 100644
--- a/pkgs/desktops/mate/atril/default.nix
+++ b/pkgs/desktops/mate/atril/default.nix
@@ -14,7 +14,7 @@
 , itstool
 , hicolor-icon-theme
 , texlive
-, wrapGAppsHook
+, wrapGAppsHook3
 , enableEpub ? true
 , webkitgtk_4_1
 , enableDjvu ? true
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/caja-extensions/default.nix b/pkgs/desktops/mate/caja-extensions/default.nix
index d3bc563f0729a..205dae5e8592f 100644
--- a/pkgs/desktops/mate/caja-extensions/default.nix
+++ b/pkgs/desktops/mate/caja-extensions/default.nix
@@ -10,7 +10,7 @@
 , gupnp
 , imagemagick
 , mate-desktop
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/caja/default.nix b/pkgs/desktops/mate/caja/default.nix
index a09cef4621a83..59474ac8920f4 100644
--- a/pkgs/desktops/mate/caja/default.nix
+++ b/pkgs/desktops/mate/caja/default.nix
@@ -12,7 +12,7 @@
 , mate-desktop
 , hicolor-icon-theme
 , wayland
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/caja/with-extensions.nix b/pkgs/desktops/mate/caja/with-extensions.nix
index b9a55b4b9209f..a66840ca94a0c 100644
--- a/pkgs/desktops/mate/caja/with-extensions.nix
+++ b/pkgs/desktops/mate/caja/with-extensions.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , xorg
 , caja
 , cajaExtensions
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     glib
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = lib.forEach selectedExtensions (x: x.buildInputs) ++ selectedExtensions
diff --git a/pkgs/desktops/mate/engrampa/default.nix b/pkgs/desktops/mate/engrampa/default.nix
index d5fb1aea2bbe7..2f0404f88fba6 100644
--- a/pkgs/desktops/mate/engrampa/default.nix
+++ b/pkgs/desktops/mate/engrampa/default.nix
@@ -10,7 +10,7 @@
 , hicolor-icon-theme
 , json-glib
 , mate-desktop
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 # can be defaulted to true once switch to meson
 , withMagic ? stdenv.buildPlatform.canExecute stdenv.hostPlatform, file
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     libxml2  # for xmllint
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/eom/default.nix b/pkgs/desktops/mate/eom/default.nix
index 98475acb3cd04..792c24c5b327b 100644
--- a/pkgs/desktops/mate/eom/default.nix
+++ b/pkgs/desktops/mate/eom/default.nix
@@ -15,7 +15,7 @@
 , gtk3
 , mate-desktop
 , hicolor-icon-theme
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     itstool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/marco/default.nix b/pkgs/desktops/mate/marco/default.nix
index 598cc51eca463..7006e66d136c6 100644
--- a/pkgs/desktops/mate/marco/default.nix
+++ b/pkgs/desktops/mate/marco/default.nix
@@ -16,7 +16,7 @@
 , gtk3
 , mate-desktop
 , mate-settings-daemon
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     itstool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-applets/default.nix b/pkgs/desktops/mate/mate-applets/default.nix
index 8e358fe29ae0b..a15fd0054b92d 100644
--- a/pkgs/desktops/mate/mate-applets/default.nix
+++ b/pkgs/desktops/mate/mate-applets/default.nix
@@ -21,7 +21,7 @@
 , upower
 , wirelesstools
 , hicolor-icon-theme
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-calc/default.nix b/pkgs/desktops/mate/mate-calc/default.nix
index 4a4d6db2a3b3c..2c11bbef52a3f 100644
--- a/pkgs/desktops/mate/mate-calc/default.nix
+++ b/pkgs/desktops/mate/mate-calc/default.nix
@@ -8,7 +8,7 @@
 , libmpc
 , libxml2
 , mpfr
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-control-center/default.nix b/pkgs/desktops/mate/mate-control-center/default.nix
index 8305601204e27..3a052549a7d1d 100644
--- a/pkgs/desktops/mate/mate-control-center/default.nix
+++ b/pkgs/desktops/mate/mate-control-center/default.nix
@@ -27,7 +27,7 @@
 , udisks2
 , systemd
 , hicolor-icon-theme
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-desktop/default.nix b/pkgs/desktops/mate/mate-desktop/default.nix
index 4f917028bd803..a60e56cae8461 100644
--- a/pkgs/desktops/mate/mate-desktop/default.nix
+++ b/pkgs/desktops/mate/mate-desktop/default.nix
@@ -7,7 +7,7 @@
 , libstartup_notification
 , gtk3
 , dconf
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-indicator-applet/default.nix b/pkgs/desktops/mate/mate-indicator-applet/default.nix
index 0a915625958b6..ecbe0e8bfc4d7 100644
--- a/pkgs/desktops/mate/mate-indicator-applet/default.nix
+++ b/pkgs/desktops/mate/mate-indicator-applet/default.nix
@@ -7,7 +7,7 @@
 , libayatana-indicator
 , mate-panel
 , hicolor-icon-theme
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-media/default.nix b/pkgs/desktops/mate/mate-media/default.nix
index 4b2590088e1d8..51dcc29f8990a 100644
--- a/pkgs/desktops/mate/mate-media/default.nix
+++ b/pkgs/desktops/mate/mate-media/default.nix
@@ -12,7 +12,7 @@
 , mate-desktop
 , mate-panel
 , wayland
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     libtool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-netbook/default.nix b/pkgs/desktops/mate/mate-netbook/default.nix
index af4e7bebf9b37..0b1c5a7479236 100644
--- a/pkgs/desktops/mate/mate-netbook/default.nix
+++ b/pkgs/desktops/mate/mate-netbook/default.nix
@@ -8,7 +8,7 @@
 , libfakekey
 , libXtst
 , mate
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-notification-daemon/default.nix b/pkgs/desktops/mate/mate-notification-daemon/default.nix
index 4299f98d4ccc7..6ac2b8abaa5dd 100644
--- a/pkgs/desktops/mate/mate-notification-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-notification-daemon/default.nix
@@ -12,7 +12,7 @@
 , libxml2
 , mate-desktop
 , mate-panel
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     libxml2 # for xmllint
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-panel/default.nix b/pkgs/desktops/mate/mate-panel/default.nix
index 8ff97affd4dbb..6ddd142a3fa54 100644
--- a/pkgs/desktops/mate/mate-panel/default.nix
+++ b/pkgs/desktops/mate/mate-panel/default.nix
@@ -18,7 +18,7 @@
 , hicolor-icon-theme
 , wayland
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , marco
 , mateUpdateScript
 }:
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     glib
     gtk3
     # See https://github.com/mate-desktop/mate-panel/issues/1402
-    # This is propagated for mate_panel_applet_settings_new and applet's wrapGAppsHook
+    # This is propagated for mate_panel_applet_settings_new and applet's wrapGAppsHook3
     gnome.dconf-editor
   ];
 
diff --git a/pkgs/desktops/mate/mate-panel/with-applets.nix b/pkgs/desktops/mate/mate-panel/with-applets.nix
index e3f76645aa7c7..dd6f8a6c58b81 100644
--- a/pkgs/desktops/mate/mate-panel/with-applets.nix
+++ b/pkgs/desktops/mate/mate-panel/with-applets.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , xorg
 , marco
 , mate-panel
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     glib
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = lib.forEach selectedApplets (x: x.buildInputs) ++ selectedApplets
diff --git a/pkgs/desktops/mate/mate-power-manager/default.nix b/pkgs/desktops/mate/mate-power-manager/default.nix
index 1eaff61fc1b2c..42a782f9e8418 100644
--- a/pkgs/desktops/mate/mate-power-manager/default.nix
+++ b/pkgs/desktops/mate/mate-power-manager/default.nix
@@ -16,7 +16,7 @@
 , gtk3
 , libtool
 , polkit
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     libtool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-screensaver/default.nix b/pkgs/desktops/mate/mate-screensaver/default.nix
index 2d2c9bfaf9522..930b6d8d814ea 100644
--- a/pkgs/desktops/mate/mate-screensaver/default.nix
+++ b/pkgs/desktops/mate/mate-screensaver/default.nix
@@ -13,7 +13,7 @@
 , mate-panel
 , pam
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     libxml2 # provides xmllint
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-session-manager/default.nix b/pkgs/desktops/mate/mate-session-manager/default.nix
index c8b0c94f888e6..1ae3a0690e338 100644
--- a/pkgs/desktops/mate/mate-session-manager/default.nix
+++ b/pkgs/desktops/mate/mate-session-manager/default.nix
@@ -15,7 +15,7 @@
 , hicolor-icon-theme
 , mate-desktop
 , mate-screensaver
-, wrapGAppsHook
+, wrapGAppsHook3
 , fetchpatch
 , mateUpdateScript
 }:
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     xtrans
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-settings-daemon/default.nix b/pkgs/desktops/mate/mate-settings-daemon/default.nix
index 09085ed04869c..425d23c660f2d 100644
--- a/pkgs/desktops/mate/mate-settings-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-settings-daemon/default.nix
@@ -16,7 +16,7 @@
 , mate-desktop
 , pulseaudioSupport ? stdenv.config.pulseaudio or true
 , libpulseaudio
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     gettext
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-settings-daemon/wrapped.nix b/pkgs/desktops/mate/mate-settings-daemon/wrapped.nix
index 1bbe53c447862..6031b7f7341f6 100644
--- a/pkgs/desktops/mate/mate-settings-daemon/wrapped.nix
+++ b/pkgs/desktops/mate/mate-settings-daemon/wrapped.nix
@@ -1,7 +1,7 @@
 { stdenv
 , mate
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation {
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   version = mate.mate-settings-daemon.version;
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-system-monitor/default.nix b/pkgs/desktops/mate/mate-system-monitor/default.nix
index 665d062dc2461..f6b38ddec47f0 100644
--- a/pkgs/desktops/mate/mate-system-monitor/default.nix
+++ b/pkgs/desktops/mate/mate-system-monitor/default.nix
@@ -10,7 +10,7 @@
 , librsvg
 , polkit
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 , mate-desktop
 , mateUpdateScript
 }:
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     itstool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-terminal/default.nix b/pkgs/desktops/mate/mate-terminal/default.nix
index 76c002c9299dd..fa08aa3264114 100644
--- a/pkgs/desktops/mate/mate-terminal/default.nix
+++ b/pkgs/desktops/mate/mate-terminal/default.nix
@@ -9,7 +9,7 @@
 , dconf
 , vte
 , pcre2
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 , nixosTests
 }:
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-tweak/default.nix b/pkgs/desktops/mate/mate-tweak/default.nix
index f4c2d76d52b24..7688d934c74ef 100644
--- a/pkgs/desktops/mate/mate-tweak/default.nix
+++ b/pkgs/desktops/mate/mate-tweak/default.nix
@@ -7,7 +7,7 @@
 , gtk3
 , gdk-pixbuf
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gitUpdater
 }:
@@ -24,7 +24,7 @@ python3Packages.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     intltool
     python3Packages.distutils-extra
     gobject-introspection
diff --git a/pkgs/desktops/mate/mate-user-share/default.nix b/pkgs/desktops/mate/mate-user-share/default.nix
index 6156a7450fa1e..3ecfc8a34e903 100644
--- a/pkgs/desktops/mate/mate-user-share/default.nix
+++ b/pkgs/desktops/mate/mate-user-share/default.nix
@@ -13,7 +13,7 @@
 , apacheHttpdPackages
 , hicolor-icon-theme
 , mate
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     libxml2
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-utils/default.nix b/pkgs/desktops/mate/mate-utils/default.nix
index 35ce76d7c0fa2..7763e2960eda6 100644
--- a/pkgs/desktops/mate/mate-utils/default.nix
+++ b/pkgs/desktops/mate/mate-utils/default.nix
@@ -16,7 +16,7 @@
 , mate-panel
 , hicolor-icon-theme
 , wayland
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     inkscape
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mozo/default.nix b/pkgs/desktops/mate/mozo/default.nix
index 66b7048ffecfb..c402cf039300f 100644
--- a/pkgs/desktops/mate/mozo/default.nix
+++ b/pkgs/desktops/mate/mozo/default.nix
@@ -6,7 +6,7 @@
 , mate-menus
 , gtk3
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , mateUpdateScript
 }:
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
     pkg-config
     gettext
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/desktops/mate/pluma/default.nix b/pkgs/desktops/mate/pluma/default.nix
index f6bfe6eb2ba19..87eca7161f760 100644
--- a/pkgs/desktops/mate/pluma/default.nix
+++ b/pkgs/desktops/mate/pluma/default.nix
@@ -12,7 +12,7 @@
 , gtksourceview4
 , libpeas
 , mate-desktop
-, wrapGAppsHook
+, wrapGAppsHook3
 , mateUpdateScript
 }:
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     perl
     pkg-config
     python3.pkgs.wrapPython
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/appcenter/default.nix b/pkgs/desktops/pantheon/apps/appcenter/default.nix
index bf99163a54144..2744d925ef0b5 100644
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@@ -19,7 +19,7 @@
 , pkg-config
 , vala
 , polkit
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-calendar/default.nix b/pkgs/desktops/pantheon/apps/elementary-calendar/default.nix
index 4f50def6cbd61..24deffaa01ec7 100644
--- a/pkgs/desktops/pantheon/apps/elementary-calendar/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calendar/default.nix
@@ -7,7 +7,7 @@
 , pkg-config
 , python3
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , clutter
 , evolution-data-server
 , folks
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
index b1bb55f1d39b4..7b0747407e9a3 100644
--- a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
@@ -7,7 +7,7 @@
 , pkg-config
 , python3
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , granite
 , gst_all_1
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-code/default.nix b/pkgs/desktops/pantheon/apps/elementary-code/default.nix
index 9ecf59d2db6fc..d9837b83676ea 100644
--- a/pkgs/desktops/pantheon/apps/elementary-code/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-code/default.nix
@@ -9,7 +9,7 @@
 , pkg-config
 , polkit
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , editorconfig-core-c
 , granite
 , gtk3
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     pkg-config
     polkit # needed for ITS rules
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-dock/default.nix b/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
index b564060d06bf8..17c0e12969eb3 100644
--- a/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
@@ -19,7 +19,7 @@
 , libdbusmenu-gtk3
 , gnome-menus
 , libgee
-, wrapGAppsHook
+, wrapGAppsHook3
 , meson
 , ninja
 , granite
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     libxml2 # xmllint
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-files/default.nix b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
index a77e440bfe392..04711a791463b 100644
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@@ -19,7 +19,7 @@
 , zeitgeist
 , libcloudproviders
 , libgit2-glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , systemd
 }:
 
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-mail/default.nix b/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
index ca672cadae9b1..8f7a89ea23feb 100644
--- a/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
@@ -18,7 +18,7 @@
 , glib-networking
 , granite
 , evolution-data-server
-, wrapGAppsHook
+, wrapGAppsHook3
 , libgee
 }:
 
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-photos/default.nix b/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
index 5170940c91381..4534a8af27ee1 100644
--- a/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
@@ -23,7 +23,7 @@
 , python3
 , libwebp
 , appstream
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix b/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
index 1ac5d6979ebb2..f8ca0fe62cd7b 100644
--- a/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
@@ -13,7 +13,7 @@
 , libgee
 , libhandy
 , libcanberra
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-tasks/default.nix b/pkgs/desktops/pantheon/apps/elementary-tasks/default.nix
index d33242b77df2d..21065a55a2a7c 100644
--- a/pkgs/desktops/pantheon/apps/elementary-tasks/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-tasks/default.nix
@@ -7,7 +7,7 @@
 , pkg-config
 , python3
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , clutter-gtk
 , evolution-data-server
 , granite
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix b/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix
index efa672c71142b..7109b8372b7d5 100644
--- a/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix
@@ -15,7 +15,7 @@
 , vte
 , libgee
 , pcre2
-, wrapGAppsHook
+, wrapGAppsHook3
 , xvfb-run
 }:
 
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     xvfb-run
   ];
 
diff --git a/pkgs/desktops/pantheon/apps/elementary-videos/default.nix b/pkgs/desktops/pantheon/apps/elementary-videos/default.nix
index 6411971fdb05e..7fb642ce7b7d1 100644
--- a/pkgs/desktops/pantheon/apps/elementary-videos/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-videos/default.nix
@@ -11,7 +11,7 @@
 , libgee
 , libhandy
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/switchboard/default.nix b/pkgs/desktops/pantheon/apps/switchboard/default.nix
index f13d90bd088aa..a8a0c34853dca 100644
--- a/pkgs/desktops/pantheon/apps/switchboard/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard/default.nix
@@ -11,7 +11,7 @@
 , libgee
 , libhandy
 , granite
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix b/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix
index e42df9bee0605..2702b438f0ec2 100644
--- a/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix
@@ -1,4 +1,4 @@
-{ wrapGAppsHook
+{ wrapGAppsHook3
 , glib
 , lib
 , stdenv
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     glib
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = lib.forEach selectedPlugs (x: x.buildInputs)
diff --git a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
index c3f31624fff21..f4d7451835f03 100644
--- a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
@@ -25,7 +25,7 @@
 , gdk-pixbuf
 , dbus
 , accountsservice
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    # A hook does this but after wrapGAppsHook so the files never get wrapped.
+    # A hook does this but after wrapGAppsHook3 so the files never get wrapped.
     "--sbindir=${placeholder "out"}/bin"
     # baked into the program for discovery of the greeter configuration
     "--sysconfdir=/etc"
diff --git a/pkgs/desktops/pantheon/desktop/gala/default.nix b/pkgs/desktops/pantheon/desktop/gala/default.nix
index 3cf8a67e9539b..ec3541b7c83b7 100644
--- a/pkgs/desktops/pantheon/desktop/gala/default.nix
+++ b/pkgs/desktops/pantheon/desktop/gala/default.nix
@@ -20,7 +20,7 @@
 , mesa
 , mutter
 , gnome-settings-daemon
-, wrapGAppsHook
+, wrapGAppsHook3
 , gexiv2
 , systemd
 }:
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel/default.nix b/pkgs/desktops/pantheon/desktop/wingpanel/default.nix
index 8b24dba707c39..7c4d8d93b6316 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , nix-update-script
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , meson
 , ninja
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix b/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix
index 89a359a4c9d29..da6d61cd1337f 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix
@@ -1,5 +1,5 @@
 { lib
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , stdenv
 , xorg
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     glib
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = lib.forEach selectedIndicators (x: x.buildInputs)
diff --git a/pkgs/desktops/pantheon/granite/default.nix b/pkgs/desktops/pantheon/granite/default.nix
index f817a3017b7a1..a16045889b9f5 100644
--- a/pkgs/desktops/pantheon/granite/default.nix
+++ b/pkgs/desktops/pantheon/granite/default.nix
@@ -12,7 +12,7 @@
 , gettext
 , gsettings-desktop-schemas
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/desktops/pantheon/services/contractor/default.nix b/pkgs/desktops/pantheon/services/contractor/default.nix
index f4ce10df84ccf..26b4e1c28e205 100644
--- a/pkgs/desktops/pantheon/services/contractor/default.nix
+++ b/pkgs/desktops/pantheon/services/contractor/default.nix
@@ -11,7 +11,7 @@
 , libgee
 , dbus
 , glib-networking
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix b/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
index 4b88ea3e5abd0..18448fd0b4f04 100644
--- a/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
@@ -14,7 +14,7 @@
 , libhandy
 , gcr
 , webkitgtk_4_1
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/services/elementary-notifications/default.nix b/pkgs/desktops/pantheon/services/elementary-notifications/default.nix
index 475503bfe4209..f21115fd0dab7 100644
--- a/pkgs/desktops/pantheon/services/elementary-notifications/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-notifications/default.nix
@@ -12,7 +12,7 @@
 , libgee
 , libhandy
 , libcanberra-gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -44,6 +44,12 @@ stdenv.mkDerivation rec {
     libhandy
   ];
 
+  postPatch = ''
+    # https://github.com/elementary/notifications/issues/222
+    substituteInPlace src/FdoActionGroup.vala \
+      --replace-fail "out VariantType" "out unowned VariantType"
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
index 805956d332792..ed9da11815145 100644
--- a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
@@ -18,7 +18,7 @@
 , granite
 , libgee
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix b/pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix
index 942e53aaf8a4f..20c28133d234b 100644
--- a/pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix
+++ b/pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix
@@ -12,7 +12,7 @@
 , desktop-file-utils
 , geoclue2
 , granite
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/services/pantheon-agent-polkit/default.nix b/pkgs/desktops/pantheon/services/pantheon-agent-polkit/default.nix
index 9e1c3464dad7d..172554fa37ac1 100644
--- a/pkgs/desktops/pantheon/services/pantheon-agent-polkit/default.nix
+++ b/pkgs/desktops/pantheon/services/pantheon-agent-polkit/default.nix
@@ -10,7 +10,7 @@
 , libgee
 , granite
 , polkit
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/plasma-5/kde-gtk-config/default.nix b/pkgs/desktops/plasma-5/kde-gtk-config/default.nix
index c55193ae6429a..fd3c5e71a3d69 100644
--- a/pkgs/desktops/plasma-5/kde-gtk-config/default.nix
+++ b/pkgs/desktops/plasma-5/kde-gtk-config/default.nix
@@ -1,6 +1,6 @@
 { mkDerivation
 , extra-cmake-modules
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gtk3
 , karchive
@@ -18,7 +18,7 @@
 
 mkDerivation {
   pname = "kde-gtk-config";
-  nativeBuildInputs = [ extra-cmake-modules wrapGAppsHook ];
+  nativeBuildInputs = [ extra-cmake-modules wrapGAppsHook3 ];
   dontWrapGApps = true; # There is nothing to wrap
   buildInputs = [
     ki18n
diff --git a/pkgs/desktops/rox/rox-filer/default.nix b/pkgs/desktops/rox/rox-filer/default.nix
index 64c658d04a94d..0d7b0acaff578 100644
--- a/pkgs/desktops/rox/rox-filer/default.nix
+++ b/pkgs/desktops/rox/rox-filer/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , fetchpatch
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , libxml2
 , gtk
 , libSM
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   buildInputs = [ libxml2 gtk shared-mime-info libSM ];
   NIX_LDFLAGS = "-lm";
diff --git a/pkgs/desktops/xfce/applications/catfish/default.nix b/pkgs/desktops/xfce/applications/catfish/default.nix
index 24148731291af..520835bf80d73 100644
--- a/pkgs/desktops/xfce/applications/catfish/default.nix
+++ b/pkgs/desktops/xfce/applications/catfish/default.nix
@@ -11,7 +11,7 @@
 , gtk3
 , python3Packages
 , xfconf
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -32,7 +32,7 @@ python3Packages.buildPythonApplication rec {
     which
     intltool
     gobject-introspection # for setup hook populating GI_TYPELIB_PATH
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/xfce/mkXfceDerivation.nix b/pkgs/desktops/xfce/mkXfceDerivation.nix
index 17939e5e2058c..7edcb6e2eef25 100644
--- a/pkgs/desktops/xfce/mkXfceDerivation.nix
+++ b/pkgs/desktops/xfce/mkXfceDerivation.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, pkg-config, xfce4-dev-tools, hicolor-icon-theme, xfce, wrapGAppsHook, gitUpdater }:
+{ lib, stdenv, fetchFromGitLab, pkg-config, xfce4-dev-tools, hicolor-icon-theme, xfce, wrapGAppsHook3, gitUpdater }:
 
 { category
 , pname
@@ -25,7 +25,7 @@ let
     zipAttrsWithNames (filterAttrNames isList (head attrsets)) (_: concatLists) attrsets;
 
   template = {
-    nativeBuildInputs = [ pkg-config xfce4-dev-tools wrapGAppsHook ];
+    nativeBuildInputs = [ pkg-config xfce4-dev-tools wrapGAppsHook3 ];
     buildInputs = [ hicolor-icon-theme ];
     configureFlags = [ "--enable-maintainer-mode" ];
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-dockbarx-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-dockbarx-plugin/default.nix
index 2dad2d688ecae..8e8da34856386 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-dockbarx-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-dockbarx-plugin/default.nix
@@ -8,7 +8,7 @@
 , keybinder3
 , pkg-config
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 , xfce
 }:
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     gobject-introspection
     pkg-config
     python3Packages.wrapPython
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index 60bce2f6e4580..9548f8fe06f8b 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -47,6 +47,12 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/dgibson/dtc/commit/35f26d2921b68d97fefbd5a2b6e821a2f02ff65d.patch";
       sha256 = "sha256-cO4f/jJX/pQL7kk4jpKUhsCVESW2ZuWaTr7z3BuvVkw=";
     })
+
+    (fetchpatch {
+      name = "static.patch";
+      url = "https://git.kernel.org/pub/scm/utils/dtc/dtc.git/patch/?id=3fbfdd08afd2a7a25b27433f6f5678c0fe694721";
+      hash = "sha256-skK8m1s4xkK6x9AqzxiEK+1uMEmS27dBI1CdEXNFTfU=";
+    })
   ];
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
diff --git a/pkgs/development/compilers/flutter/wrapper.nix b/pkgs/development/compilers/flutter/wrapper.nix
index 4a7aedf97d38e..f5b8b2e2059da 100644
--- a/pkgs/development/compilers/flutter/wrapper.nix
+++ b/pkgs/development/compilers/flutter/wrapper.nix
@@ -20,7 +20,7 @@
 , makeWrapper
 , runCommandLocal
 , writeShellScript
-, wrapGAppsHook
+, wrapGAppsHook3
 , git
 , which
 , pkg-config
@@ -123,7 +123,7 @@ in
 
   nativeBuildInputs = [ makeWrapper ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ]
-    ++ lib.optionals supportsLinuxDesktopTarget [ glib wrapGAppsHook ];
+    ++ lib.optionals supportsLinuxDesktopTarget [ glib wrapGAppsHook3 ];
 
   passthru = flutter.passthru // {
     inherit (flutter) version;
diff --git a/pkgs/development/compilers/gnu-cim/default.nix b/pkgs/development/compilers/gnu-cim/default.nix
index b1cb9f08597e0..54ba6cffff130 100644
--- a/pkgs/development/compilers/gnu-cim/default.nix
+++ b/pkgs/development/compilers/gnu-cim/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     for fname in lib/{simulation,simset}.c; do
       substituteInPlace "$fname" \
-        --replace \
+        --replace-fail \
           '#include "../../lib/cim.h"' \
           '#include "../lib/cim.h"'
     done
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index 45955dc5e1b36..82a9d63ab3300 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -58,7 +58,52 @@ let
 
   in {
 
-    libllvm = callPackage ./llvm {
+    libllvm = callPackage ../common/llvm {
+      src = fetch "llvm" "1pzx9zrmd7r3481sbhwvkms68fwhffpp4mmz45dgrkjpyl2q96kx";
+      polly_src = fetch "polly" "1yfm9ixda4a2sx7ak5vswijx4ydk5lv1c1xh39xmd2kh299y4m12";
+      patches = [
+        # When cross-compiling we configure llvm-config-native with an approximation
+        # of the flags used for the normal LLVM build. To avoid the need for building
+        # a native libLLVM.so (which would fail) we force llvm-config to be linked
+        # statically against the necessary LLVM components always.
+        ../common/llvm/llvm-config-link-static.patch
+        # Fix llvm being miscompiled by some gccs. See llvm/llvm-project#49955
+        # Fix llvm being miscompiled by some gccs. See https://github.com/llvm/llvm-project/issues/49955
+        ./llvm/fix-llvm-issue-49955.patch
+
+        ./llvm/gnu-install-dirs.patch
+        # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
+        (fetchpatch {
+          name = "uops-CMOV16rm-noreg.diff";
+          url = "https://github.com/llvm/llvm-project/commit/9e9f991ac033.diff";
+          sha256 = "sha256:12s8vr6ibri8b48h2z38f3afhwam10arfiqfy4yg37bmc054p5hi";
+          stripLen = 1;
+        })
+
+        # Fix musl build.
+        (fetchpatch {
+          url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+          relative = "llvm";
+          hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+        })
+
+        # Backport gcc-13 fixes with missing includes.
+        (fetchpatch {
+          name = "signals-gcc-13.patch";
+          url = "https://github.com/llvm/llvm-project/commit/ff1681ddb303223973653f7f5f3f3435b48a1983.patch";
+          hash = "sha256-CXwYxQezTq5vdmc8Yn88BUAEly6YZ5VEIA6X3y5NNOs=";
+          stripLen = 1;
+        })
+        (fetchpatch {
+          name = "base64-gcc-13.patch";
+          url = "https://github.com/llvm/llvm-project/commit/5e9be93566f39ee6cecd579401e453eccfbe81e5.patch";
+          hash = "sha256-PAwrVrvffPd7tphpwCkYiz+67szPRzRB2TXBvKfzQ7U=";
+          stripLen = 1;
+        })
+      ];
+      pollyPatches = [
+        ./llvm/gnu-install-dirs-polly.patch
+      ];
       inherit llvm_meta;
     };
 
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
deleted file mode 100644
index 4745345a3f712..0000000000000
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ /dev/null
@@ -1,357 +0,0 @@
-{ lib, stdenv, llvm_meta
-, pkgsBuildBuild
-, fetch
-, fetchpatch
-, cmake
-, python3
-, libffi
-, enableGoldPlugin ? libbfd.hasPluginAPI
-, libbfd
-, libpfm
-, libxml2
-, ncurses
-, version
-, release_version
-, zlib
-, buildLlvmTools
-, debugVersion ? false
-, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-  && (stdenv.hostPlatform == stdenv.buildPlatform)
-, enableManpages ? false
-, enableSharedLibraries ? !stdenv.hostPlatform.isStatic
-# broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
-# broken for the armv7l builder
-, enablePFM ? stdenv.isLinux && !stdenv.hostPlatform.isAarch
-, enablePolly ? false
-}:
-
-let
-  inherit (lib) optional optionals optionalString;
-
-  # Used when creating a version-suffixed symlink of libLLVM.dylib
-  shortVersion = with lib;
-    concatStringsSep "." (take 1 (splitString "." release_version));
-
-  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
-  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
-  # out `doCheck` as a package level attribute).
-  #
-  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
-  # particular the children it uses to do feature detection.
-  #
-  # This means that python deps we add to `checkDeps` (which the python
-  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
-  # setup hook) are not picked up by `lit` which causes it to skip tests.
-  #
-  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
-  # because this package is shadowed in `$PATH` by the regular `python3`
-  # package.
-  #
-  # So, we "manually" assemble one python derivation for the package to depend
-  # on, taking into account whether checks are enabled or not:
-  python = if doCheck then
-    let
-      checkDeps = ps: with ps; [ psutil ];
-    in python3.withPackages checkDeps
-  else python3;
-
-in stdenv.mkDerivation (rec {
-  pname = "llvm";
-  inherit version;
-
-  src = fetch pname "1pzx9zrmd7r3481sbhwvkms68fwhffpp4mmz45dgrkjpyl2q96kx";
-  polly_src = fetch "polly" "1yfm9ixda4a2sx7ak5vswijx4ydk5lv1c1xh39xmd2kh299y4m12";
-
-  unpackPhase = ''
-    unpackFile $src
-    mv llvm-${release_version}* llvm
-    sourceRoot=$PWD/llvm
-  '' + optionalString enablePolly ''
-    unpackFile $polly_src
-    mv polly-* $sourceRoot/tools/polly
-  '';
-
-  outputs = [ "out" "lib" "dev" "python" ];
-
-  nativeBuildInputs = [ cmake python ]
-    ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
-
-  buildInputs = [ libxml2 libffi ]
-    ++ optional enablePFM libpfm; # exegesis
-
-  propagatedBuildInputs = optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ ncurses ]
-    ++ [ zlib ];
-
-  patches = [
-    # When cross-compiling we configure llvm-config-native with an approximation
-    # of the flags used for the normal LLVM build. To avoid the need for building
-    # a native libLLVM.so (which would fail) we force llvm-config to be linked
-    # statically against the necessary LLVM components always.
-    ../../common/llvm/llvm-config-link-static.patch
-    # Fix llvm being miscompiled by some gccs. See llvm/llvm-project#49955
-    # Fix llvm being miscompiled by some gccs. See https://github.com/llvm/llvm-project/issues/49955
-    ./fix-llvm-issue-49955.patch
-
-    ./gnu-install-dirs.patch
-    # On older CPUs (e.g. Hydra/wendy) we'd be getting an error in this test.
-    (fetchpatch {
-      name = "uops-CMOV16rm-noreg.diff";
-      url = "https://github.com/llvm/llvm-project/commit/9e9f991ac033.diff";
-      sha256 = "sha256:12s8vr6ibri8b48h2z38f3afhwam10arfiqfy4yg37bmc054p5hi";
-      stripLen = 1;
-    })
-
-    # Fix musl build.
-    (fetchpatch {
-      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
-      relative = "llvm";
-      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
-    })
-
-    # Backport gcc-13 fixes with missing includes.
-    (fetchpatch {
-      name = "signals-gcc-13.patch";
-      url = "https://github.com/llvm/llvm-project/commit/ff1681ddb303223973653f7f5f3f3435b48a1983.patch";
-      hash = "sha256-CXwYxQezTq5vdmc8Yn88BUAEly6YZ5VEIA6X3y5NNOs=";
-      stripLen = 1;
-    })
-    (fetchpatch {
-      name = "base64-gcc-13.patch";
-      url = "https://github.com/llvm/llvm-project/commit/5e9be93566f39ee6cecd579401e453eccfbe81e5.patch";
-      hash = "sha256-PAwrVrvffPd7tphpwCkYiz+67szPRzRB2TXBvKfzQ7U=";
-      stripLen = 1;
-    })
-  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
-
-  postPatch = optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
-      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  '' + ''
-    # FileSystem permissions tests fail with various special bits
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "Path.cpp" ""
-    rm unittests/Support/Path.cpp
-    substituteInPlace unittests/IR/CMakeLists.txt \
-      --replace "PassBuilderCallbacksTest.cpp" ""
-    rm unittests/IR/PassBuilderCallbacksTest.cpp
-    # TODO: Fix failing tests:
-    rm test/DebugInfo/X86/vla-multi.ll
-  '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../../common/llvm/TLI-musl.patch}
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "add_subdirectory(DynamicLibrary)" ""
-    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
-    # valgrind unhappy with musl or glibc, but fails w/musl only
-    rm test/CodeGen/AArch64/wineh4.mir
-  '' + optionalString stdenv.hostPlatform.isAarch32 ''
-    # skip failing X86 test cases on 32-bit ARM
-    rm test/DebugInfo/X86/convert-debugloc.ll
-    rm test/DebugInfo/X86/convert-inlined.ll
-    rm test/DebugInfo/X86/convert-linked.ll
-    rm test/tools/dsymutil/X86/op-convert.test
-    rm test/tools/gold/X86/split-dwarf.ll
-    rm test/tools/llvm-objcopy/MachO/universal-object.test
-  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
-    # Seems to require certain floating point hardware (NEON?)
-    rm test/ExecutionEngine/frem.ll
-  '' + ''
-    patchShebangs test/BugPoint/compile-custom.ll.py
-  '' + ''
-    # Tweak tests to ignore namespace part of type to support
-    # gcc-12: https://gcc.gnu.org/PR103598.
-    # The change below mangles strings like:
-    #    CHECK-NEXT: Starting llvm::Function pass manager run.
-    # to:
-    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
-    for f in \
-      test/Other/new-pass-manager.ll \
-      test/Other/new-pm-O0-defaults.ll \
-      test/Other/new-pm-defaults.ll \
-      test/Other/new-pm-lto-defaults.ll \
-      test/Other/new-pm-thinlto-defaults.ll \
-      test/Other/pass-pipeline-parsing.ll \
-      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
-      test/Transforms/Inline/clear-analyses.ll \
-      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
-      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
-      test/Transforms/SCCP/preserve-analysis.ll \
-      test/Transforms/SROA/dead-inst.ll \
-      test/tools/gold/X86/new-pm.ll \
-      ; do
-      echo "PATCH: $f"
-      substituteInPlace $f \
-        --replace 'Starting llvm::' 'Starting {{.*}}' \
-        --replace 'Finished llvm::' 'Finished {{.*}}'
-    done
-  '' + ''
-    # gcc-13 fix
-    sed -i '/#include <string>/i#include <cstdint>' \
-      include/llvm/DebugInfo/Symbolize/DIPrinter.h
-  '';
-
-  preConfigure = ''
-    # Workaround for configure flags that need to have spaces
-    cmakeFlagsArray+=(
-      -DLLVM_LIT_ARGS='-svj''${NIX_BUILD_CORES} --no-progress-bar'
-    )
-  '';
-
-  # hacky fix: created binaries need to be run before installation
-  preBuild = ''
-    mkdir -p $out/
-    ln -sv $PWD/lib $out
-  '';
-
-  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
-  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
-
-  hardeningDisable = [ "trivialautovarinit" ];
-
-  cmakeBuildType = if debugVersion then "Debug" else "Release";
-
-  cmakeFlags = with stdenv; let
-    # These flags influence llvm-config's BuildVariables.inc in addition to the
-    # general build. We need to make sure these are also passed via
-    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
-    # will return different results from the cross llvm-config.
-    #
-    # Some flags don't need to be repassed because LLVM already does so (like
-    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
-    flagsForLlvmConfig = [
-      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
-      "-DLLVM_ENABLE_RTTI=ON"
-    ] ++ optionals enableSharedLibraries [
-      "-DLLVM_LINK_LLVM_DYLIB=ON"
-    ];
-  in flagsForLlvmConfig ++ [
-    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
-    "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals stdenv.hostPlatform.isStatic [
-    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
-    "-DLLVM_ENABLE_PIC=OFF"
-    "-DLLVM_BUILD_STATIC=ON"
-    # libxml2 needs to be disabled because the LLVM build system ignores its .la
-    # file and doesn't link zlib as well.
-    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
-    "-DLLVM_ENABLE_LIBXML2=OFF"
-  ] ++ optionals enableManpages [
-    "-DLLVM_BUILD_DOCS=ON"
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (enableGoldPlugin) [
-    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ] ++ optionals isDarwin [
-    "-DLLVM_ENABLE_LIBCXX=ON"
-    "-DCAN_TARGET_i386=false"
-  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
-    "-DCMAKE_CROSSCOMPILING=True"
-    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-    (
-      let
-        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
-        nativeBintools = nativeCC.bintools.bintools;
-        nativeToolchainFlags = [
-          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
-          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
-          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
-          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
-          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
-        ];
-        # We need to repass the custom GNUInstallDirs values, otherwise CMake
-        # will choose them for us, leading to wrong results in llvm-config-native
-        nativeInstallFlags = [
-          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
-          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
-          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
-          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
-          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
-        ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
-      + lib.concatStringsSep ";" (lib.concatLists [
-        flagsForLlvmConfig
-        nativeToolchainFlags
-        nativeInstallFlags
-      ])
-    )
-  ];
-
-  postBuild = ''
-    rm -fR $out
-  '';
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
-  '';
-
-  postInstall = ''
-    mkdir -p $python/share
-    mv $out/share/opt-viewer $python/share/opt-viewer
-    moveToOutput "bin/llvm-config*" "$dev"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
-      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
-      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}'"$lib"'")'
-  ''
-  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
-  ''
-  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
-  '';
-
-  inherit doCheck;
-
-  checkTarget = "check-all";
-
-  requiredSystemFeatures = [ "big-parallel" ];
-  meta = llvm_meta // {
-    homepage = "https://llvm.org/";
-    description = "A collection of modular and reusable compiler and toolchain technologies";
-    longDescription = ''
-      The LLVM Project is a collection of modular and reusable compiler and
-      toolchain technologies. Despite its name, LLVM has little to do with
-      traditional virtual machines. The name "LLVM" itself is not an acronym; it
-      is the full name of the project.
-      LLVM began as a research project at the University of Illinois, with the
-      goal of providing a modern, SSA-based compilation strategy capable of
-      supporting both static and dynamic compilation of arbitrary programming
-      languages. Since then, LLVM has grown to be an umbrella project consisting
-      of a number of subprojects, many of which are being used in production by
-      a wide variety of commercial and open source projects as well as being
-      widely used in academic research. Code in the LLVM project is licensed
-      under the "Apache 2.0 License with LLVM exceptions".
-    '';
-  };
-} // lib.optionalAttrs enableManpages {
-  pname = "llvm-manpages";
-
-  buildPhase = ''
-    make docs-llvm-man
-  '';
-
-  propagatedBuildInputs = [];
-
-  installPhase = ''
-    make -C docs install
-  '';
-
-  postPatch = null;
-  postInstall = null;
-
-  outputs = [ "out" ];
-
-  doCheck = false;
-
-  meta = llvm_meta // {
-    description = "man pages for LLVM ${version}";
-  };
-})
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index 018fb0c638505..9348e19e6de39 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -84,7 +84,47 @@ in let
 
   in {
 
-    libllvm = callPackage ./llvm {
+    libllvm = callPackage ../common/llvm {
+      patches = [
+        # When cross-compiling we configure llvm-config-native with an approximation
+        # of the flags used for the normal LLVM build. To avoid the need for building
+        # a native libLLVM.so (which would fail) we force llvm-config to be linked
+        # statically against the necessary LLVM components always.
+        ../common/llvm/llvm-config-link-static.patch
+
+        ./llvm/gnu-install-dirs.patch
+
+        # Fix random compiler crashes: https://bugs.llvm.org/show_bug.cgi?id=50611
+        (fetchpatch {
+          url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/4764a4f8c920912a2bfd8b0eea57273acfe0d8a8/trunk/no-strict-aliasing-DwarfCompileUnit.patch";
+          sha256 = "18l6mrvm2vmwm77ckcnbjvh6ybvn72rhrb799d4qzwac4x2ifl7g";
+          stripLen = 1;
+        })
+
+        # Fix musl build.
+        (fetchpatch {
+          url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+          relative = "llvm";
+          hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+        })
+
+        # Backport gcc-13 fixes with missing includes.
+        (fetchpatch {
+          name = "signals-gcc-13.patch";
+          url = "https://github.com/llvm/llvm-project/commit/ff1681ddb303223973653f7f5f3f3435b48a1983.patch";
+          hash = "sha256-CXwYxQezTq5vdmc8Yn88BUAEly6YZ5VEIA6X3y5NNOs=";
+          stripLen = 1;
+        })
+        (fetchpatch {
+          name = "base64-gcc-13.patch";
+          url = "https://github.com/llvm/llvm-project/commit/5e9be93566f39ee6cecd579401e453eccfbe81e5.patch";
+          hash = "sha256-PAwrVrvffPd7tphpwCkYiz+67szPRzRB2TXBvKfzQ7U=";
+          stripLen = 1;
+        })
+      ];
+      pollyPatches = [
+        ./llvm/gnu-install-dirs-polly.patch
+      ];
       inherit llvm_meta;
     };
 
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
deleted file mode 100644
index 58e742b9b41ea..0000000000000
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ /dev/null
@@ -1,315 +0,0 @@
-{ lib, stdenv, llvm_meta
-, pkgsBuildBuild
-, src
-, fetchpatch
-, cmake
-, python3
-, libffi
-, enableGoldPlugin ? libbfd.hasPluginAPI
-, libbfd
-, libpfm
-, libxml2
-, ncurses
-, version
-, release_version
-, zlib
-, which
-, buildLlvmTools
-, debugVersion ? false
-, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-  && (stdenv.hostPlatform == stdenv.buildPlatform)
-, enableManpages ? false
-, enableSharedLibraries ? !stdenv.hostPlatform.isStatic
-# broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
-# broken for the armv7l builder
-, enablePFM ? stdenv.isLinux && !stdenv.hostPlatform.isAarch
-, enablePolly ? false
-}:
-
-let
-  inherit (lib) optional optionals optionalString;
-
-  # Used when creating a version-suffixed symlink of libLLVM.dylib
-  shortVersion = with lib;
-    concatStringsSep "." (take 1 (splitString "." release_version));
-
-  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
-  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
-  # out `doCheck` as a package level attribute).
-  #
-  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
-  # particular the children it uses to do feature detection.
-  #
-  # This means that python deps we add to `checkDeps` (which the python
-  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
-  # setup hook) are not picked up by `lit` which causes it to skip tests.
-  #
-  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
-  # because this package is shadowed in `$PATH` by the regular `python3`
-  # package.
-  #
-  # So, we "manually" assemble one python derivation for the package to depend
-  # on, taking into account whether checks are enabled or not:
-  python = if doCheck then
-    let
-      checkDeps = ps: with ps; [ psutil ];
-    in python3.withPackages checkDeps
-  else python3;
-
-in stdenv.mkDerivation (rec {
-  pname = "llvm";
-  inherit version;
-
-  inherit src;
-  sourceRoot = "${src.name}/${pname}";
-
-  outputs = [ "out" "lib" "dev" "python" ];
-
-  nativeBuildInputs = [ cmake python ]
-    ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
-
-  buildInputs = [ libxml2 libffi ]
-    ++ optional enablePFM libpfm; # exegesis
-
-  propagatedBuildInputs = optionals (stdenv.hostPlatform == stdenv.buildPlatform) [ ncurses ]
-    ++ [ zlib ];
-
-  nativeCheckInputs = [ which ];
-
-  patches = [
-    # When cross-compiling we configure llvm-config-native with an approximation
-    # of the flags used for the normal LLVM build. To avoid the need for building
-    # a native libLLVM.so (which would fail) we force llvm-config to be linked
-    # statically against the necessary LLVM components always.
-    ../../common/llvm/llvm-config-link-static.patch
-
-    ./gnu-install-dirs.patch
-
-    # Fix random compiler crashes: https://bugs.llvm.org/show_bug.cgi?id=50611
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/4764a4f8c920912a2bfd8b0eea57273acfe0d8a8/trunk/no-strict-aliasing-DwarfCompileUnit.patch";
-      sha256 = "18l6mrvm2vmwm77ckcnbjvh6ybvn72rhrb799d4qzwac4x2ifl7g";
-      stripLen = 1;
-    })
-
-    # Fix musl build.
-    (fetchpatch {
-      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
-      relative = "llvm";
-      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
-    })
-
-    # Backport gcc-13 fixes with missing includes.
-    (fetchpatch {
-      name = "signals-gcc-13.patch";
-      url = "https://github.com/llvm/llvm-project/commit/ff1681ddb303223973653f7f5f3f3435b48a1983.patch";
-      hash = "sha256-CXwYxQezTq5vdmc8Yn88BUAEly6YZ5VEIA6X3y5NNOs=";
-      stripLen = 1;
-    })
-    (fetchpatch {
-      name = "base64-gcc-13.patch";
-      url = "https://github.com/llvm/llvm-project/commit/5e9be93566f39ee6cecd579401e453eccfbe81e5.patch";
-      hash = "sha256-PAwrVrvffPd7tphpwCkYiz+67szPRzRB2TXBvKfzQ7U=";
-      stripLen = 1;
-    })
-  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
-
-  postPatch = optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
-      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  '' + ''
-    # FileSystem permissions tests fail with various special bits
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "Path.cpp" ""
-    rm unittests/Support/Path.cpp
-    substituteInPlace unittests/IR/CMakeLists.txt \
-      --replace "PassBuilderCallbacksTest.cpp" ""
-    rm unittests/IR/PassBuilderCallbacksTest.cpp
-    rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
-  '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../../common/llvm/TLI-musl.patch}
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "add_subdirectory(DynamicLibrary)" ""
-    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
-    # valgrind unhappy with musl or glibc, but fails w/musl only
-    rm test/CodeGen/AArch64/wineh4.mir
-  '' + optionalString stdenv.hostPlatform.isAarch32 ''
-    # skip failing X86 test cases on 32-bit ARM
-    rm test/DebugInfo/X86/convert-debugloc.ll
-    rm test/DebugInfo/X86/convert-inlined.ll
-    rm test/DebugInfo/X86/convert-linked.ll
-    rm test/tools/dsymutil/X86/op-convert.test
-    rm test/tools/gold/X86/split-dwarf.ll
-  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
-    # Seems to require certain floating point hardware (NEON?)
-    rm test/ExecutionEngine/frem.ll
-  '' + ''
-    patchShebangs test/BugPoint/compile-custom.ll.py
-  '';
-
-  preConfigure = ''
-    # Workaround for configure flags that need to have spaces
-    cmakeFlagsArray+=(
-      -DLLVM_LIT_ARGS='-svj''${NIX_BUILD_CORES} --no-progress-bar'
-    )
-  '';
-
-  # hacky fix: created binaries need to be run before installation
-  preBuild = ''
-    mkdir -p $out/
-    ln -sv $PWD/lib $out
-  '';
-
-  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
-  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
-
-  hardeningDisable = [ "trivialautovarinit" ];
-
-  cmakeBuildType = if debugVersion then "Debug" else "Release";
-
-  cmakeFlags = with stdenv; let
-    # These flags influence llvm-config's BuildVariables.inc in addition to the
-    # general build. We need to make sure these are also passed via
-    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
-    # will return different results from the cross llvm-config.
-    #
-    # Some flags don't need to be repassed because LLVM already does so (like
-    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
-    flagsForLlvmConfig = [
-      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
-      "-DLLVM_ENABLE_RTTI=ON"
-    ] ++ optionals enableSharedLibraries [
-      "-DLLVM_LINK_LLVM_DYLIB=ON"
-    ];
-  in flagsForLlvmConfig ++ [
-    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
-    "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals stdenv.hostPlatform.isStatic [
-    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
-    "-DLLVM_ENABLE_PIC=OFF"
-    "-DLLVM_BUILD_STATIC=ON"
-    # libxml2 needs to be disabled because the LLVM build system ignores its .la
-    # file and doesn't link zlib as well.
-    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
-    "-DLLVM_ENABLE_LIBXML2=OFF"
-  ] ++ optionals enableManpages [
-    "-DLLVM_BUILD_DOCS=ON"
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (enableGoldPlugin) [
-    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ] ++ optionals isDarwin [
-    "-DLLVM_ENABLE_LIBCXX=ON"
-    "-DCAN_TARGET_i386=false"
-  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
-    "-DCMAKE_CROSSCOMPILING=True"
-    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-    (
-      let
-        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
-        nativeBintools = nativeCC.bintools.bintools;
-        nativeToolchainFlags = [
-          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
-          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
-          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
-          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
-          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
-        ];
-        # We need to repass the custom GNUInstallDirs values, otherwise CMake
-        # will choose them for us, leading to wrong results in llvm-config-native
-        nativeInstallFlags = [
-          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
-          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
-          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
-          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
-          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
-        ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
-      + lib.concatStringsSep ";" (lib.concatLists [
-        flagsForLlvmConfig
-        nativeToolchainFlags
-        nativeInstallFlags
-      ])
-    )
-  ];
-
-  postBuild = ''
-    rm -fR $out
-  '';
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
-  '';
-
-  postInstall = ''
-    mkdir -p $python/share
-    mv $out/share/opt-viewer $python/share/opt-viewer
-    moveToOutput "bin/llvm-config*" "$dev"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
-      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
-      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}'"$lib"'")'
-  ''
-  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
-  ''
-  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
-  '';
-
-  inherit doCheck;
-
-  checkTarget = "check-all";
-
-  requiredSystemFeatures = [ "big-parallel" ];
-  meta = llvm_meta // {
-    homepage = "https://llvm.org/";
-    description = "A collection of modular and reusable compiler and toolchain technologies";
-    longDescription = ''
-      The LLVM Project is a collection of modular and reusable compiler and
-      toolchain technologies. Despite its name, LLVM has little to do with
-      traditional virtual machines. The name "LLVM" itself is not an acronym; it
-      is the full name of the project.
-      LLVM began as a research project at the University of Illinois, with the
-      goal of providing a modern, SSA-based compilation strategy capable of
-      supporting both static and dynamic compilation of arbitrary programming
-      languages. Since then, LLVM has grown to be an umbrella project consisting
-      of a number of subprojects, many of which are being used in production by
-      a wide variety of commercial and open source projects as well as being
-      widely used in academic research. Code in the LLVM project is licensed
-      under the "Apache 2.0 License with LLVM exceptions".
-    '';
-  };
-} // lib.optionalAttrs enableManpages {
-  pname = "llvm-manpages";
-
-  buildPhase = ''
-    make docs-llvm-man
-  '';
-
-  propagatedBuildInputs = [];
-
-  installPhase = ''
-    make -C docs install
-  '';
-
-  postPatch = null;
-  postInstall = null;
-
-  outputs = [ "out" ];
-
-  doCheck = false;
-
-  meta = llvm_meta // {
-    description = "man pages for LLVM ${version}";
-  };
-})
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 588dc8fffefdd..f7368050d6149 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -1,6 +1,6 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
 , preLibcCrossHeaders
-, libxml2, python3, fetchFromGitHub, substitute, substituteAll, overrideCC, wrapCCWith, wrapBintoolsWith
+, libxml2, python3, fetchFromGitHub, substitute, substituteAll, fetchpatch, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@@ -80,7 +80,26 @@ in let
 
   in {
 
-    libllvm = callPackage ./llvm {
+    libllvm = callPackage ../common/llvm {
+      patches = [
+        ./llvm/gnu-install-dirs.patch
+
+        # Fix musl build.
+        (fetchpatch {
+          url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+          relative = "llvm";
+          hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+        })
+        # fix RuntimeDyld usage on aarch64-linux (e.g. python312Packages.numba tests)
+        (fetchpatch {
+          url = "https://github.com/llvm/llvm-project/commit/2e1b838a889f9793d4bcd5dbfe10db9796b77143.patch";
+          relative = "llvm";
+          hash = "sha256-Ot45P/iwaR4hkcM3xtLwfryQNgHI6pv6ADjv98tgdZA=";
+        })
+      ];
+      pollyPatches = [
+        ./llvm/gnu-install-dirs-polly.patch
+      ];
       inherit llvm_meta;
     };
 
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
deleted file mode 100644
index 124d07e4bb2b1..0000000000000
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ /dev/null
@@ -1,323 +0,0 @@
-{ lib, stdenv, llvm_meta
-, pkgsBuildBuild
-, monorepoSrc
-, runCommand
-, fetchpatch
-, cmake
-, python3
-, libffi
-, enableGoldPlugin ? libbfd.hasPluginAPI
-, libbfd
-, libpfm
-, libxml2
-, ncurses
-, version
-, release_version
-, zlib
-, which
-, buildLlvmTools
-, debugVersion ? false
-, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
-  && (stdenv.hostPlatform == stdenv.buildPlatform)
-, enableManpages ? false
-, enableSharedLibraries ? !stdenv.hostPlatform.isStatic
-# broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
-# broken for the armv7l builder
-, enablePFM ? stdenv.isLinux && !stdenv.hostPlatform.isAarch
-, enablePolly ? true
-}:
-
-let
-  inherit (lib) optional optionals optionalString;
-
-  # Used when creating a version-suffixed symlink of libLLVM.dylib
-  shortVersion = with lib;
-    concatStringsSep "." (take 1 (splitString "." release_version));
-
-  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
-  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
-  # out `doCheck` as a package level attribute).
-  #
-  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
-  # particular the children it uses to do feature detection.
-  #
-  # This means that python deps we add to `checkDeps` (which the python
-  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
-  # setup hook) are not picked up by `lit` which causes it to skip tests.
-  #
-  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
-  # because this package is shadowed in `$PATH` by the regular `python3`
-  # package.
-  #
-  # So, we "manually" assemble one python derivation for the package to depend
-  # on, taking into account whether checks are enabled or not:
-  python = if doCheck then
-    let
-      checkDeps = ps: with ps; [ psutil ];
-    in python3.withPackages checkDeps
-  else python3;
-
-in stdenv.mkDerivation (rec {
-  pname = "llvm";
-  inherit version;
-
-  src = runCommand "${pname}-src-${version}" {} (''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/${pname} "$out"
-    cp -r ${monorepoSrc}/third-party "$out"
-  '' + lib.optionalString enablePolly ''
-    chmod u+w "$out/${pname}/tools"
-    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
-  '');
-
-  sourceRoot = "${src.name}/${pname}";
-
-  outputs = [ "out" "lib" "dev" "python" ];
-
-  nativeBuildInputs = [ cmake python ]
-    ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
-
-  buildInputs = [ libxml2 libffi ]
-    ++ optional enablePFM libpfm; # exegesis
-
-  propagatedBuildInputs = [ ncurses zlib ];
-
-  nativeCheckInputs = [ which ];
-
-  patches = [
-    ./gnu-install-dirs.patch
-
-    # Fix musl build.
-    (fetchpatch {
-      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
-      relative = "llvm";
-      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
-    })
-    # fix RuntimeDyld usage on aarch64-linux (e.g. python312Packages.numba tests)
-    (fetchpatch {
-      url = "https://github.com/llvm/llvm-project/commit/2e1b838a889f9793d4bcd5dbfe10db9796b77143.patch";
-      relative = "llvm";
-      hash = "sha256-Ot45P/iwaR4hkcM3xtLwfryQNgHI6pv6ADjv98tgdZA=";
-    })
-  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
-
-  postPatch = optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
-      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  '' + ''
-    # FileSystem permissions tests fail with various special bits
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "Path.cpp" ""
-    rm unittests/Support/Path.cpp
-    substituteInPlace unittests/IR/CMakeLists.txt \
-      --replace "PassBuilderCallbacksTest.cpp" ""
-    rm unittests/IR/PassBuilderCallbacksTest.cpp
-    rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
-  '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../../common/llvm/TLI-musl.patch}
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "add_subdirectory(DynamicLibrary)" ""
-    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
-    # valgrind unhappy with musl or glibc, but fails w/musl only
-    rm test/CodeGen/AArch64/wineh4.mir
-  '' + optionalString stdenv.hostPlatform.isAarch32 ''
-    # skip failing X86 test cases on 32-bit ARM
-    rm test/DebugInfo/X86/convert-debugloc.ll
-    rm test/DebugInfo/X86/convert-inlined.ll
-    rm test/DebugInfo/X86/convert-linked.ll
-    rm test/tools/dsymutil/X86/op-convert.test
-    rm test/tools/gold/X86/split-dwarf.ll
-    rm test/tools/llvm-dwarfdump/X86/prettyprint_types.s
-    rm test/tools/llvm-dwarfdump/X86/simplified-template-names.s
-  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
-    # Seems to require certain floating point hardware (NEON?)
-    rm test/ExecutionEngine/frem.ll
-  '' + optionalString stdenv.hostPlatform.isRiscV ''
-    rm test/ExecutionEngine/frem.ll
-    rm test/ExecutionEngine/mov64zext32.ll
-    rm test/ExecutionEngine/test-interp-vec-arithm_float.ll
-    rm test/ExecutionEngine/test-interp-vec-arithm_int.ll
-    rm test/ExecutionEngine/test-interp-vec-logical.ll
-    rm test/ExecutionEngine/test-interp-vec-setcond-fp.ll
-    rm test/ExecutionEngine/test-interp-vec-setcond-int.ll
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "CrashRecoveryTest.cpp" ""
-    rm unittests/Support/CrashRecoveryTest.cpp
-    substituteInPlace unittests/ExecutionEngine/Orc/CMakeLists.txt \
-      --replace "OrcCAPITest.cpp" ""
-    rm unittests/ExecutionEngine/Orc/OrcCAPITest.cpp
-  '' + ''
-    patchShebangs test/BugPoint/compile-custom.ll.py
-  '';
-
-  preConfigure = ''
-    # Workaround for configure flags that need to have spaces
-    cmakeFlagsArray+=(
-      -DLLVM_LIT_ARGS='-svj''${NIX_BUILD_CORES} --no-progress-bar'
-    )
-  '';
-
-  # hacky fix: created binaries need to be run before installation
-  preBuild = ''
-    mkdir -p $out/
-    ln -sv $PWD/lib $out
-  '';
-
-  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
-  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
-
-  hardeningDisable = [ "trivialautovarinit" ];
-
-  cmakeBuildType = if debugVersion then "Debug" else "Release";
-
-  cmakeFlags = with stdenv; let
-    # These flags influence llvm-config's BuildVariables.inc in addition to the
-    # general build. We need to make sure these are also passed via
-    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
-    # will return different results from the cross llvm-config.
-    #
-    # Some flags don't need to be repassed because LLVM already does so (like
-    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
-    flagsForLlvmConfig = [
-      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
-      "-DLLVM_ENABLE_RTTI=ON"
-    ] ++ optionals enableSharedLibraries [
-      "-DLLVM_LINK_LLVM_DYLIB=ON"
-    ];
-  in flagsForLlvmConfig ++ [
-    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
-    "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals stdenv.hostPlatform.isStatic [
-    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
-    "-DLLVM_ENABLE_PIC=OFF"
-    "-DLLVM_BUILD_STATIC=ON"
-    "-DLLVM_LINK_LLVM_DYLIB=off"
-    # libxml2 needs to be disabled because the LLVM build system ignores its .la
-    # file and doesn't link zlib as well.
-    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
-    "-DLLVM_ENABLE_LIBXML2=OFF"
-  ] ++ optionals enableManpages [
-    "-DLLVM_BUILD_DOCS=ON"
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (enableGoldPlugin) [
-    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ] ++ optionals isDarwin [
-    "-DLLVM_ENABLE_LIBCXX=ON"
-    "-DCAN_TARGET_i386=false"
-  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
-    "-DCMAKE_CROSSCOMPILING=True"
-    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-    (
-      let
-        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
-        nativeBintools = nativeCC.bintools.bintools;
-        nativeToolchainFlags = [
-          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
-          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
-          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
-          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
-          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
-        ];
-        # We need to repass the custom GNUInstallDirs values, otherwise CMake
-        # will choose them for us, leading to wrong results in llvm-config-native
-        nativeInstallFlags = [
-          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
-          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
-          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
-          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
-          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
-        ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
-      + lib.concatStringsSep ";" (lib.concatLists [
-        flagsForLlvmConfig
-        nativeToolchainFlags
-        nativeInstallFlags
-      ])
-    )
-  ];
-
-  postBuild = ''
-    rm -fR $out
-  '';
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
-  '';
-
-  postInstall = ''
-    mkdir -p $python/share
-    mv $out/share/opt-viewer $python/share/opt-viewer
-    moveToOutput "bin/llvm-config*" "$dev"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
-      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
-      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}'"$lib"'")'
-  ''
-  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
-  ''
-  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
-  '';
-
-  inherit doCheck;
-
-  checkTarget = "check-all";
-
-  # For the update script:
-  passthru.monorepoSrc = monorepoSrc;
-
-  requiredSystemFeatures = [ "big-parallel" ];
-  meta = llvm_meta // {
-    homepage = "https://llvm.org/";
-    description = "A collection of modular and reusable compiler and toolchain technologies";
-    longDescription = ''
-      The LLVM Project is a collection of modular and reusable compiler and
-      toolchain technologies. Despite its name, LLVM has little to do with
-      traditional virtual machines. The name "LLVM" itself is not an acronym; it
-      is the full name of the project.
-      LLVM began as a research project at the University of Illinois, with the
-      goal of providing a modern, SSA-based compilation strategy capable of
-      supporting both static and dynamic compilation of arbitrary programming
-      languages. Since then, LLVM has grown to be an umbrella project consisting
-      of a number of subprojects, many of which are being used in production by
-      a wide variety of commercial and open source projects as well as being
-      widely used in academic research. Code in the LLVM project is licensed
-      under the "Apache 2.0 License with LLVM exceptions".
-    '';
-  };
-} // lib.optionalAttrs enableManpages {
-  pname = "llvm-manpages";
-
-  buildPhase = ''
-    make docs-llvm-man
-  '';
-
-  propagatedBuildInputs = [];
-
-  installPhase = ''
-    make -C docs install
-  '';
-
-  postPatch = null;
-  postInstall = null;
-
-  outputs = [ "out" ];
-
-  doCheck = false;
-
-  meta = llvm_meta // {
-    description = "man pages for LLVM ${version}";
-  };
-})
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index bfcbe2b86e247..5003ef32d1ee0 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -86,7 +86,64 @@ in let
 
   in {
 
-    libllvm = callPackage ./llvm {
+    libllvm = callPackage ../common/llvm {
+      patches = [
+        ./llvm/gnu-install-dirs.patch
+
+        # Running the tests involves invoking binaries (like `opt`) that depend on
+        # the LLVM dylibs and reference them by absolute install path (i.e. their
+        # nix store path).
+        #
+        # Because we have not yet run the install phase (we're running these tests
+        # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+        # paths do not exist yet; to work around this we point the loader (`ld` on
+        # unix, `dyld` on macOS) at the `lib` directory which will later become this
+        # package's `lib` output.
+        #
+        # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+        # dir but:
+        #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+        #     `DYLD_LIBRARY_PATH` (macOS):
+        #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+        #   - even if `lit` forwarded this env var, we actually cannot set
+        #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+        #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+        #     "protected processes" (i.e. the python interpreter that runs `lit`):
+        #     https://stackoverflow.com/a/35570229
+        #   - other LLVM subprojects deal with this issue by having their `lit`
+        #     configuration set these env vars for us; it makes sense to do the same
+        #     for LLVM:
+        #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+        #
+        # !!! TODO: look into upstreaming this patch
+        ./llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
+
+        # `lit` has a mode where it executes run lines as a shell script which is
+        # constructs; this is problematic for macOS because it means that there's
+        # another process in between `lit` and the binaries being tested. As noted
+        # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+        # tests fail with dyld errors.
+        #
+        # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+        # present in the test configuration.
+        #
+        # It's not clear to me why this isn't an issue for LLVM developers running
+        # on macOS (nothing about this _seems_ nix specific)..
+        ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
+
+        # Fix musl build.
+        (fetchpatch {
+          url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+          relative = "llvm";
+          hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+        })
+      ];
+      pollyPatches = [
+        ./llvm/gnu-install-dirs-polly.patch
+
+        # Just like the `llvm-lit-cfg` patch, but for `polly`.
+        ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
+      ];
       inherit llvm_meta;
     };
 
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
deleted file mode 100644
index d7ebcbcf8b760..0000000000000
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ /dev/null
@@ -1,442 +0,0 @@
-{ lib, stdenv, llvm_meta
-, pkgsBuildBuild
-, monorepoSrc
-, runCommand
-, fetchpatch
-, cmake
-, darwin
-, ninja
-, python3
-, python3Packages
-, libffi
-, enableGoldPlugin ? libbfd.hasPluginAPI
-, libbfd
-, libpfm
-, libxml2
-, ncurses
-, version
-, release_version
-, zlib
-, which
-, sysctl
-, buildLlvmTools
-, debugVersion ? false
-, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
-  && (stdenv.hostPlatform == stdenv.buildPlatform)
-, enableManpages ? false
-, enableSharedLibraries ? !stdenv.hostPlatform.isStatic
-, enablePFM ? stdenv.isLinux /* PFM only supports Linux */
-  # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
-  # broken for the armv7l builder
-  && !stdenv.hostPlatform.isAarch
-, enablePolly ? true
-}:
-
-let
-  inherit (lib) optional optionals optionalString;
-
-  # Used when creating a version-suffixed symlink of libLLVM.dylib
-  shortVersion = with lib;
-    concatStringsSep "." (take 1 (splitString "." release_version));
-
-  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
-  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
-  # out `doCheck` as a package level attribute).
-  #
-  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
-  # particular the children it uses to do feature detection.
-  #
-  # This means that python deps we add to `checkDeps` (which the python
-  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
-  # setup hook) are not picked up by `lit` which causes it to skip tests.
-  #
-  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
-  # because this package is shadowed in `$PATH` by the regular `python3`
-  # package.
-  #
-  # So, we "manually" assemble one python derivation for the package to depend
-  # on, taking into account whether checks are enabled or not:
-  python = if doCheck then
-    # Note that we _explicitly_ ask for a python interpreter for our host
-    # platform here; the splicing that would ordinarily take care of this for
-    # us does not seem to work once we use `withPackages`.
-    let
-      checkDeps = ps: with ps; [ psutil ];
-    in pkgsBuildBuild.targetPackages.python3.withPackages checkDeps
-  else python3;
-
-in stdenv.mkDerivation (rec {
-  pname = "llvm";
-  inherit version;
-
-  src = runCommand "${pname}-src-${version}" {} (''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/${pname} "$out"
-    cp -r ${monorepoSrc}/third-party "$out"
-  '' + lib.optionalString enablePolly ''
-    chmod u+w "$out/${pname}/tools"
-    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
-  '');
-
-  sourceRoot = "${src.name}/${pname}";
-
-  outputs = [ "out" "lib" "dev" "python" ];
-
-  nativeBuildInputs = [ cmake ninja python ]
-    ++ optionals enableManpages [
-      # Note: we intentionally use `python3Packages` instead of `python3.pkgs`;
-      # splicing does *not* work with the latter. (TODO: fix)
-      python3Packages.sphinx python3Packages.recommonmark
-    ];
-
-  buildInputs = [ libxml2 libffi ]
-    ++ optional enablePFM libpfm; # exegesis
-
-  propagatedBuildInputs = [ ncurses zlib ];
-
-  nativeCheckInputs = [
-    which
-  ] ++ lib.optional stdenv.isDarwin sysctl;
-
-  patches = [
-    ./gnu-install-dirs.patch
-
-    # Running the tests involves invoking binaries (like `opt`) that depend on
-    # the LLVM dylibs and reference them by absolute install path (i.e. their
-    # nix store path).
-    #
-    # Because we have not yet run the install phase (we're running these tests
-    # as part of `checkPhase` instead of `installCheckPhase`) these absolute
-    # paths do not exist yet; to work around this we point the loader (`ld` on
-    # unix, `dyld` on macOS) at the `lib` directory which will later become this
-    # package's `lib` output.
-    #
-    # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
-    # dir but:
-    #   - this doesn't generalize well to other platforms; `lit` doesn't forward
-    #     `DYLD_LIBRARY_PATH` (macOS):
-    #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
-    #   - even if `lit` forwarded this env var, we actually cannot set
-    #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
-    #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
-    #     "protected processes" (i.e. the python interpreter that runs `lit`):
-    #     https://stackoverflow.com/a/35570229
-    #   - other LLVM subprojects deal with this issue by having their `lit`
-    #     configuration set these env vars for us; it makes sense to do the same
-    #     for LLVM:
-    #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
-    #
-    # !!! TODO: look into upstreaming this patch
-    ./llvm-lit-cfg-add-libs-to-dylib-path.patch
-
-    # `lit` has a mode where it executes run lines as a shell script which is
-    # constructs; this is problematic for macOS because it means that there's
-    # another process in between `lit` and the binaries being tested. As noted
-    # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
-    # tests fail with dyld errors.
-    #
-    # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
-    # present in the test configuration.
-    #
-    # It's not clear to me why this isn't an issue for LLVM developers running
-    # on macOS (nothing about this _seems_ nix specific)..
-    ./lit-shell-script-runner-set-dyld-library-path.patch
-
-    # Fix musl build.
-    (fetchpatch {
-      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
-      relative = "llvm";
-      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
-    })
-  ] ++ lib.optionals enablePolly [
-    ./gnu-install-dirs-polly.patch
-
-    # Just like the `llvm-lit-cfg` patch, but for `polly`.
-    ./polly-lit-cfg-add-libs-to-dylib-path.patch
-  ];
-
-  postPatch = optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
-      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-
-    # As of LLVM 15, marked as XFAIL on arm64 macOS but lit doesn't seem to pick
-    # this up: https://github.com/llvm/llvm-project/blob/c344d97a125b18f8fed0a64aace73c49a870e079/llvm/test/MC/ELF/cfi-version.ll#L7
-    rm test/MC/ELF/cfi-version.ll
-
-    # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
-    # and thus fails under the sandbox:
-    substituteInPlace unittests/Support/Host.cpp \
-      --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
-  '' + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86) ''
-    # This test tries to call the intrinsics `@llvm.roundeven.f32` and
-    # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
-    # and `roundeven` on x86_64 macOS.
-    #
-    # However these functions are glibc specific so the test fails:
-    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundevenf.html
-    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundeven.html
-    #
-    # TODO(@rrbutani): this seems to run fine on `aarch64-darwin`, why does it
-    # pass there?
-    substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
-      --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
-      --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
-
-    # This test fails on darwin x86_64 because `sw_vers` reports a different
-    # macOS version than what LLVM finds by reading
-    # `/System/Library/CoreServices/SystemVersion.plist` (which is passed into
-    # the sandbox on macOS).
-    #
-    # The `sw_vers` provided by nixpkgs reports the macOS version associated
-    # with the `CoreFoundation` framework with which it was built. Because
-    # nixpkgs pins the SDK for `aarch64-darwin` and `x86_64-darwin` what
-    # `sw_vers` reports is not guaranteed to match the macOS version of the host
-    # that's building this derivation.
-    #
-    # Astute readers will note that we only _patch_ this test on aarch64-darwin
-    # (to use the nixpkgs provided `sw_vers`) instead of disabling it outright.
-    # So why does this test pass on aarch64?
-    #
-    # Well, it seems that `sw_vers` on aarch64 actually links against the _host_
-    # CoreFoundation framework instead of the nixpkgs provided one.
-    #
-    # Not entirely sure what the right fix is here. I'm assuming aarch64
-    # `sw_vers` doesn't intentionally link against the host `CoreFoundation`
-    # (still digging into how this ends up happening, will follow up) but that
-    # aside I think the more pertinent question is: should we be patching LLVM's
-    # macOS version detection logic to use `sw_vers` instead of reading host
-    # paths? This *is* a way in which details about builder machines can creep
-    # into the artifacts that are produced, affecting reproducibility, but it's
-    # not clear to me when/where/for what this even gets used in LLVM.
-    #
-    # TODO(@rrbutani): fix/follow-up
-    substituteInPlace unittests/Support/Host.cpp \
-      --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
-
-    # This test fails with a `dysmutil` crash; have not yet dug into what's
-    # going on here (TODO(@rrbutani)).
-    rm test/tools/dsymutil/ARM/obfuscated.test
-  '' + ''
-    # FileSystem permissions tests fail with various special bits
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "Path.cpp" ""
-    rm unittests/Support/Path.cpp
-    substituteInPlace unittests/IR/CMakeLists.txt \
-      --replace "PassBuilderCallbacksTest.cpp" ""
-    rm unittests/IR/PassBuilderCallbacksTest.cpp
-    rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
-    # timing-based tests are trouble
-    rm utils/lit/tests/googletest-timeout.py
-  '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../../common/llvm/TLI-musl.patch}
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "add_subdirectory(DynamicLibrary)" ""
-    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
-    # valgrind unhappy with musl or glibc, but fails w/musl only
-    rm test/CodeGen/AArch64/wineh4.mir
-  '' + optionalString stdenv.hostPlatform.isAarch32 ''
-    # skip failing X86 test cases on 32-bit ARM
-    rm test/DebugInfo/X86/convert-debugloc.ll
-    rm test/DebugInfo/X86/convert-inlined.ll
-    rm test/DebugInfo/X86/convert-linked.ll
-    rm test/tools/dsymutil/X86/op-convert.test
-    rm test/tools/gold/X86/split-dwarf.ll
-    rm test/tools/llvm-dwarfdump/X86/prettyprint_types.s
-    rm test/tools/llvm-dwarfdump/X86/simplified-template-names.s
-
-    # !!! Note: these tests are removed in LLVM 16.
-    #
-    # See here for context: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999790443
-    rm test/CodeGen/RISCV/rv32zbp.ll
-    rm test/CodeGen/RISCV/rv64zbp.ll
-  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
-    # Seems to require certain floating point hardware (NEON?)
-    rm test/ExecutionEngine/frem.ll
-  '' + ''
-    patchShebangs test/BugPoint/compile-custom.ll.py
-  '';
-
-  preConfigure = ''
-    # Workaround for configure flags that need to have spaces
-    cmakeFlagsArray+=(
-      -DLLVM_LIT_ARGS="-svj''${NIX_BUILD_CORES} --no-progress-bar"
-    )
-  '';
-
-  # Defensive check: some paths (that we make symlinks to) depend on the release
-  # version, for example:
-  #  - https://github.com/llvm/llvm-project/blob/406bde9a15136254f2b10d9ef3a42033b3cb1b16/clang/lib/Headers/CMakeLists.txt#L185
-  #
-  # So we want to sure that the version in the source matches the release
-  # version we were given.
-  #
-  # We do this check here, in the LLVM build, because it happens early.
-  postConfigure = let
-    v = lib.versions;
-    major = v.major release_version;
-    minor = v.minor release_version;
-    patch = v.patch release_version;
-  in ''
-    # $1: part, $2: expected
-    check_version() {
-      part="''${1^^}"
-      part="$(cat include/llvm/Config/llvm-config.h  | grep "#define LLVM_VERSION_''${part} " | cut -d' ' -f3)"
-
-      if [[ "$part" != "$2" ]]; then
-        echo >&2 \
-          "mismatch in the $1 version! we have version ${release_version}" \
-          "and expected the $1 version to be '$2'; the source has '$part' instead"
-        exit 3
-      fi
-    }
-
-    check_version major ${major}
-    check_version minor ${minor}
-    check_version patch ${patch}
-  '';
-
-  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
-  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
-
-  hardeningDisable = [ "trivialautovarinit" ];
-
-  cmakeBuildType = if debugVersion then "Debug" else "Release";
-
-  cmakeFlags = with stdenv; let
-    # These flags influence llvm-config's BuildVariables.inc in addition to the
-    # general build. We need to make sure these are also passed via
-    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
-    # will return different results from the cross llvm-config.
-    #
-    # Some flags don't need to be repassed because LLVM already does so (like
-    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
-    flagsForLlvmConfig = [
-      "-DLLVM_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/llvm"
-      "-DLLVM_ENABLE_RTTI=ON"
-    ] ++ optionals enableSharedLibraries [
-      "-DLLVM_LINK_LLVM_DYLIB=ON"
-    ];
-  in flagsForLlvmConfig ++ [
-    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
-    "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals stdenv.hostPlatform.isStatic [
-    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
-    "-DLLVM_ENABLE_PIC=OFF"
-    "-DLLVM_BUILD_STATIC=ON"
-    "-DLLVM_LINK_LLVM_DYLIB=off"
-    # libxml2 needs to be disabled because the LLVM build system ignores its .la
-    # file and doesn't link zlib as well.
-    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
-    "-DLLVM_ENABLE_LIBXML2=OFF"
-  ] ++ optionals enableManpages [
-    "-DLLVM_BUILD_DOCS=ON"
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (enableGoldPlugin) [
-    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ] ++ optionals isDarwin [
-    "-DLLVM_ENABLE_LIBCXX=ON"
-    "-DCAN_TARGET_i386=false"
-  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
-    "-DCMAKE_CROSSCOMPILING=True"
-    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-    (
-      let
-        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
-        nativeBintools = nativeCC.bintools.bintools;
-        nativeToolchainFlags = [
-          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
-          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
-          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
-          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
-          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
-        ];
-        # We need to repass the custom GNUInstallDirs values, otherwise CMake
-        # will choose them for us, leading to wrong results in llvm-config-native
-        nativeInstallFlags = [
-          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
-          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
-          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
-          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
-          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
-        ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
-      + lib.concatStringsSep ";" (lib.concatLists [
-        flagsForLlvmConfig
-        nativeToolchainFlags
-        nativeInstallFlags
-      ])
-    )
-  ];
-
-  postInstall = ''
-    mkdir -p $python/share
-    mv $out/share/opt-viewer $python/share/opt-viewer
-    moveToOutput "bin/llvm-config*" "$dev"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
-      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
-      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "'"$lib"'")'
-  ''
-  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
-  ''
-  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
-  '';
-
-  inherit doCheck;
-
-  checkTarget = "check-all";
-
-  # For the update script:
-  passthru.monorepoSrc = monorepoSrc;
-
-  requiredSystemFeatures = [ "big-parallel" ];
-  meta = llvm_meta // {
-    homepage = "https://llvm.org/";
-    description = "A collection of modular and reusable compiler and toolchain technologies";
-    longDescription = ''
-      The LLVM Project is a collection of modular and reusable compiler and
-      toolchain technologies. Despite its name, LLVM has little to do with
-      traditional virtual machines. The name "LLVM" itself is not an acronym; it
-      is the full name of the project.
-      LLVM began as a research project at the University of Illinois, with the
-      goal of providing a modern, SSA-based compilation strategy capable of
-      supporting both static and dynamic compilation of arbitrary programming
-      languages. Since then, LLVM has grown to be an umbrella project consisting
-      of a number of subprojects, many of which are being used in production by
-      a wide variety of commercial and open source projects as well as being
-      widely used in academic research. Code in the LLVM project is licensed
-      under the "Apache 2.0 License with LLVM exceptions".
-    '';
-  };
-} // lib.optionalAttrs enableManpages {
-  pname = "llvm-manpages";
-
-  propagatedBuildInputs = [];
-
-  ninjaFlags = [ "docs-llvm-man" ];
-  installTargets = [ "install-docs-llvm-man" ];
-
-  postPatch = null;
-  postInstall = null;
-
-  outputs = [ "out" ];
-
-  doCheck = false;
-
-  meta = llvm_meta // {
-    description = "man pages for LLVM ${version}";
-  };
-})
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 5dd07d77cf8c6..79d5f8589044c 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -87,7 +87,57 @@ in let
 
   in {
 
-    libllvm = callPackage ./llvm {
+    libllvm = callPackage ../common/llvm {
+      patches = [
+        ./llvm/gnu-install-dirs.patch
+
+        # Running the tests involves invoking binaries (like `opt`) that depend on
+        # the LLVM dylibs and reference them by absolute install path (i.e. their
+        # nix store path).
+        #
+        # Because we have not yet run the install phase (we're running these tests
+        # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+        # paths do not exist yet; to work around this we point the loader (`ld` on
+        # unix, `dyld` on macOS) at the `lib` directory which will later become this
+        # package's `lib` output.
+        #
+        # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+        # dir but:
+        #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+        #     `DYLD_LIBRARY_PATH` (macOS):
+        #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+        #   - even if `lit` forwarded this env var, we actually cannot set
+        #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+        #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+        #     "protected processes" (i.e. the python interpreter that runs `lit`):
+        #     https://stackoverflow.com/a/35570229
+        #   - other LLVM subprojects deal with this issue by having their `lit`
+        #     configuration set these env vars for us; it makes sense to do the same
+        #     for LLVM:
+        #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+        #
+        # !!! TODO: look into upstreaming this patch
+        ./llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
+
+        # `lit` has a mode where it executes run lines as a shell script which is
+        # constructs; this is problematic for macOS because it means that there's
+        # another process in between `lit` and the binaries being tested. As noted
+        # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+        # tests fail with dyld errors.
+        #
+        # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+        # present in the test configuration.
+        #
+        # It's not clear to me why this isn't an issue for LLVM developers running
+        # on macOS (nothing about this _seems_ nix specific)..
+        ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
+      ];
+      pollyPatches = [
+        ./llvm/gnu-install-dirs-polly.patch
+
+        # Just like the `llvm-lit-cfg` patch, but for `polly`.
+        ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
+      ];
       inherit llvm_meta;
     };
 
diff --git a/pkgs/development/compilers/llvm/16/llvm/default.nix b/pkgs/development/compilers/llvm/16/llvm/default.nix
deleted file mode 100644
index 0a8d877ba83c8..0000000000000
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ /dev/null
@@ -1,435 +0,0 @@
-{ lib, stdenv, llvm_meta
-, pkgsBuildBuild
-, monorepoSrc
-, runCommand
-, cmake
-, darwin
-, ninja
-, python3
-, python3Packages
-, libffi
-# TODO: Gold plugin on LLVM16 has a severe memory corruption bug: https://github.com/llvm/llvm-project/issues/61350.
-, enableGoldPlugin ? false
-, libbfd
-, libpfm
-, libxml2
-, ncurses
-, version
-, release_version
-, zlib
-, which
-, sysctl
-, buildLlvmTools
-, debugVersion ? false
-, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
-  && (stdenv.hostPlatform == stdenv.buildPlatform)
-, enableManpages ? false
-, enableSharedLibraries ? !stdenv.hostPlatform.isStatic
-, enablePFM ? stdenv.isLinux /* PFM only supports Linux */
-  # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
-  # broken for the armv7l builder
-  && !stdenv.hostPlatform.isAarch
-, enablePolly ? true
-}:
-
-let
-  inherit (lib) optional optionals optionalString;
-
-  # Used when creating a version-suffixed symlink of libLLVM.dylib
-  shortVersion = with lib;
-    concatStringsSep "." (take 1 (splitString "." release_version));
-
-  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
-  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
-  # out `doCheck` as a package level attribute).
-  #
-  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
-  # particular the children it uses to do feature detection.
-  #
-  # This means that python deps we add to `checkDeps` (which the python
-  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
-  # setup hook) are not picked up by `lit` which causes it to skip tests.
-  #
-  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
-  # because this package is shadowed in `$PATH` by the regular `python3`
-  # package.
-  #
-  # So, we "manually" assemble one python derivation for the package to depend
-  # on, taking into account whether checks are enabled or not:
-  python = if doCheck then
-    # Note that we _explicitly_ ask for a python interpreter for our host
-    # platform here; the splicing that would ordinarily take care of this for
-    # us does not seem to work once we use `withPackages`.
-    let
-      checkDeps = ps: with ps; [ psutil ];
-    in pkgsBuildBuild.targetPackages.python3.withPackages checkDeps
-  else python3;
-
-in
-  assert (lib.assertMsg (!enableGoldPlugin) "Gold plugin cannot be enabled on LLVM16 due to a upstream issue: https://github.com/llvm/llvm-project/issues/61350");
-  stdenv.mkDerivation (rec {
-  pname = "llvm";
-  inherit version;
-
-  src = runCommand "${pname}-src-${version}" {} (''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/${pname} "$out"
-    cp -r ${monorepoSrc}/third-party "$out"
-  '' + lib.optionalString enablePolly ''
-    chmod u+w "$out/${pname}/tools"
-    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
-  '');
-
-  sourceRoot = "${src.name}/${pname}";
-
-  outputs = [ "out" "lib" "dev" "python" ];
-
-  nativeBuildInputs = [ cmake ninja python ]
-    ++ optionals enableManpages [
-      # Note: we intentionally use `python3Packages` instead of `python3.pkgs`;
-      # splicing does *not* work with the latter. (TODO: fix)
-      python3Packages.sphinx python3Packages.recommonmark
-    ];
-
-  buildInputs = [ libxml2 libffi ]
-    ++ optional enablePFM libpfm; # exegesis
-
-  propagatedBuildInputs = [ ncurses zlib ];
-
-  nativeCheckInputs = [
-    which
-  ] ++ lib.optional stdenv.isDarwin sysctl;
-
-  patches = [
-    ./gnu-install-dirs.patch
-
-    # Running the tests involves invoking binaries (like `opt`) that depend on
-    # the LLVM dylibs and reference them by absolute install path (i.e. their
-    # nix store path).
-    #
-    # Because we have not yet run the install phase (we're running these tests
-    # as part of `checkPhase` instead of `installCheckPhase`) these absolute
-    # paths do not exist yet; to work around this we point the loader (`ld` on
-    # unix, `dyld` on macOS) at the `lib` directory which will later become this
-    # package's `lib` output.
-    #
-    # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
-    # dir but:
-    #   - this doesn't generalize well to other platforms; `lit` doesn't forward
-    #     `DYLD_LIBRARY_PATH` (macOS):
-    #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
-    #   - even if `lit` forwarded this env var, we actually cannot set
-    #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
-    #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
-    #     "protected processes" (i.e. the python interpreter that runs `lit`):
-    #     https://stackoverflow.com/a/35570229
-    #   - other LLVM subprojects deal with this issue by having their `lit`
-    #     configuration set these env vars for us; it makes sense to do the same
-    #     for LLVM:
-    #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
-    #
-    # !!! TODO: look into upstreaming this patch
-    ./llvm-lit-cfg-add-libs-to-dylib-path.patch
-
-    # `lit` has a mode where it executes run lines as a shell script which is
-    # constructs; this is problematic for macOS because it means that there's
-    # another process in between `lit` and the binaries being tested. As noted
-    # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
-    # tests fail with dyld errors.
-    #
-    # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
-    # present in the test configuration.
-    #
-    # It's not clear to me why this isn't an issue for LLVM developers running
-    # on macOS (nothing about this _seems_ nix specific)..
-    ./lit-shell-script-runner-set-dyld-library-path.patch
-  ] ++ lib.optionals enablePolly [
-    ./gnu-install-dirs-polly.patch
-
-    # Just like the `llvm-lit-cfg` patch, but for `polly`.
-    ./polly-lit-cfg-add-libs-to-dylib-path.patch
-  ];
-
-  postPatch = optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
-      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-
-    # As of LLVM 15, marked as XFAIL on arm64 macOS but lit doesn't seem to pick
-    # this up: https://github.com/llvm/llvm-project/blob/c344d97a125b18f8fed0a64aace73c49a870e079/llvm/test/MC/ELF/cfi-version.ll#L7
-    rm test/MC/ELF/cfi-version.ll
-
-    # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
-    # and thus fails under the sandbox:
-    substituteInPlace unittests/TargetParser/Host.cpp \
-      --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
-
-    # This test tries to call the intrinsics `@llvm.roundeven.f32` and
-    # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
-    # and `roundeven` on macOS.
-    #
-    # However these functions are glibc specific so the test fails:
-    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundevenf.html
-    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundeven.html
-    #
-    substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
-      --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
-      --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
-  '' + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86) ''
-    # This test fails on darwin x86_64 because `sw_vers` reports a different
-    # macOS version than what LLVM finds by reading
-    # `/System/Library/CoreServices/SystemVersion.plist` (which is passed into
-    # the sandbox on macOS).
-    #
-    # The `sw_vers` provided by nixpkgs reports the macOS version associated
-    # with the `CoreFoundation` framework with which it was built. Because
-    # nixpkgs pins the SDK for `aarch64-darwin` and `x86_64-darwin` what
-    # `sw_vers` reports is not guaranteed to match the macOS version of the host
-    # that's building this derivation.
-    #
-    # Astute readers will note that we only _patch_ this test on aarch64-darwin
-    # (to use the nixpkgs provided `sw_vers`) instead of disabling it outright.
-    # So why does this test pass on aarch64?
-    #
-    # Well, it seems that `sw_vers` on aarch64 actually links against the _host_
-    # CoreFoundation framework instead of the nixpkgs provided one.
-    #
-    # Not entirely sure what the right fix is here. I'm assuming aarch64
-    # `sw_vers` doesn't intentionally link against the host `CoreFoundation`
-    # (still digging into how this ends up happening, will follow up) but that
-    # aside I think the more pertinent question is: should we be patching LLVM's
-    # macOS version detection logic to use `sw_vers` instead of reading host
-    # paths? This *is* a way in which details about builder machines can creep
-    # into the artifacts that are produced, affecting reproducibility, but it's
-    # not clear to me when/where/for what this even gets used in LLVM.
-    #
-    # TODO(@rrbutani): fix/follow-up
-    substituteInPlace unittests/TargetParser/Host.cpp \
-      --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
-
-    # This test fails with a `dysmutil` crash; have not yet dug into what's
-    # going on here (TODO(@rrbutani)).
-    rm test/tools/dsymutil/ARM/obfuscated.test
-  '' + ''
-    # FileSystem permissions tests fail with various special bits
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "Path.cpp" ""
-    rm unittests/Support/Path.cpp
-    substituteInPlace unittests/IR/CMakeLists.txt \
-      --replace "PassBuilderCallbacksTest.cpp" ""
-    rm unittests/IR/PassBuilderCallbacksTest.cpp
-    rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
-
-    # Fails in the presence of anti-virus software or other intrusion-detection software that
-    # modifies the atime when run. See #284056.
-    rm test/tools/llvm-objcopy/ELF/strip-preserve-atime.test
-
-    # timing-based tests are trouble
-    rm utils/lit/tests/googletest-timeout.py
-  '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../../common/llvm/TLI-musl.patch}
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "add_subdirectory(DynamicLibrary)" ""
-    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
-    # valgrind unhappy with musl or glibc, but fails w/musl only
-    rm test/CodeGen/AArch64/wineh4.mir
-  '' + optionalString stdenv.hostPlatform.isAarch32 ''
-    # skip failing X86 test cases on 32-bit ARM
-    rm test/DebugInfo/X86/convert-debugloc.ll
-    rm test/DebugInfo/X86/convert-inlined.ll
-    rm test/DebugInfo/X86/convert-linked.ll
-    rm test/tools/dsymutil/X86/op-convert.test
-    rm test/tools/gold/X86/split-dwarf.ll
-    rm test/tools/llvm-dwarfdump/X86/prettyprint_types.s
-    rm test/tools/llvm-dwarfdump/X86/simplified-template-names.s
-  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
-    # Seems to require certain floating point hardware (NEON?)
-    rm test/ExecutionEngine/frem.ll
-  '' + ''
-    patchShebangs test/BugPoint/compile-custom.ll.py
-  '';
-
-  preConfigure = ''
-    # Workaround for configure flags that need to have spaces
-    cmakeFlagsArray+=(
-      -DLLVM_LIT_ARGS="-svj''${NIX_BUILD_CORES} --no-progress-bar"
-    )
-  '';
-
-  # Defensive check: some paths (that we make symlinks to) depend on the release
-  # version, for example:
-  #  - https://github.com/llvm/llvm-project/blob/406bde9a15136254f2b10d9ef3a42033b3cb1b16/clang/lib/Headers/CMakeLists.txt#L185
-  #
-  # So we want to sure that the version in the source matches the release
-  # version we were given.
-  #
-  # We do this check here, in the LLVM build, because it happens early.
-  postConfigure = let
-    v = lib.versions;
-    major = v.major release_version;
-    minor = v.minor release_version;
-    patch = v.patch release_version;
-  in ''
-    # $1: part, $2: expected
-    check_version() {
-      part="''${1^^}"
-      part="$(cat include/llvm/Config/llvm-config.h  | grep "#define LLVM_VERSION_''${part} " | cut -d' ' -f3)"
-
-      if [[ "$part" != "$2" ]]; then
-        echo >&2 \
-          "mismatch in the $1 version! we have version ${release_version}" \
-          "and expected the $1 version to be '$2'; the source has '$part' instead"
-        exit 3
-      fi
-    }
-
-    check_version major ${major}
-    check_version minor ${minor}
-    check_version patch ${patch}
-  '';
-
-  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
-  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
-
-  hardeningDisable = [ "trivialautovarinit" ];
-
-  cmakeBuildType = if debugVersion then "Debug" else "Release";
-
-  cmakeFlags = with stdenv; let
-    # These flags influence llvm-config's BuildVariables.inc in addition to the
-    # general build. We need to make sure these are also passed via
-    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
-    # will return different results from the cross llvm-config.
-    #
-    # Some flags don't need to be repassed because LLVM already does so (like
-    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
-    flagsForLlvmConfig = [
-      "-DLLVM_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/llvm"
-      "-DLLVM_ENABLE_RTTI=ON"
-    ] ++ optionals enableSharedLibraries [
-      "-DLLVM_LINK_LLVM_DYLIB=ON"
-    ];
-  in flagsForLlvmConfig ++ [
-    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
-    "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals stdenv.hostPlatform.isStatic [
-    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
-    "-DLLVM_ENABLE_PIC=OFF"
-    "-DLLVM_BUILD_STATIC=ON"
-    "-DLLVM_LINK_LLVM_DYLIB=off"
-    # libxml2 needs to be disabled because the LLVM build system ignores its .la
-    # file and doesn't link zlib as well.
-    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
-    "-DLLVM_ENABLE_LIBXML2=OFF"
-  ] ++ optionals enableManpages [
-    "-DLLVM_BUILD_DOCS=ON"
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals enableGoldPlugin [
-    # For LLVMgold plugin
-    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ] ++ optionals isDarwin [
-    "-DLLVM_ENABLE_LIBCXX=ON"
-    "-DCAN_TARGET_i386=false"
-  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
-    "-DCMAKE_CROSSCOMPILING=True"
-    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-    (
-      let
-        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
-        nativeBintools = nativeCC.bintools.bintools;
-        nativeToolchainFlags = [
-          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
-          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
-          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
-          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
-          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
-        ];
-        # We need to repass the custom GNUInstallDirs values, otherwise CMake
-        # will choose them for us, leading to wrong results in llvm-config-native
-        nativeInstallFlags = [
-          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
-          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
-          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
-          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
-          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
-        ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
-      + lib.concatStringsSep ";" (lib.concatLists [
-        flagsForLlvmConfig
-        nativeToolchainFlags
-        nativeInstallFlags
-      ])
-    )
-  ];
-
-  postInstall = ''
-    mkdir -p $python/share
-    mv $out/share/opt-viewer $python/share/opt-viewer
-    moveToOutput "bin/llvm-config*" "$dev"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
-      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
-      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "'"$lib"'")'
-  ''
-  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
-  ''
-  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
-  '';
-
-  inherit doCheck;
-
-  checkTarget = "check-all";
-
-  # For the update script:
-  passthru.monorepoSrc = monorepoSrc;
-
-  requiredSystemFeatures = [ "big-parallel" ];
-  meta = llvm_meta // {
-    homepage = "https://llvm.org/";
-    description = "A collection of modular and reusable compiler and toolchain technologies";
-    longDescription = ''
-      The LLVM Project is a collection of modular and reusable compiler and
-      toolchain technologies. Despite its name, LLVM has little to do with
-      traditional virtual machines. The name "LLVM" itself is not an acronym; it
-      is the full name of the project.
-      LLVM began as a research project at the University of Illinois, with the
-      goal of providing a modern, SSA-based compilation strategy capable of
-      supporting both static and dynamic compilation of arbitrary programming
-      languages. Since then, LLVM has grown to be an umbrella project consisting
-      of a number of subprojects, many of which are being used in production by
-      a wide variety of commercial and open source projects as well as being
-      widely used in academic research. Code in the LLVM project is licensed
-      under the "Apache 2.0 License with LLVM exceptions".
-    '';
-  };
-} // lib.optionalAttrs enableManpages {
-  pname = "llvm-manpages";
-
-  propagatedBuildInputs = [];
-
-  ninjaFlags = [ "docs-llvm-man" ];
-  installTargets = [ "install-docs-llvm-man" ];
-
-  postPatch = null;
-  postInstall = null;
-
-  outputs = [ "out" ];
-
-  doCheck = false;
-
-  meta = llvm_meta // {
-    description = "man pages for LLVM ${version}";
-  };
-})
diff --git a/pkgs/development/compilers/llvm/17/default.nix b/pkgs/development/compilers/llvm/17/default.nix
index 9f4be2261b0cf..b4039540badf4 100644
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ b/pkgs/development/compilers/llvm/17/default.nix
@@ -82,7 +82,57 @@ in let
 
   in {
 
-    libllvm = callPackage ./llvm {
+    libllvm = callPackage ../common/llvm {
+      patches = [
+        ./llvm/gnu-install-dirs.patch
+
+        # Running the tests involves invoking binaries (like `opt`) that depend on
+        # the LLVM dylibs and reference them by absolute install path (i.e. their
+        # nix store path).
+        #
+        # Because we have not yet run the install phase (we're running these tests
+        # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+        # paths do not exist yet; to work around this we point the loader (`ld` on
+        # unix, `dyld` on macOS) at the `lib` directory which will later become this
+        # package's `lib` output.
+        #
+        # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+        # dir but:
+        #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+        #     `DYLD_LIBRARY_PATH` (macOS):
+        #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+        #   - even if `lit` forwarded this env var, we actually cannot set
+        #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+        #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+        #     "protected processes" (i.e. the python interpreter that runs `lit`):
+        #     https://stackoverflow.com/a/35570229
+        #   - other LLVM subprojects deal with this issue by having their `lit`
+        #     configuration set these env vars for us; it makes sense to do the same
+        #     for LLVM:
+        #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+        #
+        # !!! TODO: look into upstreaming this patch
+        ./llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
+
+        # `lit` has a mode where it executes run lines as a shell script which is
+        # constructs; this is problematic for macOS because it means that there's
+        # another process in between `lit` and the binaries being tested. As noted
+        # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+        # tests fail with dyld errors.
+        #
+        # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+        # present in the test configuration.
+        #
+        # It's not clear to me why this isn't an issue for LLVM developers running
+        # on macOS (nothing about this _seems_ nix specific)..
+        ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
+      ];
+      pollyPatches = [
+        ./llvm/gnu-install-dirs-polly.patch
+
+        # Just like the `llvm-lit-cfg` patch, but for `polly`.
+        ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
+      ];
       inherit llvm_meta;
     };
 
diff --git a/pkgs/development/compilers/llvm/17/llvm/default.nix b/pkgs/development/compilers/llvm/17/llvm/default.nix
deleted file mode 100644
index a045bea9f4728..0000000000000
--- a/pkgs/development/compilers/llvm/17/llvm/default.nix
+++ /dev/null
@@ -1,431 +0,0 @@
-{ lib, stdenv, llvm_meta
-, pkgsBuildBuild
-, monorepoSrc
-, runCommand
-, cmake
-, darwin
-, ninja
-, python3
-, python3Packages
-, libffi
-, enableGoldPlugin ? libbfd.hasPluginAPI
-, libbfd
-, libpfm
-, libxml2
-, ncurses
-, version
-, release_version
-, zlib
-, which
-, sysctl
-, buildLlvmTools
-, debugVersion ? false
-, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
-  && (stdenv.hostPlatform == stdenv.buildPlatform)
-, enableManpages ? false
-, enableSharedLibraries ? !stdenv.hostPlatform.isStatic
-, enablePFM ? stdenv.isLinux /* PFM only supports Linux */
-  # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
-  # broken for the armv7l builder
-  && !stdenv.hostPlatform.isAarch
-, enablePolly ? true
-}:
-
-let
-  inherit (lib) optional optionals optionalString;
-
-  # Used when creating a version-suffixed symlink of libLLVM.dylib
-  shortVersion = with lib;
-    concatStringsSep "." (take 1 (splitString "." release_version));
-
-  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
-  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
-  # out `doCheck` as a package level attribute).
-  #
-  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
-  # particular the children it uses to do feature detection.
-  #
-  # This means that python deps we add to `checkDeps` (which the python
-  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
-  # setup hook) are not picked up by `lit` which causes it to skip tests.
-  #
-  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
-  # because this package is shadowed in `$PATH` by the regular `python3`
-  # package.
-  #
-  # So, we "manually" assemble one python derivation for the package to depend
-  # on, taking into account whether checks are enabled or not:
-  python = if doCheck then
-    # Note that we _explicitly_ ask for a python interpreter for our host
-    # platform here; the splicing that would ordinarily take care of this for
-    # us does not seem to work once we use `withPackages`.
-    let
-      checkDeps = ps: with ps; [ psutil ];
-    in pkgsBuildBuild.targetPackages.python3.withPackages checkDeps
-  else python3;
-
-in
-
-stdenv.mkDerivation (rec {
-  pname = "llvm";
-  inherit version;
-
-  src = runCommand "${pname}-src-${version}" {} (''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/${pname} "$out"
-    cp -r ${monorepoSrc}/third-party "$out"
-  '' + lib.optionalString enablePolly ''
-    chmod u+w "$out/${pname}/tools"
-    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
-  '');
-
-  sourceRoot = "${src.name}/${pname}";
-
-  outputs = [ "out" "lib" "dev" "python" ];
-
-  nativeBuildInputs = [ cmake ninja python ]
-    ++ optionals enableManpages [
-      # Note: we intentionally use `python3Packages` instead of `python3.pkgs`;
-      # splicing does *not* work with the latter. (TODO: fix)
-      python3Packages.sphinx python3Packages.recommonmark
-    ];
-
-  buildInputs = [ libxml2 libffi ]
-    ++ optional enablePFM libpfm; # exegesis
-
-  propagatedBuildInputs = [ ncurses zlib ];
-
-  nativeCheckInputs = [
-    which
-  ] ++ lib.optional stdenv.isDarwin sysctl;
-
-  patches = [
-    ./gnu-install-dirs.patch
-
-    # Running the tests involves invoking binaries (like `opt`) that depend on
-    # the LLVM dylibs and reference them by absolute install path (i.e. their
-    # nix store path).
-    #
-    # Because we have not yet run the install phase (we're running these tests
-    # as part of `checkPhase` instead of `installCheckPhase`) these absolute
-    # paths do not exist yet; to work around this we point the loader (`ld` on
-    # unix, `dyld` on macOS) at the `lib` directory which will later become this
-    # package's `lib` output.
-    #
-    # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
-    # dir but:
-    #   - this doesn't generalize well to other platforms; `lit` doesn't forward
-    #     `DYLD_LIBRARY_PATH` (macOS):
-    #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
-    #   - even if `lit` forwarded this env var, we actually cannot set
-    #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
-    #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
-    #     "protected processes" (i.e. the python interpreter that runs `lit`):
-    #     https://stackoverflow.com/a/35570229
-    #   - other LLVM subprojects deal with this issue by having their `lit`
-    #     configuration set these env vars for us; it makes sense to do the same
-    #     for LLVM:
-    #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
-    #
-    # !!! TODO: look into upstreaming this patch
-    ./llvm-lit-cfg-add-libs-to-dylib-path.patch
-
-    # `lit` has a mode where it executes run lines as a shell script which is
-    # constructs; this is problematic for macOS because it means that there's
-    # another process in between `lit` and the binaries being tested. As noted
-    # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
-    # tests fail with dyld errors.
-    #
-    # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
-    # present in the test configuration.
-    #
-    # It's not clear to me why this isn't an issue for LLVM developers running
-    # on macOS (nothing about this _seems_ nix specific)..
-    ./lit-shell-script-runner-set-dyld-library-path.patch
-  ] ++ lib.optionals enablePolly [
-    ./gnu-install-dirs-polly.patch
-
-    # Just like the `llvm-lit-cfg` patch, but for `polly`.
-    ./polly-lit-cfg-add-libs-to-dylib-path.patch
-  ];
-
-  postPatch = optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
-      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-
-    # As of LLVM 15, marked as XFAIL on arm64 macOS but lit doesn't seem to pick
-    # this up: https://github.com/llvm/llvm-project/blob/c344d97a125b18f8fed0a64aace73c49a870e079/llvm/test/MC/ELF/cfi-version.ll#L7
-    rm test/MC/ELF/cfi-version.ll
-
-    # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
-    # and thus fails under the sandbox:
-    substituteInPlace unittests/TargetParser/Host.cpp \
-      --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
-
-    # This test tries to call the intrinsics `@llvm.roundeven.f32` and
-    # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
-    # and `roundeven` on macOS.
-    #
-    # However these functions are glibc specific so the test fails:
-    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundevenf.html
-    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundeven.html
-    #
-    substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
-      --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
-      --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
-  '' + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86) ''
-    # This test fails on darwin x86_64 because `sw_vers` reports a different
-    # macOS version than what LLVM finds by reading
-    # `/System/Library/CoreServices/SystemVersion.plist` (which is passed into
-    # the sandbox on macOS).
-    #
-    # The `sw_vers` provided by nixpkgs reports the macOS version associated
-    # with the `CoreFoundation` framework with which it was built. Because
-    # nixpkgs pins the SDK for `aarch64-darwin` and `x86_64-darwin` what
-    # `sw_vers` reports is not guaranteed to match the macOS version of the host
-    # that's building this derivation.
-    #
-    # Astute readers will note that we only _patch_ this test on aarch64-darwin
-    # (to use the nixpkgs provided `sw_vers`) instead of disabling it outright.
-    # So why does this test pass on aarch64?
-    #
-    # Well, it seems that `sw_vers` on aarch64 actually links against the _host_
-    # CoreFoundation framework instead of the nixpkgs provided one.
-    #
-    # Not entirely sure what the right fix is here. I'm assuming aarch64
-    # `sw_vers` doesn't intentionally link against the host `CoreFoundation`
-    # (still digging into how this ends up happening, will follow up) but that
-    # aside I think the more pertinent question is: should we be patching LLVM's
-    # macOS version detection logic to use `sw_vers` instead of reading host
-    # paths? This *is* a way in which details about builder machines can creep
-    # into the artifacts that are produced, affecting reproducibility, but it's
-    # not clear to me when/where/for what this even gets used in LLVM.
-    #
-    # TODO(@rrbutani): fix/follow-up
-    substituteInPlace unittests/TargetParser/Host.cpp \
-      --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
-
-    # This test fails with a `dysmutil` crash; have not yet dug into what's
-    # going on here (TODO(@rrbutani)).
-    rm test/tools/dsymutil/ARM/obfuscated.test
-  '' + ''
-    # FileSystem permissions tests fail with various special bits
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "Path.cpp" ""
-    rm unittests/Support/Path.cpp
-    substituteInPlace unittests/IR/CMakeLists.txt \
-      --replace "PassBuilderCallbacksTest.cpp" ""
-    rm unittests/IR/PassBuilderCallbacksTest.cpp
-    rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
-
-    # Fails in the presence of anti-virus software or other intrusion-detection software that
-    # modifies the atime when run. See #284056.
-    rm test/tools/llvm-objcopy/ELF/strip-preserve-atime.test
-  '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../../common/llvm/TLI-musl.patch}
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "add_subdirectory(DynamicLibrary)" ""
-    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
-    # valgrind unhappy with musl or glibc, but fails w/musl only
-    rm test/CodeGen/AArch64/wineh4.mir
-  '' + optionalString stdenv.hostPlatform.isAarch32 ''
-    # skip failing X86 test cases on 32-bit ARM
-    rm test/DebugInfo/X86/convert-debugloc.ll
-    rm test/DebugInfo/X86/convert-inlined.ll
-    rm test/DebugInfo/X86/convert-linked.ll
-    rm test/tools/dsymutil/X86/op-convert.test
-    rm test/tools/gold/X86/split-dwarf.ll
-    rm test/tools/llvm-dwarfdump/X86/prettyprint_types.s
-    rm test/tools/llvm-dwarfdump/X86/simplified-template-names.s
-    rm test/CodeGen/RISCV/attributes.ll
-    rm test/CodeGen/RISCV/xtheadmempair.ll
-  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
-    # Seems to require certain floating point hardware (NEON?)
-    rm test/ExecutionEngine/frem.ll
-  '' + ''
-    patchShebangs test/BugPoint/compile-custom.ll.py
-  '';
-
-  preConfigure = ''
-    # Workaround for configure flags that need to have spaces
-    cmakeFlagsArray+=(
-      -DLLVM_LIT_ARGS="-svj''${NIX_BUILD_CORES} --no-progress-bar"
-    )
-  '';
-
-  # Defensive check: some paths (that we make symlinks to) depend on the release
-  # version, for example:
-  #  - https://github.com/llvm/llvm-project/blob/406bde9a15136254f2b10d9ef3a42033b3cb1b16/clang/lib/Headers/CMakeLists.txt#L185
-  #
-  # So we want to sure that the version in the source matches the release
-  # version we were given.
-  #
-  # We do this check here, in the LLVM build, because it happens early.
-  postConfigure = let
-    v = lib.versions;
-    major = v.major release_version;
-    minor = v.minor release_version;
-    patch = v.patch release_version;
-  in ''
-    # $1: part, $2: expected
-    check_version() {
-      part="''${1^^}"
-      part="$(cat include/llvm/Config/llvm-config.h  | grep "#define LLVM_VERSION_''${part} " | cut -d' ' -f3)"
-
-      if [[ "$part" != "$2" ]]; then
-        echo >&2 \
-          "mismatch in the $1 version! we have version ${release_version}" \
-          "and expected the $1 version to be '$2'; the source has '$part' instead"
-        exit 3
-      fi
-    }
-
-    check_version major ${major}
-    check_version minor ${minor}
-    check_version patch ${patch}
-  '';
-
-  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
-  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
-
-  cmakeBuildType = if debugVersion then "Debug" else "Release";
-
-  cmakeFlags = with stdenv; let
-    # These flags influence llvm-config's BuildVariables.inc in addition to the
-    # general build. We need to make sure these are also passed via
-    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
-    # will return different results from the cross llvm-config.
-    #
-    # Some flags don't need to be repassed because LLVM already does so (like
-    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
-    flagsForLlvmConfig = [
-      "-DLLVM_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/llvm"
-      "-DLLVM_ENABLE_RTTI=ON"
-    ] ++ optionals enableSharedLibraries [
-      "-DLLVM_LINK_LLVM_DYLIB=ON"
-    ];
-  in flagsForLlvmConfig ++ [
-    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
-    "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals stdenv.hostPlatform.isStatic [
-    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
-    "-DLLVM_ENABLE_PIC=OFF"
-    "-DLLVM_BUILD_STATIC=ON"
-    "-DLLVM_LINK_LLVM_DYLIB=off"
-    # libxml2 needs to be disabled because the LLVM build system ignores its .la
-    # file and doesn't link zlib as well.
-    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
-    "-DLLVM_ENABLE_LIBXML2=OFF"
-  ] ++ optionals enableManpages [
-    "-DLLVM_BUILD_DOCS=ON"
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals enableGoldPlugin [
-    # For LLVMgold plugin
-    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ] ++ optionals isDarwin [
-    "-DLLVM_ENABLE_LIBCXX=ON"
-    "-DCAN_TARGET_i386=false"
-  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
-    "-DCMAKE_CROSSCOMPILING=True"
-    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-    (
-      let
-        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
-        nativeBintools = nativeCC.bintools.bintools;
-        nativeToolchainFlags = [
-          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
-          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
-          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
-          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
-          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
-        ];
-        # We need to repass the custom GNUInstallDirs values, otherwise CMake
-        # will choose them for us, leading to wrong results in llvm-config-native
-        nativeInstallFlags = [
-          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
-          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
-          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
-          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
-          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
-        ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
-      + lib.concatStringsSep ";" (lib.concatLists [
-        flagsForLlvmConfig
-        nativeToolchainFlags
-        nativeInstallFlags
-      ])
-    )
-  ];
-
-  postInstall = ''
-    mkdir -p $python/share
-    mv $out/share/opt-viewer $python/share/opt-viewer
-    moveToOutput "bin/llvm-config*" "$dev"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
-      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
-      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "'"$lib"'")'
-  ''
-  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
-  ''
-  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
-  '';
-
-  inherit doCheck;
-
-  checkTarget = "check-all";
-
-  # For the update script:
-  passthru.monorepoSrc = monorepoSrc;
-
-  requiredSystemFeatures = [ "big-parallel" ];
-  meta = llvm_meta // {
-    homepage = "https://llvm.org/";
-    description = "A collection of modular and reusable compiler and toolchain technologies";
-    longDescription = ''
-      The LLVM Project is a collection of modular and reusable compiler and
-      toolchain technologies. Despite its name, LLVM has little to do with
-      traditional virtual machines. The name "LLVM" itself is not an acronym; it
-      is the full name of the project.
-      LLVM began as a research project at the University of Illinois, with the
-      goal of providing a modern, SSA-based compilation strategy capable of
-      supporting both static and dynamic compilation of arbitrary programming
-      languages. Since then, LLVM has grown to be an umbrella project consisting
-      of a number of subprojects, many of which are being used in production by
-      a wide variety of commercial and open source projects as well as being
-      widely used in academic research. Code in the LLVM project is licensed
-      under the "Apache 2.0 License with LLVM exceptions".
-    '';
-  };
-} // lib.optionalAttrs enableManpages {
-  pname = "llvm-manpages";
-
-  propagatedBuildInputs = [];
-
-  ninjaFlags = [ "docs-llvm-man" ];
-  installTargets = [ "install-docs-llvm-man" ];
-
-  postPatch = null;
-  postInstall = null;
-
-  outputs = [ "out" ];
-
-  doCheck = false;
-
-  meta = llvm_meta // {
-    description = "man pages for LLVM ${version}";
-  };
-})
diff --git a/pkgs/development/compilers/llvm/18/default.nix b/pkgs/development/compilers/llvm/18/default.nix
index 3c78cd44fdf58..ea5323db9b0f3 100644
--- a/pkgs/development/compilers/llvm/18/default.nix
+++ b/pkgs/development/compilers/llvm/18/default.nix
@@ -82,7 +82,57 @@ in let
 
   in {
 
-    libllvm = callPackage ./llvm {
+    libllvm = callPackage ../common/llvm {
+      patches = [
+        ./llvm/gnu-install-dirs.patch
+
+        # Running the tests involves invoking binaries (like `opt`) that depend on
+        # the LLVM dylibs and reference them by absolute install path (i.e. their
+        # nix store path).
+        #
+        # Because we have not yet run the install phase (we're running these tests
+        # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+        # paths do not exist yet; to work around this we point the loader (`ld` on
+        # unix, `dyld` on macOS) at the `lib` directory which will later become this
+        # package's `lib` output.
+        #
+        # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+        # dir but:
+        #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+        #     `DYLD_LIBRARY_PATH` (macOS):
+        #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+        #   - even if `lit` forwarded this env var, we actually cannot set
+        #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+        #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+        #     "protected processes" (i.e. the python interpreter that runs `lit`):
+        #     https://stackoverflow.com/a/35570229
+        #   - other LLVM subprojects deal with this issue by having their `lit`
+        #     configuration set these env vars for us; it makes sense to do the same
+        #     for LLVM:
+        #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+        #
+        # !!! TODO: look into upstreaming this patch
+        ./llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
+
+        # `lit` has a mode where it executes run lines as a shell script which is
+        # constructs; this is problematic for macOS because it means that there's
+        # another process in between `lit` and the binaries being tested. As noted
+        # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+        # tests fail with dyld errors.
+        #
+        # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+        # present in the test configuration.
+        #
+        # It's not clear to me why this isn't an issue for LLVM developers running
+        # on macOS (nothing about this _seems_ nix specific)..
+        ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
+      ];
+      pollyPatches = [
+        ./llvm/gnu-install-dirs-polly.patch
+
+        # Just like the `llvm-lit-cfg` patch, but for `polly`.
+        ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
+      ];
       inherit llvm_meta;
     };
 
diff --git a/pkgs/development/compilers/llvm/common/clang/default.nix b/pkgs/development/compilers/llvm/common/clang/default.nix
index 2373795b49fd8..58af0340a1399 100644
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@@ -71,7 +71,11 @@ let
       "-DCLANG_PSEUDO_GEN=${buildLlvmTools.libclang.dev}/bin/clang-pseudo-gen"
     ]);
 
-    postPatch = (if lib.versionOlder release_version "13" then ''
+    postPatch = ''
+      # Make sure clang passes the correct location of libLTO to ld64
+      substituteInPlace lib/Driver/ToolChains/Darwin.cpp \
+        --replace-fail 'StringRef P = llvm::sys::path::parent_path(D.Dir);' 'StringRef P = "${lib.getLib libllvm}";'
+    '' + (if lib.versionOlder release_version "13" then ''
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
              -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
              lib/Driver/ToolChains/*.cpp
diff --git a/pkgs/development/compilers/llvm/18/llvm/default.nix b/pkgs/development/compilers/llvm/common/llvm/default.nix
index a9732763e9d7b..0716453c34c94 100644
--- a/pkgs/development/compilers/llvm/18/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -1,6 +1,12 @@
-{ lib, stdenv, llvm_meta
+{ lib
+, stdenv
+, llvm_meta
 , pkgsBuildBuild
-, monorepoSrc
+, pollyPatches ? []
+, patches ? []
+, polly_src ? null
+, src ? null
+, monorepoSrc ? null
 , runCommand
 , cmake
 , darwin
@@ -8,6 +14,8 @@
 , python3
 , python3Packages
 , libffi
+  # TODO: Can this memory corruption bug still occur?
+  # <https://github.com/llvm/llvm-project/issues/61350>
 , enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
@@ -20,7 +28,8 @@
 , sysctl
 , buildLlvmTools
 , debugVersion ? false
-, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
+, doCheck ? (if lib.versionOlder release_version "15" then stdenv.isLinux else true)
+  && (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
   && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
@@ -28,7 +37,7 @@
   # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
   # broken for the armv7l builder
   && !stdenv.hostPlatform.isAarch
-, enablePolly ? true
+, enablePolly ? lib.versionAtLeast release_version "14"
 }:
 
 let
@@ -64,27 +73,36 @@ let
     in pkgsBuildBuild.targetPackages.python3.withPackages checkDeps
   else python3;
 
+  pname = "llvm";
+
+  src' = if monorepoSrc != null then
+    runCommand "${pname}-src-${version}" {} (''
+      mkdir -p "$out"
+      cp -r ${monorepoSrc}/cmake "$out"
+      cp -r ${monorepoSrc}/${pname} "$out"
+      cp -r ${monorepoSrc}/third-party "$out"
+    '' + lib.optionalString enablePolly ''
+      chmod u+w "$out/${pname}/tools"
+      cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
+    '') else src;
+
+  patches' = patches ++ lib.optionals enablePolly pollyPatches;
 in
 
 stdenv.mkDerivation (rec {
-  pname = "llvm";
-  inherit version;
-
-  src = runCommand "${pname}-src-${version}" {} (''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/${pname} "$out"
-    cp -r ${monorepoSrc}/third-party "$out"
-  '' + lib.optionalString enablePolly ''
-    chmod u+w "$out/${pname}/tools"
-    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
-  '');
+  inherit pname version;
 
-  sourceRoot = "${src.name}/${pname}";
+  src = src';
+  patches = patches';
+
+  sourceRoot = if lib.versionOlder release_version "13" then null
+    else "${src.name}/${pname}";
 
   outputs = [ "out" "lib" "dev" "python" ];
 
-  nativeBuildInputs = [ cmake ninja python ]
+  nativeBuildInputs = [ cmake ]
+    ++ (lib.optional (lib.versionAtLeast release_version "15") ninja)
+    ++ [ python ]
     ++ optionals enableManpages [
     # Note: we intentionally use `python3Packages` instead of `python3.pkgs`;
     # splicing does *not* work with the latter. (TODO: fix)
@@ -98,66 +116,14 @@ stdenv.mkDerivation (rec {
   buildInputs = [ libxml2 libffi ]
     ++ optional enablePFM libpfm; # exegesis
 
-  propagatedBuildInputs = [ ncurses zlib ];
-
-  nativeCheckInputs = [
-    which
-  ] ++ lib.optional stdenv.isDarwin sysctl;
-
-  patches = [
-    ./gnu-install-dirs.patch
-
-    # Running the tests involves invoking binaries (like `opt`) that depend on
-    # the LLVM dylibs and reference them by absolute install path (i.e. their
-    # nix store path).
-    #
-    # Because we have not yet run the install phase (we're running these tests
-    # as part of `checkPhase` instead of `installCheckPhase`) these absolute
-    # paths do not exist yet; to work around this we point the loader (`ld` on
-    # unix, `dyld` on macOS) at the `lib` directory which will later become this
-    # package's `lib` output.
-    #
-    # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
-    # dir but:
-    #   - this doesn't generalize well to other platforms; `lit` doesn't forward
-    #     `DYLD_LIBRARY_PATH` (macOS):
-    #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
-    #   - even if `lit` forwarded this env var, we actually cannot set
-    #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
-    #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
-    #     "protected processes" (i.e. the python interpreter that runs `lit`):
-    #     https://stackoverflow.com/a/35570229
-    #   - other LLVM subprojects deal with this issue by having their `lit`
-    #     configuration set these env vars for us; it makes sense to do the same
-    #     for LLVM:
-    #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
-    #
-    # !!! TODO: look into upstreaming this patch
-    ./llvm-lit-cfg-add-libs-to-dylib-path.patch
-
-    # `lit` has a mode where it executes run lines as a shell script which is
-    # constructs; this is problematic for macOS because it means that there's
-    # another process in between `lit` and the binaries being tested. As noted
-    # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
-    # tests fail with dyld errors.
-    #
-    # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
-    # present in the test configuration.
-    #
-    # It's not clear to me why this isn't an issue for LLVM developers running
-    # on macOS (nothing about this _seems_ nix specific)..
-    ./lit-shell-script-runner-set-dyld-library-path.patch
-  ] ++ lib.optionals enablePolly [
-    ./gnu-install-dirs-polly.patch
-
-    # Just like the `llvm-lit-cfg` patch, but for `polly`.
-    ./polly-lit-cfg-add-libs-to-dylib-path.patch
-  ];
+  propagatedBuildInputs = (lib.optional (lib.versionAtLeast release_version "14" || stdenv.buildPlatform == stdenv.hostPlatform) ncurses)
+    ++ [ zlib ];
 
-  postPatch = optionalString stdenv.isDarwin ''
+  postPatch = optionalString stdenv.isDarwin (''
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
+  '' + (optionalString (lib.versionAtLeast release_version "15") (''
 
     # As of LLVM 15, marked as XFAIL on arm64 macOS but lit doesn't seem to pick
     # this up: https://github.com/llvm/llvm-project/blob/c344d97a125b18f8fed0a64aace73c49a870e079/llvm/test/MC/ELF/cfi-version.ll#L7
@@ -165,8 +131,13 @@ stdenv.mkDerivation (rec {
 
     # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
     # and thus fails under the sandbox:
+  '' + (if lib.versionAtLeast release_version "16" then ''
     substituteInPlace unittests/TargetParser/Host.cpp \
       --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
+  '' else ''
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
+  '') + optionalString (lib.versionAtLeast release_version "16") ''
 
     # This test tries to call the intrinsics `@llvm.roundeven.f32` and
     # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
@@ -179,11 +150,32 @@ stdenv.mkDerivation (rec {
     substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
       --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
       --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
+  '' + optionalString (!stdenv.hostPlatform.isx86 && lib.versionAtLeast release_version "18") ''
 
     # fails when run in sandbox
     substituteInPlace unittests/Support/VirtualFileSystemTest.cpp \
       --replace "PhysicalFileSystemWorkingDirFailure" "DISABLED_PhysicalFileSystemWorkingDirFailure"
-  '' + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86) ''
+  ''))) + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86 && lib.versionAtLeast release_version "15") (optionalString (lib.versionOlder release_version "16") ''
+    # This test tries to call the intrinsics `@llvm.roundeven.f32` and
+    # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
+    # and `roundeven` on x86_64 macOS.
+    #
+    # However these functions are glibc specific so the test fails:
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundevenf.html
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundeven.html
+    #
+    # TODO(@rrbutani): this seems to run fine on `aarch64-darwin`, why does it
+    # pass there?
+    substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
+      --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
+      --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
+
+  '' + ((optionalString (lib.versionAtLeast release_version "18") ''
+
+    # fails when run in sandbox
+    substituteInPlace unittests/Support/VirtualFileSystemTest.cpp \
+      --replace "PhysicalFileSystemWorkingDirFailure" "DISABLED_PhysicalFileSystemWorkingDirFailure"
+  '') + ''
     # This test fails on darwin x86_64 because `sw_vers` reports a different
     # macOS version than what LLVM finds by reading
     # `/System/Library/CoreServices/SystemVersion.plist` (which is passed into
@@ -212,13 +204,18 @@ stdenv.mkDerivation (rec {
     # not clear to me when/where/for what this even gets used in LLVM.
     #
     # TODO(@rrbutani): fix/follow-up
+  '' + (if lib.versionAtLeast release_version "16" then ''
     substituteInPlace unittests/TargetParser/Host.cpp \
       --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
+  '' else ''
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
+  '') + ''
 
     # This test fails with a `dysmutil` crash; have not yet dug into what's
     # going on here (TODO(@rrbutani)).
     rm test/tools/dsymutil/ARM/obfuscated.test
-  '' + ''
+  '')) + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
@@ -226,13 +223,23 @@ stdenv.mkDerivation (rec {
     substituteInPlace unittests/IR/CMakeLists.txt \
       --replace "PassBuilderCallbacksTest.cpp" ""
     rm unittests/IR/PassBuilderCallbacksTest.cpp
+  '' + lib.optionalString (lib.versionAtLeast release_version "13") ''
     rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
+  '' + lib.optionalString (lib.versionOlder release_version "13") ''
+    # TODO: Fix failing tests:
+    rm test/DebugInfo/X86/vla-multi.ll
+  '' + lib.optionalString (lib.versionAtLeast release_version "16") (''
 
     # Fails in the presence of anti-virus software or other intrusion-detection software that
     # modifies the atime when run. See #284056.
     rm test/tools/llvm-objcopy/ELF/strip-preserve-atime.test
+  '' + lib.optionalString (lib.versionOlder release_version "17") ''
+
+  '') + lib.optionalString (lib.versionAtLeast release_version "15" && lib.versionOlder release_version "17") ''
+    # timing-based tests are trouble
+    rm utils/lit/tests/googletest-timeout.py
   '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../../common/llvm/TLI-musl.patch}
+    patch -p1 -i ${./TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
@@ -245,61 +252,59 @@ stdenv.mkDerivation (rec {
     rm test/DebugInfo/X86/convert-linked.ll
     rm test/tools/dsymutil/X86/op-convert.test
     rm test/tools/gold/X86/split-dwarf.ll
-    rm test/tools/llvm-dwarfdump/X86/prettyprint_types.s
-    rm test/tools/llvm-dwarfdump/X86/simplified-template-names.s
-    rm test/CodeGen/RISCV/attributes.ll
-    rm test/CodeGen/RISCV/xtheadmempair.ll
+    rm test/tools/llvm-objcopy/MachO/universal-object.test
   '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
     # Seems to require certain floating point hardware (NEON?)
     rm test/ExecutionEngine/frem.ll
   '' + ''
     patchShebangs test/BugPoint/compile-custom.ll.py
-  '';
+  '' + (lib.optionalString (lib.versionOlder release_version "13") ''
+    # Tweak tests to ignore namespace part of type to support
+    # gcc-12: https://gcc.gnu.org/PR103598.
+    # The change below mangles strings like:
+    #    CHECK-NEXT: Starting llvm::Function pass manager run.
+    # to:
+    #    CHECK-NEXT: Starting {{.*}}Function pass manager run.
+    for f in \
+      test/Other/new-pass-manager.ll \
+      test/Other/new-pm-O0-defaults.ll \
+      test/Other/new-pm-defaults.ll \
+      test/Other/new-pm-lto-defaults.ll \
+      test/Other/new-pm-thinlto-defaults.ll \
+      test/Other/pass-pipeline-parsing.ll \
+      test/Transforms/Inline/cgscc-incremental-invalidate.ll \
+      test/Transforms/Inline/clear-analyses.ll \
+      test/Transforms/LoopUnroll/unroll-loop-invalidation.ll \
+      test/Transforms/SCCP/ipsccp-preserve-analysis.ll \
+      test/Transforms/SCCP/preserve-analysis.ll \
+      test/Transforms/SROA/dead-inst.ll \
+      test/tools/gold/X86/new-pm.ll \
+      ; do
+      echo "PATCH: $f"
+      substituteInPlace $f \
+        --replace 'Starting llvm::' 'Starting {{.*}}' \
+        --replace 'Finished llvm::' 'Finished {{.*}}'
+    done
+    # gcc-13 fix
+    sed -i '/#include <string>/i#include <cstdint>' \
+      include/llvm/DebugInfo/Symbolize/DIPrinter.h
+  '');
 
-  preConfigure = ''
+  preConfigure = if lib.versionAtLeast release_version "15" then ''
     # Workaround for configure flags that need to have spaces
     cmakeFlagsArray+=(
       -DLLVM_LIT_ARGS="-svj''${NIX_BUILD_CORES} --no-progress-bar"
     )
-  '';
-
-  # Defensive check: some paths (that we make symlinks to) depend on the release
-  # version, for example:
-  #  - https://github.com/llvm/llvm-project/blob/406bde9a15136254f2b10d9ef3a42033b3cb1b16/clang/lib/Headers/CMakeLists.txt#L185
-  #
-  # So we want to sure that the version in the source matches the release
-  # version we were given.
-  #
-  # We do this check here, in the LLVM build, because it happens early.
-  postConfigure = let
-    v = lib.versions;
-    major = v.major release_version;
-    minor = v.minor release_version;
-    patch = v.patch release_version;
-  in ''
-    # $1: part, $2: expected
-    check_version() {
-      part="''${1^^}"
-      part="$(cat include/llvm/Config/llvm-config.h  | grep "#define LLVM_VERSION_''${part} " | cut -d' ' -f3)"
-
-      if [[ "$part" != "$2" ]]; then
-        echo >&2 \
-          "mismatch in the $1 version! we have version ${release_version}" \
-          "and expected the $1 version to be '$2'; the source has '$part' instead"
-        exit 3
-      fi
-    }
-
-    check_version major ${major}
-    check_version minor ${minor}
-    check_version patch ${patch}
+  '' else ''
+    # Workaround for configure flags that need to have spaces
+    cmakeFlagsArray+=(
+      -DLLVM_LIT_ARGS='-svj''${NIX_BUILD_CORES} --no-progress-bar'
+    )
   '';
 
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
-  hardeningDisable = [ "trivialautovarinit" ];
-
   cmakeBuildType = if debugVersion then "Debug" else "Release";
 
   cmakeFlags = with stdenv; let
@@ -310,8 +315,11 @@ stdenv.mkDerivation (rec {
     #
     # Some flags don't need to be repassed because LLVM already does so (like
     # CMAKE_BUILD_TYPE), others are irrelevant to the result.
-    flagsForLlvmConfig = [
+    flagsForLlvmConfig = (if lib.versionOlder release_version "15" then [
+      "-DLLVM_INSTALL_CMAKE_DIR=${placeholder "dev"}/lib/cmake/llvm/"
+    ] else [
       "-DLLVM_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/llvm"
+    ]) ++ [
       "-DLLVM_ENABLE_RTTI=ON"
     ] ++ optionals enableSharedLibraries [
       "-DLLVM_LINK_LLVM_DYLIB=ON"
@@ -327,7 +335,6 @@ stdenv.mkDerivation (rec {
     # Disables building of shared libs, -fPIC is still injected by cc-wrapper
     "-DLLVM_ENABLE_PIC=OFF"
     "-DLLVM_BUILD_STATIC=ON"
-    "-DLLVM_LINK_LLVM_DYLIB=off"
     # libxml2 needs to be disabled because the LLVM build system ignores its .la
     # file and doesn't link zlib as well.
     # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
@@ -338,7 +345,7 @@ stdenv.mkDerivation (rec {
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals enableGoldPlugin [
+  ] ++ optionals (enableGoldPlugin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
@@ -382,8 +389,15 @@ stdenv.mkDerivation (rec {
     substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
       --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
+  '' + (if lib.versionOlder release_version "15" then ''
+    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
+      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}'"$lib"'")'
+  '' else ''
     substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
       --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "'"$lib"'")'
+  '')
+  + optionalString (stdenv.isDarwin && enableSharedLibraries && lib.versionOlder release_version "18") ''
+    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
   ''
   + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
@@ -418,14 +432,11 @@ stdenv.mkDerivation (rec {
       under the "Apache 2.0 License with LLVM exceptions".
     '';
   };
-} // lib.optionalAttrs enableManpages {
+} // lib.optionalAttrs enableManpages ({
   pname = "llvm-manpages";
 
   propagatedBuildInputs = [];
 
-  ninjaFlags = [ "docs-llvm-man" ];
-  installTargets = [ "install-docs-llvm-man" ];
-
   postPatch = null;
   postInstall = null;
 
@@ -436,4 +447,79 @@ stdenv.mkDerivation (rec {
   meta = llvm_meta // {
     description = "man pages for LLVM ${version}";
   };
+} // (if lib.versionOlder release_version "15" then {
+  buildPhase = ''
+    make docs-llvm-man
+  '';
+
+  installPhase = ''
+    make -C docs install
+  '';
+} else {
+  ninjaFlags = [ "docs-llvm-man" ];
+  installTargets = [ "install-docs-llvm-man" ];
+
+  postPatch = null;
+  postInstall = null;
+})) // lib.optionalAttrs (lib.versionOlder release_version "13") {
+  inherit polly_src;
+
+  unpackPhase = ''
+    unpackFile $src
+    mv llvm-${release_version}* llvm
+    sourceRoot=$PWD/llvm
+  '' + optionalString enablePolly ''
+    unpackFile $polly_src
+    mv polly-* $sourceRoot/tools/polly
+  '';
+} // lib.optionalAttrs (lib.versionAtLeast release_version "13") {
+  nativeCheckInputs = [ which ] ++ lib.optional (stdenv.isDarwin && lib.versionAtLeast release_version "15") sysctl;
+} // lib.optionalAttrs (lib.versionOlder release_version "15") {
+  # hacky fix: created binaries need to be run before installation
+  preBuild = ''
+    mkdir -p $out/
+    ln -sv $PWD/lib $out
+  '';
+
+  postBuild = ''
+    rm -fR $out
+  '';
+
+  preCheck = ''
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
+  '';
+} // lib.optionalAttrs (lib.versionAtLeast release_version "15") {
+  # Defensive check: some paths (that we make symlinks to) depend on the release
+  # version, for example:
+  #  - https://github.com/llvm/llvm-project/blob/406bde9a15136254f2b10d9ef3a42033b3cb1b16/clang/lib/Headers/CMakeLists.txt#L185
+  #
+  # So we want to sure that the version in the source matches the release
+  # version we were given.
+  #
+  # We do this check here, in the LLVM build, because it happens early.
+  postConfigure = let
+    v = lib.versions;
+    major = v.major release_version;
+    minor = v.minor release_version;
+    patch = v.patch release_version;
+  in ''
+    # $1: part, $2: expected
+    check_version() {
+      part="''${1^^}"
+      part="$(cat include/llvm/Config/llvm-config.h  | grep "#define LLVM_VERSION_''${part} " | cut -d' ' -f3)"
+
+      if [[ "$part" != "$2" ]]; then
+        echo >&2 \
+          "mismatch in the $1 version! we have version ${release_version}" \
+          "and expected the $1 version to be '$2'; the source has '$part' instead"
+        exit 3
+      fi
+    }
+
+    check_version major ${major}
+    check_version minor ${minor}
+    check_version patch ${patch}
+  '';
+} // lib.optionalAttrs (lib.versionOlder release_version "17" || lib.versionAtLeast release_version "18") {
+  hardeningDisable = [ "trivialautovarinit" ];
 })
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 1a34130679db2..c995845fb6b38 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -87,7 +87,57 @@ in let
 
   in {
 
-    libllvm = callPackage ./llvm {
+    libllvm = callPackage ../common/llvm {
+      patches = [
+        ./llvm/gnu-install-dirs.patch
+
+        # Running the tests involves invoking binaries (like `opt`) that depend on
+        # the LLVM dylibs and reference them by absolute install path (i.e. their
+        # nix store path).
+        #
+        # Because we have not yet run the install phase (we're running these tests
+        # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+        # paths do not exist yet; to work around this we point the loader (`ld` on
+        # unix, `dyld` on macOS) at the `lib` directory which will later become this
+        # package's `lib` output.
+        #
+        # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+        # dir but:
+        #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+        #     `DYLD_LIBRARY_PATH` (macOS):
+        #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+        #   - even if `lit` forwarded this env var, we actually cannot set
+        #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+        #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+        #     "protected processes" (i.e. the python interpreter that runs `lit`):
+        #     https://stackoverflow.com/a/35570229
+        #   - other LLVM subprojects deal with this issue by having their `lit`
+        #     configuration set these env vars for us; it makes sense to do the same
+        #     for LLVM:
+        #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+        #
+        # !!! TODO: look into upstreaming this patch
+        ./llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
+
+        # `lit` has a mode where it executes run lines as a shell script which is
+        # constructs; this is problematic for macOS because it means that there's
+        # another process in between `lit` and the binaries being tested. As noted
+        # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+        # tests fail with dyld errors.
+        #
+        # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+        # present in the test configuration.
+        #
+        # It's not clear to me why this isn't an issue for LLVM developers running
+        # on macOS (nothing about this _seems_ nix specific)..
+        ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
+      ];
+      pollyPatches = [
+        ./llvm/gnu-install-dirs-polly.patch
+
+        # Just like the `llvm-lit-cfg` patch, but for `polly`.
+        ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
+      ];
       inherit llvm_meta;
     };
 
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
deleted file mode 100644
index 8987103e22fe5..0000000000000
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ /dev/null
@@ -1,435 +0,0 @@
-{ lib, stdenv, llvm_meta
-, pkgsBuildBuild
-, monorepoSrc
-, runCommand
-, cmake
-, darwin
-, ninja
-, python3
-, python3Packages
-, libffi
-, enableGoldPlugin ? libbfd.hasPluginAPI
-, libbfd
-, libpfm
-, libxml2
-, ncurses
-, version
-, release_version
-, zlib
-, which
-, sysctl
-, buildLlvmTools
-, debugVersion ? false
-, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
-  && (stdenv.hostPlatform == stdenv.buildPlatform)
-, enableManpages ? false
-, enableSharedLibraries ? !stdenv.hostPlatform.isStatic
-, enablePFM ? stdenv.isLinux /* PFM only supports Linux */
-  # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
-  # broken for the armv7l builder
-  && !stdenv.hostPlatform.isAarch
-, enablePolly ? true
-}:
-
-let
-  inherit (lib) optional optionals optionalString;
-
-  # Used when creating a version-suffixed symlink of libLLVM.dylib
-  shortVersion = with lib;
-    concatStringsSep "." (take 1 (splitString "." release_version));
-
-  # Ordinarily we would just the `doCheck` and `checkDeps` functionality
-  # `mkDerivation` gives us to manage our test dependencies (instead of breaking
-  # out `doCheck` as a package level attribute).
-  #
-  # Unfortunately `lit` does not forward `$PYTHONPATH` to children processes, in
-  # particular the children it uses to do feature detection.
-  #
-  # This means that python deps we add to `checkDeps` (which the python
-  # interpreter is made aware of via `$PYTHONPATH` – populated by the python
-  # setup hook) are not picked up by `lit` which causes it to skip tests.
-  #
-  # Adding `python3.withPackages (ps: [ ... ])` to `checkDeps` also doesn't work
-  # because this package is shadowed in `$PATH` by the regular `python3`
-  # package.
-  #
-  # So, we "manually" assemble one python derivation for the package to depend
-  # on, taking into account whether checks are enabled or not:
-  python = if doCheck then
-    # Note that we _explicitly_ ask for a python interpreter for our host
-    # platform here; the splicing that would ordinarily take care of this for
-    # us does not seem to work once we use `withPackages`.
-    let
-      checkDeps = ps: with ps; [ psutil ];
-    in pkgsBuildBuild.targetPackages.python3.withPackages checkDeps
-  else python3;
-
-in
-
-stdenv.mkDerivation (rec {
-  pname = "llvm";
-  inherit version;
-
-  src = runCommand "${pname}-src-${version}" {} (''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/${pname} "$out"
-    cp -r ${monorepoSrc}/third-party "$out"
-  '' + lib.optionalString enablePolly ''
-    chmod u+w "$out/${pname}/tools"
-    cp -r ${monorepoSrc}/polly "$out/${pname}/tools"
-  '');
-
-  sourceRoot = "${src.name}/${pname}";
-
-  outputs = [ "out" "lib" "dev" "python" ];
-
-  nativeBuildInputs = [ cmake ninja python ]
-    ++ optionals enableManpages [
-    # Note: we intentionally use `python3Packages` instead of `python3.pkgs`;
-    # splicing does *not* work with the latter. (TODO: fix)
-    python3Packages.sphinx
-  ] ++ optionals (lib.versionOlder version "18" && enableManpages) [
-    python3Packages.recommonmark
-  ] ++ optionals (lib.versionAtLeast version "18" && enableManpages) [
-    python3Packages.myst-parser
-  ];
-
-  buildInputs = [ libxml2 libffi ]
-    ++ optional enablePFM libpfm; # exegesis
-
-  propagatedBuildInputs = [ ncurses zlib ];
-
-  nativeCheckInputs = [
-    which
-  ] ++ lib.optional stdenv.isDarwin sysctl;
-
-  patches = [
-    ./gnu-install-dirs.patch
-
-    # Running the tests involves invoking binaries (like `opt`) that depend on
-    # the LLVM dylibs and reference them by absolute install path (i.e. their
-    # nix store path).
-    #
-    # Because we have not yet run the install phase (we're running these tests
-    # as part of `checkPhase` instead of `installCheckPhase`) these absolute
-    # paths do not exist yet; to work around this we point the loader (`ld` on
-    # unix, `dyld` on macOS) at the `lib` directory which will later become this
-    # package's `lib` output.
-    #
-    # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
-    # dir but:
-    #   - this doesn't generalize well to other platforms; `lit` doesn't forward
-    #     `DYLD_LIBRARY_PATH` (macOS):
-    #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
-    #   - even if `lit` forwarded this env var, we actually cannot set
-    #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
-    #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
-    #     "protected processes" (i.e. the python interpreter that runs `lit`):
-    #     https://stackoverflow.com/a/35570229
-    #   - other LLVM subprojects deal with this issue by having their `lit`
-    #     configuration set these env vars for us; it makes sense to do the same
-    #     for LLVM:
-    #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
-    #
-    # !!! TODO: look into upstreaming this patch
-    ./llvm-lit-cfg-add-libs-to-dylib-path.patch
-
-    # `lit` has a mode where it executes run lines as a shell script which is
-    # constructs; this is problematic for macOS because it means that there's
-    # another process in between `lit` and the binaries being tested. As noted
-    # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
-    # tests fail with dyld errors.
-    #
-    # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
-    # present in the test configuration.
-    #
-    # It's not clear to me why this isn't an issue for LLVM developers running
-    # on macOS (nothing about this _seems_ nix specific)..
-    ./lit-shell-script-runner-set-dyld-library-path.patch
-  ] ++ lib.optionals enablePolly [
-    ./gnu-install-dirs-polly.patch
-
-    # Just like the `llvm-lit-cfg` patch, but for `polly`.
-    ./polly-lit-cfg-add-libs-to-dylib-path.patch
-  ];
-
-  postPatch = optionalString stdenv.isDarwin ''
-    substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
-      --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-
-    # As of LLVM 15, marked as XFAIL on arm64 macOS but lit doesn't seem to pick
-    # this up: https://github.com/llvm/llvm-project/blob/c344d97a125b18f8fed0a64aace73c49a870e079/llvm/test/MC/ELF/cfi-version.ll#L7
-    rm test/MC/ELF/cfi-version.ll
-
-    # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
-    # and thus fails under the sandbox:
-    substituteInPlace unittests/TargetParser/Host.cpp \
-      --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
-
-    # This test tries to call the intrinsics `@llvm.roundeven.f32` and
-    # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
-    # and `roundeven` on macOS.
-    #
-    # However these functions are glibc specific so the test fails:
-    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundevenf.html
-    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundeven.html
-    #
-    substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
-      --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
-      --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
-
-    # fails when run in sandbox
-    substituteInPlace unittests/Support/VirtualFileSystemTest.cpp \
-      --replace "PhysicalFileSystemWorkingDirFailure" "DISABLED_PhysicalFileSystemWorkingDirFailure"
-  '' + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86) ''
-    # This test fails on darwin x86_64 because `sw_vers` reports a different
-    # macOS version than what LLVM finds by reading
-    # `/System/Library/CoreServices/SystemVersion.plist` (which is passed into
-    # the sandbox on macOS).
-    #
-    # The `sw_vers` provided by nixpkgs reports the macOS version associated
-    # with the `CoreFoundation` framework with which it was built. Because
-    # nixpkgs pins the SDK for `aarch64-darwin` and `x86_64-darwin` what
-    # `sw_vers` reports is not guaranteed to match the macOS version of the host
-    # that's building this derivation.
-    #
-    # Astute readers will note that we only _patch_ this test on aarch64-darwin
-    # (to use the nixpkgs provided `sw_vers`) instead of disabling it outright.
-    # So why does this test pass on aarch64?
-    #
-    # Well, it seems that `sw_vers` on aarch64 actually links against the _host_
-    # CoreFoundation framework instead of the nixpkgs provided one.
-    #
-    # Not entirely sure what the right fix is here. I'm assuming aarch64
-    # `sw_vers` doesn't intentionally link against the host `CoreFoundation`
-    # (still digging into how this ends up happening, will follow up) but that
-    # aside I think the more pertinent question is: should we be patching LLVM's
-    # macOS version detection logic to use `sw_vers` instead of reading host
-    # paths? This *is* a way in which details about builder machines can creep
-    # into the artifacts that are produced, affecting reproducibility, but it's
-    # not clear to me when/where/for what this even gets used in LLVM.
-    #
-    # TODO(@rrbutani): fix/follow-up
-    substituteInPlace unittests/TargetParser/Host.cpp \
-      --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
-  '' + ''
-    # FileSystem permissions tests fail with various special bits
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "Path.cpp" ""
-    rm unittests/Support/Path.cpp
-    substituteInPlace unittests/IR/CMakeLists.txt \
-      --replace "PassBuilderCallbacksTest.cpp" ""
-    rm unittests/IR/PassBuilderCallbacksTest.cpp
-    rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
-
-    # Fails in the presence of anti-virus software or other intrusion-detection software that
-    # modifies the atime when run. See #284056.
-    rm test/tools/llvm-objcopy/ELF/strip-preserve-atime.test
-  '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../../common/llvm/TLI-musl.patch}
-    substituteInPlace unittests/Support/CMakeLists.txt \
-      --replace "add_subdirectory(DynamicLibrary)" ""
-    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
-    # valgrind unhappy with musl or glibc, but fails w/musl only
-    rm test/CodeGen/AArch64/wineh4.mir
-  '' + optionalString stdenv.hostPlatform.isAarch32 ''
-    # skip failing X86 test cases on 32-bit ARM
-    rm test/DebugInfo/X86/convert-debugloc.ll
-    rm test/DebugInfo/X86/convert-inlined.ll
-    rm test/DebugInfo/X86/convert-linked.ll
-    rm test/tools/dsymutil/X86/op-convert.test
-    rm test/tools/gold/X86/split-dwarf.ll
-    rm test/tools/llvm-dwarfdump/X86/prettyprint_types.s
-    rm test/tools/llvm-dwarfdump/X86/simplified-template-names.s
-    rm test/CodeGen/RISCV/attributes.ll
-    rm test/CodeGen/RISCV/xtheadmempair.ll
-  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
-    # Seems to require certain floating point hardware (NEON?)
-    rm test/ExecutionEngine/frem.ll
-  '' + ''
-    patchShebangs test/BugPoint/compile-custom.ll.py
-  '';
-
-  preConfigure = ''
-    # Workaround for configure flags that need to have spaces
-    cmakeFlagsArray+=(
-      -DLLVM_LIT_ARGS="-svj''${NIX_BUILD_CORES} --no-progress-bar"
-    )
-  '';
-
-  # Defensive check: some paths (that we make symlinks to) depend on the release
-  # version, for example:
-  #  - https://github.com/llvm/llvm-project/blob/406bde9a15136254f2b10d9ef3a42033b3cb1b16/clang/lib/Headers/CMakeLists.txt#L185
-  #
-  # So we want to sure that the version in the source matches the release
-  # version we were given.
-  #
-  # We do this check here, in the LLVM build, because it happens early.
-  postConfigure = let
-    v = lib.versions;
-    major = v.major release_version;
-    minor = v.minor release_version;
-    patch = v.patch release_version;
-  in ''
-    # $1: part, $2: expected
-    check_version() {
-      part="''${1^^}"
-      part="$(cat include/llvm/Config/llvm-config.h  | grep "#define LLVM_VERSION_''${part} " | cut -d' ' -f3)"
-
-      if [[ "$part" != "$2" ]]; then
-        echo >&2 \
-          "mismatch in the $1 version! we have version ${release_version}" \
-          "and expected the $1 version to be '$2'; the source has '$part' instead"
-        exit 3
-      fi
-    }
-
-    check_version major ${major}
-    check_version minor ${minor}
-    check_version patch ${patch}
-  '';
-
-  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
-  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
-
-  hardeningDisable = [ "trivialautovarinit" ];
-
-  cmakeBuildType = if debugVersion then "Debug" else "Release";
-
-  cmakeFlags = with stdenv; let
-    # These flags influence llvm-config's BuildVariables.inc in addition to the
-    # general build. We need to make sure these are also passed via
-    # CROSS_TOOLCHAIN_FLAGS_NATIVE when cross-compiling or llvm-config-native
-    # will return different results from the cross llvm-config.
-    #
-    # Some flags don't need to be repassed because LLVM already does so (like
-    # CMAKE_BUILD_TYPE), others are irrelevant to the result.
-    flagsForLlvmConfig = [
-      "-DLLVM_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/llvm"
-      "-DLLVM_ENABLE_RTTI=ON"
-    ] ++ optionals enableSharedLibraries [
-      "-DLLVM_LINK_LLVM_DYLIB=ON"
-    ];
-  in flagsForLlvmConfig ++ [
-    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
-    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
-    "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_ENABLE_DUMP=ON"
-  ] ++ optionals stdenv.hostPlatform.isStatic [
-    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
-    "-DLLVM_ENABLE_PIC=OFF"
-    "-DLLVM_BUILD_STATIC=ON"
-    "-DLLVM_LINK_LLVM_DYLIB=off"
-    # libxml2 needs to be disabled because the LLVM build system ignores its .la
-    # file and doesn't link zlib as well.
-    # https://github.com/ClangBuiltLinux/tc-build/issues/150#issuecomment-845418812
-    "-DLLVM_ENABLE_LIBXML2=OFF"
-  ] ++ optionals enableManpages [
-    "-DLLVM_BUILD_DOCS=ON"
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_OUTPUT_HTML=OFF"
-    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals enableGoldPlugin [
-    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ] ++ optionals isDarwin [
-    "-DLLVM_ENABLE_LIBCXX=ON"
-    "-DCAN_TARGET_i386=false"
-  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
-    "-DCMAKE_CROSSCOMPILING=True"
-    "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-    (
-      let
-        nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
-        nativeBintools = nativeCC.bintools.bintools;
-        nativeToolchainFlags = [
-          "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
-          "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
-          "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
-          "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
-          "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
-        ];
-        # We need to repass the custom GNUInstallDirs values, otherwise CMake
-        # will choose them for us, leading to wrong results in llvm-config-native
-        nativeInstallFlags = [
-          "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
-          "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
-          "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
-          "-DCMAKE_INSTALL_LIBDIR=${placeholder "lib"}/lib"
-          "-DCMAKE_INSTALL_LIBEXECDIR=${placeholder "lib"}/libexec"
-        ];
-      in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list="
-      + lib.concatStringsSep ";" (lib.concatLists [
-        flagsForLlvmConfig
-        nativeToolchainFlags
-        nativeInstallFlags
-      ])
-    )
-  ];
-
-  postInstall = ''
-    mkdir -p $python/share
-    mv $out/share/opt-viewer $python/share/opt-viewer
-    moveToOutput "bin/llvm-config*" "$dev"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
-      --replace "\''${_IMPORT_PREFIX}/lib/lib" "$lib/lib/lib" \
-      --replace "$out/bin/llvm-config" "$dev/bin/llvm-config"
-    substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
-      --replace 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' 'set(LLVM_BINARY_DIR "'"$lib"'")'
-  ''
-  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
-    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
-  ''
-  + optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    cp NATIVE/bin/llvm-config $dev/bin/llvm-config-native
-  '';
-
-  inherit doCheck;
-
-  checkTarget = "check-all";
-
-  # For the update script:
-  passthru.monorepoSrc = monorepoSrc;
-
-  requiredSystemFeatures = [ "big-parallel" ];
-  meta = llvm_meta // {
-    homepage = "https://llvm.org/";
-    description = "A collection of modular and reusable compiler and toolchain technologies";
-    longDescription = ''
-      The LLVM Project is a collection of modular and reusable compiler and
-      toolchain technologies. Despite its name, LLVM has little to do with
-      traditional virtual machines. The name "LLVM" itself is not an acronym; it
-      is the full name of the project.
-      LLVM began as a research project at the University of Illinois, with the
-      goal of providing a modern, SSA-based compilation strategy capable of
-      supporting both static and dynamic compilation of arbitrary programming
-      languages. Since then, LLVM has grown to be an umbrella project consisting
-      of a number of subprojects, many of which are being used in production by
-      a wide variety of commercial and open source projects as well as being
-      widely used in academic research. Code in the LLVM project is licensed
-      under the "Apache 2.0 License with LLVM exceptions".
-    '';
-  };
-} // lib.optionalAttrs enableManpages {
-  pname = "llvm-manpages";
-
-  propagatedBuildInputs = [];
-
-  ninjaFlags = [ "docs-llvm-man" ];
-  installTargets = [ "install-docs-llvm-man" ];
-
-  postPatch = null;
-  postInstall = null;
-
-  outputs = [ "out" ];
-
-  doCheck = false;
-
-  meta = llvm_meta // {
-    description = "man pages for LLVM ${version}";
-  };
-})
diff --git a/pkgs/development/compilers/orc/default.nix b/pkgs/development/compilers/orc/default.nix
index 07bee8ecd2786..9841fd94f2d01 100644
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@@ -60,6 +60,6 @@ in stdenv.mkDerivation rec {
     # under the 3-clause BSD license. The rest is 2-clause BSD license.
     license = with licenses; [ bsd3 bsd2 ];
     platforms = platforms.unix;
-    maintainers = [ ];
+    maintainers = with maintainers; [ lilyinstarlight ];
   };
 }
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index ee4ee37dfc98b..4c02692b75bd5 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -274,7 +274,7 @@ in stdenv.mkDerivation (finalAttrs: {
       # Platforms with host tools from
       # https://doc.rust-lang.org/nightly/rustc/platform-support.html
       "x86_64-darwin" "i686-darwin" "aarch64-darwin"
-      "i686-freebsd13" "x86_64-freebsd13"
+      "i686-freebsd" "x86_64-freebsd"
       "x86_64-solaris"
       "aarch64-linux" "armv6l-linux" "armv7l-linux" "i686-linux"
       "loongarch64-linux" "powerpc64-linux" "powerpc64le-linux"
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 2ba79281567ba..4116952199719 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -19,12 +19,12 @@
 
 let
   versionMap = {
-    "2.4.2" = {
-      sha256 = "sha256-/APLUtEqr+h1nmMoRQogG73fibFwcaToPznoC0Pd7w8=";
-    };
     "2.4.3" = {
       sha256 = "sha256-icmq35K4KtPHSj1PFYoDiJPeoOTzlNyvyWNYPDC3w/I=";
     };
+    "2.4.4" = {
+      sha256 = "sha256-ipMmJ7Px2OlhjxzcIl7csAJFaARpfiyH0UBoN2ShBtU=";
+    };
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If ECL (or any other
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 86caf243a559c..a7041bfc6a299 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -1,10 +1,10 @@
 { stdenv, lib, fetchurl, fetchpatch, pkg-config, flex, bison, libxslt, autoconf, autoreconfHook
-, gnome, graphviz, glib, libiconv, libintl, libtool, expat, substituteAll, vala
+, gnome, graphviz, glib, libiconv, libintl, libtool, expat, substituteAll, vala, gobject-introspection
 }:
 
 let
   generic = lib.makeOverridable ({
-    version, sha256,
+    version, hash,
     extraNativeBuildInputs ? [],
     extraBuildInputs ? [],
     withGraphviz ? false
@@ -30,7 +30,7 @@ let
 
     src = fetchurl {
       url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-      inherit sha256;
+      inherit hash;
     };
 
     postPatch = ''
@@ -49,7 +49,7 @@ let
     outputs = [ "out" "devdoc" ];
 
     nativeBuildInputs = [
-      pkg-config flex bison libxslt
+      pkg-config flex bison libxslt gobject-introspection
     ] ++ lib.optional (stdenv.isDarwin) expat
       ++ lib.optional disableGraphviz autoreconfHook # if we changed our ./configure script, need to reconfigure
       ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ vala ]
@@ -86,8 +86,8 @@ let
 
 in rec {
   vala_0_56 = generic {
-    version = "0.56.14";
-    sha256 = "k4LCaMqb3AKq7cgVKpgYvzk1JzBB9inFbeQQ42Cj9Vc=";
+    version = "0.56.17";
+    hash = "sha256-JhAMTk7wBJxhknXxQNl89WWIPQDHVDyCvM5aQmk07Wo=";
   };
 
   vala = vala_0_56;
diff --git a/pkgs/development/coq-modules/coqide/default.nix b/pkgs/development/coq-modules/coqide/default.nix
index d2dda145f6773..449e81040dfa9 100644
--- a/pkgs/development/coq-modules/coqide/default.nix
+++ b/pkgs/development/coq-modules/coqide/default.nix
@@ -1,7 +1,7 @@
 { lib
 , makeDesktopItem
 , copyDesktopItems
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gnome
 , mkCoqDerivation
@@ -26,7 +26,7 @@ mkCoqDerivation rec {
 
   buildInputs = [
     copyDesktopItems
-    wrapGAppsHook
+    wrapGAppsHook3
     coq.ocamlPackages.lablgtk3-sourceview3
     glib
     gnome.adwaita-icon-theme
diff --git a/pkgs/development/coq-modules/vscoq-language-server/default.nix b/pkgs/development/coq-modules/vscoq-language-server/default.nix
index ee74d77101e7b..e79bd4f60f8da 100644
--- a/pkgs/development/coq-modules/vscoq-language-server/default.nix
+++ b/pkgs/development/coq-modules/vscoq-language-server/default.nix
@@ -1,4 +1,4 @@
-{ metaFetch, mkCoqDerivation, coq, lib, glib, gnome, wrapGAppsHook,
+{ metaFetch, mkCoqDerivation, coq, lib, glib, gnome, wrapGAppsHook3,
   version ? null }:
 
 let ocamlPackages = coq.ocamlPackages;
@@ -21,7 +21,7 @@ ocamlPackages.buildDunePackage {
   src = "${fetched.src}/language-server";
   nativeBuildInputs = [ coq ];
   buildInputs =
-    [ coq glib gnome.adwaita-icon-theme wrapGAppsHook ] ++
+    [ coq glib gnome.adwaita-icon-theme wrapGAppsHook3 ] ++
     (with ocamlPackages; [ findlib
       lablgtk3-sourceview3 yojson zarith ppx_inline_test
       ppx_assert ppx_sexp_conv ppx_deriving ppx_import sexplib
diff --git a/pkgs/development/embedded/arduino/arduino-core/default.nix b/pkgs/development/embedded/arduino/arduino-core/default.nix
index cf9e014310df6..43e6292143a4a 100644
--- a/pkgs/development/embedded/arduino/arduino-core/default.nix
+++ b/pkgs/development/embedded/arduino/arduino-core/default.nix
@@ -13,7 +13,7 @@
 , readline
 , withGui ? false
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , withTeensyduino ? false
   /* Packages needed for Teensyduino */
 , upx
@@ -113,7 +113,7 @@ stdenv.mkDerivation rec {
   # the glib setup hook will populate GSETTINGS_SCHEMAS_PATH,
   # wrapGAppHooks (among other things) adds it to XDG_DATA_DIRS
   # so 'save as...' works:
-  nativeBuildInputs = [ glib stripJavaArchivesHook wrapGAppsHook unzip ];
+  nativeBuildInputs = [ glib stripJavaArchivesHook wrapGAppsHook3 unzip ];
   buildInputs = [
     jdk
     ant
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index a0ab31525888f..27ca50b938f5e 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -934,22 +934,6 @@ self: super: {
   # https://github.com/Euterpea/Euterpea2/issues/40
   Euterpea = doJailbreak super.Euterpea;
 
-  # Install icons, metadata and cli program.
-  bustle = appendPatches [
-    # Fix build with libpcap 1.10.2
-    # https://gitlab.freedesktop.org/bustle/bustle/-/merge_requests/21
-    (pkgs.fetchpatch {
-      url = "https://gitlab.freedesktop.org/bustle/bustle/-/commit/77e2de892cd359f779c84739682431a66eb8cf31.patch";
-      hash = "sha256-sPb6/Z/ANids53aL9VsMHa/v5y+TA1ZY3jwAXlEH3Ec=";
-    })
-  ] (overrideCabal (drv: {
-    buildDepends = [ pkgs.libpcap ];
-    buildTools = with pkgs.buildPackages; [ gettext perl help2man ];
-    postInstall = ''
-      make install PREFIX=$out
-    '';
-  }) super.bustle);
-
   # Byte-compile elisp code for Emacs.
   ghc-mod = overrideCabal (drv: {
     preCheck = "export HOME=$TMPDIR";
@@ -2258,6 +2242,13 @@ self: super: {
   # https://github.com/merijn/paramtree/issues/4
   paramtree = dontCheck super.paramtree;
 
+  # https://github.com/haskell-gi/haskell-gi/issues/431
+  haskell-gi = appendPatch (fetchpatch {
+      url = "https://github.com/haskell-gi/haskell-gi/pull/430/commits/9ee545ad5028e5de8e1e1d96bbba2b9dbab47480.diff";
+      hash = "sha256-kh32mZ7EdlOsg7HQILB7Y/EkHIqG/mozbnd/kbP+WDk=";
+    })
+    super.haskell-gi;
+
   # Too strict version bounds on haskell-gi
   # https://github.com/owickstrom/gi-gtk-declarative/issues/100
   gi-gtk-declarative = doJailbreak super.gi-gtk-declarative;
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index fb4afdde5bbaf..01c366b579621 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -444,7 +444,7 @@ self: super: builtins.intersectAttrs super {
   leksah = dontCheck (overrideCabal (drv: {
     executableSystemDepends = (drv.executableSystemDepends or []) ++ (with pkgs; [
       gnome.adwaita-icon-theme # Fix error: Icon 'window-close' not present in theme ...
-      wrapGAppsHook           # Fix error: GLib-GIO-ERROR **: No GSettings schemas are installed on the system
+      wrapGAppsHook3           # Fix error: GLib-GIO-ERROR **: No GSettings schemas are installed on the system
       gtk3                    # Fix error: GLib-GIO-ERROR **: Settings schema 'org.gtk.Settings.FileChooser' is not installed
     ]);
     postPatch = (drv.postPatch or "") + ''
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 32d1466f326e4..2f3b6de7d11c8 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -29,7 +29,7 @@
 , common-updater-scripts
 , coreutils
 , git
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 { baseName ? "erlang"
 , version
@@ -46,7 +46,7 @@
 , odbcSupport ? false
 , odbcPackages ? [ unixODBC ]
 , opensslPackage ? openssl
-, wxPackages ? [ libGL libGLU wxGTK xorg.libX11 wrapGAppsHook ]
+, wxPackages ? [ libGL libGLU wxGTK xorg.libX11 wrapGAppsHook3 ]
 , preUnpack ? ""
 , postUnpack ? ""
 , patches ? [ ]
diff --git a/pkgs/development/interpreters/gnudatalanguage/default.nix b/pkgs/development/interpreters/gnudatalanguage/default.nix
index 54b5c5898c87f..41f15afbee305 100644
--- a/pkgs/development/interpreters/gnudatalanguage/default.nix
+++ b/pkgs/development/interpreters/gnudatalanguage/default.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchFromGitHub
 , cmake
-, wrapGAppsHook
+, wrapGAppsHook3
 , readline
 , ncurses
 , zlib
@@ -157,7 +157,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
-  ] ++ lib.optional enableWX wrapGAppsHook;
+  ] ++ lib.optional enableWX wrapGAppsHook3;
 
   cmakeFlags = lib.optional (!enableHDF4) "-DHDF=OFF"
     ++ [ (if enableHDF5 then "-DHDF5DIR=${hdf5-custom}" else "-DHDF5=OFF") ]
diff --git a/pkgs/development/interpreters/gtk-server/default.nix b/pkgs/development/interpreters/gtk-server/default.nix
index e6d32f40c40ea..d97c94fbd885a 100644
--- a/pkgs/development/interpreters/gtk-server/default.nix
+++ b/pkgs/development/interpreters/gtk-server/default.nix
@@ -5,7 +5,7 @@
 , gtk3
 , libffcall
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     cd src
   '';
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = [ libffcall glib gtk3 ];
 
   configureOptions = [ "--with-gtk3" ];
diff --git a/pkgs/development/interpreters/ngn-k/default.nix b/pkgs/development/interpreters/ngn-k/default.nix
index 0a24bbdfe0f79..9ec1f0b673d3d 100644
--- a/pkgs/development/interpreters/ngn-k/default.nix
+++ b/pkgs/development/interpreters/ngn-k/default.nix
@@ -65,6 +65,6 @@ useStdenv.mkDerivation {
     homepage = "https://codeberg.org/ngn/k";
     license = lib.licenses.agpl3Only;
     maintainers = [ lib.maintainers.sternenseemann ];
-    platforms = [ "x86_64-linux" "x86_64-freebsd13" ];
+    platforms = [ "x86_64-linux" "x86_64-freebsd" ];
   };
 }
diff --git a/pkgs/development/interpreters/racket/default.nix b/pkgs/development/interpreters/racket/default.nix
index 8d4615f61cead..f75470566e2cc 100644
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@@ -15,7 +15,7 @@
 , disableDocs ? false
 , CoreFoundation
 , gsettings-desktop-schemas
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
     (lib.optionalString (stdenv.cc.isGNU && ! stdenv.isDarwin) "-lgcc_s")
   ];
 
-  nativeBuildInputs = [ cacert wrapGAppsHook ];
+  nativeBuildInputs = [ cacert wrapGAppsHook3 ];
 
   buildInputs = [ fontconfig libffi libtool sqlite gsettings-desktop-schemas gtk3 ncurses ]
     ++ lib.optionals stdenv.isDarwin [ libiconv CoreFoundation ];
diff --git a/pkgs/development/interpreters/racket/racket_7_9.nix b/pkgs/development/interpreters/racket/racket_7_9.nix
index 836bc879dbbca..78efe8e2914c8 100644
--- a/pkgs/development/interpreters/racket/racket_7_9.nix
+++ b/pkgs/development/interpreters/racket/racket_7_9.nix
@@ -13,7 +13,7 @@
 , disableDocs ? false
 , CoreFoundation
 , gsettings-desktop-schemas
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     (lib.optionalString stdenv.isDarwin "-framework CoreFoundation")
   ];
 
-  nativeBuildInputs = [ cacert wrapGAppsHook ];
+  nativeBuildInputs = [ cacert wrapGAppsHook3 ];
 
   buildInputs = [ fontconfig libffi libtool sqlite gsettings-desktop-schemas gtk3 ]
     ++ lib.optionals stdenv.isDarwin [ libiconv CoreFoundation ];
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 5df1c65b3aac0..ed3a06591d165 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -296,8 +296,8 @@ in {
   mkRuby = generic;
 
   ruby_3_1 = generic {
-    version = rubyVersion "3" "1" "4" "";
-    hash = "sha256-o9VYeaDfqx1xQf3xDSKgfb+OXNxEFdob3gYSfVzDx7Y=";
+    version = rubyVersion "3" "1" "5" "";
+    hash = "sha256-NoXFHu7hNSwx6gOXBtcZdvU9AKttdzEt5qoauvXNosU=";
   };
 
   ruby_3_2 = generic {
@@ -307,8 +307,8 @@ in {
   };
 
   ruby_3_3 = generic {
-    version = rubyVersion "3" "3" "0" "";
-    hash = "sha256-llGIFNmDK+zpKoVBWoGdSJOzB9tZIa4fD3Uamomla30=";
+    version = rubyVersion "3" "3" "1" "";
+    hash = "sha256-jcKvKALMcAzRgtVDByY4jM+IWz8KFPzWoPIf8knJqpk=";
     cargoHash = "sha256-GeelTMRFIyvz1QS2L+Q3KAnyQy7jc0ejhx3TdEFVEbk=";
   };
 
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 6a28bbb488ee4..8c0bc2208c10c 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.5.7";
+  version = "3.5.9";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-w9BKIE0vcmX+mmtDqF1tInhplHdBok1W5R1xNtRinjk=";
+    hash = "sha256-KyA2Qhkea7ns4ZB19iJ1qIUmMZsSRoTEZmdBXcpDY/E=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aravis/default.nix b/pkgs/development/libraries/aravis/default.nix
index ccdc06e906fe7..e279a6d6e3695 100644
--- a/pkgs/development/libraries/aravis/default.nix
+++ b/pkgs/development/libraries/aravis/default.nix
@@ -13,7 +13,7 @@
 , enableViewer ? true
 , gst_all_1
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 
 , enableUsb ? true
 , libusb1
@@ -25,7 +25,7 @@
 assert enableGstPlugin -> gst_all_1 != null;
 assert enableViewer -> enableGstPlugin;
 assert enableViewer -> gtk3 != null;
-assert enableViewer -> wrapGAppsHook != null;
+assert enableViewer -> wrapGAppsHook3 != null;
 
 stdenv.mkDerivation rec {
   pname = "aravis";
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gi-docgen
     gobject-introspection
-  ] ++ lib.optional enableViewer wrapGAppsHook;
+  ] ++ lib.optional enableViewer wrapGAppsHook3;
 
   buildInputs =
     [ glib libxml2 ]
diff --git a/pkgs/development/libraries/at-spi2-core/default.nix b/pkgs/development/libraries/at-spi2-core/default.nix
index 270f624965f60..c70044308d023 100644
--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-core";
-  version = "2.50.2";
+  version = "2.52.0";
 
   outputs = [ "out" "dev" ];
   separateDebugInfo = true;
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-W4GxRhpi3Y++0aJ2+p71txEvmuX/huHjKtlkS2VP94w=";
+    hash = "sha256-CsP8gyDI0B+hR8Jyun+gOAY4nGsD08QG0II+MONf9as=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index 7a7d808795587..670725c2cd681 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.7.16";
+  version = "0.7.17";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    hash = "sha256-76sBv4oChDrkv80HPktkULFNC37kfTNxjlwNg/FJiyA=";
+    hash = "sha256-dSb8VgL/fxU7yHomj/ThcLCrGrvern1ESho5oM39Um4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index 360b82b6c6797..48b4e5ef11d3d 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-common";
-  version = "0.9.14";
+  version = "0.9.15";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-aeuIXqnO8divpguDpiPlYJHABYIqegpaDNGwqJ5TKZw=";
+    hash = "sha256-x5bFBiFFcx6X+ZDtIkHe+ikMTrl2REK3QnqTaXExahM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-io/default.nix b/pkgs/development/libraries/aws-c-io/default.nix
index 65b5843897612..1bc0c731a9d73 100644
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-io";
-  version = "0.14.6";
+  version = "0.14.7";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fekeGghqMKbUqKWIfpZg3a6dCpgxywhmXPoGz9y4Aos=";
+    hash = "sha256-Z4o1vv/8FWp3S7GfLDsV0a8ih+IdJIUC0DL4klOXjnw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index 8db5b837ba6b3..895babbb4f727 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.5.4";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    hash = "sha256-8eKQsP7AftNDccsZHPC9PcwpbpgZSvsioUuSsiggQDs=";
+    hash = "sha256-zzsRYhLgJfd02fPgoZBf7n6dTfbLHarc1aQa0fx/uck=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-crt-cpp/default.nix b/pkgs/development/libraries/aws-crt-cpp/default.nix
index c41c5426d5666..cbf2e22ec7322 100644
--- a/pkgs/development/libraries/aws-crt-cpp/default.nix
+++ b/pkgs/development/libraries/aws-crt-cpp/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-crt-cpp";
-  version = "0.26.4";
+  version = "0.26.8";
 
   outputs = [ "out" "dev" ];
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     owner = "awslabs";
     repo = "aws-crt-cpp";
     rev = "v${version}";
-    sha256 = "sha256-H5ms6fhhlkARn9g8S5Ma8bnisZv8mfNizP0QpzsF1tA=";
+    sha256 = "sha256-TW17Jcs9y8OqB0mnbHbOZgSWkYs70o2bhiLT/Rr1e8k=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 0d210abd4a15e..cafe03ce1461b 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -27,13 +27,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
-  version = "1.11.296";
+  version = "1.11.309";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    hash = "sha256-yg+OkeUaqwUQGQ5ThIVQUpF2rHm4FuFbcl5gE5WHHOQ=";
+    hash = "sha256-+Hx/qJREXTu92KxwOv1zTsveXWZvoBxpvc27kEej7sw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/bamf/default.nix b/pkgs/development/libraries/bamf/default.nix
index 99c1df8e0a39c..8b11954429631 100644
--- a/pkgs/development/libraries/bamf/default.nix
+++ b/pkgs/development/libraries/bamf/default.nix
@@ -17,7 +17,7 @@
 , xorgserver
 , dbus
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     pkg-config
     vala
     which
-    wrapGAppsHook
+    wrapGAppsHook3
     xorgserver
   ];
 
diff --git a/pkgs/development/libraries/duckdb/default.nix b/pkgs/development/libraries/duckdb/default.nix
index 03857e962a832..343574f251a8b 100644
--- a/pkgs/development/libraries/duckdb/default.nix
+++ b/pkgs/development/libraries/duckdb/default.nix
@@ -98,6 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
         # fails with Out of Memory Error
         "test/sql/copy/parquet/batched_write/batch_memory_usage.test"
         # wants http connection
+        "test/sql/copy/csv/recursive_query_csv.test"
         "test/sql/copy/csv/test_mixed_lines.test"
       ] ++ lib.optionals stdenv.isAarch64 [
         "test/sql/aggregate/aggregates/test_kurtosis.test"
diff --git a/pkgs/development/libraries/duckdb/versions.json b/pkgs/development/libraries/duckdb/versions.json
index efb151413e3d9..de679be88599a 100644
--- a/pkgs/development/libraries/duckdb/versions.json
+++ b/pkgs/development/libraries/duckdb/versions.json
@@ -1,5 +1,5 @@
 {
-  "version": "0.10.1",
-  "rev": "4a89d97db8a5a23a15f3025c8d2d2885337c2637",
-  "hash": "sha256-/j/DaUzsfACI5Izr4lblkYmIEmKsOXr760UTwC0l/qg="
+  "version": "0.10.2",
+  "rev": "1601d94f94a7e0d2eb805a94803eb1e3afbbe4ed",
+  "hash": "sha256-CTZ90KJvLPQqu1FYciEWsxJbvybCjeBsi/12bkfVd9Q="
 }
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index 383a157acbd14..2fa7aec062f36 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.6.8";
+  version = "2.6.9";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-9WWSMGLHfz1YhG8FWNIebQfKSkiMWIEt/e+zUgL6x64=";
+    hash = "sha256-2aWhDcmzikOzoPoix27W67fgnrU1r/YpVK/NvUDv/2s=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index bdc0cdd5ffa4c..92a28d8a7705b 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -40,12 +40,14 @@
 , withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
 , withAudioToolbox ? withHeadlessDeps && stdenv.isDarwin # Apple AudioToolbox
 , withAvFoundation ? withHeadlessDeps && stdenv.isDarwin # Apple AVFoundation framework
+, withAvisynth ? withFullDeps # AviSynth script files reading
 , withBluray ? withFullDeps # BluRay reading
 , withBs2b ? withFullDeps # bs2b DSP library
 , withBzlib ? withHeadlessDeps
 , withCaca ? withFullDeps # Textual display (ASCII art)
 , withCelt ? withFullDeps # CELT decoder
 , withChromaprint ? withFullDeps # Audio fingerprinting
+, withCodec2 ? withFullDeps # codec2 en/decoding
 , withCoreImage ? withHeadlessDeps && stdenv.isDarwin # Apple CoreImage framework
 , withCuda ? withFullDeps && withNvcodec
 , withCudaLLVM ? withFullDeps
@@ -68,6 +70,7 @@
 , withHarfbuzz ? withHeadlessDeps && lib.versionAtLeast version "6.1" # Needed for drawtext filter
 , withIconv ? withHeadlessDeps
 , withJack ? withFullDeps && !stdenv.isDarwin # Jack audio
+, withJxl ? withFullDeps && lib.versionAtLeast version "5" # JPEG XL de/encoding
 , withLadspa ? withFullDeps # LADSPA audio filtering
 , withLzma ? withHeadlessDeps # xz-utils
 , withMfx ? withFullDeps && (with stdenv.hostPlatform; isLinux && !isAarch) # Hardware acceleration via intel-media-sdk/libmfx
@@ -211,9 +214,11 @@
  *  External libraries options
  */
 , alsa-lib
+, avisynthplus
 , bzip2
 , celt
 , chromaprint
+, codec2
 , clang
 , dav1d
 , fdk_aac
@@ -243,6 +248,7 @@
 , libGLU
 , libiconv
 , libjack2
+, libjxl
 , libmodplug
 , libmysofa
 , libogg
@@ -415,6 +421,13 @@ stdenv.mkDerivation (finalAttrs: {
         '';
       }
     ]
+    ++ (lib.optionals (lib.versionAtLeast version "5" && lib.versionOlder version "6") [
+      {
+        name = "fix_build_failure_due_to_libjxl_version_to_new";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/75b1a555a70c178a9166629e43ec2f6250219eb2";
+        hash = "sha256-+2kzfPJf5piim+DqEgDuVEEX5HLwRsxq0dWONJ4ACrU=";
+      }
+    ])
     ++ (lib.optionals (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2") [
       { # this can be removed post 6.1
         name = "fix_build_failure_due_to_PropertyKey_EncoderID";
@@ -527,12 +540,14 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withAss "libass")
     (enableFeature withAudioToolbox "audiotoolbox")
     (enableFeature withAvFoundation "avfoundation")
+    (enableFeature withAvisynth "avisynth")
     (enableFeature withBluray "libbluray")
     (enableFeature withBs2b "libbs2b")
     (enableFeature withBzlib "bzlib")
     (enableFeature withCaca "libcaca")
     (enableFeature withCelt "libcelt")
     (enableFeature withChromaprint "chromaprint")
+    (enableFeature withCodec2 "libcodec2")
     (enableFeature withCoreImage "coreimage")
     (enableFeature withCuda "cuda")
     (enableFeature withCudaLLVM "cuda-llvm")
@@ -560,6 +575,9 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ [
     (enableFeature withIconv "iconv")
     (enableFeature withJack "libjack")
+  ] ++ optionals (versionAtLeast finalAttrs.version "5.0") [
+    (enableFeature withJxl "libjxl")
+  ] ++ [
     (enableFeature withLadspa "ladspa")
     (enableFeature withLzma "lzma")
     (enableFeature withMfx "libmfx")
@@ -671,12 +689,14 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withAss [ libass ]
   ++ optionals withAudioToolbox [ AudioToolbox ]
   ++ optionals withAvFoundation [ AVFoundation ]
+  ++ optionals withAvisynth [ avisynthplus ]
   ++ optionals withBluray [ libbluray ]
   ++ optionals withBs2b [ libbs2b ]
   ++ optionals withBzlib [ bzip2 ]
   ++ optionals withCaca [ libcaca ]
   ++ optionals withCelt [ celt ]
   ++ optionals withChromaprint [ chromaprint ]
+  ++ optionals withCodec2 [ codec2 ]
   ++ optionals withCoreImage [ CoreImage ]
   ++ optionals withDav1d [ dav1d ]
   ++ optionals withDc1394 [ libdc1394 libraw1394 ]
@@ -696,6 +716,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withHarfbuzz [ harfbuzz ]
   ++ optionals withIconv [ libiconv ] # On Linux this should be in libc, do we really need it?
   ++ optionals withJack [ libjack2 ]
+  ++ optionals withJxl [ libjxl ]
   ++ optionals withLadspa [ ladspaH ]
   ++ optionals withLzma [ xz ]
   ++ optionals withMfx [ intel-media-sdk ]
diff --git a/pkgs/development/libraries/folks/default.nix b/pkgs/development/libraries/folks/default.nix
index 8df1c9585450a..0f40be439a3ab 100644
--- a/pkgs/development/libraries/folks/default.nix
+++ b/pkgs/development/libraries/folks/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "folks";
-  version = "0.15.7";
+  version = "0.15.9";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/folks/${lib.versions.majorMinor finalAttrs.version}/folks-${finalAttrs.version}.tar.xz";
-    sha256 = "Eg8hnvYyEsqpWuf2rrZOKZKLCxqLlFIFQwSgDQ80eHE=";
+    hash = "sha256-IxGzc1XDUfM/Fj/cOUh0oioKBoLDGUk9bYpuQgcRQV8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gcr/4.nix b/pkgs/development/libraries/gcr/4.nix
index ea1dbf99f2730..dd860d0bc7008 100644
--- a/pkgs/development/libraries/gcr/4.nix
+++ b/pkgs/development/libraries/gcr/4.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gcr";
-  version = "4.1.0";
+  version = "4.3.0";
 
   outputs = [ "out" "bin" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "nOqtKShLqRm5IW4oiMGOxnJAwsk7OkhWvFSIu8Hzo4M=";
+    hash = "sha256-w+6HKOQ2SwOX9DX6IPkvkBqxOdKyZPTgWdZ7PA9DzTY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gcr/default.nix b/pkgs/development/libraries/gcr/default.nix
index 11d695e774994..db31927b7a70a 100644
--- a/pkgs/development/libraries/gcr/default.nix
+++ b/pkgs/development/libraries/gcr/default.nix
@@ -16,7 +16,7 @@
 , openssh
 , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , gi-docgen
 , vala
 , gnome
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     gettext
     gobject-introspection
     gi-docgen
-    wrapGAppsHook
+    wrapGAppsHook3
     vala
     shared-mime-info
     openssh
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index f77daec2ea6fb..a90a2c5c9f780 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdk-pixbuf";
-  version = "2.42.10";
+  version = "2.42.11";
 
   outputs = [ "out" "dev" "man" ]
     ++ lib.optional withIntrospection "devdoc"
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "7ptsddE7oJaQei48aye2G80X9cfr6rWltDnS8uOf5Es=";
+    hash = "sha256-Sdy0AjiHCGR+jDIdVrb7MPIeUeUV0MWpQiaNIwUqLwA=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/geis/default.nix b/pkgs/development/libraries/geis/default.nix
index 17ef806ec9ad7..9f1cc784e1407 100644
--- a/pkgs/development/libraries/geis/default.nix
+++ b/pkgs/development/libraries/geis/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl
 , pkg-config
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 , atk
 , dbus
 , evemu
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   pythonPath = with python3Packages;
     [ pygobject3  ];
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook python3Packages.wrapPython gobject-introspection ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 python3Packages.wrapPython gobject-introspection ];
   buildInputs = [ atk dbus evemu frame gdk-pixbuf grail
     gtk3 xorg.libX11 xorg.libXext xorg.libXi xorg.libXtst pango python3Packages.python xorgserver
   ];
diff --git a/pkgs/development/libraries/geoclue/default.nix b/pkgs/development/libraries/geoclue/default.nix
index c2bf28d710452..df58e5dc9e193 100644
--- a/pkgs/development/libraries/geoclue/default.nix
+++ b/pkgs/development/libraries/geoclue/default.nix
@@ -19,7 +19,7 @@
 , avahi
 , glib-networking
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , vala
 , withDemoAgent ? false
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     intltool
     meson
     ninja
-    wrapGAppsHook
+    wrapGAppsHook3
     python3
     vala
     gobject-introspection
diff --git a/pkgs/development/libraries/giflib/default.nix b/pkgs/development/libraries/giflib/default.nix
index 9c24d11d4abc3..677db06e5083c 100644
--- a/pkgs/development/libraries/giflib/default.nix
+++ b/pkgs/development/libraries/giflib/default.nix
@@ -4,7 +4,6 @@
 , fetchpatch
 , fixDarwinDylibNames
 , pkgsStatic
-, imagemagick_light
 }:
 
 stdenv.mkDerivation rec {
@@ -29,9 +28,7 @@ stdenv.mkDerivation rec {
     ./mingw-install-exes.patch
   ];
 
-  nativeBuildInputs = [
-    imagemagick_light
-  ] ++ lib.optionals stdenv.isDarwin [
+  nativeBuildInputs = lib.optionals stdenv.isDarwin [
     fixDarwinDylibNames
   ];
 
@@ -39,7 +36,11 @@ stdenv.mkDerivation rec {
     "PREFIX=${builtins.placeholder "out"}"
   ];
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
+  postPatch = ''
+    # we don't want to build HTML documentation
+    substituteInPlace doc/Makefile \
+      --replace-fail "all: allhtml manpages" "all: manpages"
+  '' + lib.optionalString stdenv.hostPlatform.isStatic ''
     # Upstream build system does not support NOT building shared libraries.
     sed -i '/all:/ s/$(LIBGIFSO)//' Makefile
     sed -i '/all:/ s/$(LIBUTILSO)//' Makefile
diff --git a/pkgs/development/libraries/gjs/default.nix b/pkgs/development/libraries/gjs/default.nix
index dc5f5e46975d2..604435cee5105 100644
--- a/pkgs/development/libraries/gjs/default.nix
+++ b/pkgs/development/libraries/gjs/default.nix
@@ -32,13 +32,13 @@ let
   ];
 in stdenv.mkDerivation (finalAttrs: {
   pname = "gjs";
-  version = "1.78.4";
+  version = "1.80.2";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mux6uHLCBQQEkHrpTwrnq+yKVL2ciU3bXC0PUekyuaE=";
+    hash = "sha256-E145xaxZEJYjPlV8/ld9ZAk/UFRBHUfLLiFLrX1Bmb0=";
   };
 
   patches = [
@@ -47,6 +47,10 @@ in stdenv.mkDerivation (finalAttrs: {
 
     # Allow installing installed tests to a separate output.
     ./installed-tests-path.patch
+
+    # Disable introspection test in installed tests
+    # (minijasmine:1317): GLib-GIO-WARNING **: 17:33:39.556: Error creating IO channel for /proc/self/mountinfo: No such file or directory (g-io-error-quark, 1)
+    ./disable-introspection-test.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gjs/disable-introspection-test.patch b/pkgs/development/libraries/gjs/disable-introspection-test.patch
new file mode 100644
index 0000000000000..1c438dd6b4019
--- /dev/null
+++ b/pkgs/development/libraries/gjs/disable-introspection-test.patch
@@ -0,0 +1,12 @@
+diff --git a/installed-tests/js/meson.build b/installed-tests/js/meson.build
+index 07759690..43c87c59 100644
+--- a/installed-tests/js/meson.build
++++ b/installed-tests/js/meson.build
+@@ -123,7 +123,6 @@ jasmine_tests = [
+     'GTypeClass',
+     'Importer',
+     'Importer2',
+-    'Introspection',
+     'Lang',
+     'LegacyByteArray',
+     'LegacyClass',
diff --git a/pkgs/development/libraries/glib-networking/default.nix b/pkgs/development/libraries/glib-networking/default.nix
index 39e17a894cb7d..d74acc063e5c0 100644
--- a/pkgs/development/libraries/glib-networking/default.nix
+++ b/pkgs/development/libraries/glib-networking/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glib-networking";
-  version = "2.78.1";
+  version = "2.80.0";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "5I8t27BJgyy7CSMFKcXkXayp8N8O2jJfgy9zeYWb8J8=";
+    hash = "sha256-2PTxqrITF5rjNRYXtZ2rXea8yeeFAh7uF4mY69S7Os8=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index c52a23672e6d5..5a7f49ce94ae1 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -2,36 +2,31 @@
 , lib
 , stdenv
 , fetchurl
-, fetchpatch
 , gettext
 , meson
 , ninja
 , pkg-config
 , perl
 , python3
-, libiconv, zlib, libffi, pcre2, elfutils, gnome, libselinux, bash, gnum4, gtk-doc, docbook_xsl, docbook_xml_dtd_45, libxslt
+, python3Packages
+, libiconv, zlib, libffi, pcre2, elfutils, gnome, libselinux, bash, gnum4, libxslt
+, docutils, gi-docgen
 # use util-linuxMinimal to avoid circular dependency (util-linux, systemd, glib)
 , util-linuxMinimal ? null
 , buildPackages
 
 # this is just for tests (not in the closure of any regular package)
-, coreutils, dbus, libxml2, tzdata
+, coreutils, dbus, tzdata
 , desktop-file-utils, shared-mime-info
 , darwin
 , makeHardcodeGsettingsPatch
 , testers
+, gobject-introspection
+, withIntrospection ? stdenv.buildPlatform.canExecute stdenv.hostPlatform && lib.meta.availableOn stdenv.hostPlatform gobject-introspection
 }:
 
 assert stdenv.isLinux -> util-linuxMinimal != null;
 
-/*
-  * TODO:
-  * Use --enable-installed-tests for GNOME-related packages,
-      and use them as a separately installed tests run by Hydra
-      (they should test an already installed package)
-      https://wiki.gnome.org/Initiatives/GnomeGoals/InstalledTests
-  * Support org.freedesktop.Application, including D-Bus activation from desktop files
-*/
 let
   # Some packages don't get "Cflags" from pkg-config correctly
   # and then fail to build when directly including like <glib/...>.
@@ -46,16 +41,26 @@ let
     ln -sr -t "''${!outputInclude}/include/" "''${!outputInclude}"/lib/*/include/* 2>/dev/null || true
   '';
 
-  buildDocs = stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isStatic;
+  gobject-introspection' = buildPackages.gobject-introspection.override {
+    propagateFullGlib = false;
+    # Avoid introducing cairo, which enables gobjectSupport by default.
+    x11Support = false;
+  };
+
+  librarySuffix = if (stdenv.targetPlatform.extensions.library == ".so") then "2.0.so.0"
+                  else if (stdenv.targetPlatform.extensions.library == ".dylib") then "2.0.0.dylib"
+                  else if (stdenv.targetPlatform.extensions.library == ".a") then "2.0.a"
+                  else if (stdenv.targetPlatform.extensions.library == ".dll") then "2.0-0.dll"
+                  else "2.0-0.lib";
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.78.4";
+  version = "2.80.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-JLjgZy3KEgzDLTlLzLhYROcy4E/nXRi7BXOy28dUj2M=";
+    hash = "sha256-giipL5KkEhYLE5rmi2NFvSjyRDSnta8VDr4h/1h6Vh0=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
@@ -64,13 +69,19 @@ stdenv.mkDerivation (finalAttrs: {
     ./quark_init_on_demand.patch
     ./gobject_init_on_demand.patch
   ] ++ [
-    (fetchpatch {
-      name = "GLib-against-PCRE2-10.43.patch";
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/cce3ae98a2c1966719daabff5a4ec6cf94a846f6.patch";
-      hash = "sha256-vgKzb5hQmFQGD8zxRrXnuX9Gpg/TeSrzehlOH2vA1xU=";
-    })
-
+    # This patch lets GLib's GDesktopAppInfo API watch and notice changes
+    # to the Nix user and system profiles.  That way, the list of available
+    # applications shown by the desktop environment is immediately updated
+    # when the user installs or removes any
+    # (see <https://issues.guix.gnu.org/35594>).
+
+    # It does so by monitoring /nix/var/nix/profiles (for changes to the system
+    # profile) and /nix/var/nix/profiles/per-user/USER (for changes to the user
+    # profile) as well as /etc/profiles/per-user (for chanes to the user
+    # environment profile) and crawling their share/applications sub-directory when
+    # changes happen.
     ./glib-appinfo-watch.patch
+
     ./schema-override-variable.patch
 
     # Add support for Pantheon’s terminal emulator.
@@ -99,10 +110,6 @@ stdenv.mkDerivation (finalAttrs: {
     # 3. Tools for desktop environment that cannot go to $bin due to $out depending on them ($out)
     #    * gio-launch-desktop
     ./split-dev-programs.patch
-
-    # Disable flaky test.
-    # https://gitlab.gnome.org/GNOME/glib/-/issues/820
-    ./skip-timer-test.patch
   ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
@@ -121,48 +128,42 @@ stdenv.mkDerivation (finalAttrs: {
     util-linuxMinimal # for libmount
   ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     AppKit Carbon Cocoa CoreFoundation CoreServices Foundation
-  ]) ++ lib.optionals buildDocs [
-    # Note: this needs to be both in buildInputs and nativeBuildInputs. The
-    # Meson gtkdoc module uses find_program to look it up (-> build dep), but
-    # glib's own Meson configuration uses the host pkg-config to find its
-    # version (-> host dep). We could technically go and fix this in glib, add
-    # pkg-config to depsBuildBuild, but this would be a futile exercise since
-    # Meson's gtkdoc integration does not support cross compilation[1] anyway
-    # and this derivation disables the docs build when cross compiling.
-    #
-    # [1] https://github.com/mesonbuild/meson/issues/2003
-    gtk-doc
-  ];
+  ]);
 
   strictDeps = true;
 
+  depsBuildBuild = [
+    pkg-config # required to find native gi-docgen
+  ];
+
   nativeBuildInputs = [
+    docutils # for rst2man, rst2html5
     meson
     ninja
     pkg-config
     perl
     python3
+    python3Packages.packaging # mostly used to make meson happy
+    python3Packages.wrapPython # for patchPythonScript
     gettext
     libxslt
-    docbook_xsl
-  ] ++ lib.optionals buildDocs [
-    gtk-doc
-    docbook_xml_dtd_45
-    libxml2
+  ] ++ lib.optionals withIntrospection [
+    gi-docgen
+    gobject-introspection'
   ];
 
   propagatedBuildInputs = [ zlib libffi gettext libiconv ];
 
   mesonFlags = [
-    # Avoid the need for gobject introspection binaries in PATH in cross-compiling case.
-    # Instead we just copy them over from the native output.
-    "-Dgtk_doc=${lib.boolToString buildDocs}"
+    "-Ddocumentation=true" # gvariant specification can be built without gi-docgen
     "-Dnls=enabled"
     "-Ddevbindir=${placeholder "dev"}/bin"
+    (lib.mesonEnable "introspection" withIntrospection)
+    # FIXME: Fails when linking target glib/tests/libconstructor-helper.so
+    # relocation R_X86_64_32 against hidden symbol `__TMC_END__' can not be used when making a shared object
+    "-Dtests=${lib.boolToString (!stdenv.hostPlatform.isStatic)}"
   ] ++ lib.optionals (!lib.meta.availableOn stdenv.hostPlatform elfutils) [
     "-Dlibelf=disabled"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    "-Dman=true"                # broken on Darwin
   ] ++ lib.optionals stdenv.isFreeBSD [
     "-Db_lundef=false"
     "-Dxattr=false"
@@ -176,14 +177,11 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
-    chmod +x gio/tests/gengiotypefuncs.py
-    patchShebangs gio/tests/gengiotypefuncs.py
-    chmod +x docs/reference/gio/concat-files-helper.py
-    patchShebangs docs/reference/gio/concat-files-helper.py
     patchShebangs glib/gen-unicode-tables.pl
     patchShebangs glib/tests/gen-casefold-txt.py
     patchShebangs glib/tests/gen-casemap-txt.py
     patchShebangs tools/gen-visibility-macros.py
+    patchShebangs tests
 
     # Needs machine-id, comment the test
     sed -e '/\/gdbus\/codegen-peer-to-peer/ s/^\/*/\/\//' -i gio/tests/gdbus-peer.c
@@ -219,8 +217,11 @@ stdenv.mkDerivation (finalAttrs: {
     for i in $dev/bin/*; do
       moveToOutput "share/bash-completion/completions/''${i##*/}" "$dev"
     done
-  '' + lib.optionalString (!buildDocs) ''
-    cp -r ${buildPackages.glib.devdoc} $devdoc
+  '';
+
+  preFixup = lib.optionalString (!stdenv.hostPlatform.isStatic) ''
+    buildPythonPath ${python3Packages.packaging}
+    patchPythonScript "$dev/share/glib-2.0/codegen/utils.py"
   '';
 
   # Move man pages to the same output as their binaries (needs to be
@@ -230,6 +231,9 @@ stdenv.mkDerivation (finalAttrs: {
     for i in $dev/bin/*; do
       moveToOutput "share/man/man1/''${i##*/}.1.*" "$dev"
     done
+
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc/glib-2.0" "$devdoc"
   '';
 
   nativeCheckInputs = [ tzdata desktop-file-utils shared-mime-info ];
@@ -242,8 +246,34 @@ stdenv.mkDerivation (finalAttrs: {
     export HOME="$TMP"
     export XDG_DATA_DIRS="${desktop-file-utils}/share:${shared-mime-info}/share"
     export G_TEST_DBUS_DAEMON="${dbus}/bin/dbus-daemon"
-    export PATH="$PATH:$(pwd)/gobject"
+
+    # pkg_config_tests expects a PKG_CONFIG_PATH that points to meson-private, wrapped pkg-config
+    # tries to be clever and picks up the wrong glib at the end.
+    export PATH="${buildPackages.pkg-config-unwrapped}/bin:$PATH:$(pwd)/gobject"
     echo "PATH=$PATH"
+
+    # Our gobject-introspection patches make the shared library paths absolute
+    # in the GIR files. When running tests, the library is not yet installed,
+    # though, so we need to replace the absolute path with a local one during build.
+    # We are using a symlink that we will delete before installation.
+    mkdir -p $out/lib
+    ln -s $PWD/gobject/libgobject-${librarySuffix} $out/lib/libgobject-${librarySuffix}
+    ln -s $PWD/gio/libgio-${librarySuffix} $out/lib/libgio-${librarySuffix}
+    ln -s $PWD/glib/libglib-${librarySuffix} $out/lib/libglib-${librarySuffix}
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+
+    meson test --print-errorlogs
+
+    runHook postCheck
+  '';
+
+  postCheck = ''
+    rm $out/lib/libgobject-${librarySuffix}
+    rm $out/lib/libgio-${librarySuffix}
+    rm $out/lib/libglib-${librarySuffix}
   '';
 
   separateDebugInfo = stdenv.isLinux;
diff --git a/pkgs/development/libraries/glib/elementary-terminal-support.patch b/pkgs/development/libraries/glib/elementary-terminal-support.patch
index 34a56c8487aee..5178f9d016cae 100644
--- a/pkgs/development/libraries/glib/elementary-terminal-support.patch
+++ b/pkgs/development/libraries/glib/elementary-terminal-support.patch
@@ -1,8 +1,8 @@
 diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
-index 30fcb2937..a6a7163a7 100644
+index 87db7a97a..bf01fb6b6 100644
 --- a/gio/gdesktopappinfo.c
 +++ b/gio/gdesktopappinfo.c
-@@ -2704,6 +2704,7 @@ prepend_terminal_to_vector (int          *argc,
+@@ -2697,6 +2697,7 @@ prepend_terminal_to_vector (int          *argc,
      { "gnome-terminal", "--" },
      { "mate-terminal", "-x" },
      { "xfce4-terminal", "-x" },
diff --git a/pkgs/development/libraries/glib/glib-appinfo-watch.patch b/pkgs/development/libraries/glib/glib-appinfo-watch.patch
index cbd78a6db4a6f..43641301d3ef6 100644
--- a/pkgs/development/libraries/glib/glib-appinfo-watch.patch
+++ b/pkgs/development/libraries/glib/glib-appinfo-watch.patch
@@ -1,20 +1,8 @@
-This patch lets GLib's GDesktopAppInfo API watch and notice changes
-to the Nix user and system profiles.  That way, the list of available
-applications shown by the desktop environment is immediately updated
-when the user installs or removes any
-(see <https://issues.guix.gnu.org/35594>).
-
-It does so by monitoring /nix/var/nix/profiles (for changes to the system
-profile) and /nix/var/nix/profiles/per-user/USER (for changes to the user
-profile) as well as /etc/profiles/per-user (for chanes to the user
-environment profile) and crawling their share/applications sub-directory when
-changes happen.
-
 diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
-index b779b30..31069f7 100644
+index 87db7a97a..2e1689ed7 100644
 --- a/gio/gdesktopappinfo.c
 +++ b/gio/gdesktopappinfo.c
-@@ -150,6 +150,7 @@ typedef struct
+@@ -147,6 +147,7 @@ typedef struct
    gchar                      *alternatively_watching;
    gboolean                    is_config;
    gboolean                    is_setup;
@@ -22,7 +10,7 @@ index b779b30..31069f7 100644
    GFileMonitor               *monitor;
    GHashTable                 *app_names;
    GHashTable                 *mime_tweaks;
-@@ -181,6 +182,7 @@ desktop_file_dir_unref (DesktopFileDir *dir)
+@@ -179,6 +180,7 @@ desktop_file_dir_unref (DesktopFileDir *dir)
      {
        desktop_file_dir_reset (dir);
        g_free (dir->path);
@@ -30,7 +18,7 @@ index b779b30..31069f7 100644
        g_free (dir);
      }
  }
-@@ -205,6 +207,14 @@ desktop_file_dir_get_alternative_dir (DesktopFileDir *dir)
+@@ -203,6 +205,14 @@ desktop_file_dir_get_alternative_dir (DesktopFileDir *dir)
  {
    gchar *parent;
  
@@ -45,7 +33,7 @@ index b779b30..31069f7 100644
    /* If the directory itself exists then we need no alternative. */
    if (g_access (dir->path, R_OK | X_OK) == 0)
      return NULL;
-@@ -250,11 +260,11 @@ desktop_file_dir_changed (GFileMonitor      *monitor,
+@@ -248,11 +258,11 @@ desktop_file_dir_changed (GFileMonitor      *monitor,
     *
     * If this is a notification for a parent directory (because the
     * desktop directory didn't exist) then we shouldn't fire the signal
@@ -59,7 +47,7 @@ index b779b30..31069f7 100644
      {
        gchar *alternative_dir;
  
-@@ -1556,6 +1566,40 @@ desktop_file_dirs_lock (void)
+@@ -1650,6 +1660,40 @@ desktop_file_dirs_lock (void)
        for (i = 0; dirs[i]; i++)
          g_ptr_array_add (desktop_file_dirs, desktop_file_dir_new (dirs[i]));
  
@@ -84,7 +72,7 @@ index b779b30..31069f7 100644
 +            user_data_dir = g_build_filename (profile_dir, "profile", "share", NULL);
 +            user_profile_dir = desktop_file_dir_new (user_data_dir);
 +            user_profile_dir->nix_profile_watch_dir = profile_dir;
-+            
++
 +            env_dir = g_build_filename ("/etc/profiles/per-user", NULL);
 +            env_data_dir = g_build_filename (env_dir, user, "share", NULL);
 +            user_env_dir = desktop_file_dir_new (env_data_dir);
diff --git a/pkgs/development/libraries/glib/schema-override-variable.patch b/pkgs/development/libraries/glib/schema-override-variable.patch
index f98af04a7f245..84d3e93730a59 100644
--- a/pkgs/development/libraries/glib/schema-override-variable.patch
+++ b/pkgs/development/libraries/glib/schema-override-variable.patch
@@ -1,8 +1,8 @@
 diff --git a/gio/gsettingsschema.c b/gio/gsettingsschema.c
-index 1282c10a1..feadfe3aa 100644
+index b1918657d..504ff97c4 100644
 --- a/gio/gsettingsschema.c
 +++ b/gio/gsettingsschema.c
-@@ -360,6 +360,9 @@ initialise_schema_sources (void)
+@@ -356,6 +356,9 @@ initialise_schema_sources (void)
  
        try_prepend_data_dir (g_get_user_data_dir ());
  
diff --git a/pkgs/development/libraries/glib/skip-timer-test.patch b/pkgs/development/libraries/glib/skip-timer-test.patch
deleted file mode 100644
index 942f3e7864c4f..0000000000000
--- a/pkgs/development/libraries/glib/skip-timer-test.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Description: Skip test which performs some unreliable floating point comparisons
-Forwarded: https://bugzilla.gnome.org/show_bug.cgi?id=722604
-
-Index: b/glib/tests/timer.c
-===================================================================
---- a/glib/tests/timer.c
-+++ b/glib/tests/timer.c
-@@ -203,7 +203,7 @@
- {
-   g_test_init (&argc, &argv, NULL);
- 
--  g_test_add_func ("/timer/basic", test_timer_basic);
-+/*  g_test_add_func ("/timer/basic", test_timer_basic);*/
--  g_test_add_func ("/timer/stop", test_timer_stop);
-+/*  g_test_add_func ("/timer/stop", test_timer_stop);*/
-   g_test_add_func ("/timer/continue", test_timer_continue);
-   g_test_add_func ("/timer/reset", test_timer_reset);
diff --git a/pkgs/development/libraries/glib/split-dev-programs.patch b/pkgs/development/libraries/glib/split-dev-programs.patch
index 0333c5c9ca295..b32fccb8379f4 100644
--- a/pkgs/development/libraries/glib/split-dev-programs.patch
+++ b/pkgs/development/libraries/glib/split-dev-programs.patch
@@ -1,5 +1,5 @@
 diff --git a/gio/gdbus-2.0/codegen/meson.build b/gio/gdbus-2.0/codegen/meson.build
-index 65faae9b2..4297513d4 100644
+index 6d19cd4ba..0205e5074 100644
 --- a/gio/gdbus-2.0/codegen/meson.build
 +++ b/gio/gdbus-2.0/codegen/meson.build
 @@ -20,7 +20,7 @@ gdbus_codegen_conf.set('DATADIR', glib_datadir)
@@ -12,13 +12,13 @@ index 65faae9b2..4297513d4 100644
    configuration : gdbus_codegen_conf
  )
 diff --git a/gio/meson.build b/gio/meson.build
-index 75686bb3e..2f1a73482 100644
+index 59c2b0fc0..87cbb8229 100644
 --- a/gio/meson.build
 +++ b/gio/meson.build
-@@ -882,14 +882,15 @@ pkg.generate(libgio,
+@@ -885,14 +885,15 @@ pkg.generate(libgio,
+   variables : [
      'schemasdir=' + '${datadir}' / schemas_subdir,
      'dtdsdir=' + '${datadir}' / dtds_subdir,
-     'bindir=' + '${prefix}' / get_option('bindir'),
 +    'devbindir=' + get_option('devbindir'),
      'giomoduledir=' + pkgconfig_giomodulesdir,
      'gio=' + '${bindir}' / 'gio',
@@ -36,7 +36,7 @@ index 75686bb3e..2f1a73482 100644
      'gsettings=' + '${bindir}' / 'gsettings',
    ],
    version : glib_version,
-@@ -992,6 +993,7 @@ executable('gio', gio_tool_sources,
+@@ -995,6 +996,7 @@ gio_tool = executable('gio', gio_tool_sources,
  
  executable('gresource', 'gresource-tool.c',
    install : true,
@@ -44,7 +44,7 @@ index 75686bb3e..2f1a73482 100644
    install_tag : 'bin',
    # intl.lib is not compatible with SAFESEH
    link_args : noseh_link_args,
-@@ -999,7 +1001,7 @@ executable('gresource', 'gresource-tool.c',
+@@ -1002,7 +1004,7 @@ executable('gresource', 'gresource-tool.c',
  
  gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodule-priv.c',
    install : true,
@@ -53,7 +53,7 @@ index 75686bb3e..2f1a73482 100644
    install_tag : 'bin',
    c_args : gio_c_args,
    # intl.lib is not compatible with SAFESEH
-@@ -1009,7 +1011,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu
+@@ -1012,7 +1014,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu
  glib_compile_schemas = executable('glib-compile-schemas',
    ['glib-compile-schemas.c'],
    install : true,
@@ -62,7 +62,7 @@ index 75686bb3e..2f1a73482 100644
    install_tag : 'bin',
    # intl.lib is not compatible with SAFESEH
    link_args : noseh_link_args,
-@@ -1018,6 +1020,7 @@ glib_compile_schemas = executable('glib-compile-schemas',
+@@ -1021,6 +1023,7 @@ glib_compile_schemas = executable('glib-compile-schemas',
  glib_compile_resources = executable('glib-compile-resources',
    [gconstructor_as_data_h, 'glib-compile-resources.c'],
    install : true,
@@ -71,10 +71,10 @@ index 75686bb3e..2f1a73482 100644
    c_args : gio_c_args,
    # intl.lib is not compatible with SAFESEH
 diff --git a/gio/tests/meson.build b/gio/tests/meson.build
-index 4ef3343ab..2a0a6b56b 100644
+index 232ecca5e..e292927ac 100644
 --- a/gio/tests/meson.build
 +++ b/gio/tests/meson.build
-@@ -1131,16 +1131,18 @@ if have_bash and have_pkg_config
+@@ -1182,16 +1182,18 @@ if have_bash and have_pkg_config
  
    gio_binaries = [
      'gio',
@@ -97,7 +97,7 @@ index 4ef3343ab..2a0a6b56b 100644
  
    foreach binary: gio_binaries
      pkg_config_tests += [
-@@ -1149,6 +1151,13 @@ if have_bash and have_pkg_config
+@@ -1200,6 +1202,13 @@ if have_bash and have_pkg_config
          prefix / get_option('bindir') / binary)
      ]
    endforeach
@@ -112,13 +112,13 @@ index 4ef3343ab..2a0a6b56b 100644
    foreach binary: gio_multiarch_binaries
      pkg_config_tests += [
 diff --git a/glib/meson.build b/glib/meson.build
-index c26a35e42..38effe12a 100644
+index d2efebadc..eb9fa5b2f 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -447,9 +447,10 @@ pkg.generate(libglib,
+   subdirs : ['glib-2.0'],
+   extra_cflags : ['-I${libdir}/glib-2.0/include'] + win32_cflags,
    variables : [
-     'bindir=' + '${prefix}' / get_option('bindir'),
-     'datadir=' + '${prefix}' / get_option('datadir'),
 -    'glib_genmarshal=' + '${bindir}' / 'glib-genmarshal',
 -    'gobject_query=' + '${bindir}' / 'gobject-query',
 -    'glib_mkenums=' + '${bindir}' / 'glib-mkenums',
@@ -147,10 +147,10 @@ index c26a35e42..38effe12a 100644
    configuration: report_conf,
    install_mode: 'rwxr-xr-x'
 diff --git a/glib/tests/meson.build b/glib/tests/meson.build
-index 09ecd5ab3..9748d4122 100644
+index f6efc593a..5522dcb96 100644
 --- a/glib/tests/meson.build
 +++ b/glib/tests/meson.build
-@@ -508,9 +508,9 @@ if have_bash and have_pkg_config
+@@ -568,9 +568,9 @@ if have_bash and have_pkg_config
          'test "$(pkg-config --variable=datadir glib-2.0)" = "@0@"'.format(
            prefix / get_option('datadir')),
          'test "$(pkg-config --variable=gobject_query glib-2.0)" = "@0@"'.format(
@@ -184,7 +184,7 @@ index 2129aaf8a..da8462428 100644
    dependencies : [libglib_dep, libgobject_dep])
  
 diff --git a/meson_options.txt b/meson_options.txt
-index 517d5757c..198cc1b3c 100644
+index 69a2135bc..cfe14bb09 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -4,6 +4,11 @@ option('runtime_libdir',
diff --git a/pkgs/development/libraries/glibc/2.39-master.patch b/pkgs/development/libraries/glibc/2.39-master.patch
index 3e0815573f5eb..b1d7d60411c81 100644
--- a/pkgs/development/libraries/glibc/2.39-master.patch
+++ b/pkgs/development/libraries/glibc/2.39-master.patch
@@ -6,14 +6,6 @@ Date:   Wed Jan 31 02:12:43 2024 +0100
     
     Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
 
-diff --git a/ADVISORIES b/ADVISORIES
-new file mode 100644
-index 0000000000..d4e33f2df3
---- /dev/null
-+++ b/ADVISORIES
-@@ -0,0 +1,2 @@
-+For the GNU C Library Security Advisories, see the git master branch:
-+https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD
 diff --git a/advisories/GLIBC-SA-2023-0001 b/advisories/GLIBC-SA-2023-0001
 deleted file mode 100644
 index 3d19c91b6a..0000000000
@@ -564,3 +556,8521 @@ index 470676ab2b..2bc7124983 100644
 -#define TEST_FUNCTION do_test ()
 -#include "../test-skeleton.c"
 +#include <support/test-driver.c>
+
+commit 1b9c1a0047fb26a65a9b2a7b8cd977243f7d353c
+Author: Jakub Jelinek <jakub@redhat.com>
+Date:   Wed Jan 31 19:17:27 2024 +0100
+
+    Use gcc __builtin_stdc_* builtins in stdbit.h if possible
+    
+    The following patch uses the GCC 14 __builtin_stdc_* builtins in stdbit.h
+    for the type-generic macros, so that when compiled with GCC 14 or later,
+    it supports not just 8/16/32/64-bit unsigned integers, but also 128-bit
+    (if target supports them) and unsigned _BitInt (any supported precision).
+    And so that the macros don't expand arguments multiple times and can be
+    evaluated in constant expressions.
+    
+    The new testcase is gcc's gcc/testsuite/gcc.dg/builtin-stdc-bit-1.c
+    adjusted to test stdbit.h and the type-generic macros in there instead
+    of the builtins and adjusted to use glibc test framework rather than
+    gcc style tests with __builtin_abort ().
+    
+    Signed-off-by: Jakub Jelinek <jakub@redhat.com>
+    Reviewed-by: Joseph Myers <josmyers@redhat.com>
+    (cherry picked from commit da89496337b97e6a2aaf1e81d55cf998f6db1070)
+
+diff --git a/manual/stdbit.texi b/manual/stdbit.texi
+index fe41c671d8..6c75ed9a20 100644
+--- a/manual/stdbit.texi
++++ b/manual/stdbit.texi
+@@ -32,7 +32,13 @@ and @code{unsigned long long int}.  In addition, there is a
+ corresponding type-generic macro (not listed below), named the same as
+ the functions but without any suffix such as @samp{_uc}.  The
+ type-generic macro can only be used with an argument of an unsigned
+-integer type with a width of 8, 16, 32 or 64 bits.
++integer type with a width of 8, 16, 32 or 64 bits, or when using
++a compiler with support for
++@uref{https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html,@code{__builtin_stdc_bit_ceil}},
++etc.@:, built-in functions such as GCC 14.1 or later
++any unsigned integer type those built-in functions support.
++In GCC 14.1 that includes support for @code{unsigned __int128} and
++@code{unsigned _BitInt(@var{n})} if supported by the target.
+ 
+ @deftypefun {unsigned int} stdc_leading_zeros_uc (unsigned char @var{x})
+ @deftypefunx {unsigned int} stdc_leading_zeros_us (unsigned short @var{x})
+diff --git a/stdlib/Makefile b/stdlib/Makefile
+index d587f054d1..9898cc5d8a 100644
+--- a/stdlib/Makefile
++++ b/stdlib/Makefile
+@@ -308,6 +308,7 @@ tests := \
+   tst-setcontext10 \
+   tst-setcontext11 \
+   tst-stdbit-Wconversion \
++  tst-stdbit-builtins \
+   tst-stdc_bit_ceil \
+   tst-stdc_bit_floor \
+   tst-stdc_bit_width \
+diff --git a/stdlib/stdbit.h b/stdlib/stdbit.h
+index f334eb174d..2801590c63 100644
+--- a/stdlib/stdbit.h
++++ b/stdlib/stdbit.h
+@@ -64,9 +64,13 @@ extern unsigned int stdc_leading_zeros_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_leading_zeros_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_leading_zeros(x)				\
++#if __glibc_has_builtin (__builtin_stdc_leading_zeros)
++# define stdc_leading_zeros(x) (__builtin_stdc_leading_zeros (x))
++#else
++# define stdc_leading_zeros(x)				\
+   (stdc_leading_zeros_ull (x)				\
+    - (unsigned int) (8 * (sizeof (0ULL) - sizeof (x))))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_clzll)
+ static __always_inline unsigned int
+@@ -116,9 +120,13 @@ extern unsigned int stdc_leading_ones_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_leading_ones_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_leading_ones(x)					\
++#if __glibc_has_builtin (__builtin_stdc_leading_ones)
++# define stdc_leading_ones(x) (__builtin_stdc_leading_ones (x))
++#else
++# define stdc_leading_ones(x)					\
+   (stdc_leading_ones_ull ((unsigned long long int) (x)		\
+ 			  << 8 * (sizeof (0ULL) - sizeof (x))))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_clzll)
+ static __always_inline unsigned int
+@@ -168,11 +176,15 @@ extern unsigned int stdc_trailing_zeros_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_trailing_zeros_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_trailing_zeros(x)				\
++#if __glibc_has_builtin (__builtin_stdc_trailing_zeros)
++# define stdc_trailing_zeros(x) (__builtin_stdc_trailing_zeros (x))
++#else
++# define stdc_trailing_zeros(x)				\
+   (sizeof (x) == 8 ? stdc_trailing_zeros_ull (x)	\
+    : sizeof (x) == 4 ? stdc_trailing_zeros_ui (x)	\
+    : sizeof (x) == 2 ? stdc_trailing_zeros_us (__pacify_uint16 (x))	\
+    : stdc_trailing_zeros_uc (__pacify_uint8 (x)))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_ctzll)
+ static __always_inline unsigned int
+@@ -222,7 +234,11 @@ extern unsigned int stdc_trailing_ones_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_trailing_ones_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_trailing_ones(x) (stdc_trailing_ones_ull (x))
++#if __glibc_has_builtin (__builtin_stdc_trailing_ones)
++# define stdc_trailing_ones(x) (__builtin_stdc_trailing_ones (x))
++#else
++# define stdc_trailing_ones(x) (stdc_trailing_ones_ull (x))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_ctzll)
+ static __always_inline unsigned int
+@@ -272,11 +288,15 @@ extern unsigned int stdc_first_leading_zero_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_first_leading_zero_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_first_leading_zero(x)			\
++#if __glibc_has_builtin (__builtin_stdc_first_leading_zero)
++# define stdc_first_leading_zero(x) (__builtin_stdc_first_leading_zero (x))
++#else
++# define stdc_first_leading_zero(x)			\
+   (sizeof (x) == 8 ? stdc_first_leading_zero_ull (x)	\
+    : sizeof (x) == 4 ? stdc_first_leading_zero_ui (x)	\
+    : sizeof (x) == 2 ? stdc_first_leading_zero_us (__pacify_uint16 (x))	\
+    : stdc_first_leading_zero_uc (__pacify_uint8 (x)))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_clzll)
+ static __always_inline unsigned int
+@@ -326,11 +346,15 @@ extern unsigned int stdc_first_leading_one_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_first_leading_one_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_first_leading_one(x)			\
++#if __glibc_has_builtin (__builtin_stdc_first_leading_one)
++# define stdc_first_leading_one(x) (__builtin_stdc_first_leading_one (x))
++#else
++# define stdc_first_leading_one(x)			\
+   (sizeof (x) == 8 ? stdc_first_leading_one_ull (x)	\
+    : sizeof (x) == 4 ? stdc_first_leading_one_ui (x)	\
+    : sizeof (x) == 2 ? stdc_first_leading_one_us (__pacify_uint16 (x))	\
+    : stdc_first_leading_one_uc (__pacify_uint8 (x)))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_clzll)
+ static __always_inline unsigned int
+@@ -380,11 +404,15 @@ extern unsigned int stdc_first_trailing_zero_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_first_trailing_zero_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_first_trailing_zero(x)			\
++#if __glibc_has_builtin (__builtin_stdc_first_trailing_zero)
++# define stdc_first_trailing_zero(x) (__builtin_stdc_first_trailing_zero (x))
++#else
++# define stdc_first_trailing_zero(x)			\
+   (sizeof (x) == 8 ? stdc_first_trailing_zero_ull (x)	\
+    : sizeof (x) == 4 ? stdc_first_trailing_zero_ui (x)	\
+    : sizeof (x) == 2 ? stdc_first_trailing_zero_us (__pacify_uint16 (x)) \
+    : stdc_first_trailing_zero_uc (__pacify_uint8 (x)))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_ctzll)
+ static __always_inline unsigned int
+@@ -434,11 +462,15 @@ extern unsigned int stdc_first_trailing_one_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_first_trailing_one_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_first_trailing_one(x)			\
++#if __glibc_has_builtin (__builtin_stdc_first_trailing_one)
++# define stdc_first_trailing_one(x) (__builtin_stdc_first_trailing_one (x))
++#else
++# define stdc_first_trailing_one(x)			\
+   (sizeof (x) == 8 ? stdc_first_trailing_one_ull (x)	\
+    : sizeof (x) == 4 ? stdc_first_trailing_one_ui (x)	\
+    : sizeof (x) == 2 ? stdc_first_trailing_one_us (__pacify_uint16 (x))	\
+    : stdc_first_trailing_one_uc (__pacify_uint8 (x)))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_ctzll)
+ static __always_inline unsigned int
+@@ -488,9 +520,13 @@ extern unsigned int stdc_count_zeros_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_count_zeros_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_count_zeros(x)				\
++#if __glibc_has_builtin (__builtin_stdc_count_zeros)
++# define stdc_count_zeros(x) (__builtin_stdc_count_zeros (x))
++#else
++# define stdc_count_zeros(x)				\
+   (stdc_count_zeros_ull (x)				\
+    - (unsigned int) (8 * (sizeof (0ULL) - sizeof (x))))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_popcountll)
+ static __always_inline unsigned int
+@@ -540,7 +576,11 @@ extern unsigned int stdc_count_ones_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_count_ones_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_count_ones(x) (stdc_count_ones_ull (x))
++#if __glibc_has_builtin (__builtin_stdc_count_ones)
++# define stdc_count_ones(x) (__builtin_stdc_count_ones (x))
++#else
++# define stdc_count_ones(x) (stdc_count_ones_ull (x))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_popcountll)
+ static __always_inline unsigned int
+@@ -590,10 +630,14 @@ extern bool stdc_has_single_bit_ul (unsigned long int __x)
+ __extension__
+ extern bool stdc_has_single_bit_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_has_single_bit(x)				\
++#if __glibc_has_builtin (__builtin_stdc_has_single_bit)
++# define stdc_has_single_bit(x) (__builtin_stdc_has_single_bit (x))
++#else
++# define stdc_has_single_bit(x)				\
+   ((bool) (sizeof (x) <= sizeof (unsigned int)		\
+ 	   ? stdc_has_single_bit_ui (x)			\
+ 	   : stdc_has_single_bit_ull (x)))
++#endif
+ 
+ static __always_inline bool
+ __hsb64_inline (uint64_t __x)
+@@ -641,7 +685,11 @@ extern unsigned int stdc_bit_width_ul (unsigned long int __x)
+ __extension__
+ extern unsigned int stdc_bit_width_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_bit_width(x) (stdc_bit_width_ull (x))
++#if __glibc_has_builtin (__builtin_stdc_bit_width)
++# define stdc_bit_width(x) (__builtin_stdc_bit_width (x))
++#else
++# define stdc_bit_width(x) (stdc_bit_width_ull (x))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_clzll)
+ static __always_inline unsigned int
+@@ -691,7 +739,11 @@ extern unsigned long int stdc_bit_floor_ul (unsigned long int __x)
+ __extension__
+ extern unsigned long long int stdc_bit_floor_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_bit_floor(x) ((__typeof (x)) stdc_bit_floor_ull (x))
++#if __glibc_has_builtin (__builtin_stdc_bit_floor)
++# define stdc_bit_floor(x) (__builtin_stdc_bit_floor (x))
++#else
++# define stdc_bit_floor(x) ((__typeof (x)) stdc_bit_floor_ull (x))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_clzll)
+ static __always_inline uint64_t
+@@ -743,7 +795,11 @@ extern unsigned long int stdc_bit_ceil_ul (unsigned long int __x)
+ __extension__
+ extern unsigned long long int stdc_bit_ceil_ull (unsigned long long int __x)
+      __THROW __attribute_const__;
+-#define stdc_bit_ceil(x) ((__typeof (x)) stdc_bit_ceil_ull (x))
++#if __glibc_has_builtin (__builtin_stdc_bit_ceil)
++# define stdc_bit_ceil(x) (__builtin_stdc_bit_ceil (x))
++#else
++# define stdc_bit_ceil(x) ((__typeof (x)) stdc_bit_ceil_ull (x))
++#endif
+ 
+ #if __GNUC_PREREQ (3, 4) || __glibc_has_builtin (__builtin_clzll)
+ static __always_inline uint64_t
+diff --git a/stdlib/tst-stdbit-builtins.c b/stdlib/tst-stdbit-builtins.c
+new file mode 100644
+index 0000000000..536841ca8a
+--- /dev/null
++++ b/stdlib/tst-stdbit-builtins.c
+@@ -0,0 +1,778 @@
++/* Test <stdbit.h> type-generic macros with compiler __builtin_stdc_* support.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdbit.h>
++#include <limits.h>
++#include <support/check.h>
++
++#if __glibc_has_builtin (__builtin_stdc_leading_zeros) \
++    && __glibc_has_builtin (__builtin_stdc_leading_ones) \
++    && __glibc_has_builtin (__builtin_stdc_trailing_zeros) \
++    && __glibc_has_builtin (__builtin_stdc_trailing_ones) \
++    && __glibc_has_builtin (__builtin_stdc_first_leading_zero) \
++    && __glibc_has_builtin (__builtin_stdc_first_leading_one) \
++    && __glibc_has_builtin (__builtin_stdc_first_trailing_zero) \
++    && __glibc_has_builtin (__builtin_stdc_first_trailing_one) \
++    && __glibc_has_builtin (__builtin_stdc_count_zeros) \
++    && __glibc_has_builtin (__builtin_stdc_count_ones) \
++    && __glibc_has_builtin (__builtin_stdc_has_single_bit) \
++    && __glibc_has_builtin (__builtin_stdc_bit_width) \
++    && __glibc_has_builtin (__builtin_stdc_bit_floor) \
++    && __glibc_has_builtin (__builtin_stdc_bit_ceil)
++
++# if !defined (BITINT_MAXWIDTH) && defined (__BITINT_MAXWIDTH__)
++#  define BITINT_MAXWIDTH __BITINT_MAXWIDTH__
++# endif
++
++typedef unsigned char uc;
++typedef unsigned short us;
++typedef unsigned int ui;
++typedef unsigned long int ul;
++typedef unsigned long long int ull;
++
++# define expr_has_type(e, t) _Generic (e, default : 0, t : 1)
++
++static int
++do_test (void)
++{
++  TEST_COMPARE (stdc_leading_zeros ((uc) 0), CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_leading_zeros ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_leading_zeros ((us) 0), sizeof (short) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_leading_zeros ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_leading_zeros (0U), sizeof (int) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_leading_zeros (0U), ui), 1);
++  TEST_COMPARE (stdc_leading_zeros (0UL), sizeof (long int) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_leading_zeros (0UL), ui), 1);
++  TEST_COMPARE (stdc_leading_zeros (0ULL), sizeof (long long int) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_leading_zeros (0ULL), ui), 1);
++  TEST_COMPARE (stdc_leading_zeros ((uc) ~0U), 0);
++  TEST_COMPARE (stdc_leading_zeros ((us) ~0U), 0);
++  TEST_COMPARE (stdc_leading_zeros (~0U), 0);
++  TEST_COMPARE (stdc_leading_zeros (~0UL), 0);
++  TEST_COMPARE (stdc_leading_zeros (~0ULL), 0);
++  TEST_COMPARE (stdc_leading_zeros ((uc) 3), CHAR_BIT - 2);
++  TEST_COMPARE (stdc_leading_zeros ((us) 9), sizeof (short) * CHAR_BIT - 4);
++  TEST_COMPARE (stdc_leading_zeros (34U), sizeof (int) * CHAR_BIT - 6);
++  TEST_COMPARE (stdc_leading_zeros (130UL), sizeof (long int) * CHAR_BIT - 8);
++  TEST_COMPARE (stdc_leading_zeros (512ULL),
++		sizeof (long long int) * CHAR_BIT - 10);
++  TEST_COMPARE (stdc_leading_ones ((uc) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_leading_ones ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_leading_ones ((us) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_leading_ones ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_leading_ones (0U), 0);
++  TEST_COMPARE (expr_has_type (stdc_leading_ones (0U), ui), 1);
++  TEST_COMPARE (stdc_leading_ones (0UL), 0);
++  TEST_COMPARE (expr_has_type (stdc_leading_ones (0UL), ui), 1);
++  TEST_COMPARE (stdc_leading_ones (0ULL), 0);
++  TEST_COMPARE (expr_has_type (stdc_leading_ones (0ULL), ui), 1);
++  TEST_COMPARE (stdc_leading_ones ((uc) ~0U), CHAR_BIT);
++  TEST_COMPARE (stdc_leading_ones ((us) ~0U), sizeof (short) * CHAR_BIT);
++  TEST_COMPARE (stdc_leading_ones (~0U), sizeof (int) * CHAR_BIT);
++  TEST_COMPARE (stdc_leading_ones (~0UL), sizeof (long int) * CHAR_BIT);
++  TEST_COMPARE (stdc_leading_ones (~0ULL), sizeof (long long int) * CHAR_BIT);
++  TEST_COMPARE (stdc_leading_ones ((uc) ~3), CHAR_BIT - 2);
++  TEST_COMPARE (stdc_leading_ones ((us) ~9), sizeof (short) * CHAR_BIT - 4);
++  TEST_COMPARE (stdc_leading_ones (~34U), sizeof (int) * CHAR_BIT - 6);
++  TEST_COMPARE (stdc_leading_ones (~130UL), sizeof (long int) * CHAR_BIT - 8);
++  TEST_COMPARE (stdc_leading_ones (~512ULL),
++		sizeof (long long int) * CHAR_BIT - 10);
++  TEST_COMPARE (stdc_trailing_zeros ((uc) 0), CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_trailing_zeros ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_trailing_zeros ((us) 0), sizeof (short) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_trailing_zeros ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_trailing_zeros (0U), sizeof (int) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_trailing_zeros (0U), ui), 1);
++  TEST_COMPARE (stdc_trailing_zeros (0UL), sizeof (long int) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_trailing_zeros (0UL), ui), 1);
++  TEST_COMPARE (stdc_trailing_zeros (0ULL), sizeof (long long int) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_trailing_zeros (0ULL), ui), 1);
++  TEST_COMPARE (stdc_trailing_zeros ((uc) ~0U), 0);
++  TEST_COMPARE (stdc_trailing_zeros ((us) ~0U), 0);
++  TEST_COMPARE (stdc_trailing_zeros (~0U), 0);
++  TEST_COMPARE (stdc_trailing_zeros (~0UL), 0);
++  TEST_COMPARE (stdc_trailing_zeros (~0ULL), 0);
++  TEST_COMPARE (stdc_trailing_zeros ((uc) 2), 1);
++  TEST_COMPARE (stdc_trailing_zeros ((us) 24), 3);
++  TEST_COMPARE (stdc_trailing_zeros (32U), 5);
++  TEST_COMPARE (stdc_trailing_zeros (128UL), 7);
++  TEST_COMPARE (stdc_trailing_zeros (512ULL), 9);
++  TEST_COMPARE (stdc_trailing_ones ((uc) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_trailing_ones ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_trailing_ones ((us) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_trailing_ones ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_trailing_ones (0U), 0);
++  TEST_COMPARE (expr_has_type (stdc_trailing_ones (0U), ui), 1);
++  TEST_COMPARE (stdc_trailing_ones (0UL), 0);
++  TEST_COMPARE (expr_has_type (stdc_trailing_ones (0UL), ui), 1);
++  TEST_COMPARE (stdc_trailing_ones (0ULL), 0);
++  TEST_COMPARE (expr_has_type (stdc_trailing_ones (0ULL), ui), 1);
++  TEST_COMPARE (stdc_trailing_ones ((uc) ~0U), CHAR_BIT);
++  TEST_COMPARE (stdc_trailing_ones ((us) ~0U), sizeof (short) * CHAR_BIT);
++  TEST_COMPARE (stdc_trailing_ones (~0U), sizeof (int) * CHAR_BIT);
++  TEST_COMPARE (stdc_trailing_ones (~0UL), sizeof (long int) * CHAR_BIT);
++  TEST_COMPARE (stdc_trailing_ones (~0ULL), sizeof (long long int) * CHAR_BIT);
++  TEST_COMPARE (stdc_trailing_ones ((uc) 5), 1);
++  TEST_COMPARE (stdc_trailing_ones ((us) 15), 4);
++  TEST_COMPARE (stdc_trailing_ones (127U), 7);
++  TEST_COMPARE (stdc_trailing_ones (511UL), 9);
++  TEST_COMPARE (stdc_trailing_ones (~0ULL >> 2),
++		sizeof (long long int) * CHAR_BIT - 2);
++  TEST_COMPARE (stdc_first_leading_zero ((uc) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_zero ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_first_leading_zero ((us) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_zero ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_first_leading_zero (0U), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_zero (0U), ui), 1);
++  TEST_COMPARE (stdc_first_leading_zero (0UL), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_zero (0UL), ui), 1);
++  TEST_COMPARE (stdc_first_leading_zero (0ULL), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_zero (0ULL), ui), 1);
++  TEST_COMPARE (stdc_first_leading_zero ((uc) ~0U), 0);
++  TEST_COMPARE (stdc_first_leading_zero ((us) ~0U), 0);
++  TEST_COMPARE (stdc_first_leading_zero (~0U), 0);
++  TEST_COMPARE (stdc_first_leading_zero (~0UL), 0);
++  TEST_COMPARE (stdc_first_leading_zero (~0ULL), 0);
++  TEST_COMPARE (stdc_first_leading_zero ((uc) ~3U), CHAR_BIT - 1);
++  TEST_COMPARE (stdc_first_leading_zero ((us) ~15U),
++		sizeof (short) * CHAR_BIT - 3);
++  TEST_COMPARE (stdc_first_leading_zero (~63U), sizeof (int) * CHAR_BIT - 5);
++  TEST_COMPARE (stdc_first_leading_zero (~255UL),
++		sizeof (long int) * CHAR_BIT - 7);
++  TEST_COMPARE (stdc_first_leading_zero (~1023ULL),
++		sizeof (long long int) * CHAR_BIT - 9);
++  TEST_COMPARE (stdc_first_leading_one ((uc) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_one ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_first_leading_one ((us) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_one ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_first_leading_one (0U), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_one (0U), ui), 1);
++  TEST_COMPARE (stdc_first_leading_one (0UL), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_one (0UL), ui), 1);
++  TEST_COMPARE (stdc_first_leading_one (0ULL), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_one (0ULL), ui), 1);
++  TEST_COMPARE (stdc_first_leading_one ((uc) ~0U), 1);
++  TEST_COMPARE (stdc_first_leading_one ((us) ~0U), 1);
++  TEST_COMPARE (stdc_first_leading_one (~0U), 1);
++  TEST_COMPARE (stdc_first_leading_one (~0UL), 1);
++  TEST_COMPARE (stdc_first_leading_one (~0ULL), 1);
++  TEST_COMPARE (stdc_first_leading_one ((uc) 3), CHAR_BIT - 1);
++  TEST_COMPARE (stdc_first_leading_one ((us) 9),
++		sizeof (short) * CHAR_BIT - 3);
++  TEST_COMPARE (stdc_first_leading_one (34U), sizeof (int) * CHAR_BIT - 5);
++  TEST_COMPARE (stdc_first_leading_one (130UL),
++		sizeof (long int) * CHAR_BIT - 7);
++  TEST_COMPARE (stdc_first_leading_one (512ULL),
++		sizeof (long long int) * CHAR_BIT - 9);
++  TEST_COMPARE (stdc_first_trailing_zero ((uc) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_zero ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_zero ((us) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_zero ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_zero (0U), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_zero (0U), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_zero (0UL), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_zero (0UL), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_zero (0ULL), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_zero (0ULL), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_zero ((uc) ~0U), 0);
++  TEST_COMPARE (stdc_first_trailing_zero ((us) ~0U), 0);
++  TEST_COMPARE (stdc_first_trailing_zero (~0U), 0);
++  TEST_COMPARE (stdc_first_trailing_zero (~0UL), 0);
++  TEST_COMPARE (stdc_first_trailing_zero (~0ULL), 0);
++  TEST_COMPARE (stdc_first_trailing_zero ((uc) 2), 1);
++  TEST_COMPARE (stdc_first_trailing_zero ((us) 15), 5);
++  TEST_COMPARE (stdc_first_trailing_zero (63U), 7);
++  TEST_COMPARE (stdc_first_trailing_zero (128UL), 1);
++  TEST_COMPARE (stdc_first_trailing_zero (511ULL), 10);
++  TEST_COMPARE (stdc_first_trailing_one ((uc) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_one ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_one ((us) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_one ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_one (0U), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_one (0U), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_one (0UL), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_one (0UL), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_one (0ULL), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_one (0ULL), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_one ((uc) ~0U), 1);
++  TEST_COMPARE (stdc_first_trailing_one ((us) ~0U), 1);
++  TEST_COMPARE (stdc_first_trailing_one (~0U), 1);
++  TEST_COMPARE (stdc_first_trailing_one (~0UL), 1);
++  TEST_COMPARE (stdc_first_trailing_one (~0ULL), 1);
++  TEST_COMPARE (stdc_first_trailing_one ((uc) 4), 3);
++  TEST_COMPARE (stdc_first_trailing_one ((us) 96), 6);
++  TEST_COMPARE (stdc_first_trailing_one (127U), 1);
++  TEST_COMPARE (stdc_first_trailing_one (511UL), 1);
++  TEST_COMPARE (stdc_first_trailing_one (~0ULL << 12), 13);
++  TEST_COMPARE (stdc_count_zeros ((uc) 0), CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_count_zeros ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_count_zeros ((us) 0), sizeof (short) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_count_zeros ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_count_zeros (0U), sizeof (int) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_count_zeros (0U), ui), 1);
++  TEST_COMPARE (stdc_count_zeros (0UL), sizeof (long int) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_count_zeros (0UL), ui), 1);
++  TEST_COMPARE (stdc_count_zeros (0ULL), sizeof (long long int) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_count_zeros (0ULL), ui), 1);
++  TEST_COMPARE (stdc_count_zeros ((uc) ~0U), 0);
++  TEST_COMPARE (stdc_count_zeros ((us) ~0U), 0);
++  TEST_COMPARE (stdc_count_zeros (~0U), 0);
++  TEST_COMPARE (stdc_count_zeros (~0UL), 0);
++  TEST_COMPARE (stdc_count_zeros (~0ULL), 0);
++  TEST_COMPARE (stdc_count_zeros ((uc) 1U), CHAR_BIT - 1);
++  TEST_COMPARE (stdc_count_zeros ((us) 42), sizeof (short) * CHAR_BIT - 3);
++  TEST_COMPARE (stdc_count_zeros (291U), sizeof (int) * CHAR_BIT - 4);
++  TEST_COMPARE (stdc_count_zeros (~1315UL), 5);
++  TEST_COMPARE (stdc_count_zeros (3363ULL),
++		sizeof (long long int) * CHAR_BIT - 6);
++  TEST_COMPARE (stdc_count_ones ((uc) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_count_ones ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_count_ones ((us) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_count_ones ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_count_ones (0U), 0);
++  TEST_COMPARE (expr_has_type (stdc_count_ones (0U), ui), 1);
++  TEST_COMPARE (stdc_count_ones (0UL), 0);
++  TEST_COMPARE (expr_has_type (stdc_count_ones (0UL), ui), 1);
++  TEST_COMPARE (stdc_count_ones (0ULL), 0);
++  TEST_COMPARE (expr_has_type (stdc_count_ones (0ULL), ui), 1);
++  TEST_COMPARE (stdc_count_ones ((uc) ~0U), CHAR_BIT);
++  TEST_COMPARE (stdc_count_ones ((us) ~0U), sizeof (short) * CHAR_BIT);
++  TEST_COMPARE (stdc_count_ones (~0U), sizeof (int) * CHAR_BIT);
++  TEST_COMPARE (stdc_count_ones (~0UL), sizeof (long int) * CHAR_BIT);
++  TEST_COMPARE (stdc_count_ones (~0ULL), sizeof (long long int) * CHAR_BIT);
++  TEST_COMPARE (stdc_count_ones ((uc) ~1U), CHAR_BIT - 1);
++  TEST_COMPARE (stdc_count_ones ((us) ~42), sizeof (short) * CHAR_BIT - 3);
++  TEST_COMPARE (stdc_count_ones (~291U), sizeof (int) * CHAR_BIT - 4);
++  TEST_COMPARE (stdc_count_ones (1315UL), 5);
++  TEST_COMPARE (stdc_count_ones (~3363ULL),
++		sizeof (long long int) * CHAR_BIT - 6);
++  TEST_COMPARE (stdc_has_single_bit ((uc) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_has_single_bit ((uc) 0), _Bool), 1);
++  TEST_COMPARE (stdc_has_single_bit ((us) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_has_single_bit ((us) 0), _Bool), 1);
++  TEST_COMPARE (stdc_has_single_bit (0U), 0);
++  TEST_COMPARE (expr_has_type (stdc_has_single_bit (0U), _Bool), 1);
++  TEST_COMPARE (stdc_has_single_bit (0UL), 0);
++  TEST_COMPARE (expr_has_type (stdc_has_single_bit (0UL), _Bool), 1);
++  TEST_COMPARE (stdc_has_single_bit (0ULL), 0);
++  TEST_COMPARE (expr_has_type (stdc_has_single_bit (0ULL), _Bool), 1);
++  TEST_COMPARE (stdc_has_single_bit ((uc) 2), 1);
++  TEST_COMPARE (stdc_has_single_bit ((us) 8), 1);
++  TEST_COMPARE (stdc_has_single_bit (32U), 1);
++  TEST_COMPARE (stdc_has_single_bit (128UL), 1);
++  TEST_COMPARE (stdc_has_single_bit (512ULL), 1);
++  TEST_COMPARE (stdc_has_single_bit ((uc) 7), 0);
++  TEST_COMPARE (stdc_has_single_bit ((us) 96), 0);
++  TEST_COMPARE (stdc_has_single_bit (513U), 0);
++  TEST_COMPARE (stdc_has_single_bit (1022UL), 0);
++  TEST_COMPARE (stdc_has_single_bit (12ULL), 0);
++  TEST_COMPARE (stdc_bit_width ((uc) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_width ((uc) 0), ui), 1);
++  TEST_COMPARE (stdc_bit_width ((us) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_width ((us) 0), ui), 1);
++  TEST_COMPARE (stdc_bit_width (0U), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_width (0U), ui), 1);
++  TEST_COMPARE (stdc_bit_width (0UL), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_width (0UL), ui), 1);
++  TEST_COMPARE (stdc_bit_width (0ULL), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_width (0ULL), ui), 1);
++  TEST_COMPARE (stdc_bit_width ((uc) ~0U), CHAR_BIT);
++  TEST_COMPARE (stdc_bit_width ((us) ~0U), sizeof (short) * CHAR_BIT);
++  TEST_COMPARE (stdc_bit_width (~0U), sizeof (int) * CHAR_BIT);
++  TEST_COMPARE (stdc_bit_width (~0UL), sizeof (long int) * CHAR_BIT);
++  TEST_COMPARE (stdc_bit_width (~0ULL), sizeof (long long int) * CHAR_BIT);
++  TEST_COMPARE (stdc_bit_width ((uc) ((uc) ~0U >> 1)), CHAR_BIT - 1);
++  TEST_COMPARE (stdc_bit_width ((uc) 6), 3);
++  TEST_COMPARE (stdc_bit_width ((us) 12U), 4);
++  TEST_COMPARE (stdc_bit_width ((us) ((us) ~0U >> 5)),
++		sizeof (short) * CHAR_BIT - 5);
++  TEST_COMPARE (stdc_bit_width (137U), 8);
++  TEST_COMPARE (stdc_bit_width (269U), 9);
++  TEST_COMPARE (stdc_bit_width (39UL), 6);
++  TEST_COMPARE (stdc_bit_width (~0UL >> 2), sizeof (long int) * CHAR_BIT - 2);
++  TEST_COMPARE (stdc_bit_width (1023ULL), 10);
++  TEST_COMPARE (stdc_bit_width (1024ULL), 11);
++  TEST_COMPARE (stdc_bit_floor ((uc) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_floor ((uc) 0), uc), 1);
++  TEST_COMPARE (stdc_bit_floor ((us) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_floor ((us) 0), us), 1);
++  TEST_COMPARE (stdc_bit_floor (0U), 0U);
++  TEST_COMPARE (expr_has_type (stdc_bit_floor (0U), ui), 1);
++  TEST_COMPARE (stdc_bit_floor (0UL), 0UL);
++  TEST_COMPARE (expr_has_type (stdc_bit_floor (0UL), ul), 1);
++  TEST_COMPARE (stdc_bit_floor (0ULL), 0ULL);
++  TEST_COMPARE (expr_has_type (stdc_bit_floor (0ULL), ull), 1);
++  TEST_COMPARE (stdc_bit_floor ((uc) ~0U), (1U << (CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_floor ((us) ~0U),
++		(1U << (sizeof (short) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_floor (~0U), (1U << (sizeof (int) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_floor (~0UL),
++		(1UL << (sizeof (long int) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_floor (~0ULL),
++		(1ULL << (sizeof (long long int) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_floor ((uc) 4), 4);
++  TEST_COMPARE (stdc_bit_floor ((uc) 7), 4);
++  TEST_COMPARE (stdc_bit_floor ((us) 8U), 8);
++  TEST_COMPARE (stdc_bit_floor ((us) 31U), 16);
++  TEST_COMPARE (stdc_bit_floor (137U), 128U);
++  TEST_COMPARE (stdc_bit_floor (269U), 256U);
++  TEST_COMPARE (stdc_bit_floor (511UL), 256UL);
++  TEST_COMPARE (stdc_bit_floor (512UL), 512UL);
++  TEST_COMPARE (stdc_bit_floor (513UL), 512ULL);
++  TEST_COMPARE (stdc_bit_floor (1024ULL), 1024ULL);
++  TEST_COMPARE (stdc_bit_ceil ((uc) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_bit_ceil ((uc) 0), uc), 1);
++  TEST_COMPARE (stdc_bit_ceil ((us) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_bit_ceil ((us) 0), us), 1);
++  TEST_COMPARE (stdc_bit_ceil (0U), 1U);
++  TEST_COMPARE (expr_has_type (stdc_bit_ceil (0U), ui), 1);
++  TEST_COMPARE (stdc_bit_ceil (0UL), 1UL);
++  TEST_COMPARE (expr_has_type (stdc_bit_ceil (0UL), ul), 1);
++  TEST_COMPARE (stdc_bit_ceil (0ULL), 1ULL);
++  TEST_COMPARE (expr_has_type (stdc_bit_ceil (0ULL), ull), 1);
++  TEST_COMPARE (stdc_bit_ceil ((uc) ~0U), 0);
++  TEST_COMPARE (stdc_bit_ceil ((us) ~0U), 0);
++  TEST_COMPARE (stdc_bit_ceil (~0U), 0U);
++  TEST_COMPARE (stdc_bit_ceil (~0UL), 0UL);
++  TEST_COMPARE (stdc_bit_ceil (~0ULL), 0ULL);
++  TEST_COMPARE (stdc_bit_ceil ((uc) ((uc) ~0U >> 1)), (1U << (CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_ceil ((uc) ((uc) ~0U >> 1)), (1U << (CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_ceil ((us) ((us) ~0U >> 1)),
++		(1U << (sizeof (short) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_ceil ((us) ((us) ~0U >> 1)),
++		(1U << (sizeof (short) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_ceil (~0U >> 1),
++		(1U << (sizeof (int) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_ceil (1U << (sizeof (int) * CHAR_BIT - 1)),
++		(1U << (sizeof (int) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_ceil (~0UL >> 1),
++		(1UL << (sizeof (long int) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_ceil (~0UL >> 1),
++		(1UL << (sizeof (long int) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_ceil (1ULL
++			       << (sizeof (long long int) * CHAR_BIT - 1)),
++		(1ULL << (sizeof (long long int) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_ceil (~0ULL >> 1),
++		(1ULL << (sizeof (long long int) * CHAR_BIT - 1)));
++  TEST_COMPARE (stdc_bit_ceil ((uc) 1), 1);
++  TEST_COMPARE (stdc_bit_ceil ((uc) 2), 2);
++  TEST_COMPARE (stdc_bit_ceil ((us) 3U), 4);
++  TEST_COMPARE (stdc_bit_ceil ((us) 4U), 4);
++  TEST_COMPARE (stdc_bit_ceil (5U), 8U);
++  TEST_COMPARE (stdc_bit_ceil (269U), 512U);
++  TEST_COMPARE (stdc_bit_ceil (511UL), 512UL);
++  TEST_COMPARE (stdc_bit_ceil (512UL), 512UL);
++  TEST_COMPARE (stdc_bit_ceil (513ULL), 1024ULL);
++  TEST_COMPARE (stdc_bit_ceil (1025ULL), 2048ULL);
++# ifdef __SIZEOF_INT128__
++  TEST_COMPARE (stdc_leading_zeros ((unsigned __int128) 0),
++		sizeof (__int128) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_leading_zeros ((unsigned __int128) 0), ui),
++		1);
++  TEST_COMPARE (stdc_leading_zeros (~(unsigned __int128) 0), 0);
++  TEST_COMPARE (stdc_leading_ones ((unsigned __int128) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_leading_ones ((unsigned __int128) 0), ui),
++		1);
++  TEST_COMPARE (stdc_leading_ones (~(unsigned __int128) 0),
++		sizeof (__int128) * CHAR_BIT);
++  TEST_COMPARE (stdc_trailing_zeros ((unsigned __int128) 0),
++		sizeof (__int128) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_trailing_zeros ((unsigned __int128) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_trailing_zeros (~(unsigned __int128) 0), 0);
++  TEST_COMPARE (stdc_trailing_ones ((unsigned __int128) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_trailing_ones ((unsigned __int128) 0), ui),
++		1);
++  TEST_COMPARE (stdc_trailing_ones (~(unsigned __int128) 0),
++		sizeof (__int128) * CHAR_BIT);
++  TEST_COMPARE (stdc_first_leading_zero ((unsigned __int128) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_zero ((unsigned __int128) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_first_leading_zero (~(unsigned __int128) 0), 0);
++  TEST_COMPARE (stdc_first_leading_one ((unsigned __int128) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_one ((unsigned __int128) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_first_leading_one (~(unsigned __int128) 0), 1);
++  TEST_COMPARE (stdc_first_trailing_zero ((unsigned __int128) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_zero ((unsigned __int128)
++							 0), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_zero (~(unsigned __int128) 0), 0);
++  TEST_COMPARE (stdc_first_trailing_one ((unsigned __int128) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_one ((unsigned __int128) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_first_trailing_one (~(unsigned __int128) 0), 1);
++  TEST_COMPARE (stdc_count_zeros ((unsigned __int128) 0),
++		sizeof (__int128) * CHAR_BIT);
++  TEST_COMPARE (expr_has_type (stdc_count_zeros ((unsigned __int128) 0), ui),
++		1);
++  TEST_COMPARE (stdc_count_zeros (~(unsigned __int128) 0), 0);
++  TEST_COMPARE (stdc_count_ones ((unsigned __int128) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_count_ones ((unsigned __int128) 0), ui),
++		1);
++  TEST_COMPARE (stdc_count_ones (~(unsigned __int128) 0),
++		sizeof (__int128) * CHAR_BIT);
++  TEST_COMPARE (stdc_has_single_bit ((unsigned __int128) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_has_single_bit ((unsigned __int128) 0),
++		_Bool), 1);
++  TEST_COMPARE (stdc_has_single_bit (~(unsigned __int128) 0), 0);
++  TEST_COMPARE (stdc_bit_width ((unsigned __int128) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_width ((unsigned __int128) 0), ui), 1);
++  TEST_COMPARE (stdc_bit_width (~(unsigned __int128) 0),
++		sizeof (__int128) * CHAR_BIT);
++  TEST_COMPARE (stdc_bit_floor ((unsigned __int128) 0) != 0, 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_floor ((unsigned __int128) 0),
++			       unsigned __int128), 1);
++  TEST_COMPARE (stdc_bit_floor (~(unsigned __int128) 0)
++		!= ((unsigned __int128) 1) << (sizeof (__int128)
++					       * CHAR_BIT - 1), 0);
++  TEST_COMPARE (stdc_bit_ceil ((unsigned __int128) 0) != 1, 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_ceil ((unsigned __int128) 0),
++			       unsigned __int128), 1);
++  TEST_COMPARE (stdc_bit_ceil ((unsigned __int128) 1) != 1, 0);
++  TEST_COMPARE (stdc_bit_ceil ((~(unsigned __int128) 0) >> 1)
++		!= ((unsigned __int128) 1) << (sizeof (__int128)
++					       * CHAR_BIT - 1), 0);
++  TEST_COMPARE (stdc_bit_ceil (~(unsigned __int128) 0) != 0, 0);
++# endif
++  uc a = 0;
++  TEST_COMPARE (stdc_bit_width (a++), 0);
++  TEST_COMPARE (a, 1);
++  ull b = 0;
++  TEST_COMPARE (stdc_bit_width (b++), 0);
++  TEST_COMPARE (b, 1);
++  TEST_COMPARE (stdc_bit_floor (a++), 1);
++  TEST_COMPARE (a, 2);
++  TEST_COMPARE (stdc_bit_floor (b++), 1);
++  TEST_COMPARE (b, 2);
++  TEST_COMPARE (stdc_bit_ceil (a++), 2);
++  TEST_COMPARE (a, 3);
++  TEST_COMPARE (stdc_bit_ceil (b++), 2);
++  TEST_COMPARE (b, 3);
++  TEST_COMPARE (stdc_leading_zeros (a++), CHAR_BIT - 2);
++  TEST_COMPARE (a, 4);
++  TEST_COMPARE (stdc_leading_zeros (b++),
++		sizeof (long long int) * CHAR_BIT - 2);
++  TEST_COMPARE (b, 4);
++  TEST_COMPARE (stdc_leading_ones (a++), 0);
++  TEST_COMPARE (a, 5);
++  TEST_COMPARE (stdc_leading_ones (b++), 0);
++  TEST_COMPARE (b, 5);
++  TEST_COMPARE (stdc_trailing_zeros (a++), 0);
++  TEST_COMPARE (a, 6);
++  TEST_COMPARE (stdc_trailing_zeros (b++), 0);
++  TEST_COMPARE (b, 6);
++  TEST_COMPARE (stdc_trailing_ones (a++), 0);
++  TEST_COMPARE (a, 7);
++  TEST_COMPARE (stdc_trailing_ones (b++), 0);
++  TEST_COMPARE (b, 7);
++  TEST_COMPARE (stdc_first_leading_zero (a++), 1);
++  TEST_COMPARE (a, 8);
++  TEST_COMPARE (stdc_first_leading_zero (b++), 1);
++  TEST_COMPARE (b, 8);
++  TEST_COMPARE (stdc_first_leading_one (a++), CHAR_BIT - 3);
++  TEST_COMPARE (a, 9);
++  TEST_COMPARE (stdc_first_leading_one (b++),
++		sizeof (long long int) * CHAR_BIT - 3);
++  TEST_COMPARE (b, 9);
++  TEST_COMPARE (stdc_first_trailing_zero (a++), 2);
++  TEST_COMPARE (a, 10);
++  TEST_COMPARE (stdc_first_trailing_zero (b++), 2);
++  TEST_COMPARE (b, 10);
++  TEST_COMPARE (stdc_first_trailing_one (a++), 2);
++  TEST_COMPARE (a, 11);
++  TEST_COMPARE (stdc_first_trailing_one (b++), 2);
++  TEST_COMPARE (b, 11);
++  TEST_COMPARE (stdc_count_zeros (a++), CHAR_BIT - 3);
++  TEST_COMPARE (a, 12);
++  TEST_COMPARE (stdc_count_zeros (b++),
++		sizeof (long long int) * CHAR_BIT - 3);
++  TEST_COMPARE (b, 12);
++  TEST_COMPARE (stdc_count_ones (a++), 2);
++  TEST_COMPARE (a, 13);
++  TEST_COMPARE (stdc_count_ones (b++), 2);
++  TEST_COMPARE (b, 13);
++  TEST_COMPARE (stdc_has_single_bit (a++), 0);
++  TEST_COMPARE (a, 14);
++  TEST_COMPARE (stdc_has_single_bit (b++), 0);
++  TEST_COMPARE (b, 14);
++# ifdef BITINT_MAXWIDTH
++#  if BITINT_MAXWIDTH >= 64
++  TEST_COMPARE (stdc_leading_zeros (0uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_leading_zeros (0uwb), ui), 1);
++  TEST_COMPARE (stdc_leading_zeros (1uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_leading_zeros (1uwb), ui), 1);
++  TEST_COMPARE (stdc_leading_ones (0uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_leading_ones (0uwb), ui), 1);
++  TEST_COMPARE (stdc_leading_ones (1uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_leading_ones (1uwb), ui), 1);
++  TEST_COMPARE (stdc_trailing_zeros (0uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_trailing_zeros (0uwb), ui), 1);
++  TEST_COMPARE (stdc_trailing_zeros (1uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_trailing_zeros (1uwb), ui), 1);
++  TEST_COMPARE (stdc_trailing_ones (0uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_trailing_ones (0uwb), ui), 1);
++  TEST_COMPARE (stdc_trailing_ones (1uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_trailing_ones (1uwb), ui), 1);
++  TEST_COMPARE (stdc_first_leading_zero (0uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_zero (0uwb), ui), 1);
++  TEST_COMPARE (stdc_first_leading_zero (1uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_zero (1uwb), ui), 1);
++  TEST_COMPARE (stdc_first_leading_one (0uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_one (0uwb), ui), 1);
++  TEST_COMPARE (stdc_first_leading_one (1uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_one (1uwb), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_zero (0uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_zero (0uwb), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_zero (1uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_zero (1uwb), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_one (0uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_one (0uwb), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_one (1uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_one (1uwb), ui), 1);
++  TEST_COMPARE (stdc_count_zeros (0uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_count_zeros (0uwb), ui), 1);
++  TEST_COMPARE (stdc_count_zeros (1uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_count_zeros (1uwb), ui), 1);
++  TEST_COMPARE (stdc_count_ones (0uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_count_ones (0uwb), ui), 1);
++  TEST_COMPARE (stdc_count_ones (1uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_count_ones (1uwb), ui), 1);
++  TEST_COMPARE (stdc_has_single_bit (0uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_has_single_bit (0uwb), _Bool), 1);
++  TEST_COMPARE (stdc_has_single_bit (1uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_has_single_bit (1uwb), _Bool), 1);
++  TEST_COMPARE (stdc_bit_width (0uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_width (0uwb), ui), 1);
++  TEST_COMPARE (stdc_bit_width (1uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_bit_width (1uwb), ui), 1);
++  TEST_COMPARE (stdc_bit_floor (0uwb), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_floor (0uwb), unsigned _BitInt(1)), 1);
++  TEST_COMPARE (stdc_bit_floor (1uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_bit_floor (1uwb), unsigned _BitInt(1)), 1);
++  TEST_COMPARE (stdc_bit_ceil (0uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_bit_ceil (0uwb), unsigned _BitInt(1)), 1);
++  TEST_COMPARE (stdc_bit_ceil (1uwb), 1);
++  TEST_COMPARE (expr_has_type (stdc_bit_ceil (1uwb), unsigned _BitInt(1)), 1);
++  unsigned _BitInt(1) c = 0;
++  TEST_COMPARE (stdc_bit_floor (c++), 0);
++  TEST_COMPARE (c, 1);
++  TEST_COMPARE (stdc_bit_floor (c++), 1);
++  TEST_COMPARE (c, 0);
++  TEST_COMPARE (stdc_bit_ceil (c++), 1);
++  TEST_COMPARE (c, 1);
++  TEST_COMPARE (stdc_bit_ceil (c++), 1);
++  TEST_COMPARE (c, 0);
++#  endif
++#  if BITINT_MAXWIDTH >= 512
++  TEST_COMPARE (stdc_leading_zeros ((unsigned _BitInt(512)) 0), 512);
++  TEST_COMPARE (expr_has_type (stdc_leading_zeros ((unsigned _BitInt(512)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_leading_zeros ((unsigned _BitInt(373)) 0), 373);
++  TEST_COMPARE (expr_has_type (stdc_leading_zeros ((unsigned _BitInt(373)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_leading_zeros (~(unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (stdc_leading_zeros (~(unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (stdc_leading_zeros ((unsigned _BitInt(512)) 275), 512 - 9);
++  TEST_COMPARE (stdc_leading_zeros ((unsigned _BitInt(373)) 512), 373 - 10);
++  TEST_COMPARE (stdc_leading_ones ((unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_leading_ones ((unsigned _BitInt(512)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_leading_ones ((unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_leading_ones ((unsigned _BitInt(373)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_leading_ones (~(unsigned _BitInt(512)) 0), 512);
++  TEST_COMPARE (stdc_leading_ones (~(unsigned _BitInt(373)) 0), 373);
++  TEST_COMPARE (stdc_leading_ones (~(unsigned _BitInt(512)) 275), 512 - 9);
++  TEST_COMPARE (stdc_leading_ones (~(unsigned _BitInt(373)) 512), 373 - 10);
++  TEST_COMPARE (stdc_trailing_zeros ((unsigned _BitInt(512)) 0), 512);
++  TEST_COMPARE (expr_has_type (stdc_trailing_zeros ((unsigned _BitInt(512)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_trailing_zeros ((unsigned _BitInt(373)) 0), 373);
++  TEST_COMPARE (expr_has_type (stdc_trailing_zeros ((unsigned _BitInt(373)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_trailing_zeros (~(unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (stdc_trailing_zeros (~(unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (stdc_trailing_zeros ((unsigned _BitInt(512)) 256), 8);
++  TEST_COMPARE (stdc_trailing_zeros ((unsigned _BitInt(373)) 512), 9);
++  TEST_COMPARE (stdc_trailing_ones ((unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_trailing_ones ((unsigned _BitInt(512)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_trailing_ones ((unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_trailing_ones ((unsigned _BitInt(373)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_trailing_ones (~(unsigned _BitInt(512)) 0), 512);
++  TEST_COMPARE (stdc_trailing_ones (~(unsigned _BitInt(373)) 0), 373);
++  TEST_COMPARE (stdc_trailing_ones ((unsigned _BitInt(512)) 255), 8);
++  TEST_COMPARE (stdc_trailing_ones ((~(unsigned _BitInt(373)) 0) >> 2),
++		373 - 2);
++  TEST_COMPARE (stdc_first_leading_zero ((unsigned _BitInt(512)) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_zero ((unsigned _BitInt(512))
++							0), ui), 1);
++  TEST_COMPARE (stdc_first_leading_zero ((unsigned _BitInt(373)) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_zero ((unsigned _BitInt(373))
++							0), ui), 1);
++  TEST_COMPARE (stdc_first_leading_zero (~(unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (stdc_first_leading_zero (~(unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (stdc_first_leading_zero (~(unsigned _BitInt(512)) 511),
++		512 - 8);
++  TEST_COMPARE (stdc_first_leading_zero (~(unsigned _BitInt(373)) 1023),
++		373 - 9);
++  TEST_COMPARE (stdc_first_leading_one ((unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_one ((unsigned _BitInt(512))
++						       0), ui), 1);
++  TEST_COMPARE (stdc_first_leading_one ((unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_leading_one ((unsigned _BitInt(373))
++						       0), ui), 1);
++  TEST_COMPARE (stdc_first_leading_one (~(unsigned _BitInt(512)) 0), 1);
++  TEST_COMPARE (stdc_first_leading_one (~(unsigned _BitInt(373)) 0), 1);
++  TEST_COMPARE (stdc_first_leading_one ((unsigned _BitInt(512)) 275), 512 - 8);
++  TEST_COMPARE (stdc_first_leading_one ((unsigned _BitInt(373)) 512), 373 - 9);
++  TEST_COMPARE (stdc_first_trailing_zero ((unsigned _BitInt(512)) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_zero ((unsigned
++							  _BitInt(512)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_first_trailing_zero ((unsigned _BitInt(373)) 0), 1);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_zero ((unsigned
++							  _BitInt(373)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_first_trailing_zero (~(unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (stdc_first_trailing_zero (~(unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (stdc_first_trailing_zero ((unsigned _BitInt(512)) 255), 9);
++  TEST_COMPARE (stdc_first_trailing_zero ((unsigned _BitInt(373)) 511), 10);
++  TEST_COMPARE (stdc_first_trailing_one ((unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_one ((unsigned _BitInt(512))
++							0), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_one ((unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_first_trailing_one ((unsigned _BitInt(373))
++							0), ui), 1);
++  TEST_COMPARE (stdc_first_trailing_one (~(unsigned _BitInt(512)) 0), 1);
++  TEST_COMPARE (stdc_first_trailing_one (~(unsigned _BitInt(373)) 0), 1);
++  TEST_COMPARE (stdc_first_trailing_one (((unsigned _BitInt(512)) 255) << 175),
++		176);
++  TEST_COMPARE (stdc_first_trailing_one ((~(unsigned _BitInt(373)) 0) << 311),
++		312);
++  TEST_COMPARE (stdc_count_zeros ((unsigned _BitInt(512)) 0), 512);
++  TEST_COMPARE (expr_has_type (stdc_count_zeros ((unsigned _BitInt(512)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_count_zeros ((unsigned _BitInt(373)) 0), 373);
++  TEST_COMPARE (expr_has_type (stdc_count_zeros ((unsigned _BitInt(373)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_count_zeros (~(unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (stdc_count_zeros (~(unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (stdc_count_zeros ((unsigned _BitInt(512)) 1315), 512 - 5);
++  TEST_COMPARE (stdc_count_zeros ((unsigned _BitInt(373)) 3363), 373 - 6);
++  TEST_COMPARE (stdc_count_ones ((unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_count_ones ((unsigned _BitInt(512)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_count_ones ((unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_count_ones ((unsigned _BitInt(373)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_count_ones (~(unsigned _BitInt(512)) 0), 512);
++  TEST_COMPARE (stdc_count_ones (~(unsigned _BitInt(373)) 0), 373);
++  TEST_COMPARE (stdc_count_ones (~(unsigned _BitInt(512)) 1315), 512 - 5);
++  TEST_COMPARE (stdc_count_ones (~(unsigned _BitInt(373)) 3363), 373 - 6);
++  TEST_COMPARE (stdc_has_single_bit ((unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_has_single_bit ((unsigned _BitInt(512)) 0),
++			       _Bool), 1);
++  TEST_COMPARE (stdc_has_single_bit ((unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_has_single_bit ((unsigned _BitInt(373)) 0),
++			       _Bool), 1);
++  TEST_COMPARE (stdc_has_single_bit (~(unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (stdc_has_single_bit (~(unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (stdc_has_single_bit (((unsigned _BitInt(512)) 1022) << 279),
++		0);
++  TEST_COMPARE (stdc_has_single_bit (((unsigned _BitInt(373)) 12) << 305), 0);
++  TEST_COMPARE (stdc_bit_width ((unsigned _BitInt(512)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_width ((unsigned _BitInt(512)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_bit_width ((unsigned _BitInt(373)) 0), 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_width ((unsigned _BitInt(373)) 0),
++			       ui), 1);
++  TEST_COMPARE (stdc_bit_width (~(unsigned _BitInt(512)) 0), 512);
++  TEST_COMPARE (stdc_bit_width (~(unsigned _BitInt(373)) 0), 373);
++  TEST_COMPARE (stdc_bit_width (((unsigned _BitInt(512)) 1023) << 405),
++		405 + 10);
++  TEST_COMPARE (stdc_bit_width (((unsigned _BitInt(373)) 1024) << 242),
++		242 + 11);
++  TEST_COMPARE (stdc_bit_floor ((unsigned _BitInt(512)) 0) != 0, 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_floor ((unsigned _BitInt(512)) 0),
++			       unsigned _BitInt(512)), 1);
++  TEST_COMPARE (stdc_bit_floor ((unsigned _BitInt(373)) 0) != 0, 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_floor ((unsigned _BitInt(373)) 0),
++			       unsigned _BitInt(373)), 1);
++  TEST_COMPARE (stdc_bit_floor (~(unsigned _BitInt(512)) 0)
++		!= ((unsigned _BitInt(512)) 1) << (512 - 1), 0);
++  TEST_COMPARE (stdc_bit_floor (~(unsigned _BitInt(373)) 0)
++		!= ((unsigned _BitInt(373)) 1) << (373 - 1), 0);
++  TEST_COMPARE (stdc_bit_floor (((unsigned _BitInt(512)) 511) << 405)
++		!= (((unsigned _BitInt(512)) 256) << 405), 0);
++  TEST_COMPARE (stdc_bit_floor (((unsigned _BitInt(373)) 512) << 242)
++		!= (((unsigned _BitInt(512)) 512) << 242), 0);
++  TEST_COMPARE (stdc_bit_ceil ((unsigned _BitInt(512)) 0) != 1, 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_ceil ((unsigned _BitInt(512)) 0),
++			       unsigned _BitInt(512)), 1);
++  TEST_COMPARE (stdc_bit_ceil ((unsigned _BitInt(373)) 0) != 1, 0);
++  TEST_COMPARE (expr_has_type (stdc_bit_ceil ((unsigned _BitInt(373)) 0),
++			       unsigned _BitInt(373)), 1);
++  TEST_COMPARE (stdc_bit_ceil (~(unsigned _BitInt(512)) 0) != 0, 0);
++  TEST_COMPARE (stdc_bit_ceil (~(unsigned _BitInt(373)) 0) != 0, 0);
++  TEST_COMPARE (stdc_bit_ceil (((unsigned _BitInt(512)) 1) << (512 - 1))
++		!= ((unsigned _BitInt(512)) 1) << (512 - 1), 0);
++  TEST_COMPARE (stdc_bit_ceil ((~(unsigned _BitInt(373)) 0) >> 1)
++		!= ((unsigned _BitInt(373)) 1) << (373 - 1), 0);
++  TEST_COMPARE (stdc_bit_ceil (((unsigned _BitInt(512)) 512) << 405)
++		!= (((unsigned _BitInt(512)) 512) << 405), 0);
++  TEST_COMPARE (stdc_bit_ceil (((unsigned _BitInt(373)) 513) << 242)
++		!= (((unsigned _BitInt(512)) 1024) << 242), 0);
++  TEST_COMPARE (stdc_bit_floor ((unsigned _BitInt(BITINT_MAXWIDTH)) 0) != 0,
++		0);
++  TEST_COMPARE (stdc_bit_floor (~(unsigned _BitInt(BITINT_MAXWIDTH)) 0)
++		!= ((unsigned _BitInt(BITINT_MAXWIDTH)) 1) << (BITINT_MAXWIDTH
++							       - 1), 0);
++  TEST_COMPARE (stdc_bit_floor (((unsigned _BitInt(BITINT_MAXWIDTH)) 511)
++				<< 405)
++		!= (((unsigned _BitInt(BITINT_MAXWIDTH)) 256) << 405), 0);
++  TEST_COMPARE (stdc_bit_floor (((unsigned _BitInt(BITINT_MAXWIDTH)) 512)
++				<< 405)
++		!= (((unsigned _BitInt(BITINT_MAXWIDTH)) 512) << 405), 0);
++  TEST_COMPARE (stdc_bit_ceil ((unsigned _BitInt(BITINT_MAXWIDTH)) 0) != 1, 0);
++  TEST_COMPARE (stdc_bit_ceil (~(unsigned _BitInt(BITINT_MAXWIDTH)) 0) != 0,
++		0);
++  TEST_COMPARE (stdc_bit_ceil (((unsigned _BitInt(BITINT_MAXWIDTH)) 1)
++			       << (BITINT_MAXWIDTH - 1))
++		!= ((unsigned _BitInt(BITINT_MAXWIDTH)) 1) << (BITINT_MAXWIDTH
++							       - 1), 0);
++  TEST_COMPARE (stdc_bit_ceil (((unsigned _BitInt(BITINT_MAXWIDTH)) 512)
++			       << 405)
++		!= (((unsigned _BitInt(BITINT_MAXWIDTH)) 512) << 405), 0);
++  TEST_COMPARE (stdc_bit_ceil (((unsigned _BitInt(BITINT_MAXWIDTH)) 513)
++			       << 405)
++		!= (((unsigned _BitInt(BITINT_MAXWIDTH)) 1024) << 405), 0);
++#  endif
++# endif
++  return 0;
++}
++#else
++static int
++do_test (void)
++{
++  return 0;
++}
++#endif
++
++#include <support/test-driver.c>
+
+commit 71fcdba577884627c3ee4e43beb915da752efb1f
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Mar 15 19:08:24 2024 +0100
+
+    linux: Use rseq area unconditionally in sched_getcpu (bug 31479)
+    
+    Originally, nptl/descr.h included <sys/rseq.h>, but we removed that
+    in commit 2c6b4b272e6b4d07303af25709051c3e96288f2d ("nptl:
+    Unconditionally use a 32-byte rseq area").  After that, it was
+    not ensured that the RSEQ_SIG macro was defined during sched_getcpu.c
+    compilation that provided a definition.  This commit always checks
+    the rseq area for CPU number information before using the other
+    approaches.
+    
+    This adds an unnecessary (but well-predictable) branch on
+    architectures which do not define RSEQ_SIG, but its cost is small
+    compared to the system call.  Most architectures that have vDSO
+    acceleration for getcpu also have rseq support.
+    
+    Fixes: 2c6b4b272e6b4d07303af25709051c3e96288f2d
+    Fixes: 1d350aa06091211863e41169729cee1bca39f72f
+    Reviewed-by: Arjun Shankar <arjun@redhat.com>
+    (cherry picked from commit 7a76f218677d149d8b7875b336722108239f7ee9)
+
+diff --git a/sysdeps/unix/sysv/linux/sched_getcpu.c b/sysdeps/unix/sysv/linux/sched_getcpu.c
+index dfb884568d..72a3360550 100644
+--- a/sysdeps/unix/sysv/linux/sched_getcpu.c
++++ b/sysdeps/unix/sysv/linux/sched_getcpu.c
+@@ -33,17 +33,9 @@ vsyscall_sched_getcpu (void)
+   return r == -1 ? r : cpu;
+ }
+ 
+-#ifdef RSEQ_SIG
+ int
+ sched_getcpu (void)
+ {
+   int cpu_id = THREAD_GETMEM_VOLATILE (THREAD_SELF, rseq_area.cpu_id);
+   return __glibc_likely (cpu_id >= 0) ? cpu_id : vsyscall_sched_getcpu ();
+ }
+-#else /* RSEQ_SIG */
+-int
+-sched_getcpu (void)
+-{
+-  return vsyscall_sched_getcpu ();
+-}
+-#endif /* RSEQ_SIG */
+
+commit ee7f4c54e19738c2c27d3846e1e9b3595c89221f
+Author: Manjunath Matti <mmatti@linux.ibm.com>
+Date:   Tue Mar 19 15:29:48 2024 -0500
+
+    powerpc: Add HWCAP3/HWCAP4 data to TCB for Power Architecture.
+    
+    This patch adds a new feature for powerpc.  In order to get faster
+    access to the HWCAP3/HWCAP4 masks, similar to HWCAP/HWCAP2 (i.e. for
+    implementing __builtin_cpu_supports() in GCC) without the overhead of
+    reading them from the auxiliary vector, we now reserve space for them
+    in the TCB.
+    
+    Suggested-by: Peter Bergner <bergner@linux.ibm.com>
+    Reviewed-by: Peter Bergner <bergner@linux.ibm.com>
+    (cherry picked from commit 3ab9b88e2ac91062b6d493fe32bd101a55006c6a)
+
+diff --git a/elf/dl-diagnostics.c b/elf/dl-diagnostics.c
+index 7345ebc4e5..aaf67b87e8 100644
+--- a/elf/dl-diagnostics.c
++++ b/elf/dl-diagnostics.c
+@@ -235,6 +235,8 @@ _dl_print_diagnostics (char **environ)
+   _dl_diagnostics_print_labeled_value ("dl_hwcap", GLRO (dl_hwcap));
+   _dl_diagnostics_print_labeled_value ("dl_hwcap_important", HWCAP_IMPORTANT);
+   _dl_diagnostics_print_labeled_value ("dl_hwcap2", GLRO (dl_hwcap2));
++  _dl_diagnostics_print_labeled_value ("dl_hwcap3", GLRO (dl_hwcap3));
++  _dl_diagnostics_print_labeled_value ("dl_hwcap4", GLRO (dl_hwcap4));
+   _dl_diagnostics_print_labeled_string
+     ("dl_hwcaps_subdirs", _dl_hwcaps_subdirs);
+   _dl_diagnostics_print_labeled_value
+diff --git a/elf/dl-support.c b/elf/dl-support.c
+index 2f502c8b0d..451932dd03 100644
+--- a/elf/dl-support.c
++++ b/elf/dl-support.c
+@@ -158,6 +158,8 @@ const ElfW(Phdr) *_dl_phdr;
+ size_t _dl_phnum;
+ uint64_t _dl_hwcap;
+ uint64_t _dl_hwcap2;
++uint64_t _dl_hwcap3;
++uint64_t _dl_hwcap4;
+ 
+ enum dso_sort_algorithm _dl_dso_sort_algo;
+ 
+diff --git a/elf/elf.h b/elf/elf.h
+index 455731663c..1c394c64cd 100644
+--- a/elf/elf.h
++++ b/elf/elf.h
+@@ -1234,6 +1234,10 @@ typedef struct
+ #define AT_RSEQ_FEATURE_SIZE	27	/* rseq supported feature size.  */
+ #define AT_RSEQ_ALIGN	28		/* rseq allocation alignment.  */
+ 
++/* More machine-dependent hints about processor capabilities.  */
++#define AT_HWCAP3	29		/* extension of AT_HWCAP.  */
++#define AT_HWCAP4	30		/* extension of AT_HWCAP.  */
++
+ #define AT_EXECFN	31		/* Filename of executable.  */
+ 
+ /* Pointer to the global system page used for system calls and other
+diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
+index 117c901ccc..50f58a60e3 100644
+--- a/sysdeps/generic/ldsodefs.h
++++ b/sysdeps/generic/ldsodefs.h
+@@ -646,6 +646,8 @@ struct rtld_global_ro
+   /* Mask for more hardware capabilities that are available on some
+      platforms.  */
+   EXTERN uint64_t _dl_hwcap2;
++  EXTERN uint64_t _dl_hwcap3;
++  EXTERN uint64_t _dl_hwcap4;
+ 
+   EXTERN enum dso_sort_algorithm _dl_dso_sort_algo;
+ 
+diff --git a/sysdeps/powerpc/dl-procinfo.c b/sysdeps/powerpc/dl-procinfo.c
+index a76bb6e5b0..8cf00aa7e3 100644
+--- a/sysdeps/powerpc/dl-procinfo.c
++++ b/sysdeps/powerpc/dl-procinfo.c
+@@ -38,6 +38,10 @@
+        needed.
+   */
+ 
++/* The total number of available bits (including those prior to
++   _DL_HWCAP_FIRST).  Some of these bits might not be used.  */
++#define _DL_HWCAP_COUNT         128
++
+ #ifndef PROCINFO_CLASS
+ # define PROCINFO_CLASS
+ #endif
+@@ -61,7 +65,7 @@ PROCINFO_CLASS struct cpu_features _dl_powerpc_cpu_features
+ #if !defined PROCINFO_DECL && defined SHARED
+   ._dl_powerpc_cap_flags
+ #else
+-PROCINFO_CLASS const char _dl_powerpc_cap_flags[64][15]
++PROCINFO_CLASS const char _dl_powerpc_cap_flags[_DL_HWCAP_COUNT][15]
+ #endif
+ #ifndef PROCINFO_DECL
+ = {
+diff --git a/sysdeps/powerpc/dl-procinfo.h b/sysdeps/powerpc/dl-procinfo.h
+index 68f4241095..f8cb343877 100644
+--- a/sysdeps/powerpc/dl-procinfo.h
++++ b/sysdeps/powerpc/dl-procinfo.h
+@@ -22,16 +22,17 @@
+ #include <ldsodefs.h>
+ #include <sysdep.h>	/* This defines the PPC_FEATURE[2]_* macros.  */
+ 
+-/* The total number of available bits (including those prior to
+-   _DL_HWCAP_FIRST).  Some of these bits might not be used.  */
+-#define _DL_HWCAP_COUNT		64
++/* Feature masks are all 32-bits in size.  */
++#define _DL_HWCAP_SIZE		32
+ 
+-/* Features started at bit 31 and decremented as new features were added.  */
+-#define _DL_HWCAP_LAST		31
++/* AT_HWCAP2 feature strings follow the AT_HWCAP feature strings.  */
++#define _DL_HWCAP2_OFFSET	_DL_HWCAP_SIZE
+ 
+-/* AT_HWCAP2 features started at bit 31 and decremented as new features were
+-   added.  HWCAP2 feature bits start at bit 0.  */
+-#define _DL_HWCAP2_LAST		31
++/* AT_HWCAP3 feature strings follow the AT_HWCAP2 feature strings.  */
++#define _DL_HWCAP3_OFFSET	(_DL_HWCAP2_OFFSET + _DL_HWCAP_SIZE)
++
++/* AT_HWCAP4 feature strings follow the AT_HWCAP3 feature strings.  */
++#define _DL_HWCAP4_OFFSET	(_DL_HWCAP3_OFFSET + _DL_HWCAP_SIZE)
+ 
+ /* These bits influence library search.  */
+ #define HWCAP_IMPORTANT		(PPC_FEATURE_HAS_ALTIVEC \
+@@ -187,21 +188,42 @@ _dl_procinfo (unsigned int type, unsigned long int word)
+     case AT_HWCAP:
+       _dl_printf ("AT_HWCAP:            ");
+ 
+-      for (int i = 0; i <= _DL_HWCAP_LAST; ++i)
++      for (int i = 0; i < _DL_HWCAP_SIZE; ++i)
+        if (word & (1 << i))
+          _dl_printf (" %s", _dl_hwcap_string (i));
+       break;
+     case AT_HWCAP2:
+       {
+-       unsigned int offset = _DL_HWCAP_LAST + 1;
+ 
+        _dl_printf ("AT_HWCAP2:           ");
+ 
+-        /* We have to go through them all because the kernel added the
+-          AT_HWCAP2 features starting with the high bits.  */
+-       for (int i = 0; i <= _DL_HWCAP2_LAST; ++i)
+-         if (word & (1 << i))
+-           _dl_printf (" %s", _dl_hwcap_string (offset + i));
++       /* We have to go through them all because the kernel added the
++	  AT_HWCAP2 features starting with the high bits.  */
++       for (int i = 0; i < _DL_HWCAP_SIZE; ++i)
++	 if (word & (1 << i))
++	   _dl_printf (" %s", _dl_hwcap_string (_DL_HWCAP2_OFFSET + i));
++       break;
++      }
++    case AT_HWCAP3:
++      {
++       _dl_printf ("AT_HWCAP3:           ");
++
++       /* We have to go through them all because the kernel added the
++	  AT_HWCAP3 features starting with the high bits.  */
++       for (int i = 0; i < _DL_HWCAP_SIZE; ++i)
++	 if (word & (1 << i))
++	   _dl_printf (" %s", _dl_hwcap_string (_DL_HWCAP3_OFFSET + i));
++       break;
++      }
++    case AT_HWCAP4:
++      {
++       _dl_printf ("AT_HWCAP4:           ");
++
++       /* We have to go through them all because the kernel added the
++	  AT_HWCAP4 features starting with the high bits.  */
++       for (int i = 0; i <= _DL_HWCAP_SIZE; ++i)
++	 if (word & (1 << i))
++	   _dl_printf (" %s", _dl_hwcap_string (_DL_HWCAP4_OFFSET + i));
+        break;
+       }
+     case AT_L1I_CACHEGEOMETRY:
+diff --git a/sysdeps/powerpc/hwcapinfo.c b/sysdeps/powerpc/hwcapinfo.c
+index 76344f285a..f6fede15a7 100644
+--- a/sysdeps/powerpc/hwcapinfo.c
++++ b/sysdeps/powerpc/hwcapinfo.c
+@@ -31,7 +31,7 @@ void
+ __tcb_parse_hwcap_and_convert_at_platform (void)
+ {
+ 
+-  uint64_t h1, h2;
++  uint64_t h1, h2, h3, h4;
+ 
+   /* Read AT_PLATFORM string from auxv and convert it to a number.  */
+   __tcb.at_platform = _dl_string_platform (GLRO (dl_platform));
+@@ -39,6 +39,8 @@ __tcb_parse_hwcap_and_convert_at_platform (void)
+   /* Read HWCAP and HWCAP2 from auxv.  */
+   h1 = GLRO (dl_hwcap);
+   h2 = GLRO (dl_hwcap2);
++  h3 = GLRO (dl_hwcap3);
++  h4 = GLRO (dl_hwcap4);
+ 
+   /* hwcap contains only the latest supported ISA, the code checks which is
+      and fills the previous supported ones.  */
+@@ -64,13 +66,16 @@ __tcb_parse_hwcap_and_convert_at_platform (void)
+   else if (h1 & PPC_FEATURE_POWER5)
+     h1 |= PPC_FEATURE_POWER4;
+ 
+-  uint64_t array_hwcaps[] = { h1, h2 };
++  uint64_t array_hwcaps[] = { h1, h2, h3, h4 };
+   init_cpu_features (&GLRO(dl_powerpc_cpu_features), array_hwcaps);
+ 
+   /* Consolidate both HWCAP and HWCAP2 into a single doubleword so that
+      we can read both in a single load later.  */
+   __tcb.hwcap = (h1 << 32) | (h2 & 0xffffffff);
+-  __tcb.hwcap_extn = 0x0;
++
++  /* Consolidate both HWCAP3 and HWCAP4 into a single doubleword so that
++     we can read both in a single load later.  */
++  __tcb.hwcap_extn = (h3 << 32) | (h4 & 0xffffffff);
+ 
+ }
+ #if IS_IN (rtld)
+diff --git a/sysdeps/unix/sysv/linux/dl-parse_auxv.h b/sysdeps/unix/sysv/linux/dl-parse_auxv.h
+index e3d758b163..ea2a58ecb1 100644
+--- a/sysdeps/unix/sysv/linux/dl-parse_auxv.h
++++ b/sysdeps/unix/sysv/linux/dl-parse_auxv.h
+@@ -47,6 +47,8 @@ void _dl_parse_auxv (ElfW(auxv_t) *av, dl_parse_auxv_t auxv_values)
+   GLRO(dl_platform) = (void *) auxv_values[AT_PLATFORM];
+   GLRO(dl_hwcap) = auxv_values[AT_HWCAP];
+   GLRO(dl_hwcap2) = auxv_values[AT_HWCAP2];
++  GLRO(dl_hwcap3) = auxv_values[AT_HWCAP3];
++  GLRO(dl_hwcap4) = auxv_values[AT_HWCAP4];
+   GLRO(dl_clktck) = auxv_values[AT_CLKTCK];
+   GLRO(dl_fpu_control) = auxv_values[AT_FPUCW];
+   _dl_random = (void *) auxv_values[AT_RANDOM];
+diff --git a/sysdeps/unix/sysv/linux/dl-sysdep.c b/sysdeps/unix/sysv/linux/dl-sysdep.c
+index ad3692d738..e1b14e9eb3 100644
+--- a/sysdeps/unix/sysv/linux/dl-sysdep.c
++++ b/sysdeps/unix/sysv/linux/dl-sysdep.c
+@@ -197,6 +197,8 @@ _dl_show_auxv (void)
+ 	  [AT_SYSINFO_EHDR - 2] =	{ "SYSINFO_EHDR:      0x", hex },
+ 	  [AT_RANDOM - 2] =		{ "RANDOM:            0x", hex },
+ 	  [AT_HWCAP2 - 2] =		{ "HWCAP2:            0x", hex },
++	  [AT_HWCAP3 - 2] =		{ "HWCAP3:            0x", hex },
++	  [AT_HWCAP4 - 2] =		{ "HWCAP4:            0x", hex },
+ 	  [AT_MINSIGSTKSZ - 2] =	{ "MINSIGSTKSZ:       ", dec },
+ 	  [AT_L1I_CACHESIZE - 2] =	{ "L1I_CACHESIZE:     ", dec },
+ 	  [AT_L1I_CACHEGEOMETRY - 2] =	{ "L1I_CACHEGEOMETRY: 0x", hex },
+diff --git a/sysdeps/unix/sysv/linux/powerpc/cpu-features.c b/sysdeps/unix/sysv/linux/powerpc/cpu-features.c
+index 8e8a5ec2ea..a947d62db6 100644
+--- a/sysdeps/unix/sysv/linux/powerpc/cpu-features.c
++++ b/sysdeps/unix/sysv/linux/powerpc/cpu-features.c
+@@ -94,6 +94,8 @@ init_cpu_features (struct cpu_features *cpu_features, uint64_t hwcaps[])
+      which are set by __tcb_parse_hwcap_and_convert_at_platform.  */
+   cpu_features->hwcap = hwcaps[0];
+   cpu_features->hwcap2 = hwcaps[1];
++  cpu_features->hwcap3 = hwcaps[2];
++  cpu_features->hwcap4 = hwcaps[3];
+   /* Default is to use aligned memory access on optimized function unless
+      tunables is enable, since for this case user can explicit disable
+      unaligned optimizations.  */
+diff --git a/sysdeps/unix/sysv/linux/powerpc/cpu-features.h b/sysdeps/unix/sysv/linux/powerpc/cpu-features.h
+index 1294f0b601..e9eb6a13c8 100644
+--- a/sysdeps/unix/sysv/linux/powerpc/cpu-features.h
++++ b/sysdeps/unix/sysv/linux/powerpc/cpu-features.h
+@@ -26,6 +26,8 @@ struct cpu_features
+   bool use_cached_memopt;
+   unsigned long int hwcap;
+   unsigned long int hwcap2;
++  unsigned long int hwcap3;
++  unsigned long int hwcap4;
+ };
+ 
+ static const char hwcap_names[] = {
+diff --git a/sysdeps/unix/sysv/linux/powerpc/libc-start.c b/sysdeps/unix/sysv/linux/powerpc/libc-start.c
+index a4705daf1c..6a00cd88cd 100644
+--- a/sysdeps/unix/sysv/linux/powerpc/libc-start.c
++++ b/sysdeps/unix/sysv/linux/powerpc/libc-start.c
+@@ -87,6 +87,12 @@ __libc_start_main_impl (int argc, char **argv,
+       case AT_HWCAP2:
+ 	_dl_hwcap2 = (unsigned long int) av->a_un.a_val;
+ 	break;
++      case AT_HWCAP3:
++	_dl_hwcap3 = (unsigned long int) av->a_un.a_val;
++	break;
++      case AT_HWCAP4:
++	_dl_hwcap4 = (unsigned long int) av->a_un.a_val;
++	break;
+       case AT_PLATFORM:
+ 	_dl_platform = (void *) av->a_un.a_val;
+ 	break;
+
+commit aad45c8ac30aa1072e54903ce6aead22702f244a
+Author: Amrita H S <amritahs@linux.ibm.com>
+Date:   Tue Mar 19 19:08:47 2024 -0500
+
+    powerpc: Placeholder and infrastructure/build support to add Power11 related changes.
+    
+    The following three changes have been added to provide initial Power11 support.
+        1. Add the directories to hold Power11 files.
+        2. Add support to select Power11 libraries based on AT_PLATFORM.
+        3. Let submachine=power11 be set automatically.
+    
+    Reviewed-by: Florian Weimer <fweimer@redhat.com>
+    Reviewed-by: Peter Bergner <bergner@linux.ibm.com>
+    (cherry picked from commit 1ea051145612f199d8716ecdf78b084b00b5a727)
+
+diff --git a/sysdeps/powerpc/dl-procinfo.h b/sysdeps/powerpc/dl-procinfo.h
+index f8cb343877..b36697ba44 100644
+--- a/sysdeps/powerpc/dl-procinfo.h
++++ b/sysdeps/powerpc/dl-procinfo.h
+@@ -38,7 +38,7 @@
+ #define HWCAP_IMPORTANT		(PPC_FEATURE_HAS_ALTIVEC \
+ 				+ PPC_FEATURE_HAS_DFP)
+ 
+-#define _DL_PLATFORMS_COUNT	16
++#define _DL_PLATFORMS_COUNT	17
+ 
+ #define _DL_FIRST_PLATFORM	32
+ /* Mask to filter out platforms.  */
+@@ -62,6 +62,7 @@
+ #define PPC_PLATFORM_POWER8		13
+ #define PPC_PLATFORM_POWER9		14
+ #define PPC_PLATFORM_POWER10		15
++#define PPC_PLATFORM_POWER11		16
+ 
+ static inline const char *
+ __attribute__ ((unused))
+@@ -89,6 +90,11 @@ _dl_string_platform (const char *str)
+ 	      ret = _DL_FIRST_PLATFORM + PPC_PLATFORM_POWER10;
+ 	      str++;
+ 	    }
++	  else if (str[1] == '1')
++	    {
++	      ret = _DL_FIRST_PLATFORM + PPC_PLATFORM_POWER11;
++	      str++;
++	    }
+ 	  else
+ 	    return -1;
+ 	  break;
+diff --git a/sysdeps/powerpc/powerpc32/power11/Implies b/sysdeps/powerpc/powerpc32/power11/Implies
+new file mode 100644
+index 0000000000..051cbe0f79
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc32/power11/Implies
+@@ -0,0 +1,2 @@
++powerpc/powerpc32/power10/fpu
++powerpc/powerpc32/power10
+diff --git a/sysdeps/powerpc/powerpc32/power11/fpu/multiarch/Implies b/sysdeps/powerpc/powerpc32/power11/fpu/multiarch/Implies
+new file mode 100644
+index 0000000000..58edb2861d
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc32/power11/fpu/multiarch/Implies
+@@ -0,0 +1 @@
++powerpc/powerpc32/power10/fpu/multiarch
+diff --git a/sysdeps/powerpc/powerpc32/power11/multiarch/Implies b/sysdeps/powerpc/powerpc32/power11/multiarch/Implies
+new file mode 100644
+index 0000000000..c70f0428ba
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc32/power11/multiarch/Implies
+@@ -0,0 +1 @@
++powerpc/powerpc32/power10/multiarch
+diff --git a/sysdeps/powerpc/powerpc64/be/power11/Implies b/sysdeps/powerpc/powerpc64/be/power11/Implies
+new file mode 100644
+index 0000000000..de481d1c13
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc64/be/power11/Implies
+@@ -0,0 +1,2 @@
++powerpc/powerpc64/be/power10/fpu
++powerpc/powerpc64/be/power10
+diff --git a/sysdeps/powerpc/powerpc64/be/power11/fpu/Implies b/sysdeps/powerpc/powerpc64/be/power11/fpu/Implies
+new file mode 100644
+index 0000000000..dff0e13064
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc64/be/power11/fpu/Implies
+@@ -0,0 +1 @@
++powerpc/powerpc64/be/power10/fpu
+diff --git a/sysdeps/powerpc/powerpc64/be/power11/fpu/multiarch/Implies b/sysdeps/powerpc/powerpc64/be/power11/fpu/multiarch/Implies
+new file mode 100644
+index 0000000000..c3f259e009
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc64/be/power11/fpu/multiarch/Implies
+@@ -0,0 +1 @@
++powerpc/powerpc64/be/power10/fpu/multiarch
+diff --git a/sysdeps/powerpc/powerpc64/be/power11/multiarch/Implies b/sysdeps/powerpc/powerpc64/be/power11/multiarch/Implies
+new file mode 100644
+index 0000000000..9491a394c9
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc64/be/power11/multiarch/Implies
+@@ -0,0 +1 @@
++powerpc/powerpc64/be/power10/multiarch
+diff --git a/sysdeps/powerpc/powerpc64/le/power11/Implies b/sysdeps/powerpc/powerpc64/le/power11/Implies
+new file mode 100644
+index 0000000000..e18182dcc1
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc64/le/power11/Implies
+@@ -0,0 +1,2 @@
++powerpc/powerpc64/le/power10/fpu
++powerpc/powerpc64/le/power10
+diff --git a/sysdeps/powerpc/powerpc64/le/power11/fpu/Implies b/sysdeps/powerpc/powerpc64/le/power11/fpu/Implies
+new file mode 100644
+index 0000000000..e41bd55684
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc64/le/power11/fpu/Implies
+@@ -0,0 +1 @@
++powerpc/powerpc64/le/power10/fpu
+diff --git a/sysdeps/powerpc/powerpc64/le/power11/fpu/multiarch/Implies b/sysdeps/powerpc/powerpc64/le/power11/fpu/multiarch/Implies
+new file mode 100644
+index 0000000000..c838d50931
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc64/le/power11/fpu/multiarch/Implies
+@@ -0,0 +1 @@
++powerpc/powerpc64/le/power10/fpu/multiarch
+diff --git a/sysdeps/powerpc/powerpc64/le/power11/multiarch/Implies b/sysdeps/powerpc/powerpc64/le/power11/multiarch/Implies
+new file mode 100644
+index 0000000000..687248c3c2
+--- /dev/null
++++ b/sysdeps/powerpc/powerpc64/le/power11/multiarch/Implies
+@@ -0,0 +1 @@
++powerpc/powerpc64/le/power10/multiarch
+diff --git a/sysdeps/powerpc/powerpc64/le/tst-glibc-hwcaps.c b/sysdeps/powerpc/powerpc64/le/tst-glibc-hwcaps.c
+index 77465d9133..65d3e69303 100644
+--- a/sysdeps/powerpc/powerpc64/le/tst-glibc-hwcaps.c
++++ b/sysdeps/powerpc/powerpc64/le/tst-glibc-hwcaps.c
+@@ -36,9 +36,11 @@ compute_level (void)
+     return 9;
+   if (strcmp (platform, "power10") == 0)
+     return 10;
++  if (strcmp (platform, "power11") == 0)
++    return 11;
+   printf ("warning: unrecognized AT_PLATFORM value: %s\n", platform);
+-  /* Assume that the new platform supports POWER10.  */
+-  return 10;
++  /* Assume that the new platform supports POWER11.  */
++  return 11;
+ }
+ 
+ static int
+diff --git a/sysdeps/powerpc/preconfigure b/sysdeps/powerpc/preconfigure
+index 4de94089a3..9e5a07ab6d 100644
+--- a/sysdeps/powerpc/preconfigure
++++ b/sysdeps/powerpc/preconfigure
+@@ -58,7 +58,7 @@ fi
+ 
+     ;;
+ 
+-  a2|970|power[4-9]|power5x|power6+|power10)
++  a2|970|power[4-9]|power5x|power6+|power10|power11)
+     submachine=${archcpu}
+     if test ${libc_cv_cc_submachine+y}
+ then :
+diff --git a/sysdeps/powerpc/preconfigure.ac b/sysdeps/powerpc/preconfigure.ac
+index 6c63bd8257..14b6dafd4a 100644
+--- a/sysdeps/powerpc/preconfigure.ac
++++ b/sysdeps/powerpc/preconfigure.ac
+@@ -46,7 +46,7 @@ case "${machine}:${submachine}" in
+     AC_CACHE_VAL(libc_cv_cc_submachine,libc_cv_cc_submachine="")
+     ;;
+ 
+-  a2|970|power[[4-9]]|power5x|power6+|power10)
++  a2|970|power[[4-9]]|power5x|power6+|power10|power11)
+     submachine=${archcpu}
+     AC_CACHE_VAL(libc_cv_cc_submachine,libc_cv_cc_submachine="")
+     ;;
+
+commit 983f34a1252de3ca6f2305c211d86530ea42010e
+Author: caiyinyu <caiyinyu@loongson.cn>
+Date:   Mon Mar 11 16:07:48 2024 +0800
+
+    LoongArch: Correct {__ieee754, _}_scalb -> {__ieee754, _}_scalbf
+
+diff --git a/sysdeps/loongarch/fpu/e_scalbf.c b/sysdeps/loongarch/fpu/e_scalbf.c
+index 9f05485236..7c0395fbb5 100644
+--- a/sysdeps/loongarch/fpu/e_scalbf.c
++++ b/sysdeps/loongarch/fpu/e_scalbf.c
+@@ -57,4 +57,4 @@ __ieee754_scalbf (float x, float fn)
+ 
+   return x;
+ }
+-libm_alias_finite (__ieee754_scalb, __scalb)
++libm_alias_finite (__ieee754_scalbf, __scalbf)
+
+commit 7fc8242bf87828c935ac5df5cafb9dc7ab635fd9
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Fri Feb 16 07:17:10 2024 -0800
+
+    x86-64: Save APX registers in ld.so trampoline
+    
+    Add APX registers to STATE_SAVE_MASK so that APX registers are saved in
+    ld.so trampoline.  This fixes BZ #31371.
+    
+    Also update STATE_SAVE_OFFSET and STATE_SAVE_MASK for i386 which will
+    be used by i386 _dl_tlsdesc_dynamic.
+    Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
+    
+    (cherry picked from commit dfb05f8e704edac70db38c4c8ee700769d91a413)
+
+diff --git a/sysdeps/x86/sysdep.h b/sysdeps/x86/sysdep.h
+index 85d0a8c943..837fd28734 100644
+--- a/sysdeps/x86/sysdep.h
++++ b/sysdeps/x86/sysdep.h
+@@ -21,14 +21,54 @@
+ 
+ #include <sysdeps/generic/sysdep.h>
+ 
++/* The extended state feature IDs in the state component bitmap.  */
++#define X86_XSTATE_X87_ID	0
++#define X86_XSTATE_SSE_ID	1
++#define X86_XSTATE_AVX_ID	2
++#define X86_XSTATE_BNDREGS_ID	3
++#define X86_XSTATE_BNDCFG_ID	4
++#define X86_XSTATE_K_ID		5
++#define X86_XSTATE_ZMM_H_ID	6
++#define X86_XSTATE_ZMM_ID	7
++#define X86_XSTATE_PKRU_ID	9
++#define X86_XSTATE_TILECFG_ID	17
++#define X86_XSTATE_TILEDATA_ID	18
++#define X86_XSTATE_APX_F_ID	19
++
++#ifdef __x86_64__
+ /* Offset for fxsave/xsave area used by _dl_runtime_resolve.  Also need
+    space to preserve RCX, RDX, RSI, RDI, R8, R9 and RAX.  It must be
+-   aligned to 16 bytes for fxsave and 64 bytes for xsave.  */
+-#define STATE_SAVE_OFFSET (8 * 7 + 8)
+-
+-/* Save SSE, AVX, AVX512, mask and bound registers.  */
+-#define STATE_SAVE_MASK \
+-  ((1 << 1) | (1 << 2) | (1 << 3) | (1 << 5) | (1 << 6) | (1 << 7))
++   aligned to 16 bytes for fxsave and 64 bytes for xsave.
++
++   NB: Is is non-zero because of the 128-byte red-zone.  Some registers
++   are saved on stack without adjusting stack pointer first.  When we
++   update stack pointer to allocate more space, we need to take the
++   red-zone into account.  */
++# define STATE_SAVE_OFFSET (8 * 7 + 8)
++
++/* Save SSE, AVX, AVX512, mask, bound and APX registers.  Bound and APX
++   registers are mutually exclusive.  */
++# define STATE_SAVE_MASK		\
++  ((1 << X86_XSTATE_SSE_ID)		\
++   | (1 << X86_XSTATE_AVX_ID)		\
++   | (1 << X86_XSTATE_BNDREGS_ID)	\
++   | (1 << X86_XSTATE_K_ID)		\
++   | (1 << X86_XSTATE_ZMM_H_ID) 	\
++   | (1 << X86_XSTATE_ZMM_ID)		\
++   | (1 << X86_XSTATE_APX_F_ID))
++#else
++/* Offset for fxsave/xsave area used by _dl_tlsdesc_dynamic.  Since i386
++   doesn't have red-zone, use 0 here.  */
++# define STATE_SAVE_OFFSET 0
++
++/* Save SSE, AVX, AXV512, mask and bound registers.   */
++# define STATE_SAVE_MASK		\
++  ((1 << X86_XSTATE_SSE_ID)		\
++   | (1 << X86_XSTATE_AVX_ID)		\
++   | (1 << X86_XSTATE_BNDREGS_ID)	\
++   | (1 << X86_XSTATE_K_ID)		\
++   | (1 << X86_XSTATE_ZMM_H_ID))
++#endif
+ 
+ /* Constants for bits in __x86_string_control:  */
+ 
+
+commit a364304718725a31ab141936322855c76c73e35e
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Mon Feb 26 06:37:03 2024 -0800
+
+    x86: Update _dl_tlsdesc_dynamic to preserve caller-saved registers
+    
+    Compiler generates the following instruction sequence for GNU2 dynamic
+    TLS access:
+    
+            leaq    tls_var@TLSDESC(%rip), %rax
+            call    *tls_var@TLSCALL(%rax)
+    
+    or
+    
+            leal    tls_var@TLSDESC(%ebx), %eax
+            call    *tls_var@TLSCALL(%eax)
+    
+    CALL instruction is transparent to compiler which assumes all registers,
+    except for EFLAGS and RAX/EAX, are unchanged after CALL.  When
+    _dl_tlsdesc_dynamic is called, it calls __tls_get_addr on the slow
+    path.  __tls_get_addr is a normal function which doesn't preserve any
+    caller-saved registers.  _dl_tlsdesc_dynamic saved and restored integer
+    caller-saved registers, but didn't preserve any other caller-saved
+    registers.  Add _dl_tlsdesc_dynamic IFUNC functions for FNSAVE, FXSAVE,
+    XSAVE and XSAVEC to save and restore all caller-saved registers.  This
+    fixes BZ #31372.
+    
+    Add GLRO(dl_x86_64_runtime_resolve) with GLRO(dl_x86_tlsdesc_dynamic)
+    to optimize elf_machine_runtime_setup.
+    Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
+    
+    (cherry picked from commit 0aac205a814a8511e98d02b91a8dc908f1c53cde)
+
+diff --git a/elf/Makefile b/elf/Makefile
+index 5d78b659ce..c5c37a9147 100644
+--- a/elf/Makefile
++++ b/elf/Makefile
+@@ -424,6 +424,7 @@ tests += \
+   tst-glibc-hwcaps-prepend \
+   tst-global1 \
+   tst-global2 \
++  tst-gnu2-tls2 \
+   tst-initfinilazyfail \
+   tst-initorder \
+   tst-initorder2 \
+@@ -846,6 +847,9 @@ modules-names += \
+   tst-filterobj-flt \
+   tst-finilazyfailmod \
+   tst-globalmod2 \
++  tst-gnu2-tls2mod0 \
++  tst-gnu2-tls2mod1 \
++  tst-gnu2-tls2mod2 \
+   tst-initlazyfailmod \
+   tst-initorder2a \
+   tst-initorder2b \
+@@ -3044,8 +3048,22 @@ $(objpfx)tst-tlsgap.out: \
+   $(objpfx)tst-tlsgap-mod0.so \
+   $(objpfx)tst-tlsgap-mod1.so \
+   $(objpfx)tst-tlsgap-mod2.so
++
++$(objpfx)tst-gnu2-tls2: $(shared-thread-library)
++$(objpfx)tst-gnu2-tls2.out: \
++  $(objpfx)tst-gnu2-tls2mod0.so \
++  $(objpfx)tst-gnu2-tls2mod1.so \
++  $(objpfx)tst-gnu2-tls2mod2.so
++
+ ifeq (yes,$(have-mtls-dialect-gnu2))
++# This test fails if dl_tlsdesc_dynamic doesn't preserve all caller-saved
++# registers.  See https://sourceware.org/bugzilla/show_bug.cgi?id=31372
++test-xfail-tst-gnu2-tls2 = yes
++
+ CFLAGS-tst-tlsgap-mod0.c += -mtls-dialect=gnu2
+ CFLAGS-tst-tlsgap-mod1.c += -mtls-dialect=gnu2
+ CFLAGS-tst-tlsgap-mod2.c += -mtls-dialect=gnu2
++CFLAGS-tst-gnu2-tls2mod0.c += -mtls-dialect=gnu2
++CFLAGS-tst-gnu2-tls2mod1.c += -mtls-dialect=gnu2
++CFLAGS-tst-gnu2-tls2mod2.c += -mtls-dialect=gnu2
+ endif
+diff --git a/elf/tst-gnu2-tls2.c b/elf/tst-gnu2-tls2.c
+new file mode 100644
+index 0000000000..7ac04d7f33
+--- /dev/null
++++ b/elf/tst-gnu2-tls2.c
+@@ -0,0 +1,122 @@
++/* Test TLSDESC relocation.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <dlfcn.h>
++#include <pthread.h>
++#include <support/xdlfcn.h>
++#include <support/xthread.h>
++#include <support/check.h>
++#include <support/test-driver.h>
++#include "tst-gnu2-tls2.h"
++
++#ifndef IS_SUPPORTED
++# define IS_SUPPORTED() true
++#endif
++
++/* An architecture can define it to clobber caller-saved registers in
++   malloc below to verify that the implicit TLSDESC call won't change
++   caller-saved registers.  */
++#ifndef PREPARE_MALLOC
++# define PREPARE_MALLOC()
++#endif
++
++extern void * __libc_malloc (size_t);
++
++size_t malloc_counter = 0;
++
++void *
++malloc (size_t n)
++{
++  PREPARE_MALLOC ();
++  malloc_counter++;
++  return __libc_malloc (n);
++}
++
++static void *mod[3];
++#ifndef MOD
++# define MOD(i) "tst-gnu2-tls2mod" #i ".so"
++#endif
++static const char *modname[3] = { MOD(0), MOD(1), MOD(2) };
++#undef MOD
++
++static void
++open_mod (int i)
++{
++  mod[i] = xdlopen (modname[i], RTLD_LAZY);
++  printf ("open %s\n", modname[i]);
++}
++
++static void
++close_mod (int i)
++{
++  xdlclose (mod[i]);
++  mod[i] = NULL;
++  printf ("close %s\n", modname[i]);
++}
++
++static void
++access_mod (int i, const char *sym)
++{
++  struct tls var = { -1, -1, -1, -1 };
++  struct tls *(*f) (struct tls *) = xdlsym (mod[i], sym);
++  /* Check that our malloc is called.  */
++  malloc_counter = 0;
++  struct tls *p = f (&var);
++  TEST_VERIFY (malloc_counter != 0);
++  printf ("access %s: %s() = %p\n", modname[i], sym, p);
++  TEST_VERIFY_EXIT (memcmp (p, &var, sizeof (var)) == 0);
++  ++(p->a);
++}
++
++static void *
++start (void *arg)
++{
++  /* The DTV generation is at the last dlopen of mod0 and the
++     entry for mod1 is NULL.  */
++
++  open_mod (1); /* Reuse modid of mod1. Uses dynamic TLS.  */
++
++  /* Force the slow path in GNU2 TLS descriptor call.  */
++  access_mod (1, "apply_tls");
++
++  return arg;
++}
++
++static int
++do_test (void)
++{
++  if (!IS_SUPPORTED ())
++    return EXIT_UNSUPPORTED;
++
++  open_mod (0);
++  open_mod (1);
++  open_mod (2);
++  close_mod (0);
++  close_mod (1); /* Create modid gap at mod1.  */
++  open_mod (0); /* Reuse modid of mod0, bump generation count.  */
++
++  /* Create a thread where DTV of mod1 is NULL.  */
++  pthread_t t = xpthread_create (NULL, start, NULL);
++  xpthread_join (t);
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/elf/tst-gnu2-tls2.h b/elf/tst-gnu2-tls2.h
+new file mode 100644
+index 0000000000..77964a57a3
+--- /dev/null
++++ b/elf/tst-gnu2-tls2.h
+@@ -0,0 +1,36 @@
++/* Test TLSDESC relocation.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdint.h>
++
++struct tls
++{
++  int64_t a, b, c, d;
++};
++
++extern struct tls *apply_tls (struct tls *);
++
++/* An architecture can define them to verify that clobber caller-saved
++   registers aren't changed by the implicit TLSDESC call.  */
++#ifndef BEFORE_TLSDESC_CALL
++# define BEFORE_TLSDESC_CALL()
++#endif
++
++#ifndef AFTER_TLSDESC_CALL
++# define AFTER_TLSDESC_CALL()
++#endif
+diff --git a/elf/tst-gnu2-tls2mod0.c b/elf/tst-gnu2-tls2mod0.c
+new file mode 100644
+index 0000000000..45556a0e17
+--- /dev/null
++++ b/elf/tst-gnu2-tls2mod0.c
+@@ -0,0 +1,31 @@
++/* DSO used by tst-gnu2-tls2.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include "tst-gnu2-tls2.h"
++
++__thread struct tls tls_var0 __attribute__ ((visibility ("hidden")));
++
++struct tls *
++apply_tls (struct tls *p)
++{
++  BEFORE_TLSDESC_CALL ();
++  tls_var0 = *p;
++  struct tls *ret = &tls_var0;
++  AFTER_TLSDESC_CALL ();
++  return ret;
++}
+diff --git a/elf/tst-gnu2-tls2mod1.c b/elf/tst-gnu2-tls2mod1.c
+new file mode 100644
+index 0000000000..e10b9dbc0a
+--- /dev/null
++++ b/elf/tst-gnu2-tls2mod1.c
+@@ -0,0 +1,31 @@
++/* DSO used by tst-gnu2-tls2.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include "tst-gnu2-tls2.h"
++
++__thread struct tls tls_var1[100] __attribute__ ((visibility ("hidden")));
++
++struct tls *
++apply_tls (struct tls *p)
++{
++  BEFORE_TLSDESC_CALL ();
++  tls_var1[1] = *p;
++  struct tls *ret = &tls_var1[1];
++  AFTER_TLSDESC_CALL ();
++  return ret;
++}
+diff --git a/elf/tst-gnu2-tls2mod2.c b/elf/tst-gnu2-tls2mod2.c
+new file mode 100644
+index 0000000000..141af51e55
+--- /dev/null
++++ b/elf/tst-gnu2-tls2mod2.c
+@@ -0,0 +1,31 @@
++/* DSO used by tst-gnu2-tls2.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include "tst-gnu2-tls2.h"
++
++__thread struct tls tls_var2 __attribute__ ((visibility ("hidden")));
++
++struct tls *
++apply_tls (struct tls *p)
++{
++  BEFORE_TLSDESC_CALL ();
++  tls_var2 = *p;
++  struct tls *ret = &tls_var2;
++  AFTER_TLSDESC_CALL ();
++  return ret;
++}
+diff --git a/sysdeps/i386/dl-machine.h b/sysdeps/i386/dl-machine.h
+index fc1ef96587..50d74fe6e9 100644
+--- a/sysdeps/i386/dl-machine.h
++++ b/sysdeps/i386/dl-machine.h
+@@ -347,7 +347,7 @@ and creates an unsatisfiable circular dependency.\n",
+ 		  {
+ 		    td->arg = _dl_make_tlsdesc_dynamic
+ 		      (sym_map, sym->st_value + (ElfW(Word))td->arg);
+-		    td->entry = _dl_tlsdesc_dynamic;
++		    td->entry = GLRO(dl_x86_tlsdesc_dynamic);
+ 		  }
+ 		else
+ #  endif
+diff --git a/sysdeps/i386/dl-tlsdesc-dynamic.h b/sysdeps/i386/dl-tlsdesc-dynamic.h
+new file mode 100644
+index 0000000000..3627028577
+--- /dev/null
++++ b/sysdeps/i386/dl-tlsdesc-dynamic.h
+@@ -0,0 +1,190 @@
++/* Thread-local storage handling in the ELF dynamic linker.  i386 version.
++   Copyright (C) 2004-2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#undef REGISTER_SAVE_AREA
++
++#if !defined USE_FNSAVE && (STATE_SAVE_ALIGNMENT % 16) != 0
++# error STATE_SAVE_ALIGNMENT must be multiple of 16
++#endif
++
++#if DL_RUNTIME_RESOLVE_REALIGN_STACK
++# ifdef USE_FNSAVE
++#  error USE_FNSAVE shouldn't be defined
++# endif
++# ifdef USE_FXSAVE
++/* Use fxsave to save all registers.  */
++#  define REGISTER_SAVE_AREA	512
++# endif
++#else
++# ifdef USE_FNSAVE
++/* Use fnsave to save x87 FPU stack registers.  */
++#  define REGISTER_SAVE_AREA	108
++# else
++#  ifndef USE_FXSAVE
++#   error USE_FXSAVE must be defined
++#  endif
++/* Use fxsave to save all registers.  Add 12 bytes to align the stack
++   to 16 bytes.  */
++#  define REGISTER_SAVE_AREA	(512 + 12)
++# endif
++#endif
++
++	.hidden _dl_tlsdesc_dynamic
++	.global	_dl_tlsdesc_dynamic
++	.type	_dl_tlsdesc_dynamic,@function
++
++     /* This function is used for symbols that need dynamic TLS.
++
++	%eax points to the TLS descriptor, such that 0(%eax) points to
++	_dl_tlsdesc_dynamic itself, and 4(%eax) points to a struct
++	tlsdesc_dynamic_arg object.  It must return in %eax the offset
++	between the thread pointer and the object denoted by the
++	argument, without clobbering any registers.
++
++	The assembly code that follows is a rendition of the following
++	C code, hand-optimized a little bit.
++
++ptrdiff_t
++__attribute__ ((__regparm__ (1)))
++_dl_tlsdesc_dynamic (struct tlsdesc *tdp)
++{
++  struct tlsdesc_dynamic_arg *td = tdp->arg;
++  dtv_t *dtv = *(dtv_t **)((char *)__thread_pointer + DTV_OFFSET);
++  if (__builtin_expect (td->gen_count <= dtv[0].counter
++			&& (dtv[td->tlsinfo.ti_module].pointer.val
++			    != TLS_DTV_UNALLOCATED),
++			1))
++    return dtv[td->tlsinfo.ti_module].pointer.val + td->tlsinfo.ti_offset
++      - __thread_pointer;
++
++  return ___tls_get_addr (&td->tlsinfo) - __thread_pointer;
++}
++*/
++	cfi_startproc
++	.align 16
++_dl_tlsdesc_dynamic:
++	/* Like all TLS resolvers, preserve call-clobbered registers.
++	   We need two scratch regs anyway.  */
++	subl	$32, %esp
++	cfi_adjust_cfa_offset (32)
++	movl	%ecx, 20(%esp)
++	movl	%edx, 24(%esp)
++	movl	TLSDESC_ARG(%eax), %eax
++	movl	%gs:DTV_OFFSET, %edx
++	movl	TLSDESC_GEN_COUNT(%eax), %ecx
++	cmpl	(%edx), %ecx
++	ja	2f
++	movl	TLSDESC_MODID(%eax), %ecx
++	movl	(%edx,%ecx,8), %edx
++	cmpl	$-1, %edx
++	je	2f
++	movl	TLSDESC_MODOFF(%eax), %eax
++	addl	%edx, %eax
++1:
++	movl	20(%esp), %ecx
++	subl	%gs:0, %eax
++	movl	24(%esp), %edx
++	addl	$32, %esp
++	cfi_adjust_cfa_offset (-32)
++	ret
++	.p2align 4,,7
++2:
++	cfi_adjust_cfa_offset (32)
++#if DL_RUNTIME_RESOLVE_REALIGN_STACK
++	movl	%ebx, -28(%esp)
++	movl	%esp, %ebx
++	cfi_def_cfa_register(%ebx)
++	and	$-STATE_SAVE_ALIGNMENT, %esp
++#endif
++#ifdef REGISTER_SAVE_AREA
++	subl	$REGISTER_SAVE_AREA, %esp
++# if !DL_RUNTIME_RESOLVE_REALIGN_STACK
++	cfi_adjust_cfa_offset(REGISTER_SAVE_AREA)
++# endif
++#else
++# if !DL_RUNTIME_RESOLVE_REALIGN_STACK
++#  error DL_RUNTIME_RESOLVE_REALIGN_STACK must be true
++# endif
++	/* Allocate stack space of the required size to save the state.  */
++	LOAD_PIC_REG (cx)
++	subl	RTLD_GLOBAL_RO_DL_X86_CPU_FEATURES_OFFSET+XSAVE_STATE_SIZE_OFFSET+_rtld_local_ro@GOTOFF(%ecx), %esp
++#endif
++#ifdef USE_FNSAVE
++	fnsave	(%esp)
++#elif defined USE_FXSAVE
++	fxsave	(%esp)
++#else
++	/* Save the argument for ___tls_get_addr in EAX.  */
++	movl	%eax, %ecx
++	movl	$TLSDESC_CALL_STATE_SAVE_MASK, %eax
++	xorl	%edx, %edx
++	/* Clear the XSAVE Header.  */
++# ifdef USE_XSAVE
++	movl	%edx, (512)(%esp)
++	movl	%edx, (512 + 4 * 1)(%esp)
++	movl	%edx, (512 + 4 * 2)(%esp)
++	movl	%edx, (512 + 4 * 3)(%esp)
++# endif
++	movl	%edx, (512 + 4 * 4)(%esp)
++	movl	%edx, (512 + 4 * 5)(%esp)
++	movl	%edx, (512 + 4 * 6)(%esp)
++	movl	%edx, (512 + 4 * 7)(%esp)
++	movl	%edx, (512 + 4 * 8)(%esp)
++	movl	%edx, (512 + 4 * 9)(%esp)
++	movl	%edx, (512 + 4 * 10)(%esp)
++	movl	%edx, (512 + 4 * 11)(%esp)
++	movl	%edx, (512 + 4 * 12)(%esp)
++	movl	%edx, (512 + 4 * 13)(%esp)
++	movl	%edx, (512 + 4 * 14)(%esp)
++	movl	%edx, (512 + 4 * 15)(%esp)
++# ifdef USE_XSAVE
++	xsave	(%esp)
++# else
++	xsavec	(%esp)
++# endif
++	/* Restore the argument for ___tls_get_addr in EAX.  */
++	movl	%ecx, %eax
++#endif
++	call	HIDDEN_JUMPTARGET (___tls_get_addr)
++	/* Get register content back.  */
++#ifdef USE_FNSAVE
++	frstor	(%esp)
++#elif defined USE_FXSAVE
++	fxrstor	(%esp)
++#else
++	/* Save and retore ___tls_get_addr return value stored in EAX.  */
++	movl	%eax, %ecx
++	movl	$TLSDESC_CALL_STATE_SAVE_MASK, %eax
++	xorl	%edx, %edx
++	xrstor	(%esp)
++	movl	%ecx, %eax
++#endif
++#if DL_RUNTIME_RESOLVE_REALIGN_STACK
++	mov	%ebx, %esp
++	cfi_def_cfa_register(%esp)
++	movl	-28(%esp), %ebx
++	cfi_restore(%ebx)
++#else
++	addl	$REGISTER_SAVE_AREA, %esp
++	cfi_adjust_cfa_offset(-REGISTER_SAVE_AREA)
++#endif
++	jmp	1b
++	cfi_endproc
++	.size	_dl_tlsdesc_dynamic, .-_dl_tlsdesc_dynamic
++
++#undef STATE_SAVE_ALIGNMENT
+diff --git a/sysdeps/i386/dl-tlsdesc.S b/sysdeps/i386/dl-tlsdesc.S
+index 90d93caa0c..f002feee56 100644
+--- a/sysdeps/i386/dl-tlsdesc.S
++++ b/sysdeps/i386/dl-tlsdesc.S
+@@ -18,8 +18,27 @@
+ 
+ #include <sysdep.h>
+ #include <tls.h>
++#include <cpu-features-offsets.h>
++#include <features-offsets.h>
+ #include "tlsdesc.h"
+ 
++#ifndef DL_STACK_ALIGNMENT
++/* Due to GCC bug:
++
++   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58066
++
++   __tls_get_addr may be called with 4-byte stack alignment.  Although
++   this bug has been fixed in GCC 4.9.4, 5.3 and 6, we can't assume
++   that stack will be always aligned at 16 bytes.  */
++# define DL_STACK_ALIGNMENT 4
++#endif
++
++/* True if _dl_tlsdesc_dynamic should align stack for STATE_SAVE or align
++   stack to MINIMUM_ALIGNMENT bytes before calling ___tls_get_addr.  */
++#define DL_RUNTIME_RESOLVE_REALIGN_STACK \
++  (STATE_SAVE_ALIGNMENT > DL_STACK_ALIGNMENT \
++   || MINIMUM_ALIGNMENT > DL_STACK_ALIGNMENT)
++
+ 	.text
+ 
+      /* This function is used to compute the TP offset for symbols in
+@@ -65,69 +84,35 @@ _dl_tlsdesc_undefweak:
+ 	.size	_dl_tlsdesc_undefweak, .-_dl_tlsdesc_undefweak
+ 
+ #ifdef SHARED
+-	.hidden _dl_tlsdesc_dynamic
+-	.global	_dl_tlsdesc_dynamic
+-	.type	_dl_tlsdesc_dynamic,@function
+-
+-     /* This function is used for symbols that need dynamic TLS.
+-
+-	%eax points to the TLS descriptor, such that 0(%eax) points to
+-	_dl_tlsdesc_dynamic itself, and 4(%eax) points to a struct
+-	tlsdesc_dynamic_arg object.  It must return in %eax the offset
+-	between the thread pointer and the object denoted by the
+-	argument, without clobbering any registers.
+-
+-	The assembly code that follows is a rendition of the following
+-	C code, hand-optimized a little bit.
+-
+-ptrdiff_t
+-__attribute__ ((__regparm__ (1)))
+-_dl_tlsdesc_dynamic (struct tlsdesc *tdp)
+-{
+-  struct tlsdesc_dynamic_arg *td = tdp->arg;
+-  dtv_t *dtv = *(dtv_t **)((char *)__thread_pointer + DTV_OFFSET);
+-  if (__builtin_expect (td->gen_count <= dtv[0].counter
+-			&& (dtv[td->tlsinfo.ti_module].pointer.val
+-			    != TLS_DTV_UNALLOCATED),
+-			1))
+-    return dtv[td->tlsinfo.ti_module].pointer.val + td->tlsinfo.ti_offset
+-      - __thread_pointer;
+-
+-  return ___tls_get_addr (&td->tlsinfo) - __thread_pointer;
+-}
+-*/
+-	cfi_startproc
+-	.align 16
+-_dl_tlsdesc_dynamic:
+-	/* Like all TLS resolvers, preserve call-clobbered registers.
+-	   We need two scratch regs anyway.  */
+-	subl	$28, %esp
+-	cfi_adjust_cfa_offset (28)
+-	movl	%ecx, 20(%esp)
+-	movl	%edx, 24(%esp)
+-	movl	TLSDESC_ARG(%eax), %eax
+-	movl	%gs:DTV_OFFSET, %edx
+-	movl	TLSDESC_GEN_COUNT(%eax), %ecx
+-	cmpl	(%edx), %ecx
+-	ja	.Lslow
+-	movl	TLSDESC_MODID(%eax), %ecx
+-	movl	(%edx,%ecx,8), %edx
+-	cmpl	$-1, %edx
+-	je	.Lslow
+-	movl	TLSDESC_MODOFF(%eax), %eax
+-	addl	%edx, %eax
+-.Lret:
+-	movl	20(%esp), %ecx
+-	subl	%gs:0, %eax
+-	movl	24(%esp), %edx
+-	addl	$28, %esp
+-	cfi_adjust_cfa_offset (-28)
+-	ret
+-	.p2align 4,,7
+-.Lslow:
+-	cfi_adjust_cfa_offset (28)
+-	call	HIDDEN_JUMPTARGET (___tls_get_addr)
+-	jmp	.Lret
+-	cfi_endproc
+-	.size	_dl_tlsdesc_dynamic, .-_dl_tlsdesc_dynamic
++# define USE_FNSAVE
++# define MINIMUM_ALIGNMENT	4
++# define STATE_SAVE_ALIGNMENT	4
++# define _dl_tlsdesc_dynamic	_dl_tlsdesc_dynamic_fnsave
++# include "dl-tlsdesc-dynamic.h"
++# undef _dl_tlsdesc_dynamic
++# undef MINIMUM_ALIGNMENT
++# undef USE_FNSAVE
++
++# define MINIMUM_ALIGNMENT	16
++
++# define USE_FXSAVE
++# define STATE_SAVE_ALIGNMENT	16
++# define _dl_tlsdesc_dynamic	_dl_tlsdesc_dynamic_fxsave
++# include "dl-tlsdesc-dynamic.h"
++# undef _dl_tlsdesc_dynamic
++# undef USE_FXSAVE
++
++# define USE_XSAVE
++# define STATE_SAVE_ALIGNMENT	64
++# define _dl_tlsdesc_dynamic	_dl_tlsdesc_dynamic_xsave
++# include "dl-tlsdesc-dynamic.h"
++# undef _dl_tlsdesc_dynamic
++# undef USE_XSAVE
++
++# define USE_XSAVEC
++# define STATE_SAVE_ALIGNMENT	64
++# define _dl_tlsdesc_dynamic	_dl_tlsdesc_dynamic_xsavec
++# include "dl-tlsdesc-dynamic.h"
++# undef _dl_tlsdesc_dynamic
++# undef USE_XSAVEC
+ #endif /* SHARED */
+diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile
+index 4d50b327b5..992aabe43e 100644
+--- a/sysdeps/x86/Makefile
++++ b/sysdeps/x86/Makefile
+@@ -1,5 +1,5 @@
+ ifeq ($(subdir),csu)
+-gen-as-const-headers += cpu-features-offsets.sym
++gen-as-const-headers += cpu-features-offsets.sym features-offsets.sym
+ endif
+ 
+ ifeq ($(subdir),elf)
+@@ -86,6 +86,11 @@ endif
+ tst-ifunc-isa-2-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=-SSE4_2,-AVX,-AVX2,-AVX512F
+ tst-ifunc-isa-2-static-ENV = $(tst-ifunc-isa-2-ENV)
+ tst-hwcap-tunables-ARGS = -- $(host-test-program-cmd)
++
++CFLAGS-tst-gnu2-tls2.c += -msse
++CFLAGS-tst-gnu2-tls2mod0.c += -msse2 -mtune=haswell
++CFLAGS-tst-gnu2-tls2mod1.c += -msse2 -mtune=haswell
++CFLAGS-tst-gnu2-tls2mod2.c += -msse2 -mtune=haswell
+ endif
+ 
+ ifeq ($(subdir),math)
+diff --git a/sysdeps/x86/cpu-features.c b/sysdeps/x86/cpu-features.c
+index 25e6622a79..835113b42f 100644
+--- a/sysdeps/x86/cpu-features.c
++++ b/sysdeps/x86/cpu-features.c
+@@ -27,8 +27,13 @@
+ extern void TUNABLE_CALLBACK (set_hwcaps) (tunable_val_t *)
+   attribute_hidden;
+ 
+-#if defined SHARED && defined __x86_64__
+-# include <dl-plt-rewrite.h>
++#if defined SHARED
++extern void _dl_tlsdesc_dynamic_fxsave (void) attribute_hidden;
++extern void _dl_tlsdesc_dynamic_xsave (void) attribute_hidden;
++extern void _dl_tlsdesc_dynamic_xsavec (void) attribute_hidden;
++
++# ifdef __x86_64__
++#  include <dl-plt-rewrite.h>
+ 
+ static void
+ TUNABLE_CALLBACK (set_plt_rewrite) (tunable_val_t *valp)
+@@ -47,6 +52,15 @@ TUNABLE_CALLBACK (set_plt_rewrite) (tunable_val_t *valp)
+ 		 : plt_rewrite_jmp);
+     }
+ }
++# else
++extern void _dl_tlsdesc_dynamic_fnsave (void) attribute_hidden;
++# endif
++#endif
++
++#ifdef __x86_64__
++extern void _dl_runtime_resolve_fxsave (void) attribute_hidden;
++extern void _dl_runtime_resolve_xsave (void) attribute_hidden;
++extern void _dl_runtime_resolve_xsavec (void) attribute_hidden;
+ #endif
+ 
+ #ifdef __LP64__
+@@ -1130,6 +1144,44 @@ no_cpuid:
+ 	       TUNABLE_CALLBACK (set_x86_shstk));
+ #endif
+ 
++  if (GLRO(dl_x86_cpu_features).xsave_state_size != 0)
++    {
++      if (CPU_FEATURE_USABLE_P (cpu_features, XSAVEC))
++	{
++#ifdef __x86_64__
++	  GLRO(dl_x86_64_runtime_resolve) = _dl_runtime_resolve_xsavec;
++#endif
++#ifdef SHARED
++	  GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_xsavec;
++#endif
++	}
++      else
++	{
++#ifdef __x86_64__
++	  GLRO(dl_x86_64_runtime_resolve) = _dl_runtime_resolve_xsave;
++#endif
++#ifdef SHARED
++	  GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_xsave;
++#endif
++	}
++    }
++  else
++    {
++#ifdef __x86_64__
++      GLRO(dl_x86_64_runtime_resolve) = _dl_runtime_resolve_fxsave;
++# ifdef SHARED
++      GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_fxsave;
++# endif
++#else
++# ifdef SHARED
++      if (CPU_FEATURE_USABLE_P (cpu_features, FXSR))
++	GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_fxsave;
++      else
++	GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_fnsave;
++# endif
++#endif
++    }
++
+ #ifdef SHARED
+ # ifdef __x86_64__
+   TUNABLE_GET (plt_rewrite, tunable_val_t *,
+diff --git a/sysdeps/x86/dl-procinfo.c b/sysdeps/x86/dl-procinfo.c
+index ee957b4d70..5920d4b320 100644
+--- a/sysdeps/x86/dl-procinfo.c
++++ b/sysdeps/x86/dl-procinfo.c
+@@ -86,3 +86,19 @@ PROCINFO_CLASS const char _dl_x86_platforms[4][9]
+ #else
+ ,
+ #endif
++
++#if defined SHARED && !IS_IN (ldconfig)
++# if !defined PROCINFO_DECL
++  ._dl_x86_tlsdesc_dynamic
++# else
++PROCINFO_CLASS void * _dl_x86_tlsdesc_dynamic
++# endif
++# ifndef PROCINFO_DECL
++= NULL
++# endif
++# ifdef PROCINFO_DECL
++;
++# else
++,
++# endif
++#endif
+diff --git a/sysdeps/x86_64/features-offsets.sym b/sysdeps/x86/features-offsets.sym
+similarity index 89%
+rename from sysdeps/x86_64/features-offsets.sym
+rename to sysdeps/x86/features-offsets.sym
+index 9e4be3393a..77e990c705 100644
+--- a/sysdeps/x86_64/features-offsets.sym
++++ b/sysdeps/x86/features-offsets.sym
+@@ -3,4 +3,6 @@
+ #include <ldsodefs.h>
+ 
+ RTLD_GLOBAL_RO_DL_X86_CPU_FEATURES_OFFSET offsetof (struct rtld_global_ro, _dl_x86_cpu_features)
++#ifdef __x86_64__
+ RTLD_GLOBAL_DL_X86_FEATURE_1_OFFSET offsetof (struct rtld_global, _dl_x86_feature_1)
++#endif
+diff --git a/sysdeps/x86/sysdep.h b/sysdeps/x86/sysdep.h
+index 837fd28734..485cad9c02 100644
+--- a/sysdeps/x86/sysdep.h
++++ b/sysdeps/x86/sysdep.h
+@@ -70,6 +70,12 @@
+    | (1 << X86_XSTATE_ZMM_H_ID))
+ #endif
+ 
++/* States which should be saved for TLSDESC_CALL and TLS_DESC_CALL.
++   Compiler assumes that all registers, including x87 FPU stack registers,
++   are unchanged after CALL, except for EFLAGS and RAX/EAX.  */
++#define TLSDESC_CALL_STATE_SAVE_MASK	\
++  (STATE_SAVE_MASK | (1 << X86_XSTATE_X87_ID))
++
+ /* Constants for bits in __x86_string_control:  */
+ 
+ /* Avoid short distance REP MOVSB.  */
+diff --git a/sysdeps/x86/tst-gnu2-tls2.c b/sysdeps/x86/tst-gnu2-tls2.c
+new file mode 100644
+index 0000000000..de900a423b
+--- /dev/null
++++ b/sysdeps/x86/tst-gnu2-tls2.c
+@@ -0,0 +1,20 @@
++#ifndef __x86_64__
++#include <sys/platform/x86.h>
++
++#define IS_SUPPORTED() CPU_FEATURE_ACTIVE (SSE2)
++#endif
++
++/* Clear XMM0...XMM7  */
++#define PREPARE_MALLOC()				\
++{							\
++  asm volatile ("xorps %%xmm0, %%xmm0" : : : "xmm0" );	\
++  asm volatile ("xorps %%xmm1, %%xmm1" : : : "xmm1" );	\
++  asm volatile ("xorps %%xmm2, %%xmm2" : : : "xmm2" );	\
++  asm volatile ("xorps %%xmm3, %%xmm3" : : : "xmm3" );	\
++  asm volatile ("xorps %%xmm4, %%xmm4" : : : "xmm4" );	\
++  asm volatile ("xorps %%xmm5, %%xmm5" : : : "xmm5" );	\
++  asm volatile ("xorps %%xmm6, %%xmm6" : : : "xmm6" );	\
++  asm volatile ("xorps %%xmm7, %%xmm7" : : : "xmm7" );	\
++}
++
++#include <elf/tst-gnu2-tls2.c>
+diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile
+index 90f4ecfd26..e8babc9a4e 100644
+--- a/sysdeps/x86_64/Makefile
++++ b/sysdeps/x86_64/Makefile
+@@ -10,7 +10,7 @@ LDFLAGS-rtld += -Wl,-z,nomark-plt
+ endif
+ 
+ ifeq ($(subdir),csu)
+-gen-as-const-headers += features-offsets.sym link-defines.sym
++gen-as-const-headers += link-defines.sym
+ endif
+ 
+ ifeq ($(subdir),gmon)
+diff --git a/sysdeps/x86_64/dl-machine.h b/sysdeps/x86_64/dl-machine.h
+index 6d605d0d32..ff5d45f7cb 100644
+--- a/sysdeps/x86_64/dl-machine.h
++++ b/sysdeps/x86_64/dl-machine.h
+@@ -71,9 +71,6 @@ elf_machine_runtime_setup (struct link_map *l, struct r_scope_elem *scope[],
+ 			   int lazy, int profile)
+ {
+   Elf64_Addr *got;
+-  extern void _dl_runtime_resolve_fxsave (ElfW(Word)) attribute_hidden;
+-  extern void _dl_runtime_resolve_xsave (ElfW(Word)) attribute_hidden;
+-  extern void _dl_runtime_resolve_xsavec (ElfW(Word)) attribute_hidden;
+   extern void _dl_runtime_profile_sse (ElfW(Word)) attribute_hidden;
+   extern void _dl_runtime_profile_avx (ElfW(Word)) attribute_hidden;
+   extern void _dl_runtime_profile_avx512 (ElfW(Word)) attribute_hidden;
+@@ -96,8 +93,6 @@ elf_machine_runtime_setup (struct link_map *l, struct r_scope_elem *scope[],
+       /* Identify this shared object.  */
+       *(ElfW(Addr) *) (got + 1) = (ElfW(Addr)) l;
+ 
+-      const struct cpu_features* cpu_features = __get_cpu_features ();
+-
+ #ifdef SHARED
+       /* The got[2] entry contains the address of a function which gets
+ 	 called to get the address of a so far unresolved function and
+@@ -107,6 +102,7 @@ elf_machine_runtime_setup (struct link_map *l, struct r_scope_elem *scope[],
+ 	 end in this function.  */
+       if (__glibc_unlikely (profile))
+ 	{
++	  const struct cpu_features* cpu_features = __get_cpu_features ();
+ 	  if (X86_ISA_CPU_FEATURE_USABLE_P (cpu_features, AVX512F))
+ 	    *(ElfW(Addr) *) (got + 2) = (ElfW(Addr)) &_dl_runtime_profile_avx512;
+ 	  else if (X86_ISA_CPU_FEATURE_USABLE_P (cpu_features, AVX))
+@@ -126,15 +122,8 @@ elf_machine_runtime_setup (struct link_map *l, struct r_scope_elem *scope[],
+ 	  /* This function will get called to fix up the GOT entry
+ 	     indicated by the offset on the stack, and then jump to
+ 	     the resolved address.  */
+-	  if (MINIMUM_X86_ISA_LEVEL >= AVX_X86_ISA_LEVEL
+-	      || GLRO(dl_x86_cpu_features).xsave_state_size != 0)
+-	    *(ElfW(Addr) *) (got + 2)
+-	      = (CPU_FEATURE_USABLE_P (cpu_features, XSAVEC)
+-		 ? (ElfW(Addr)) &_dl_runtime_resolve_xsavec
+-		 : (ElfW(Addr)) &_dl_runtime_resolve_xsave);
+-	  else
+-	    *(ElfW(Addr) *) (got + 2)
+-	      = (ElfW(Addr)) &_dl_runtime_resolve_fxsave;
++	  *(ElfW(Addr) *) (got + 2)
++	    = (ElfW(Addr)) GLRO(dl_x86_64_runtime_resolve);
+ 	}
+     }
+ 
+@@ -383,7 +372,7 @@ and creates an unsatisfiable circular dependency.\n",
+ 		  {
+ 		    td->arg = _dl_make_tlsdesc_dynamic
+ 		      (sym_map, sym->st_value + reloc->r_addend);
+-		    td->entry = _dl_tlsdesc_dynamic;
++		    td->entry = GLRO(dl_x86_tlsdesc_dynamic);
+ 		  }
+ 		else
+ #  endif
+diff --git a/sysdeps/x86_64/dl-procinfo.c b/sysdeps/x86_64/dl-procinfo.c
+index 4d1d790fbb..06637a8154 100644
+--- a/sysdeps/x86_64/dl-procinfo.c
++++ b/sysdeps/x86_64/dl-procinfo.c
+@@ -41,5 +41,21 @@
+ 
+ #include <sysdeps/x86/dl-procinfo.c>
+ 
++#if !IS_IN (ldconfig)
++# if !defined PROCINFO_DECL && defined SHARED
++  ._dl_x86_64_runtime_resolve
++# else
++PROCINFO_CLASS void * _dl_x86_64_runtime_resolve
++# endif
++# ifndef PROCINFO_DECL
++= NULL
++# endif
++# if !defined SHARED || defined PROCINFO_DECL
++;
++# else
++,
++# endif
++#endif
++
+ #undef PROCINFO_DECL
+ #undef PROCINFO_CLASS
+diff --git a/sysdeps/x86_64/dl-tlsdesc-dynamic.h b/sysdeps/x86_64/dl-tlsdesc-dynamic.h
+new file mode 100644
+index 0000000000..0c2e8d5320
+--- /dev/null
++++ b/sysdeps/x86_64/dl-tlsdesc-dynamic.h
+@@ -0,0 +1,166 @@
++/* Thread-local storage handling in the ELF dynamic linker.  x86_64 version.
++   Copyright (C) 2004-2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#ifndef SECTION
++# define SECTION(p)	p
++#endif
++
++#undef REGISTER_SAVE_AREA
++#undef LOCAL_STORAGE_AREA
++#undef BASE
++
++#include "dl-trampoline-state.h"
++
++	.section SECTION(.text),"ax",@progbits
++
++	.hidden _dl_tlsdesc_dynamic
++	.global	_dl_tlsdesc_dynamic
++	.type	_dl_tlsdesc_dynamic,@function
++
++     /* %rax points to the TLS descriptor, such that 0(%rax) points to
++	_dl_tlsdesc_dynamic itself, and 8(%rax) points to a struct
++	tlsdesc_dynamic_arg object.  It must return in %rax the offset
++	between the thread pointer and the object denoted by the
++	argument, without clobbering any registers.
++
++	The assembly code that follows is a rendition of the following
++	C code, hand-optimized a little bit.
++
++ptrdiff_t
++_dl_tlsdesc_dynamic (register struct tlsdesc *tdp asm ("%rax"))
++{
++  struct tlsdesc_dynamic_arg *td = tdp->arg;
++  dtv_t *dtv = *(dtv_t **)((char *)__thread_pointer + DTV_OFFSET);
++  if (__builtin_expect (td->gen_count <= dtv[0].counter
++			&& (dtv[td->tlsinfo.ti_module].pointer.val
++			    != TLS_DTV_UNALLOCATED),
++			1))
++    return dtv[td->tlsinfo.ti_module].pointer.val + td->tlsinfo.ti_offset
++      - __thread_pointer;
++
++  return __tls_get_addr_internal (&td->tlsinfo) - __thread_pointer;
++}
++*/
++	cfi_startproc
++	.align 16
++_dl_tlsdesc_dynamic:
++	_CET_ENDBR
++	/* Preserve call-clobbered registers that we modify.
++	   We need two scratch regs anyway.  */
++	movq	%rsi, -16(%rsp)
++	mov	%fs:DTV_OFFSET, %RSI_LP
++	movq	%rdi, -8(%rsp)
++	movq	TLSDESC_ARG(%rax), %rdi
++	movq	(%rsi), %rax
++	cmpq	%rax, TLSDESC_GEN_COUNT(%rdi)
++	ja	2f
++	movq	TLSDESC_MODID(%rdi), %rax
++	salq	$4, %rax
++	movq	(%rax,%rsi), %rax
++	cmpq	$-1, %rax
++	je	2f
++	addq	TLSDESC_MODOFF(%rdi), %rax
++1:
++	movq	-16(%rsp), %rsi
++	sub	%fs:0, %RAX_LP
++	movq	-8(%rsp), %rdi
++	ret
++2:
++#if DL_RUNTIME_RESOLVE_REALIGN_STACK
++	movq	%rbx, -24(%rsp)
++	mov	%RSP_LP, %RBX_LP
++	cfi_def_cfa_register(%rbx)
++	and	$-STATE_SAVE_ALIGNMENT, %RSP_LP
++#endif
++#ifdef REGISTER_SAVE_AREA
++# if DL_RUNTIME_RESOLVE_REALIGN_STACK
++	/* STATE_SAVE_OFFSET has space for 8 integer registers.  But we
++	   need space for RCX, RDX, RSI, RDI, R8, R9, R10 and R11, plus
++	   RBX above.  */
++	sub	$(REGISTER_SAVE_AREA + STATE_SAVE_ALIGNMENT), %RSP_LP
++# else
++	sub	$REGISTER_SAVE_AREA, %RSP_LP
++	cfi_adjust_cfa_offset(REGISTER_SAVE_AREA)
++# endif
++#else
++	/* Allocate stack space of the required size to save the state.  */
++	sub	_rtld_local_ro+RTLD_GLOBAL_RO_DL_X86_CPU_FEATURES_OFFSET+XSAVE_STATE_SIZE_OFFSET(%rip), %RSP_LP
++#endif
++	/* Besides rdi and rsi, saved above, save rcx, rdx, r8, r9,
++	   r10 and r11.  */
++	movq	%rcx, REGISTER_SAVE_RCX(%rsp)
++	movq	%rdx, REGISTER_SAVE_RDX(%rsp)
++	movq	%r8, REGISTER_SAVE_R8(%rsp)
++	movq	%r9, REGISTER_SAVE_R9(%rsp)
++	movq	%r10, REGISTER_SAVE_R10(%rsp)
++	movq	%r11, REGISTER_SAVE_R11(%rsp)
++#ifdef USE_FXSAVE
++	fxsave	STATE_SAVE_OFFSET(%rsp)
++#else
++	movl	$TLSDESC_CALL_STATE_SAVE_MASK, %eax
++	xorl	%edx, %edx
++	/* Clear the XSAVE Header.  */
++# ifdef USE_XSAVE
++	movq	%rdx, (STATE_SAVE_OFFSET + 512)(%rsp)
++	movq	%rdx, (STATE_SAVE_OFFSET + 512 + 8)(%rsp)
++# endif
++	movq	%rdx, (STATE_SAVE_OFFSET + 512 + 8 * 2)(%rsp)
++	movq	%rdx, (STATE_SAVE_OFFSET + 512 + 8 * 3)(%rsp)
++	movq	%rdx, (STATE_SAVE_OFFSET + 512 + 8 * 4)(%rsp)
++	movq	%rdx, (STATE_SAVE_OFFSET + 512 + 8 * 5)(%rsp)
++	movq	%rdx, (STATE_SAVE_OFFSET + 512 + 8 * 6)(%rsp)
++	movq	%rdx, (STATE_SAVE_OFFSET + 512 + 8 * 7)(%rsp)
++# ifdef USE_XSAVE
++	xsave	STATE_SAVE_OFFSET(%rsp)
++# else
++	xsavec	STATE_SAVE_OFFSET(%rsp)
++# endif
++#endif
++	/* %rdi already points to the tlsinfo data structure.  */
++	call	HIDDEN_JUMPTARGET (__tls_get_addr)
++	# Get register content back.
++#ifdef USE_FXSAVE
++	fxrstor	STATE_SAVE_OFFSET(%rsp)
++#else
++	/* Save and retore __tls_get_addr return value stored in RAX.  */
++	mov	%RAX_LP, %RCX_LP
++	movl	$TLSDESC_CALL_STATE_SAVE_MASK, %eax
++	xorl	%edx, %edx
++	xrstor	STATE_SAVE_OFFSET(%rsp)
++	mov	%RCX_LP, %RAX_LP
++#endif
++	movq	REGISTER_SAVE_R11(%rsp), %r11
++	movq	REGISTER_SAVE_R10(%rsp), %r10
++	movq	REGISTER_SAVE_R9(%rsp), %r9
++	movq	REGISTER_SAVE_R8(%rsp), %r8
++	movq	REGISTER_SAVE_RDX(%rsp), %rdx
++	movq	REGISTER_SAVE_RCX(%rsp), %rcx
++#if DL_RUNTIME_RESOLVE_REALIGN_STACK
++	mov	%RBX_LP, %RSP_LP
++	cfi_def_cfa_register(%rsp)
++	movq	-24(%rsp), %rbx
++	cfi_restore(%rbx)
++#else
++	add	$REGISTER_SAVE_AREA, %RSP_LP
++	cfi_adjust_cfa_offset(-REGISTER_SAVE_AREA)
++#endif
++	jmp	1b
++	cfi_endproc
++	.size	_dl_tlsdesc_dynamic, .-_dl_tlsdesc_dynamic
++
++#undef STATE_SAVE_ALIGNMENT
+diff --git a/sysdeps/x86_64/dl-tlsdesc.S b/sysdeps/x86_64/dl-tlsdesc.S
+index f748af2ece..ea69f5223a 100644
+--- a/sysdeps/x86_64/dl-tlsdesc.S
++++ b/sysdeps/x86_64/dl-tlsdesc.S
+@@ -18,7 +18,19 @@
+ 
+ #include <sysdep.h>
+ #include <tls.h>
++#include <cpu-features-offsets.h>
++#include <features-offsets.h>
+ #include "tlsdesc.h"
++#include "dl-trampoline-save.h"
++
++/* Area on stack to save and restore registers used for parameter
++   passing when calling _dl_tlsdesc_dynamic.  */
++#define REGISTER_SAVE_RCX	0
++#define REGISTER_SAVE_RDX	(REGISTER_SAVE_RCX + 8)
++#define REGISTER_SAVE_R8	(REGISTER_SAVE_RDX + 8)
++#define REGISTER_SAVE_R9	(REGISTER_SAVE_R8 + 8)
++#define REGISTER_SAVE_R10	(REGISTER_SAVE_R9 + 8)
++#define REGISTER_SAVE_R11	(REGISTER_SAVE_R10 + 8)
+ 
+ 	.text
+ 
+@@ -67,80 +79,24 @@ _dl_tlsdesc_undefweak:
+ 	.size	_dl_tlsdesc_undefweak, .-_dl_tlsdesc_undefweak
+ 
+ #ifdef SHARED
+-	.hidden _dl_tlsdesc_dynamic
+-	.global	_dl_tlsdesc_dynamic
+-	.type	_dl_tlsdesc_dynamic,@function
+-
+-     /* %rax points to the TLS descriptor, such that 0(%rax) points to
+-	_dl_tlsdesc_dynamic itself, and 8(%rax) points to a struct
+-	tlsdesc_dynamic_arg object.  It must return in %rax the offset
+-	between the thread pointer and the object denoted by the
+-	argument, without clobbering any registers.
+-
+-	The assembly code that follows is a rendition of the following
+-	C code, hand-optimized a little bit.
+-
+-ptrdiff_t
+-_dl_tlsdesc_dynamic (register struct tlsdesc *tdp asm ("%rax"))
+-{
+-  struct tlsdesc_dynamic_arg *td = tdp->arg;
+-  dtv_t *dtv = *(dtv_t **)((char *)__thread_pointer + DTV_OFFSET);
+-  if (__builtin_expect (td->gen_count <= dtv[0].counter
+-			&& (dtv[td->tlsinfo.ti_module].pointer.val
+-			    != TLS_DTV_UNALLOCATED),
+-			1))
+-    return dtv[td->tlsinfo.ti_module].pointer.val + td->tlsinfo.ti_offset
+-      - __thread_pointer;
+-
+-  return __tls_get_addr_internal (&td->tlsinfo) - __thread_pointer;
+-}
+-*/
+-	cfi_startproc
+-	.align 16
+-_dl_tlsdesc_dynamic:
+-	_CET_ENDBR
+-	/* Preserve call-clobbered registers that we modify.
+-	   We need two scratch regs anyway.  */
+-	movq	%rsi, -16(%rsp)
+-	mov	%fs:DTV_OFFSET, %RSI_LP
+-	movq	%rdi, -8(%rsp)
+-	movq	TLSDESC_ARG(%rax), %rdi
+-	movq	(%rsi), %rax
+-	cmpq	%rax, TLSDESC_GEN_COUNT(%rdi)
+-	ja	.Lslow
+-	movq	TLSDESC_MODID(%rdi), %rax
+-	salq	$4, %rax
+-	movq	(%rax,%rsi), %rax
+-	cmpq	$-1, %rax
+-	je	.Lslow
+-	addq	TLSDESC_MODOFF(%rdi), %rax
+-.Lret:
+-	movq	-16(%rsp), %rsi
+-	sub	%fs:0, %RAX_LP
+-	movq	-8(%rsp), %rdi
+-	ret
+-.Lslow:
+-	/* Besides rdi and rsi, saved above, save rdx, rcx, r8, r9,
+-	   r10 and r11.  Also, align the stack, that's off by 8 bytes.	*/
+-	subq	$72, %rsp
+-	cfi_adjust_cfa_offset (72)
+-	movq	%rdx, 8(%rsp)
+-	movq	%rcx, 16(%rsp)
+-	movq	%r8, 24(%rsp)
+-	movq	%r9, 32(%rsp)
+-	movq	%r10, 40(%rsp)
+-	movq	%r11, 48(%rsp)
+-	/* %rdi already points to the tlsinfo data structure.  */
+-	call	HIDDEN_JUMPTARGET (__tls_get_addr)
+-	movq	8(%rsp), %rdx
+-	movq	16(%rsp), %rcx
+-	movq	24(%rsp), %r8
+-	movq	32(%rsp), %r9
+-	movq	40(%rsp), %r10
+-	movq	48(%rsp), %r11
+-	addq	$72, %rsp
+-	cfi_adjust_cfa_offset (-72)
+-	jmp	.Lret
+-	cfi_endproc
+-	.size	_dl_tlsdesc_dynamic, .-_dl_tlsdesc_dynamic
++# define USE_FXSAVE
++# define STATE_SAVE_ALIGNMENT	16
++# define _dl_tlsdesc_dynamic	_dl_tlsdesc_dynamic_fxsave
++# include "dl-tlsdesc-dynamic.h"
++# undef _dl_tlsdesc_dynamic
++# undef USE_FXSAVE
++
++# define USE_XSAVE
++# define STATE_SAVE_ALIGNMENT	64
++# define _dl_tlsdesc_dynamic	_dl_tlsdesc_dynamic_xsave
++# include "dl-tlsdesc-dynamic.h"
++# undef _dl_tlsdesc_dynamic
++# undef USE_XSAVE
++
++# define USE_XSAVEC
++# define STATE_SAVE_ALIGNMENT	64
++# define _dl_tlsdesc_dynamic	_dl_tlsdesc_dynamic_xsavec
++# include "dl-tlsdesc-dynamic.h"
++# undef _dl_tlsdesc_dynamic
++# undef USE_XSAVEC
+ #endif /* SHARED */
+diff --git a/sysdeps/x86_64/dl-trampoline-save.h b/sysdeps/x86_64/dl-trampoline-save.h
+new file mode 100644
+index 0000000000..84eac4a8ac
+--- /dev/null
++++ b/sysdeps/x86_64/dl-trampoline-save.h
+@@ -0,0 +1,34 @@
++/* x86-64 PLT trampoline register save macros.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#ifndef DL_STACK_ALIGNMENT
++/* Due to GCC bug:
++
++   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58066
++
++   __tls_get_addr may be called with 8-byte stack alignment.  Although
++   this bug has been fixed in GCC 4.9.4, 5.3 and 6, we can't assume
++   that stack will be always aligned at 16 bytes.  */
++# define DL_STACK_ALIGNMENT 8
++#endif
++
++/* True if _dl_runtime_resolve should align stack for STATE_SAVE or align
++   stack to 16 bytes before calling _dl_fixup.  */
++#define DL_RUNTIME_RESOLVE_REALIGN_STACK \
++  (STATE_SAVE_ALIGNMENT > DL_STACK_ALIGNMENT \
++   || 16 > DL_STACK_ALIGNMENT)
+diff --git a/sysdeps/x86_64/dl-trampoline-state.h b/sysdeps/x86_64/dl-trampoline-state.h
+new file mode 100644
+index 0000000000..575f120797
+--- /dev/null
++++ b/sysdeps/x86_64/dl-trampoline-state.h
+@@ -0,0 +1,51 @@
++/* x86-64 PLT dl-trampoline state macros.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#if (STATE_SAVE_ALIGNMENT % 16) != 0
++# error STATE_SAVE_ALIGNMENT must be multiple of 16
++#endif
++
++#if (STATE_SAVE_OFFSET % STATE_SAVE_ALIGNMENT) != 0
++# error STATE_SAVE_OFFSET must be multiple of STATE_SAVE_ALIGNMENT
++#endif
++
++#if DL_RUNTIME_RESOLVE_REALIGN_STACK
++/* Local stack area before jumping to function address: RBX.  */
++# define LOCAL_STORAGE_AREA	8
++# define BASE			rbx
++# ifdef USE_FXSAVE
++/* Use fxsave to save XMM registers.  */
++#  define REGISTER_SAVE_AREA	(512 + STATE_SAVE_OFFSET)
++#  if (REGISTER_SAVE_AREA % 16) != 0
++#   error REGISTER_SAVE_AREA must be multiple of 16
++#  endif
++# endif
++#else
++# ifndef USE_FXSAVE
++#  error USE_FXSAVE must be defined
++# endif
++/* Use fxsave to save XMM registers.  */
++# define REGISTER_SAVE_AREA	(512 + STATE_SAVE_OFFSET + 8)
++/* Local stack area before jumping to function address:  All saved
++   registers.  */
++# define LOCAL_STORAGE_AREA	REGISTER_SAVE_AREA
++# define BASE			rsp
++# if (REGISTER_SAVE_AREA % 16) != 8
++#  error REGISTER_SAVE_AREA must be odd multiple of 8
++# endif
++#endif
+diff --git a/sysdeps/x86_64/dl-trampoline.S b/sysdeps/x86_64/dl-trampoline.S
+index b2e7e0f69b..87c5137837 100644
+--- a/sysdeps/x86_64/dl-trampoline.S
++++ b/sysdeps/x86_64/dl-trampoline.S
+@@ -22,25 +22,7 @@
+ #include <features-offsets.h>
+ #include <link-defines.h>
+ #include <isa-level.h>
+-
+-#ifndef DL_STACK_ALIGNMENT
+-/* Due to GCC bug:
+-
+-   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58066
+-
+-   __tls_get_addr may be called with 8-byte stack alignment.  Although
+-   this bug has been fixed in GCC 4.9.4, 5.3 and 6, we can't assume
+-   that stack will be always aligned at 16 bytes.  We use unaligned
+-   16-byte move to load and store SSE registers, which has no penalty
+-   on modern processors if stack is 16-byte aligned.  */
+-# define DL_STACK_ALIGNMENT 8
+-#endif
+-
+-/* True if _dl_runtime_resolve should align stack for STATE_SAVE or align
+-   stack to 16 bytes before calling _dl_fixup.  */
+-#define DL_RUNTIME_RESOLVE_REALIGN_STACK \
+-  (STATE_SAVE_ALIGNMENT > DL_STACK_ALIGNMENT \
+-   || 16 > DL_STACK_ALIGNMENT)
++#include "dl-trampoline-save.h"
+ 
+ /* Area on stack to save and restore registers used for parameter
+    passing when calling _dl_fixup.  */
+diff --git a/sysdeps/x86_64/dl-trampoline.h b/sysdeps/x86_64/dl-trampoline.h
+index f55c6ea040..d9ccfb40d4 100644
+--- a/sysdeps/x86_64/dl-trampoline.h
++++ b/sysdeps/x86_64/dl-trampoline.h
+@@ -27,39 +27,7 @@
+ # undef LOCAL_STORAGE_AREA
+ # undef BASE
+ 
+-# if (STATE_SAVE_ALIGNMENT % 16) != 0
+-#  error STATE_SAVE_ALIGNMENT must be multiple of 16
+-# endif
+-
+-# if (STATE_SAVE_OFFSET % STATE_SAVE_ALIGNMENT) != 0
+-#  error STATE_SAVE_OFFSET must be multiple of STATE_SAVE_ALIGNMENT
+-# endif
+-
+-# if DL_RUNTIME_RESOLVE_REALIGN_STACK
+-/* Local stack area before jumping to function address: RBX.  */
+-#  define LOCAL_STORAGE_AREA	8
+-#  define BASE			rbx
+-#  ifdef USE_FXSAVE
+-/* Use fxsave to save XMM registers.  */
+-#   define REGISTER_SAVE_AREA	(512 + STATE_SAVE_OFFSET)
+-#   if (REGISTER_SAVE_AREA % 16) != 0
+-#    error REGISTER_SAVE_AREA must be multiple of 16
+-#   endif
+-#  endif
+-# else
+-#  ifndef USE_FXSAVE
+-#   error USE_FXSAVE must be defined
+-#  endif
+-/* Use fxsave to save XMM registers.  */
+-#  define REGISTER_SAVE_AREA	(512 + STATE_SAVE_OFFSET + 8)
+-/* Local stack area before jumping to function address:  All saved
+-   registers.  */
+-#  define LOCAL_STORAGE_AREA	REGISTER_SAVE_AREA
+-#  define BASE			rsp
+-#  if (REGISTER_SAVE_AREA % 16) != 8
+-#   error REGISTER_SAVE_AREA must be odd multiple of 8
+-#  endif
+-# endif
++# include "dl-trampoline-state.h"
+ 
+ 	.globl _dl_runtime_resolve
+ 	.hidden _dl_runtime_resolve
+
+commit 853e915fdd6ae6c5f1a7a68d2594ec8dbfef1286
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Wed Feb 28 12:08:03 2024 -0800
+
+    x86-64: Update _dl_tlsdesc_dynamic to preserve AMX registers
+    
+    _dl_tlsdesc_dynamic should also preserve AMX registers which are
+    caller-saved.  Add X86_XSTATE_TILECFG_ID and X86_XSTATE_TILEDATA_ID
+    to x86-64 TLSDESC_CALL_STATE_SAVE_MASK.  Compute the AMX state size
+    and save it in xsave_state_full_size which is only used by
+    _dl_tlsdesc_dynamic_xsave and _dl_tlsdesc_dynamic_xsavec.  This fixes
+    the AMX part of BZ #31372.  Tested on AMX processor.
+    
+    AMX test is enabled only for compilers with the fix for
+    
+    https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114098
+    
+    GCC 14 and GCC 11/12/13 branches have the bug fix.
+    Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com>
+    
+    (cherry picked from commit 9b7091415af47082664717210ac49d51551456ab)
+
+diff --git a/sysdeps/unix/sysv/linux/x86_64/Makefile b/sysdeps/unix/sysv/linux/x86_64/Makefile
+index 4223feb95f..9a1e7aa646 100644
+--- a/sysdeps/unix/sysv/linux/x86_64/Makefile
++++ b/sysdeps/unix/sysv/linux/x86_64/Makefile
+@@ -63,6 +63,33 @@ $(objpfx)libx86-64-isa-level%.os: $(..)/sysdeps/unix/sysv/linux/x86_64/x86-64-is
+ $(objpfx)libx86-64-isa-level.so: $(objpfx)libx86-64-isa-level-1.so
+ 	cp $< $@
+ endif
++
++ifeq (yes,$(have-mamx-tile))
++tests += \
++  tst-gnu2-tls2-amx \
++# tests
++
++modules-names += \
++  tst-gnu2-tls2-amx-mod0 \
++  tst-gnu2-tls2-amx-mod1 \
++  tst-gnu2-tls2-amx-mod2 \
++# modules-names
++
++$(objpfx)tst-gnu2-tls2-amx: $(shared-thread-library)
++$(objpfx)tst-gnu2-tls2-amx.out: \
++  $(objpfx)tst-gnu2-tls2-amx-mod0.so \
++  $(objpfx)tst-gnu2-tls2-amx-mod1.so \
++  $(objpfx)tst-gnu2-tls2-amx-mod2.so
++$(objpfx)tst-gnu2-tls2-amx-mod0.so: $(libsupport)
++$(objpfx)tst-gnu2-tls2-amx-mod1.so: $(libsupport)
++$(objpfx)tst-gnu2-tls2-amx-mod2.so: $(libsupport)
++
++CFLAGS-tst-gnu2-tls2-amx.c += -mamx-tile
++CFLAGS-tst-gnu2-tls2-amx-mod0.c += -mamx-tile -mtls-dialect=gnu2
++CFLAGS-tst-gnu2-tls2-amx-mod1.c += -mamx-tile -mtls-dialect=gnu2
++CFLAGS-tst-gnu2-tls2-amx-mod2.c += -mamx-tile -mtls-dialect=gnu2
++endif
++
+ endif # $(subdir) == elf
+ 
+ ifneq ($(enable-cet),no)
+diff --git a/sysdeps/unix/sysv/linux/x86_64/include/asm/prctl.h b/sysdeps/unix/sysv/linux/x86_64/include/asm/prctl.h
+index 2f511321ad..ef4631bf4b 100644
+--- a/sysdeps/unix/sysv/linux/x86_64/include/asm/prctl.h
++++ b/sysdeps/unix/sysv/linux/x86_64/include/asm/prctl.h
+@@ -20,3 +20,8 @@
+ # define ARCH_SHSTK_SHSTK		0x1
+ # define ARCH_SHSTK_WRSS		0x2
+ #endif
++
++#ifndef ARCH_GET_XCOMP_PERM
++# define ARCH_GET_XCOMP_PERM		0x1022
++# define ARCH_REQ_XCOMP_PERM		0x1023
++#endif
+diff --git a/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx-mod0.c b/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx-mod0.c
+new file mode 100644
+index 0000000000..2e0c7b91b7
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx-mod0.c
+@@ -0,0 +1,2 @@
++#include "tst-gnu2-tls2-amx.h"
++#include <tst-gnu2-tls2mod0.c>
+diff --git a/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx-mod1.c b/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx-mod1.c
+new file mode 100644
+index 0000000000..b8a8ccf1c1
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx-mod1.c
+@@ -0,0 +1,2 @@
++#include "tst-gnu2-tls2-amx.h"
++#include <tst-gnu2-tls2mod1.c>
+diff --git a/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx-mod2.c b/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx-mod2.c
+new file mode 100644
+index 0000000000..cdf4a8f363
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx-mod2.c
+@@ -0,0 +1,2 @@
++#include "tst-gnu2-tls2-amx.h"
++#include <tst-gnu2-tls2mod2.c>
+diff --git a/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx.c b/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx.c
+new file mode 100644
+index 0000000000..ae4dd82556
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx.c
+@@ -0,0 +1,83 @@
++/* Test TLSDESC relocation with AMX.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#include <stdbool.h>
++#include <asm/prctl.h>
++#include <support/check.h>
++#include "tst-gnu2-tls2-amx.h"
++
++extern int arch_prctl (int, ...);
++
++#define X86_XSTATE_TILECFG_ID	17
++#define X86_XSTATE_TILEDATA_ID	18
++
++/* Initialize tile config.  */
++__attribute__ ((noinline, noclone))
++static void
++init_tile_config (__tilecfg *tileinfo)
++{
++  int i;
++  tileinfo->palette_id = 1;
++  tileinfo->start_row = 0;
++
++  tileinfo->colsb[0] = MAX_ROWS;
++  tileinfo->rows[0] = MAX_ROWS;
++
++  for (i = 1; i < 4; ++i)
++  {
++    tileinfo->colsb[i] = MAX_COLS;
++    tileinfo->rows[i] = MAX_ROWS;
++  }
++
++  _tile_loadconfig (tileinfo);
++}
++
++static bool
++enable_amx (void)
++{
++  uint64_t bitmask;
++  if (arch_prctl (ARCH_GET_XCOMP_PERM, &bitmask) != 0)
++    return false;
++
++  if ((bitmask & (1 << X86_XSTATE_TILECFG_ID)) == 0)
++    return false;
++
++  if (arch_prctl (ARCH_REQ_XCOMP_PERM, X86_XSTATE_TILEDATA_ID) != 0)
++    return false;
++
++  /* Load tile configuration.  */
++  __tilecfg tile_data = { 0 };
++  init_tile_config (&tile_data);
++
++  return true;
++}
++
++/* An architecture can define it to clobber caller-saved registers in
++   malloc below to verify that the implicit TLSDESC call won't change
++   caller-saved registers.  */
++static void
++clear_tile_register (void)
++{
++  _tile_zero (2);
++}
++
++#define MOD(i) "tst-gnu2-tls2-amx-mod" #i ".so"
++#define IS_SUPPORTED()	enable_amx ()
++#define PREPARE_MALLOC() clear_tile_register ()
++
++#include <elf/tst-gnu2-tls2.c>
+diff --git a/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx.h b/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx.h
+new file mode 100644
+index 0000000000..1845a3caba
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/x86_64/tst-gnu2-tls2-amx.h
+@@ -0,0 +1,63 @@
++/* Test TLSDESC relocation with AMX.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#include <stdint.h>
++#include <string.h>
++#include <x86intrin.h>
++#include <support/check.h>
++
++#define MAX_ROWS 16
++#define MAX_COLS 64
++#define MAX 1024
++#define STRIDE 64
++
++typedef struct __tile_config
++{
++  uint8_t palette_id;
++  uint8_t start_row;
++  uint8_t reserved_0[14];
++  uint16_t colsb[16];
++  uint8_t rows[16];
++} __tilecfg __attribute__ ((aligned (64)));
++
++/* Initialize int8_t buffer */
++static inline void
++init_buffer (int8_t *buf, int8_t value)
++{
++  int rows, colsb, i, j;
++  rows  = MAX_ROWS;
++  colsb = MAX_COLS;
++
++  for (i = 0; i < rows; i++)
++    for (j = 0; j < colsb; j++)
++      buf[i * colsb + j] = value;
++}
++
++#define BEFORE_TLSDESC_CALL()					\
++  int8_t src[MAX];						\
++  int8_t res[MAX];						\
++  /* Initialize src with data  */				\
++  init_buffer (src, 2);						\
++  /* Load tile rows from memory.  */				\
++  _tile_loadd (2, src, STRIDE);
++
++#define AFTER_TLSDESC_CALL()					\
++  /* Store the tile data to memory.  */				\
++  _tile_stored (2, res, STRIDE);				\
++  _tile_release ();						\
++  TEST_VERIFY_EXIT (memcmp (src, res, sizeof (res)) == 0);
+diff --git a/sysdeps/x86/cpu-features-offsets.sym b/sysdeps/x86/cpu-features-offsets.sym
+index 6a8fd29813..21fc88d651 100644
+--- a/sysdeps/x86/cpu-features-offsets.sym
++++ b/sysdeps/x86/cpu-features-offsets.sym
+@@ -3,3 +3,4 @@
+ #include <ldsodefs.h>
+ 
+ XSAVE_STATE_SIZE_OFFSET	offsetof (struct cpu_features, xsave_state_size)
++XSAVE_STATE_FULL_SIZE_OFFSET offsetof (struct cpu_features, xsave_state_full_size)
+diff --git a/sysdeps/x86/cpu-features.c b/sysdeps/x86/cpu-features.c
+index 835113b42f..d71e8d3d2e 100644
+--- a/sysdeps/x86/cpu-features.c
++++ b/sysdeps/x86/cpu-features.c
+@@ -307,6 +307,8 @@ update_active (struct cpu_features *cpu_features)
+ 	  __cpuid_count (0xd, 0, eax, ebx, ecx, edx);
+ 	  if (ebx != 0)
+ 	    {
++	      /* NB: On AMX capable processors, ebx always includes AMX
++		 states.  */
+ 	      unsigned int xsave_state_full_size
+ 		= ALIGN_UP (ebx + STATE_SAVE_OFFSET, 64);
+ 
+@@ -320,6 +322,11 @@ update_active (struct cpu_features *cpu_features)
+ 		{
+ 		  unsigned int xstate_comp_offsets[32];
+ 		  unsigned int xstate_comp_sizes[32];
++#ifdef __x86_64__
++		  unsigned int xstate_amx_comp_offsets[32];
++		  unsigned int xstate_amx_comp_sizes[32];
++		  unsigned int amx_ecx;
++#endif
+ 		  unsigned int i;
+ 
+ 		  xstate_comp_offsets[0] = 0;
+@@ -327,16 +334,39 @@ update_active (struct cpu_features *cpu_features)
+ 		  xstate_comp_offsets[2] = 576;
+ 		  xstate_comp_sizes[0] = 160;
+ 		  xstate_comp_sizes[1] = 256;
++#ifdef __x86_64__
++		  xstate_amx_comp_offsets[0] = 0;
++		  xstate_amx_comp_offsets[1] = 160;
++		  xstate_amx_comp_offsets[2] = 576;
++		  xstate_amx_comp_sizes[0] = 160;
++		  xstate_amx_comp_sizes[1] = 256;
++#endif
+ 
+ 		  for (i = 2; i < 32; i++)
+ 		    {
+-		      if ((STATE_SAVE_MASK & (1 << i)) != 0)
++		      if ((FULL_STATE_SAVE_MASK & (1 << i)) != 0)
+ 			{
+ 			  __cpuid_count (0xd, i, eax, ebx, ecx, edx);
+-			  xstate_comp_sizes[i] = eax;
++#ifdef __x86_64__
++			  /* Include this in xsave_state_full_size.  */
++			  amx_ecx = ecx;
++			  xstate_amx_comp_sizes[i] = eax;
++			  if ((AMX_STATE_SAVE_MASK & (1 << i)) != 0)
++			    {
++			      /* Exclude this from xsave_state_size.  */
++			      ecx = 0;
++			      xstate_comp_sizes[i] = 0;
++			    }
++			  else
++#endif
++			    xstate_comp_sizes[i] = eax;
+ 			}
+ 		      else
+ 			{
++#ifdef __x86_64__
++			  amx_ecx = 0;
++			  xstate_amx_comp_sizes[i] = 0;
++#endif
+ 			  ecx = 0;
+ 			  xstate_comp_sizes[i] = 0;
+ 			}
+@@ -349,6 +379,15 @@ update_active (struct cpu_features *cpu_features)
+ 			  if ((ecx & (1 << 1)) != 0)
+ 			    xstate_comp_offsets[i]
+ 			      = ALIGN_UP (xstate_comp_offsets[i], 64);
++#ifdef __x86_64__
++			  xstate_amx_comp_offsets[i]
++			    = (xstate_amx_comp_offsets[i - 1]
++			       + xstate_amx_comp_sizes[i - 1]);
++			  if ((amx_ecx & (1 << 1)) != 0)
++			    xstate_amx_comp_offsets[i]
++			      = ALIGN_UP (xstate_amx_comp_offsets[i],
++					  64);
++#endif
+ 			}
+ 		    }
+ 
+@@ -357,6 +396,18 @@ update_active (struct cpu_features *cpu_features)
+ 		    = xstate_comp_offsets[31] + xstate_comp_sizes[31];
+ 		  if (size)
+ 		    {
++#ifdef __x86_64__
++		      unsigned int amx_size
++			= (xstate_amx_comp_offsets[31]
++			   + xstate_amx_comp_sizes[31]);
++		      amx_size = ALIGN_UP (amx_size + STATE_SAVE_OFFSET,
++					   64);
++		      /* Set xsave_state_full_size to the compact AMX
++			 state size for XSAVEC.  NB: xsave_state_full_size
++			 is only used in _dl_tlsdesc_dynamic_xsave and
++			 _dl_tlsdesc_dynamic_xsavec.  */
++		      cpu_features->xsave_state_full_size = amx_size;
++#endif
+ 		      cpu_features->xsave_state_size
+ 			= ALIGN_UP (size + STATE_SAVE_OFFSET, 64);
+ 		      CPU_FEATURE_SET (cpu_features, XSAVEC);
+diff --git a/sysdeps/x86/include/cpu-features.h b/sysdeps/x86/include/cpu-features.h
+index b9bf3115b6..cd7bd27cf3 100644
+--- a/sysdeps/x86/include/cpu-features.h
++++ b/sysdeps/x86/include/cpu-features.h
+@@ -934,6 +934,8 @@ struct cpu_features
+   /* The full state size for XSAVE when XSAVEC is disabled by
+ 
+      GLIBC_TUNABLES=glibc.cpu.hwcaps=-XSAVEC
++
++     and the AMX state size when XSAVEC is available.
+    */
+   unsigned int xsave_state_full_size;
+   /* Data cache size for use in memory and string routines, typically
+diff --git a/sysdeps/x86/sysdep.h b/sysdeps/x86/sysdep.h
+index 485cad9c02..db8e576e91 100644
+--- a/sysdeps/x86/sysdep.h
++++ b/sysdeps/x86/sysdep.h
+@@ -56,6 +56,14 @@
+    | (1 << X86_XSTATE_ZMM_H_ID) 	\
+    | (1 << X86_XSTATE_ZMM_ID)		\
+    | (1 << X86_XSTATE_APX_F_ID))
++
++/* AMX state mask.  */
++# define AMX_STATE_SAVE_MASK		\
++  ((1 << X86_XSTATE_TILECFG_ID) | (1 << X86_XSTATE_TILEDATA_ID))
++
++/* States to be included in xsave_state_full_size.  */
++# define FULL_STATE_SAVE_MASK		\
++  (STATE_SAVE_MASK | AMX_STATE_SAVE_MASK)
+ #else
+ /* Offset for fxsave/xsave area used by _dl_tlsdesc_dynamic.  Since i386
+    doesn't have red-zone, use 0 here.  */
+@@ -68,13 +76,17 @@
+    | (1 << X86_XSTATE_BNDREGS_ID)	\
+    | (1 << X86_XSTATE_K_ID)		\
+    | (1 << X86_XSTATE_ZMM_H_ID))
++
++/* States to be included in xsave_state_size.  */
++# define FULL_STATE_SAVE_MASK		STATE_SAVE_MASK
+ #endif
+ 
+ /* States which should be saved for TLSDESC_CALL and TLS_DESC_CALL.
+-   Compiler assumes that all registers, including x87 FPU stack registers,
+-   are unchanged after CALL, except for EFLAGS and RAX/EAX.  */
++   Compiler assumes that all registers, including AMX and x87 FPU
++   stack registers, are unchanged after CALL, except for EFLAGS and
++   RAX/EAX.  */
+ #define TLSDESC_CALL_STATE_SAVE_MASK	\
+-  (STATE_SAVE_MASK | (1 << X86_XSTATE_X87_ID))
++  (FULL_STATE_SAVE_MASK | (1 << X86_XSTATE_X87_ID))
+ 
+ /* Constants for bits in __x86_string_control:  */
+ 
+diff --git a/sysdeps/x86_64/configure b/sysdeps/x86_64/configure
+index 418cc4a9b8..04a534fa12 100755
+--- a/sysdeps/x86_64/configure
++++ b/sysdeps/x86_64/configure
+@@ -134,6 +134,34 @@ fi
+ config_vars="$config_vars
+ enable-cet = $enable_cet"
+ 
++# Check if -mamx-tile works properly.
++{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether -mamx-tile works properly" >&5
++printf %s "checking whether -mamx-tile works properly... " >&6; }
++if test ${libc_cv_x86_have_amx_tile+y}
++then :
++  printf %s "(cached) " >&6
++else $as_nop
++  cat > conftest.c <<EOF
++#include <x86intrin.h>
++EOF
++	       libc_cv_x86_have_amx_tile=no
++	       if { ac_try='${CC-cc} -E $CFLAGS -mamx-tile conftest.c > conftest.i'
++  { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
++  (eval $ac_try) 2>&5
++  ac_status=$?
++  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++  test $ac_status = 0; }; }; then
++		 if grep -q __builtin_ia32_ldtilecfg conftest.i; then
++		   libc_cv_x86_have_amx_tile=yes
++	         fi
++	       fi
++	       rm -rf conftest*
++fi
++{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $libc_cv_x86_have_amx_tile" >&5
++printf "%s\n" "$libc_cv_x86_have_amx_tile" >&6; }
++config_vars="$config_vars
++have-mamx-tile = $libc_cv_x86_have_amx_tile"
++
+ test -n "$critic_missing" && as_fn_error $? "
+ *** $critic_missing" "$LINENO" 5
+ 
+diff --git a/sysdeps/x86_64/configure.ac b/sysdeps/x86_64/configure.ac
+index d1f803c02e..c714c47351 100644
+--- a/sysdeps/x86_64/configure.ac
++++ b/sysdeps/x86_64/configure.ac
+@@ -61,5 +61,20 @@ elif test $enable_cet = permissive; then
+ fi
+ LIBC_CONFIG_VAR([enable-cet], [$enable_cet])
+ 
++# Check if -mamx-tile works properly.
++AC_CACHE_CHECK(whether -mamx-tile works properly,
++	       libc_cv_x86_have_amx_tile, [dnl
++cat > conftest.c <<EOF
++#include <x86intrin.h>
++EOF
++	       libc_cv_x86_have_amx_tile=no
++	       if AC_TRY_COMMAND(${CC-cc} -E $CFLAGS -mamx-tile conftest.c > conftest.i); then
++		 if grep -q __builtin_ia32_ldtilecfg conftest.i; then
++		   libc_cv_x86_have_amx_tile=yes
++	         fi
++	       fi
++	       rm -rf conftest*])
++LIBC_CONFIG_VAR([have-mamx-tile], [$libc_cv_x86_have_amx_tile])
++
+ test -n "$critic_missing" && AC_MSG_ERROR([
+ *** $critic_missing])
+diff --git a/sysdeps/x86_64/dl-tlsdesc-dynamic.h b/sysdeps/x86_64/dl-tlsdesc-dynamic.h
+index 0c2e8d5320..9f02cfc3eb 100644
+--- a/sysdeps/x86_64/dl-tlsdesc-dynamic.h
++++ b/sysdeps/x86_64/dl-tlsdesc-dynamic.h
+@@ -99,7 +99,7 @@ _dl_tlsdesc_dynamic:
+ # endif
+ #else
+ 	/* Allocate stack space of the required size to save the state.  */
+-	sub	_rtld_local_ro+RTLD_GLOBAL_RO_DL_X86_CPU_FEATURES_OFFSET+XSAVE_STATE_SIZE_OFFSET(%rip), %RSP_LP
++	sub	_rtld_local_ro+RTLD_GLOBAL_RO_DL_X86_CPU_FEATURES_OFFSET+XSAVE_STATE_FULL_SIZE_OFFSET(%rip), %RSP_LP
+ #endif
+ 	/* Besides rdi and rsi, saved above, save rcx, rdx, r8, r9,
+ 	   r10 and r11.  */
+
+commit 354cabcb2634abe16da7a2ba5e648aac1204b58e
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Mon Mar 18 06:40:16 2024 -0700
+
+    x86-64: Allocate state buffer space for RDI, RSI and RBX
+    
+    _dl_tlsdesc_dynamic preserves RDI, RSI and RBX before realigning stack.
+    After realigning stack, it saves RCX, RDX, R8, R9, R10 and R11.  Define
+    TLSDESC_CALL_REGISTER_SAVE_AREA to allocate space for RDI, RSI and RBX
+    to avoid clobbering saved RDI, RSI and RBX values on stack by xsave to
+    STATE_SAVE_OFFSET(%rsp).
+    
+       +==================+<- stack frame start aligned at 8 or 16 bytes
+       |                  |<- RDI saved in the red zone
+       |                  |<- RSI saved in the red zone
+       |                  |<- RBX saved in the red zone
+       |                  |<- paddings for stack realignment of 64 bytes
+       |------------------|<- xsave buffer end aligned at 64 bytes
+       |                  |<-
+       |                  |<-
+       |                  |<-
+       |------------------|<- xsave buffer start at STATE_SAVE_OFFSET(%rsp)
+       |                  |<- 8-byte padding for 64-byte alignment
+       |                  |<- 8-byte padding for 64-byte alignment
+       |                  |<- R11
+       |                  |<- R10
+       |                  |<- R9
+       |                  |<- R8
+       |                  |<- RDX
+       |                  |<- RCX
+       +==================+<- RSP aligned at 64 bytes
+    
+    Define TLSDESC_CALL_REGISTER_SAVE_AREA, the total register save area size
+    for all integer registers by adding 24 to STATE_SAVE_OFFSET since RDI, RSI
+    and RBX are saved onto stack without adjusting stack pointer first, using
+    the red-zone.  This fixes BZ #31501.
+    Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com>
+    
+    (cherry picked from commit 717ebfa85c8240d32d0d19d86a484c31c55c9617)
+
+diff --git a/sysdeps/x86/cpu-features.c b/sysdeps/x86/cpu-features.c
+index d71e8d3d2e..6fe1b728c6 100644
+--- a/sysdeps/x86/cpu-features.c
++++ b/sysdeps/x86/cpu-features.c
+@@ -310,7 +310,7 @@ update_active (struct cpu_features *cpu_features)
+ 	      /* NB: On AMX capable processors, ebx always includes AMX
+ 		 states.  */
+ 	      unsigned int xsave_state_full_size
+-		= ALIGN_UP (ebx + STATE_SAVE_OFFSET, 64);
++		= ALIGN_UP (ebx + TLSDESC_CALL_REGISTER_SAVE_AREA, 64);
+ 
+ 	      cpu_features->xsave_state_size
+ 		= xsave_state_full_size;
+@@ -400,8 +400,10 @@ update_active (struct cpu_features *cpu_features)
+ 		      unsigned int amx_size
+ 			= (xstate_amx_comp_offsets[31]
+ 			   + xstate_amx_comp_sizes[31]);
+-		      amx_size = ALIGN_UP (amx_size + STATE_SAVE_OFFSET,
+-					   64);
++		      amx_size
++			= ALIGN_UP ((amx_size
++				     + TLSDESC_CALL_REGISTER_SAVE_AREA),
++				    64);
+ 		      /* Set xsave_state_full_size to the compact AMX
+ 			 state size for XSAVEC.  NB: xsave_state_full_size
+ 			 is only used in _dl_tlsdesc_dynamic_xsave and
+@@ -409,7 +411,8 @@ update_active (struct cpu_features *cpu_features)
+ 		      cpu_features->xsave_state_full_size = amx_size;
+ #endif
+ 		      cpu_features->xsave_state_size
+-			= ALIGN_UP (size + STATE_SAVE_OFFSET, 64);
++			= ALIGN_UP (size + TLSDESC_CALL_REGISTER_SAVE_AREA,
++				    64);
+ 		      CPU_FEATURE_SET (cpu_features, XSAVEC);
+ 		    }
+ 		}
+diff --git a/sysdeps/x86/sysdep.h b/sysdeps/x86/sysdep.h
+index db8e576e91..7359149e17 100644
+--- a/sysdeps/x86/sysdep.h
++++ b/sysdeps/x86/sysdep.h
+@@ -38,14 +38,59 @@
+ #ifdef __x86_64__
+ /* Offset for fxsave/xsave area used by _dl_runtime_resolve.  Also need
+    space to preserve RCX, RDX, RSI, RDI, R8, R9 and RAX.  It must be
+-   aligned to 16 bytes for fxsave and 64 bytes for xsave.
+-
+-   NB: Is is non-zero because of the 128-byte red-zone.  Some registers
+-   are saved on stack without adjusting stack pointer first.  When we
+-   update stack pointer to allocate more space, we need to take the
+-   red-zone into account.  */
++   aligned to 16 bytes for fxsave and 64 bytes for xsave.  It is non-zero
++   because MOV, instead of PUSH, is used to save registers onto stack.
++
++   +==================+<- stack frame start aligned at 8 or 16 bytes
++   |                  |<- paddings for stack realignment of 64 bytes
++   |------------------|<- xsave buffer end aligned at 64 bytes
++   |                  |<-
++   |                  |<-
++   |                  |<-
++   |------------------|<- xsave buffer start at STATE_SAVE_OFFSET(%rsp)
++   |                  |<- 8-byte padding for 64-byte alignment
++   |                  |<- R9
++   |                  |<- R8
++   |                  |<- RDI
++   |                  |<- RSI
++   |                  |<- RDX
++   |                  |<- RCX
++   |                  |<- RAX
++   +==================+<- RSP aligned at 64 bytes
++
++ */
+ # define STATE_SAVE_OFFSET (8 * 7 + 8)
+ 
++/* _dl_tlsdesc_dynamic preserves RDI, RSI and RBX before realigning
++   stack.  After realigning stack, it saves RCX, RDX, R8, R9, R10 and
++   R11.  Allocate space for RDI, RSI and RBX to avoid clobbering saved
++   RDI, RSI and RBX values on stack by xsave.
++
++   +==================+<- stack frame start aligned at 8 or 16 bytes
++   |                  |<- RDI saved in the red zone
++   |                  |<- RSI saved in the red zone
++   |                  |<- RBX saved in the red zone
++   |                  |<- paddings for stack realignment of 64 bytes
++   |------------------|<- xsave buffer end aligned at 64 bytes
++   |                  |<-
++   |                  |<-
++   |                  |<-
++   |------------------|<- xsave buffer start at STATE_SAVE_OFFSET(%rsp)
++   |                  |<- 8-byte padding for 64-byte alignment
++   |                  |<- 8-byte padding for 64-byte alignment
++   |                  |<- R11
++   |                  |<- R10
++   |                  |<- R9
++   |                  |<- R8
++   |                  |<- RDX
++   |                  |<- RCX
++   +==================+<- RSP aligned at 64 bytes
++
++   Define the total register save area size for all integer registers by
++   adding 24 to STATE_SAVE_OFFSET since RDI, RSI and RBX are saved onto
++   stack without adjusting stack pointer first, using the red-zone.  */
++# define TLSDESC_CALL_REGISTER_SAVE_AREA (STATE_SAVE_OFFSET + 24)
++
+ /* Save SSE, AVX, AVX512, mask, bound and APX registers.  Bound and APX
+    registers are mutually exclusive.  */
+ # define STATE_SAVE_MASK		\
+@@ -66,8 +111,9 @@
+   (STATE_SAVE_MASK | AMX_STATE_SAVE_MASK)
+ #else
+ /* Offset for fxsave/xsave area used by _dl_tlsdesc_dynamic.  Since i386
+-   doesn't have red-zone, use 0 here.  */
++   uses PUSH to save registers onto stack, use 0 here.  */
+ # define STATE_SAVE_OFFSET 0
++# define TLSDESC_CALL_REGISTER_SAVE_AREA 0
+ 
+ /* Save SSE, AVX, AXV512, mask and bound registers.   */
+ # define STATE_SAVE_MASK		\
+diff --git a/sysdeps/x86_64/tst-gnu2-tls2mod1.S b/sysdeps/x86_64/tst-gnu2-tls2mod1.S
+new file mode 100644
+index 0000000000..1d636669ba
+--- /dev/null
++++ b/sysdeps/x86_64/tst-gnu2-tls2mod1.S
+@@ -0,0 +1,87 @@
++/* Check if TLSDESC relocation preserves %rdi, %rsi and %rbx.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++
++/* On AVX512 machines, OFFSET == 40 caused _dl_tlsdesc_dynamic_xsavec
++   to clobber %rdi, %rsi and %rbx.  On Intel AVX CPUs, the state size
++   is 960 bytes and this test didn't fail.  It may be due to the unused
++   last 128 bytes.  On AMD AVX CPUs, the state size is 832 bytes and
++   this test might fail without the fix.  */
++#ifndef OFFSET
++# define OFFSET 40
++#endif
++
++	.text
++	.p2align 4
++	.globl	apply_tls
++	.type	apply_tls, @function
++apply_tls:
++	cfi_startproc
++	_CET_ENDBR
++	pushq	%rbp
++	cfi_def_cfa_offset (16)
++	cfi_offset (6, -16)
++	movdqu	(%RDI_LP), %xmm0
++	lea	tls_var1@TLSDESC(%rip), %RAX_LP
++	mov	%RSP_LP, %RBP_LP
++	cfi_def_cfa_register (6)
++	/* Align stack to 64 bytes.  */
++	and	$-64, %RSP_LP
++	sub	$OFFSET, %RSP_LP
++	pushq	%rbx
++	/* Set %ebx to 0xbadbeef.  */
++	movl	$0xbadbeef, %ebx
++	movl	$0xbadbeef, %esi
++	movq	%rdi, saved_rdi(%rip)
++	movq	%rsi, saved_rsi(%rip)
++	call	*tls_var1@TLSCALL(%RAX_LP)
++	/* Check if _dl_tlsdesc_dynamic preserves %rdi, %rsi and %rbx.  */
++	cmpq	saved_rdi(%rip), %rdi
++	jne	L(hlt)
++	cmpq	saved_rsi(%rip), %rsi
++	jne	L(hlt)
++	cmpl	$0xbadbeef, %ebx
++	jne	L(hlt)
++	add	%fs:0, %RAX_LP
++	movups	%xmm0, 32(%RAX_LP)
++	movdqu	16(%RDI_LP), %xmm1
++	mov	%RAX_LP, %RBX_LP
++	movups	%xmm1, 48(%RAX_LP)
++	lea	32(%RBX_LP), %RAX_LP
++	pop	%rbx
++	leave
++	cfi_def_cfa (7, 8)
++	ret
++L(hlt):
++	hlt
++	cfi_endproc
++	.size	apply_tls, .-apply_tls
++	.hidden	tls_var1
++	.globl	tls_var1
++	.section	.tbss,"awT",@nobits
++	.align 16
++	.type	tls_var1, @object
++	.size	tls_var1, 3200
++tls_var1:
++	.zero	3200
++	.local	saved_rdi
++	.comm	saved_rdi,8,8
++	.local	saved_rsi
++	.comm	saved_rsi,8,8
++	.section	.note.GNU-stack,"",@progbits
+
+commit 15aebdbada54098787715448c94701f17033fc92
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Tue Mar 12 13:21:18 2024 -0300
+
+    Ignore undefined symbols for -mtls-dialect=gnu2
+    
+    So it does not fail for arm config that defaults to -mtp=soft (which
+    issues a call to __aeabi_read_tp).
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    
+    (cherry picked from commit 968b0ca9440040a2b31248a572891f0e55c1ab10)
+
+diff --git a/configure b/configure
+index 59ff1e415d..117b48a421 100755
+--- a/configure
++++ b/configure
+@@ -7020,7 +7020,7 @@ void foo (void)
+ }
+ EOF
+ if { ac_try='${CC-cc} $CFLAGS $CPPFLAGS -fPIC -mtls-dialect=gnu2 -nostdlib -nostartfiles
+-		   conftest.c -o conftest 1>&5'
++		   -shared conftest.c -o conftest 1>&5'
+   { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
+   (eval $ac_try) 2>&5
+   ac_status=$?
+diff --git a/configure.ac b/configure.ac
+index 65799e5685..19b88a47a5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1297,7 +1297,7 @@ void foo (void)
+ }
+ EOF
+ if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS -fPIC -mtls-dialect=gnu2 -nostdlib -nostartfiles
+-		   conftest.c -o conftest 1>&AS_MESSAGE_LOG_FD])
++		   -shared conftest.c -o conftest 1>&AS_MESSAGE_LOG_FD])
+ then
+   libc_cv_mtls_dialect_gnu2=yes
+ else
+
+commit a8ba52bde58c69f2b31da62ad2311f119adf6cb9
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Tue Mar 12 13:21:19 2024 -0300
+
+    arm: Update _dl_tlsdesc_dynamic to preserve caller-saved registers (BZ 31372)
+    
+    ARM _dl_tlsdesc_dynamic slow path has two issues:
+    
+      * The ip/r12 is defined by AAPCS as a scratch register, and gcc is
+        used to save the stack pointer before on some function calls.  So it
+        should also be saved/restored as well.  It fixes the tst-gnu2-tls2.
+    
+      * None of the possible VFP registers are saved/restored.  ARM has the
+        additional complexity to have different VFP bank sizes (depending of
+        VFP support by the chip).
+    
+    The tst-gnu2-tls2 test is extended to check for VFP registers, although
+    only for hardfp builds.  Different than setcontext, _dl_tlsdesc_dynamic
+    does not have  HWCAP_ARM_IWMMXT (I don't have a way to properly test
+    it and it is almost a decade since newer hardware was released).
+    
+    With this patch there is no need to mark tst-gnu2-tls2 as XFAIL.
+    
+    Checked on arm-linux-gnueabihf.
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    
+    (cherry picked from commit 64c7e344289ed085517c2227d8e3b06388242c13)
+
+diff --git a/config.h.in b/config.h.in
+index 44a34072a4..4d33c63a84 100644
+--- a/config.h.in
++++ b/config.h.in
+@@ -141,6 +141,9 @@
+ /* LOONGARCH floating-point ABI for ld.so.  */
+ #undef LOONGARCH_ABI_FRLEN
+ 
++/* Define whether ARM used hard-float and support VFPvX-D32.  */
++#undef HAVE_ARM_PCS_VFP_D32
++
+ /* Linux specific: minimum supported kernel version.  */
+ #undef	__LINUX_KERNEL_VERSION
+ 
+diff --git a/elf/Makefile b/elf/Makefile
+index c5c37a9147..030db4d207 100644
+--- a/elf/Makefile
++++ b/elf/Makefile
+@@ -3056,10 +3056,6 @@ $(objpfx)tst-gnu2-tls2.out: \
+   $(objpfx)tst-gnu2-tls2mod2.so
+ 
+ ifeq (yes,$(have-mtls-dialect-gnu2))
+-# This test fails if dl_tlsdesc_dynamic doesn't preserve all caller-saved
+-# registers.  See https://sourceware.org/bugzilla/show_bug.cgi?id=31372
+-test-xfail-tst-gnu2-tls2 = yes
+-
+ CFLAGS-tst-tlsgap-mod0.c += -mtls-dialect=gnu2
+ CFLAGS-tst-tlsgap-mod1.c += -mtls-dialect=gnu2
+ CFLAGS-tst-tlsgap-mod2.c += -mtls-dialect=gnu2
+diff --git a/elf/tst-gnu2-tls2.h b/elf/tst-gnu2-tls2.h
+index 77964a57a3..1ade8151e2 100644
+--- a/elf/tst-gnu2-tls2.h
++++ b/elf/tst-gnu2-tls2.h
+@@ -27,6 +27,10 @@ extern struct tls *apply_tls (struct tls *);
+ 
+ /* An architecture can define them to verify that clobber caller-saved
+    registers aren't changed by the implicit TLSDESC call.  */
++#ifndef INIT_TLSDESC_CALL
++# define INIT_TLSDESC_CALL()
++#endif
++
+ #ifndef BEFORE_TLSDESC_CALL
+ # define BEFORE_TLSDESC_CALL()
+ #endif
+diff --git a/elf/tst-gnu2-tls2mod0.c b/elf/tst-gnu2-tls2mod0.c
+index 45556a0e17..3fe3c14277 100644
+--- a/elf/tst-gnu2-tls2mod0.c
++++ b/elf/tst-gnu2-tls2mod0.c
+@@ -16,13 +16,14 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include "tst-gnu2-tls2.h"
++#include <tst-gnu2-tls2.h>
+ 
+ __thread struct tls tls_var0 __attribute__ ((visibility ("hidden")));
+ 
+ struct tls *
+ apply_tls (struct tls *p)
+ {
++  INIT_TLSDESC_CALL ();
+   BEFORE_TLSDESC_CALL ();
+   tls_var0 = *p;
+   struct tls *ret = &tls_var0;
+diff --git a/elf/tst-gnu2-tls2mod1.c b/elf/tst-gnu2-tls2mod1.c
+index e10b9dbc0a..e210538468 100644
+--- a/elf/tst-gnu2-tls2mod1.c
++++ b/elf/tst-gnu2-tls2mod1.c
+@@ -16,13 +16,14 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include "tst-gnu2-tls2.h"
++#include <tst-gnu2-tls2.h>
+ 
+ __thread struct tls tls_var1[100] __attribute__ ((visibility ("hidden")));
+ 
+ struct tls *
+ apply_tls (struct tls *p)
+ {
++  INIT_TLSDESC_CALL ();
+   BEFORE_TLSDESC_CALL ();
+   tls_var1[1] = *p;
+   struct tls *ret = &tls_var1[1];
+diff --git a/elf/tst-gnu2-tls2mod2.c b/elf/tst-gnu2-tls2mod2.c
+index 141af51e55..6d3031dc5f 100644
+--- a/elf/tst-gnu2-tls2mod2.c
++++ b/elf/tst-gnu2-tls2mod2.c
+@@ -16,13 +16,14 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include "tst-gnu2-tls2.h"
++#include <tst-gnu2-tls2.h>
+ 
+ __thread struct tls tls_var2 __attribute__ ((visibility ("hidden")));
+ 
+ struct tls *
+ apply_tls (struct tls *p)
+ {
++  INIT_TLSDESC_CALL ();
+   BEFORE_TLSDESC_CALL ();
+   tls_var2 = *p;
+   struct tls *ret = &tls_var2;
+diff --git a/sysdeps/arm/configure b/sysdeps/arm/configure
+index 35e2918922..4ef4d46cbd 100644
+--- a/sysdeps/arm/configure
++++ b/sysdeps/arm/configure
+@@ -187,6 +187,38 @@ else
+ default-abi = soft"
+ fi
+ 
++{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether VFP supports 32 registers" >&5
++printf %s "checking whether VFP supports 32 registers... " >&6; }
++if test ${libc_cv_arm_pcs_vfp_d32+y}
++then :
++  printf %s "(cached) " >&6
++else $as_nop
++
++cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h.  */
++
++void foo (void)
++{
++  asm volatile ("vldr d16,=17" : : : "d16");
++}
++
++_ACEOF
++if ac_fn_c_try_compile "$LINENO"
++then :
++  libc_cv_arm_pcs_vfp_d32=yes
++else $as_nop
++  libc_cv_arm_pcs_vfp_d32=no
++fi
++rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
++fi
++{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $libc_cv_arm_pcs_vfp_d32" >&5
++printf "%s\n" "$libc_cv_arm_pcs_vfp_d32" >&6; }
++if test "$libc_cv_arm_pcs_vfp_d32" = yes ;
++then
++  printf "%s\n" "#define HAVE_ARM_PCS_VFP_D32 1" >>confdefs.h
++
++fi
++
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether PC-relative relocs in movw/movt work properly" >&5
+ printf %s "checking whether PC-relative relocs in movw/movt work properly... " >&6; }
+ if test ${libc_cv_arm_pcrel_movw+y}
+diff --git a/sysdeps/arm/configure.ac b/sysdeps/arm/configure.ac
+index 5172e30bbe..cd00ddc9d9 100644
+--- a/sysdeps/arm/configure.ac
++++ b/sysdeps/arm/configure.ac
+@@ -21,6 +21,21 @@ else
+   LIBC_CONFIG_VAR([default-abi], [soft])
+ fi
+ 
++AC_CACHE_CHECK([whether VFP supports 32 registers],
++		libc_cv_arm_pcs_vfp_d32, [
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
++void foo (void)
++{
++  asm volatile ("vldr d16,=17" : : : "d16");
++}
++]])],
++                [libc_cv_arm_pcs_vfp_d32=yes],
++                [libc_cv_arm_pcs_vfp_d32=no])])
++if test "$libc_cv_arm_pcs_vfp_d32" = yes ;
++then
++  AC_DEFINE(HAVE_ARM_PCS_VFP_D32)
++fi
++
+ AC_CACHE_CHECK([whether PC-relative relocs in movw/movt work properly],
+ 	       libc_cv_arm_pcrel_movw, [
+ cat > conftest.s <<\EOF
+diff --git a/sysdeps/arm/dl-tlsdesc.S b/sysdeps/arm/dl-tlsdesc.S
+index 764c56e70f..ada106521d 100644
+--- a/sysdeps/arm/dl-tlsdesc.S
++++ b/sysdeps/arm/dl-tlsdesc.S
+@@ -19,6 +19,7 @@
+ #include <sysdep.h>
+ #include <arm-features.h>
+ #include <tls.h>
++#include <rtld-global-offsets.h>
+ #include "tlsdesc.h"
+ 
+ 	.text
+@@ -83,14 +84,20 @@ _dl_tlsdesc_dynamic(struct tlsdesc *tdp)
+ 	.align 2
+ _dl_tlsdesc_dynamic:
+ 	/* Our calling convention is to clobber r0, r1 and the processor
+-	   flags.  All others that are modified must be saved */
+-	eabi_save ({r2,r3,r4,lr})
+-	push	{r2,r3,r4,lr}
+-	cfi_adjust_cfa_offset (16)
++	   flags.  All others that are modified must be saved.  r5 is
++	   used as the hwcap value to avoid reload after __tls_get_addr
++	   call.  If required we will save the vector register on the slow
++	   path.  */
++	eabi_save ({r2,r3,r4,r5,ip,lr})
++	push	{r2,r3,r4,r5,ip,lr}
++	cfi_adjust_cfa_offset (24)
+ 	cfi_rel_offset (r2,0)
+ 	cfi_rel_offset (r3,4)
+ 	cfi_rel_offset (r4,8)
+-	cfi_rel_offset (lr,12)
++	cfi_rel_offset (r5,12)
++	cfi_rel_offset (ip,16)
++	cfi_rel_offset (lr,20)
++
+ 	ldr	r1, [r0] /* td */
+ 	GET_TLS (lr)
+ 	mov	r4, r0 /* r4 = tp */
+@@ -113,22 +120,69 @@ _dl_tlsdesc_dynamic:
+ 	rsbne	r0, r4, r3
+ 	bne	2f
+ 1:	mov	r0, r1
++
++	/* Load the hwcap to check for vector support.  */
++	ldr     r2, 3f
++	ldr     r1, .Lrtld_global_ro
++0:	add     r2, pc, r2
++	ldr     r2, [r2, r1]
++	ldr     r5, [r2, #RTLD_GLOBAL_RO_DL_HWCAP_OFFSET]
++
++#ifdef __SOFTFP__
++	tst     r5, #HWCAP_ARM_VFP
++	beq     .Lno_vfp
++#endif
++
++	/* Store the VFP registers.  Don't use VFP instructions directly
++	   because this code is used in non-VFP multilibs.  */
++#define VFP_STACK_REQ (32*8 + 8)
++	sub	sp, sp, VFP_STACK_REQ
++	cfi_adjust_cfa_offset (VFP_STACK_REQ)
++	mov	r3, sp
++	.inst	0xeca30b20	/* vstmia r3!, {d0-d15} */
++	tst	r5, #HWCAP_ARM_VFPD32
++	beq	4f
++	.inst	0xece30b20	/* vstmia r3!, {d16-d31}  */
++	/* Store the floating-point status register.  */
++4:	.inst	0xeef12a10	/* vmrs	r2, fpscr */
++	str	r2, [r3]
++.Lno_vfp:
+ 	bl	__tls_get_addr
+ 	rsb	r0, r4, r0
++#ifdef __SOFTFP__
++	tst     r5, #HWCAP_ARM_VFP
++	beq     2f
++#endif
++	mov	r3, sp
++	.inst	0xecb30b20	/* vldmia r3!, {d0-d15}  */
++	tst	r5, #HWCAP_ARM_VFPD32
++	beq	5f
++	.inst	0xecf30b20	/* vldmia r3!, {d16-d31}  */
++	ldr	r4, [r3]
++5:	.inst	0xeee14a10	/* vmsr	fpscr, r4  */
++	add	sp, sp, VFP_STACK_REQ
++	cfi_adjust_cfa_offset (-VFP_STACK_REQ)
++
+ 2:
+ #if ((defined (__ARM_ARCH_4T__) && defined (__THUMB_INTERWORK__)) \
+      || defined (ARM_ALWAYS_BX))
+-	pop	{r2,r3,r4, lr}
+-	cfi_adjust_cfa_offset (-16)
++	pop	{r2,r3,r4,r5,ip, lr}
++	cfi_adjust_cfa_offset (-20)
+ 	cfi_restore (lr)
++	cfi_restore (ip)
++	cfi_restore (r5)
+ 	cfi_restore (r4)
+ 	cfi_restore (r3)
+ 	cfi_restore (r2)
+ 	bx	lr
+ #else
+-	pop	{r2,r3,r4, pc}
++	pop	{r2,r3,r4,r5,ip, pc}
+ #endif
+ 	eabi_fnend
+ 	cfi_endproc
+ 	.size	_dl_tlsdesc_dynamic, .-_dl_tlsdesc_dynamic
++
++3:      .long   _GLOBAL_OFFSET_TABLE_ - 0b - PC_OFS
++.Lrtld_global_ro:
++	.long   C_SYMBOL_NAME(_rtld_global_ro)(GOT)
+ #endif /* SHARED */
+diff --git a/sysdeps/arm/tst-gnu2-tls2.h b/sysdeps/arm/tst-gnu2-tls2.h
+new file mode 100644
+index 0000000000..e413ac21fb
+--- /dev/null
++++ b/sysdeps/arm/tst-gnu2-tls2.h
+@@ -0,0 +1,128 @@
++/* Test TLSDESC relocation.  ARM version.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <config.h>
++#include <sys/auxv.h>
++#include <string.h>
++#include <stdlib.h>
++#include <endian.h>
++
++#ifndef __SOFTFP__
++
++# ifdef HAVE_ARM_PCS_VFP_D32
++#  define SAVE_VFP_D32					\
++      asm volatile ("vldr d16,=17" : : : "d16");	\
++      asm volatile ("vldr d17,=18" : : : "d17");	\
++      asm volatile ("vldr d18,=19" : : : "d18");	\
++      asm volatile ("vldr d19,=20" : : : "d19");	\
++      asm volatile ("vldr d20,=21" : : : "d20");	\
++      asm volatile ("vldr d21,=22" : : : "d21");	\
++      asm volatile ("vldr d22,=23" : : : "d22");	\
++      asm volatile ("vldr d23,=24" : : : "d23");	\
++      asm volatile ("vldr d24,=25" : : : "d24");	\
++      asm volatile ("vldr d25,=26" : : : "d25");	\
++      asm volatile ("vldr d26,=27" : : : "d26");	\
++      asm volatile ("vldr d27,=28" : : : "d27");	\
++      asm volatile ("vldr d28,=29" : : : "d28");	\
++      asm volatile ("vldr d29,=30" : : : "d29");	\
++      asm volatile ("vldr d30,=31" : : : "d30");	\
++      asm volatile ("vldr d31,=32" : : : "d31");
++# else
++#  define SAVE_VFP_D32
++# endif
++
++# define INIT_TLSDESC_CALL()				\
++  unsigned long hwcap = getauxval (AT_HWCAP)
++
++/* Set each vector register to a value from 1 to 32 before the TLS access,
++   dump to memory after TLS access, and compare with the expected values.  */
++
++# define BEFORE_TLSDESC_CALL()				\
++  if (hwcap & HWCAP_ARM_VFP)				\
++    {							\
++      asm volatile ("vldr  d0,=1" : : : "d0");		\
++      asm volatile ("vldr  d1,=2" : : : "d1");		\
++      asm volatile ("vldr  d2,=3" : : : "d1");		\
++      asm volatile ("vldr  d3,=4" : : : "d3");		\
++      asm volatile ("vldr  d4,=5" : : : "d4");		\
++      asm volatile ("vldr  d5,=6" : : : "d5");		\
++      asm volatile ("vldr  d6,=7" : : : "d6");		\
++      asm volatile ("vldr  d7,=8" : : : "d7");		\
++      asm volatile ("vldr  d8,=9" : : : "d8");		\
++      asm volatile ("vldr  d9,=10" : : : "d9");		\
++      asm volatile ("vldr d10,=11" : : : "d10");	\
++      asm volatile ("vldr d11,=12" : : : "d11");	\
++      asm volatile ("vldr d12,=13" : : : "d12");	\
++      asm volatile ("vldr d13,=14" : : : "d13");	\
++      asm volatile ("vldr d14,=15" : : : "d14");	\
++      asm volatile ("vldr d15,=16" : : : "d15");	\
++    }							\
++  if (hwcap & HWCAP_ARM_VFPD32)				\
++    {							\
++      SAVE_VFP_D32					\
++    }
++
++# define VFP_STACK_REQ (16*8)
++# if __BYTE_ORDER == __BIG_ENDIAN
++#  define DISP 7
++# else
++#  define DISP 0
++# endif
++
++# ifdef HAVE_ARM_PCS_VFP_D32
++#  define CHECK_VFP_D32							\
++      char vfp[VFP_STACK_REQ];						\
++      asm volatile ("vstmia %0, {d16-d31}\n"				\
++		    :							\
++		    : "r" (vfp)						\
++		    : "memory");					\
++									\
++      char expected[VFP_STACK_REQ] = { 0 };				\
++      for (int i = 0; i < 16; ++i)					\
++	expected[i * 8 + DISP] = i + 17;				\
++									\
++      if (memcmp (vfp, expected, VFP_STACK_REQ) != 0)			\
++        abort ();
++# else
++#  define CHECK_VFP_D32
++# endif
++
++# define AFTER_TLSDESC_CALL()						\
++  if (hwcap & HWCAP_ARM_VFP)						\
++    {									\
++      char vfp[VFP_STACK_REQ];						\
++      asm volatile ("vstmia %0, {d0-d15}\n"				\
++		    :							\
++		    : "r" (vfp)						\
++		    : "memory");					\
++									\
++      char expected[VFP_STACK_REQ] = { 0 };				\
++      for (int i = 0; i < 16; ++i)					\
++	expected[i * 8 + DISP] = i + 1;					\
++									\
++      if (memcmp (vfp, expected, VFP_STACK_REQ) != 0)			\
++        abort ();							\
++    }									\
++  if (hwcap & HWCAP_ARM_VFPD32)						\
++    {									\
++      CHECK_VFP_D32							\
++    }
++
++#endif /* __SOFTFP__ */
++
++#include_next <tst-gnu2-tls2.h>
+
+commit aded2fc004e7ee85cf0b45b1382552d41e555a23
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Tue Mar 12 13:21:20 2024 -0300
+
+    elf: Enable TLS descriptor tests on aarch64
+    
+    The aarch64 uses 'trad' for traditional tls and 'desc' for tls
+    descriptors, but unlike other targets it defaults to 'desc'.  The
+    gnutls2 configure check does not set aarch64 as an ABI that uses
+    TLS descriptors, which then disable somes stests.
+    
+    Also rename the internal machinery fron gnu2 to tls descriptors.
+    
+    Checked on aarch64-linux-gnu.
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    
+    (cherry picked from commit 3d53d18fc71c5d9ef4773b8bce04d54b80181926)
+
+diff --git a/configure b/configure
+index 117b48a421..432e40a592 100755
+--- a/configure
++++ b/configure
+@@ -653,7 +653,7 @@ LIBGD
+ libc_cv_cc_loop_to_function
+ libc_cv_cc_submachine
+ libc_cv_cc_nofma
+-libc_cv_mtls_dialect_gnu2
++libc_cv_mtls_descriptor
+ libc_cv_has_glob_dat
+ libc_cv_fpie
+ libc_cv_z_execstack
+@@ -4760,6 +4760,9 @@ libc_config_ok=no
+ # whether to use such directories.
+ with_fp_cond=1
+ 
++# A preconfigure script may define another name to TLS descriptor variant
++mtls_descriptor=gnu2
++
+ if frags=`ls -d $srcdir/sysdeps/*/preconfigure 2> /dev/null`
+ then
+   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sysdeps preconfigure fragments" >&5
+@@ -7006,9 +7009,9 @@ fi
+ printf "%s\n" "$libc_cv_has_glob_dat" >&6; }
+ 
+ 
+-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for -mtls-dialect=gnu2" >&5
+-printf %s "checking for -mtls-dialect=gnu2... " >&6; }
+-if test ${libc_cv_mtls_dialect_gnu2+y}
++{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for tls descriptor support" >&5
++printf %s "checking for tls descriptor support... " >&6; }
++if test ${libc_cv_mtls_descriptor+y}
+ then :
+   printf %s "(cached) " >&6
+ else $as_nop
+@@ -7019,7 +7022,7 @@ void foo (void)
+   i = 10;
+ }
+ EOF
+-if { ac_try='${CC-cc} $CFLAGS $CPPFLAGS -fPIC -mtls-dialect=gnu2 -nostdlib -nostartfiles
++if { ac_try='${CC-cc} $CFLAGS $CPPFLAGS -fPIC -mtls-dialect=$mtls_descriptor -nostdlib -nostartfiles
+ 		   -shared conftest.c -o conftest 1>&5'
+   { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
+   (eval $ac_try) 2>&5
+@@ -7027,17 +7030,17 @@ if { ac_try='${CC-cc} $CFLAGS $CPPFLAGS -fPIC -mtls-dialect=gnu2 -nostdlib -nost
+   printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+   test $ac_status = 0; }; }
+ then
+-  libc_cv_mtls_dialect_gnu2=yes
++  libc_cv_mtls_descriptor=$mtls_descriptor
+ else
+-  libc_cv_mtls_dialect_gnu2=no
++  libc_cv_mtls_descriptor=no
+ fi
+ rm -f conftest*
+ fi
+-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $libc_cv_mtls_dialect_gnu2" >&5
+-printf "%s\n" "$libc_cv_mtls_dialect_gnu2" >&6; }
++{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $libc_cv_mtls_descriptor" >&5
++printf "%s\n" "$libc_cv_mtls_descriptor" >&6; }
+ 
+ config_vars="$config_vars
+-have-mtls-dialect-gnu2 = $libc_cv_mtls_dialect_gnu2"
++have-mtls-descriptor = $libc_cv_mtls_descriptor"
+ 
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if -Wno-ignored-attributes is required for aliases" >&5
+ printf %s "checking if -Wno-ignored-attributes is required for aliases... " >&6; }
+diff --git a/configure.ac b/configure.ac
+index 19b88a47a5..bdc385d03c 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -442,6 +442,9 @@ libc_config_ok=no
+ # whether to use such directories.
+ with_fp_cond=1
+ 
++# A preconfigure script may define another name to TLS descriptor variant
++mtls_descriptor=gnu2
++
+ dnl Let sysdeps/*/preconfigure act here.
+ LIBC_PRECONFIGURE([$srcdir], [for sysdeps])
+ 
+@@ -1287,7 +1290,7 @@ fi
+ rm -f conftest*])
+ AC_SUBST(libc_cv_has_glob_dat)
+ 
+-AC_CACHE_CHECK([for -mtls-dialect=gnu2], libc_cv_mtls_dialect_gnu2,
++AC_CACHE_CHECK([for tls descriptor support], libc_cv_mtls_descriptor,
+ [dnl
+ cat > conftest.c <<EOF
+ __thread int i;
+@@ -1296,16 +1299,16 @@ void foo (void)
+   i = 10;
+ }
+ EOF
+-if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS -fPIC -mtls-dialect=gnu2 -nostdlib -nostartfiles
++if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS -fPIC -mtls-dialect=$mtls_descriptor -nostdlib -nostartfiles
+ 		   -shared conftest.c -o conftest 1>&AS_MESSAGE_LOG_FD])
+ then
+-  libc_cv_mtls_dialect_gnu2=yes
++  libc_cv_mtls_descriptor=$mtls_descriptor
+ else
+-  libc_cv_mtls_dialect_gnu2=no
++  libc_cv_mtls_descriptor=no
+ fi
+ rm -f conftest*])
+-AC_SUBST(libc_cv_mtls_dialect_gnu2)
+-LIBC_CONFIG_VAR([have-mtls-dialect-gnu2], [$libc_cv_mtls_dialect_gnu2])
++AC_SUBST(libc_cv_mtls_descriptor)
++LIBC_CONFIG_VAR([have-mtls-descriptor], [$libc_cv_mtls_descriptor])
+ 
+ dnl clang emits an warning for a double alias redirection, to warn the
+ dnl original symbol is sed even when weak definition overrides it.
+diff --git a/elf/Makefile b/elf/Makefile
+index 030db4d207..69aa423c4b 100644
+--- a/elf/Makefile
++++ b/elf/Makefile
+@@ -999,13 +999,13 @@ modules-names-tests = $(filter-out ifuncmod% tst-tlsmod%,\
+ # For +depfiles in Makerules.
+ extra-test-objs += tst-auditmod17.os
+ 
+-ifeq (yes,$(have-mtls-dialect-gnu2))
++ifneq (no,$(have-mtls-descriptor))
+ tests += tst-gnu2-tls1
+ modules-names += tst-gnu2-tls1mod
+ $(objpfx)tst-gnu2-tls1: $(objpfx)tst-gnu2-tls1mod.so
+ tst-gnu2-tls1mod.so-no-z-defs = yes
+-CFLAGS-tst-gnu2-tls1mod.c += -mtls-dialect=gnu2
+-endif # $(have-mtls-dialect-gnu2)
++CFLAGS-tst-gnu2-tls1mod.c += -mtls-dialect=$(have-mtls-descriptor)
++endif # $(have-mtls-descriptor)
+ 
+ ifeq (yes,$(have-protected-data))
+ modules-names += tst-protected1moda tst-protected1modb
+@@ -2972,11 +2972,11 @@ $(objpfx)tst-tls-allocation-failure-static-patched.out: \
+ $(objpfx)tst-audit-tlsdesc: $(objpfx)tst-audit-tlsdesc-mod1.so \
+ 			    $(objpfx)tst-audit-tlsdesc-mod2.so \
+ 			    $(shared-thread-library)
+-ifeq (yes,$(have-mtls-dialect-gnu2))
++ifneq (no,$(have-mtls-descriptor))
+ # The test is valid for all TLS types, but we want to exercise GNU2
+ # TLS if possible.
+-CFLAGS-tst-audit-tlsdesc-mod1.c += -mtls-dialect=gnu2
+-CFLAGS-tst-audit-tlsdesc-mod2.c += -mtls-dialect=gnu2
++CFLAGS-tst-audit-tlsdesc-mod1.c += -mtls-dialect=$(have-mtls-descriptor)
++CFLAGS-tst-audit-tlsdesc-mod2.c += -mtls-dialect=$(have-mtls-descriptor)
+ endif
+ $(objpfx)tst-audit-tlsdesc-dlopen: $(shared-thread-library)
+ $(objpfx)tst-audit-tlsdesc-dlopen.out: $(objpfx)tst-audit-tlsdesc-mod1.so \
+@@ -3055,11 +3055,11 @@ $(objpfx)tst-gnu2-tls2.out: \
+   $(objpfx)tst-gnu2-tls2mod1.so \
+   $(objpfx)tst-gnu2-tls2mod2.so
+ 
+-ifeq (yes,$(have-mtls-dialect-gnu2))
+-CFLAGS-tst-tlsgap-mod0.c += -mtls-dialect=gnu2
+-CFLAGS-tst-tlsgap-mod1.c += -mtls-dialect=gnu2
+-CFLAGS-tst-tlsgap-mod2.c += -mtls-dialect=gnu2
+-CFLAGS-tst-gnu2-tls2mod0.c += -mtls-dialect=gnu2
+-CFLAGS-tst-gnu2-tls2mod1.c += -mtls-dialect=gnu2
+-CFLAGS-tst-gnu2-tls2mod2.c += -mtls-dialect=gnu2
++ifneq (no,$(have-mtls-descriptor))
++CFLAGS-tst-tlsgap-mod0.c += -mtls-dialect=$(have-mtls-descriptor)
++CFLAGS-tst-tlsgap-mod1.c += -mtls-dialect=$(have-mtls-descriptor)
++CFLAGS-tst-tlsgap-mod2.c += -mtls-dialect=$(have-mtls-descriptor)
++CFLAGS-tst-gnu2-tls2mod0.c += -mtls-dialect=$(have-mtls-descriptor)
++CFLAGS-tst-gnu2-tls2mod1.c += -mtls-dialect=$(have-mtls-descriptor)
++CFLAGS-tst-gnu2-tls2mod2.c += -mtls-dialect=$(have-mtls-descriptor)
+ endif
+diff --git a/sysdeps/aarch64/preconfigure b/sysdeps/aarch64/preconfigure
+index d9bd1f8558..19657b627b 100644
+--- a/sysdeps/aarch64/preconfigure
++++ b/sysdeps/aarch64/preconfigure
+@@ -2,5 +2,6 @@ case "$machine" in
+ aarch64*)
+ 	base_machine=aarch64
+ 	machine=aarch64
++	mtls_descriptor=desc
+ 	;;
+ esac
+diff --git a/sysdeps/arm/Makefile b/sysdeps/arm/Makefile
+index d5cea717a9..619474eca9 100644
+--- a/sysdeps/arm/Makefile
++++ b/sysdeps/arm/Makefile
+@@ -13,15 +13,15 @@ $(objpfx)libgcc-stubs.a: $(objpfx)aeabi_unwind_cpp_pr1.os
+ lib-noranlib: $(objpfx)libgcc-stubs.a
+ 
+ ifeq ($(build-shared),yes)
+-ifeq (yes,$(have-mtls-dialect-gnu2))
++ifneq (no,$(have-mtls-descriptor))
+ tests += tst-armtlsdescloc tst-armtlsdescextnow tst-armtlsdescextlazy
+ modules-names += tst-armtlsdesclocmod
+ modules-names += tst-armtlsdescextlazymod tst-armtlsdescextnowmod
+ CPPFLAGS-tst-armtlsdescextnowmod.c += -Dstatic=
+ CPPFLAGS-tst-armtlsdescextlazymod.c += -Dstatic=
+-CFLAGS-tst-armtlsdesclocmod.c += -mtls-dialect=gnu2
+-CFLAGS-tst-armtlsdescextnowmod.c += -mtls-dialect=gnu2
+-CFLAGS-tst-armtlsdescextlazymod.c += -mtls-dialect=gnu2
++CFLAGS-tst-armtlsdesclocmod.c += -mtls-dialect=$(have-mtls-descriptor)
++CFLAGS-tst-armtlsdescextnowmod.c += -mtls-dialect=$(have-mtls-descriptor)
++CFLAGS-tst-armtlsdescextlazymod.c += -mtls-dialect=$(have-mtls-descriptor)
+ LDFLAGS-tst-armtlsdescextnowmod.so += -Wl,-z,now
+ tst-armtlsdescloc-ENV = LD_BIND_NOW=1
+ tst-armtlsdescextnow-ENV = LD_BIND_NOW=1
+
+commit 5a461f2949ded98d8211939f84988bc464c7b4fe
+Author: Andreas Schwab <schwab@suse.de>
+Date:   Tue Mar 19 13:49:50 2024 +0100
+
+    Add tst-gnu2-tls2mod1 to test-internal-extras
+    
+    That allows sysdeps/x86_64/tst-gnu2-tls2mod1.S to use internal headers.
+    
+    Fixes: 717ebfa85c ("x86-64: Allocate state buffer space for RDI, RSI and RBX")
+    (cherry picked from commit fd7ee2e6c5eb49e4a630a9978b4d668bff6354ee)
+
+diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile
+index e8babc9a4e..9d374a3299 100644
+--- a/sysdeps/x86_64/Makefile
++++ b/sysdeps/x86_64/Makefile
+@@ -210,6 +210,8 @@ tst-plt-rewrite2-ENV = GLIBC_TUNABLES=glibc.cpu.plt_rewrite=2
+ $(objpfx)tst-plt-rewrite2: $(objpfx)tst-plt-rewritemod2.so
+ endif
+ 
++test-internal-extras += tst-gnu2-tls2mod1
++
+ endif # $(subdir) == elf
+ 
+ ifeq ($(subdir),csu)
+
+commit aa4249266e9906c4bc833e4847f4d8feef59504f
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Thu Feb 8 10:08:38 2024 -0300
+
+    x86: Fix Zen3/Zen4 ERMS selection (BZ 30994)
+    
+    The REP MOVSB usage on memcpy/memmove does not show much performance
+    improvement on Zen3/Zen4 cores compared to the vectorized loops.  Also,
+    as from BZ 30994, if the source is aligned and the destination is not
+    the performance can be 20x slower.
+    
+    The performance difference is noticeable with small buffer sizes, closer
+    to the lower bounds limits when memcpy/memmove starts to use ERMS.  The
+    performance of REP MOVSB is similar to vectorized instruction on the
+    size limit (the L2 cache).  Also, there is no drawback to multiple cores
+    sharing the cache.
+    
+    Checked on x86_64-linux-gnu on Zen3.
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    
+    (cherry picked from commit 0c0d39fe4aeb0f69b26e76337c5dfd5530d5d44e)
+
+diff --git a/sysdeps/x86/dl-cacheinfo.h b/sysdeps/x86/dl-cacheinfo.h
+index d5101615e3..f34d12846c 100644
+--- a/sysdeps/x86/dl-cacheinfo.h
++++ b/sysdeps/x86/dl-cacheinfo.h
+@@ -791,7 +791,6 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+   long int data = -1;
+   long int shared = -1;
+   long int shared_per_thread = -1;
+-  long int core = -1;
+   unsigned int threads = 0;
+   unsigned long int level1_icache_size = -1;
+   unsigned long int level1_icache_linesize = -1;
+@@ -809,7 +808,6 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+   if (cpu_features->basic.kind == arch_kind_intel)
+     {
+       data = handle_intel (_SC_LEVEL1_DCACHE_SIZE, cpu_features);
+-      core = handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features);
+       shared = handle_intel (_SC_LEVEL3_CACHE_SIZE, cpu_features);
+       shared_per_thread = shared;
+ 
+@@ -822,7 +820,8 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+ 	= handle_intel (_SC_LEVEL1_DCACHE_ASSOC, cpu_features);
+       level1_dcache_linesize
+ 	= handle_intel (_SC_LEVEL1_DCACHE_LINESIZE, cpu_features);
+-      level2_cache_size = core;
++      level2_cache_size
++	= handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features);
+       level2_cache_assoc
+ 	= handle_intel (_SC_LEVEL2_CACHE_ASSOC, cpu_features);
+       level2_cache_linesize
+@@ -835,12 +834,12 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+       level4_cache_size
+ 	= handle_intel (_SC_LEVEL4_CACHE_SIZE, cpu_features);
+ 
+-      get_common_cache_info (&shared, &shared_per_thread, &threads, core);
++      get_common_cache_info (&shared, &shared_per_thread, &threads,
++			     level2_cache_size);
+     }
+   else if (cpu_features->basic.kind == arch_kind_zhaoxin)
+     {
+       data = handle_zhaoxin (_SC_LEVEL1_DCACHE_SIZE);
+-      core = handle_zhaoxin (_SC_LEVEL2_CACHE_SIZE);
+       shared = handle_zhaoxin (_SC_LEVEL3_CACHE_SIZE);
+       shared_per_thread = shared;
+ 
+@@ -849,19 +848,19 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+       level1_dcache_size = data;
+       level1_dcache_assoc = handle_zhaoxin (_SC_LEVEL1_DCACHE_ASSOC);
+       level1_dcache_linesize = handle_zhaoxin (_SC_LEVEL1_DCACHE_LINESIZE);
+-      level2_cache_size = core;
++      level2_cache_size = handle_zhaoxin (_SC_LEVEL2_CACHE_SIZE);
+       level2_cache_assoc = handle_zhaoxin (_SC_LEVEL2_CACHE_ASSOC);
+       level2_cache_linesize = handle_zhaoxin (_SC_LEVEL2_CACHE_LINESIZE);
+       level3_cache_size = shared;
+       level3_cache_assoc = handle_zhaoxin (_SC_LEVEL3_CACHE_ASSOC);
+       level3_cache_linesize = handle_zhaoxin (_SC_LEVEL3_CACHE_LINESIZE);
+ 
+-      get_common_cache_info (&shared, &shared_per_thread, &threads, core);
++      get_common_cache_info (&shared, &shared_per_thread, &threads,
++			     level2_cache_size);
+     }
+   else if (cpu_features->basic.kind == arch_kind_amd)
+     {
+       data = handle_amd (_SC_LEVEL1_DCACHE_SIZE);
+-      core = handle_amd (_SC_LEVEL2_CACHE_SIZE);
+       shared = handle_amd (_SC_LEVEL3_CACHE_SIZE);
+ 
+       level1_icache_size = handle_amd (_SC_LEVEL1_ICACHE_SIZE);
+@@ -869,7 +868,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+       level1_dcache_size = data;
+       level1_dcache_assoc = handle_amd (_SC_LEVEL1_DCACHE_ASSOC);
+       level1_dcache_linesize = handle_amd (_SC_LEVEL1_DCACHE_LINESIZE);
+-      level2_cache_size = core;
++      level2_cache_size = handle_amd (_SC_LEVEL2_CACHE_SIZE);;
+       level2_cache_assoc = handle_amd (_SC_LEVEL2_CACHE_ASSOC);
+       level2_cache_linesize = handle_amd (_SC_LEVEL2_CACHE_LINESIZE);
+       level3_cache_size = shared;
+@@ -880,12 +879,12 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+       if (shared <= 0)
+         {
+            /* No shared L3 cache.  All we have is the L2 cache.  */
+-           shared = core;
++           shared = level2_cache_size;
+         }
+       else if (cpu_features->basic.family < 0x17)
+         {
+            /* Account for exclusive L2 and L3 caches.  */
+-           shared += core;
++           shared += level2_cache_size;
+         }
+ 
+       shared_per_thread = shared;
+@@ -987,6 +986,12 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+   if (CPU_FEATURE_USABLE_P (cpu_features, FSRM))
+     rep_movsb_threshold = 2112;
+ 
++   /* For AMD CPUs that support ERMS (Zen3+), REP MOVSB is in a lot of
++      cases slower than the vectorized path (and for some alignments,
++      it is really slow, check BZ #30994).  */
++  if (cpu_features->basic.kind == arch_kind_amd)
++    rep_movsb_threshold = non_temporal_threshold;
++
+   /* The default threshold to use Enhanced REP STOSB.  */
+   unsigned long int rep_stosb_threshold = 2048;
+ 
+@@ -1028,16 +1033,9 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+ 			   SIZE_MAX);
+ 
+   unsigned long int rep_movsb_stop_threshold;
+-  /* ERMS feature is implemented from AMD Zen3 architecture and it is
+-     performing poorly for data above L2 cache size. Henceforth, adding
+-     an upper bound threshold parameter to limit the usage of Enhanced
+-     REP MOVSB operations and setting its value to L2 cache size.  */
+-  if (cpu_features->basic.kind == arch_kind_amd)
+-    rep_movsb_stop_threshold = core;
+   /* Setting the upper bound of ERMS to the computed value of
+-     non-temporal threshold for architectures other than AMD.  */
+-  else
+-    rep_movsb_stop_threshold = non_temporal_threshold;
++     non-temporal threshold for all architectures.  */
++  rep_movsb_stop_threshold = non_temporal_threshold;
+ 
+   cpu_features->data_cache_size = data;
+   cpu_features->shared_cache_size = shared;
+
+commit 6484a92698039c4a7a510f0214e22d067b0d78b3
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Thu Feb 8 10:08:39 2024 -0300
+
+    x86: Do not prefer ERMS for memset on Zen3+
+    
+    For AMD Zen3+ architecture, the performance of the vectorized loop is
+    slightly better than ERMS.
+    
+    Checked on x86_64-linux-gnu on Zen3.
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    
+    (cherry picked from commit 272708884cb750f12f5c74a00e6620c19dc6d567)
+
+diff --git a/sysdeps/x86/dl-cacheinfo.h b/sysdeps/x86/dl-cacheinfo.h
+index f34d12846c..5a98f70364 100644
+--- a/sysdeps/x86/dl-cacheinfo.h
++++ b/sysdeps/x86/dl-cacheinfo.h
+@@ -1021,6 +1021,11 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+      minimum value is fixed.  */
+   rep_stosb_threshold = TUNABLE_GET (x86_rep_stosb_threshold,
+ 				     long int, NULL);
++  if (cpu_features->basic.kind == arch_kind_amd
++      && !TUNABLE_IS_INITIALIZED (x86_rep_stosb_threshold))
++    /* For AMD Zen3+ architecture, the performance of the vectorized loop is
++       slightly better than ERMS.  */
++    rep_stosb_threshold = SIZE_MAX;
+ 
+   TUNABLE_SET_WITH_BOUNDS (x86_data_cache_size, data, 0, SIZE_MAX);
+   TUNABLE_SET_WITH_BOUNDS (x86_shared_cache_size, shared, 0, SIZE_MAX);
+
+commit 5d070d12b3a52bc44dd1b71743abc4b6243862ae
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Thu Feb 8 10:08:40 2024 -0300
+
+    x86: Expand the comment on when REP STOSB is used on memset
+    
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    (cherry picked from commit 491e55beab7457ed310a4a47496f4a333c5d1032)
+
+diff --git a/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S b/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S
+index 9984c3ca0f..97839a2248 100644
+--- a/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S
++++ b/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S
+@@ -21,7 +21,9 @@
+    2. If size is less than VEC, use integer register stores.
+    3. If size is from VEC_SIZE to 2 * VEC_SIZE, use 2 VEC stores.
+    4. If size is from 2 * VEC_SIZE to 4 * VEC_SIZE, use 4 VEC stores.
+-   5. If size is more to 4 * VEC_SIZE, align to 4 * VEC_SIZE with
++   5. On machines ERMS feature, if size is greater or equal than
++      __x86_rep_stosb_threshold then REP STOSB will be used.
++   6. If size is more to 4 * VEC_SIZE, align to 4 * VEC_SIZE with
+       4 VEC stores and store 4 * VEC at a time until done.  */
+ 
+ #include <sysdep.h>
+
+commit 31c7d69af59da0da80caa74b2ec6ae149013384d
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Feb 16 07:40:37 2024 +0100
+
+    i386: Use generic memrchr in libc (bug 31316)
+    
+    Before this change, we incorrectly used the SSE2 variant in the
+    implementation, without checking that the system actually supports
+    SSE2.
+    
+    Tested-by: Sam James <sam@gentoo.org>
+    (cherry picked from commit 0d9166c2245cad4ac520b337dee40c9a583872b6)
+
+diff --git a/sysdeps/i386/i686/multiarch/memrchr-c.c b/sysdeps/i386/i686/multiarch/memrchr-c.c
+index ef7bbbe792..20bfdf3af3 100644
+--- a/sysdeps/i386/i686/multiarch/memrchr-c.c
++++ b/sysdeps/i386/i686/multiarch/memrchr-c.c
+@@ -5,3 +5,4 @@ extern void *__memrchr_ia32 (const void *, int, size_t);
+ #endif
+ 
+ #include "string/memrchr.c"
++strong_alias (__memrchr_ia32, __GI___memrchr)
+diff --git a/sysdeps/i386/i686/multiarch/memrchr-sse2.S b/sysdeps/i386/i686/multiarch/memrchr-sse2.S
+index d9dae04171..e123f87435 100644
+--- a/sysdeps/i386/i686/multiarch/memrchr-sse2.S
++++ b/sysdeps/i386/i686/multiarch/memrchr-sse2.S
+@@ -720,5 +720,4 @@ L(ret_null):
+ 	ret
+ 
+ END (__memrchr_sse2)
+-strong_alias (__memrchr_sse2, __GI___memrchr)
+ #endif
+
+commit b0e0a07018098c2c5927796be5681a298c312626
+Author: Joe Ramsay <Joe.Ramsay@arm.com>
+Date:   Tue Feb 20 16:44:13 2024 +0000
+
+    aarch64/fpu: Sync libmvec routines from 2.39 and before with AOR
+    
+    This includes a fix for big-endian in AdvSIMD log, some cosmetic
+    changes, and numerous small optimisations mainly around inlining and
+    using indexed variants of MLA intrinsics.
+    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+    
+    (cherry picked from commit e302e1021391d13a9611ba3a910df128830bd19e)
+
+diff --git a/sysdeps/aarch64/fpu/acos_advsimd.c b/sysdeps/aarch64/fpu/acos_advsimd.c
+index a8eabb5e71..0a86c9823a 100644
+--- a/sysdeps/aarch64/fpu/acos_advsimd.c
++++ b/sysdeps/aarch64/fpu/acos_advsimd.c
+@@ -40,8 +40,8 @@ static const struct data
+ };
+ 
+ #define AllMask v_u64 (0xffffffffffffffff)
+-#define Oneu (0x3ff0000000000000)
+-#define Small (0x3e50000000000000) /* 2^-53.  */
++#define Oneu 0x3ff0000000000000
++#define Small 0x3e50000000000000 /* 2^-53.  */
+ 
+ #if WANT_SIMD_EXCEPT
+ static float64x2_t VPCS_ATTR NOINLINE
+diff --git a/sysdeps/aarch64/fpu/asin_advsimd.c b/sysdeps/aarch64/fpu/asin_advsimd.c
+index 141646e954..2de6eff407 100644
+--- a/sysdeps/aarch64/fpu/asin_advsimd.c
++++ b/sysdeps/aarch64/fpu/asin_advsimd.c
+@@ -39,8 +39,8 @@ static const struct data
+ };
+ 
+ #define AllMask v_u64 (0xffffffffffffffff)
+-#define One (0x3ff0000000000000)
+-#define Small (0x3e50000000000000) /* 2^-12.  */
++#define One 0x3ff0000000000000
++#define Small 0x3e50000000000000 /* 2^-12.  */
+ 
+ #if WANT_SIMD_EXCEPT
+ static float64x2_t VPCS_ATTR NOINLINE
+diff --git a/sysdeps/aarch64/fpu/atan2_sve.c b/sysdeps/aarch64/fpu/atan2_sve.c
+index 09a4c559b8..04fa71fa37 100644
+--- a/sysdeps/aarch64/fpu/atan2_sve.c
++++ b/sysdeps/aarch64/fpu/atan2_sve.c
+@@ -37,9 +37,6 @@ static const struct data
+   .pi_over_2 = 0x1.921fb54442d18p+0,
+ };
+ 
+-/* Useful constants.  */
+-#define SignMask sv_u64 (0x8000000000000000)
+-
+ /* Special cases i.e. 0, infinity, nan (fall back to scalar calls).  */
+ static svfloat64_t NOINLINE
+ special_case (svfloat64_t y, svfloat64_t x, svfloat64_t ret,
+@@ -72,14 +69,15 @@ svfloat64_t SV_NAME_D2 (atan2) (svfloat64_t y, svfloat64_t x, const svbool_t pg)
+   svbool_t cmp_y = zeroinfnan (iy, pg);
+   svbool_t cmp_xy = svorr_z (pg, cmp_x, cmp_y);
+ 
+-  svuint64_t sign_x = svand_x (pg, ix, SignMask);
+-  svuint64_t sign_y = svand_x (pg, iy, SignMask);
+-  svuint64_t sign_xy = sveor_x (pg, sign_x, sign_y);
+-
+   svfloat64_t ax = svabs_x (pg, x);
+   svfloat64_t ay = svabs_x (pg, y);
++  svuint64_t iax = svreinterpret_u64 (ax);
++  svuint64_t iay = svreinterpret_u64 (ay);
++
++  svuint64_t sign_x = sveor_x (pg, ix, iax);
++  svuint64_t sign_y = sveor_x (pg, iy, iay);
++  svuint64_t sign_xy = sveor_x (pg, sign_x, sign_y);
+ 
+-  svbool_t pred_xlt0 = svcmplt (pg, x, 0.0);
+   svbool_t pred_aygtax = svcmpgt (pg, ay, ax);
+ 
+   /* Set up z for call to atan.  */
+@@ -88,8 +86,9 @@ svfloat64_t SV_NAME_D2 (atan2) (svfloat64_t y, svfloat64_t x, const svbool_t pg)
+   svfloat64_t z = svdiv_x (pg, n, d);
+ 
+   /* Work out the correct shift.  */
+-  svfloat64_t shift = svsel (pred_xlt0, sv_f64 (-2.0), sv_f64 (0.0));
+-  shift = svsel (pred_aygtax, svadd_x (pg, shift, 1.0), shift);
++  svfloat64_t shift = svreinterpret_f64 (svlsr_x (pg, sign_x, 1));
++  shift = svsel (pred_aygtax, sv_f64 (1.0), shift);
++  shift = svreinterpret_f64 (svorr_x (pg, sign_x, svreinterpret_u64 (shift)));
+   shift = svmul_x (pg, shift, data_ptr->pi_over_2);
+ 
+   /* Use split Estrin scheme for P(z^2) with deg(P)=19.  */
+@@ -109,10 +108,10 @@ svfloat64_t SV_NAME_D2 (atan2) (svfloat64_t y, svfloat64_t x, const svbool_t pg)
+   ret = svadd_m (pg, ret, shift);
+ 
+   /* Account for the sign of x and y.  */
+-  ret = svreinterpret_f64 (sveor_x (pg, svreinterpret_u64 (ret), sign_xy));
+-
+   if (__glibc_unlikely (svptest_any (pg, cmp_xy)))
+-    return special_case (y, x, ret, cmp_xy);
+-
+-  return ret;
++    return special_case (
++	y, x,
++	svreinterpret_f64 (sveor_x (pg, svreinterpret_u64 (ret), sign_xy)),
++	cmp_xy);
++  return svreinterpret_f64 (sveor_x (pg, svreinterpret_u64 (ret), sign_xy));
+ }
+diff --git a/sysdeps/aarch64/fpu/atan2f_sve.c b/sysdeps/aarch64/fpu/atan2f_sve.c
+index b92f83cdea..9ea197147c 100644
+--- a/sysdeps/aarch64/fpu/atan2f_sve.c
++++ b/sysdeps/aarch64/fpu/atan2f_sve.c
+@@ -32,10 +32,8 @@ static const struct data
+   .pi_over_2 = 0x1.921fb6p+0f,
+ };
+ 
+-#define SignMask sv_u32 (0x80000000)
+-
+ /* Special cases i.e. 0, infinity, nan (fall back to scalar calls).  */
+-static inline svfloat32_t
++static svfloat32_t NOINLINE
+ special_case (svfloat32_t y, svfloat32_t x, svfloat32_t ret,
+ 	      const svbool_t cmp)
+ {
+@@ -67,14 +65,15 @@ svfloat32_t SV_NAME_F2 (atan2) (svfloat32_t y, svfloat32_t x, const svbool_t pg)
+   svbool_t cmp_y = zeroinfnan (iy, pg);
+   svbool_t cmp_xy = svorr_z (pg, cmp_x, cmp_y);
+ 
+-  svuint32_t sign_x = svand_x (pg, ix, SignMask);
+-  svuint32_t sign_y = svand_x (pg, iy, SignMask);
+-  svuint32_t sign_xy = sveor_x (pg, sign_x, sign_y);
+-
+   svfloat32_t ax = svabs_x (pg, x);
+   svfloat32_t ay = svabs_x (pg, y);
++  svuint32_t iax = svreinterpret_u32 (ax);
++  svuint32_t iay = svreinterpret_u32 (ay);
++
++  svuint32_t sign_x = sveor_x (pg, ix, iax);
++  svuint32_t sign_y = sveor_x (pg, iy, iay);
++  svuint32_t sign_xy = sveor_x (pg, sign_x, sign_y);
+ 
+-  svbool_t pred_xlt0 = svcmplt (pg, x, 0.0);
+   svbool_t pred_aygtax = svcmpgt (pg, ay, ax);
+ 
+   /* Set up z for call to atan.  */
+@@ -83,11 +82,12 @@ svfloat32_t SV_NAME_F2 (atan2) (svfloat32_t y, svfloat32_t x, const svbool_t pg)
+   svfloat32_t z = svdiv_x (pg, n, d);
+ 
+   /* Work out the correct shift.  */
+-  svfloat32_t shift = svsel (pred_xlt0, sv_f32 (-2.0), sv_f32 (0.0));
+-  shift = svsel (pred_aygtax, svadd_x (pg, shift, 1.0), shift);
++  svfloat32_t shift = svreinterpret_f32 (svlsr_x (pg, sign_x, 1));
++  shift = svsel (pred_aygtax, sv_f32 (1.0), shift);
++  shift = svreinterpret_f32 (svorr_x (pg, sign_x, svreinterpret_u32 (shift)));
+   shift = svmul_x (pg, shift, sv_f32 (data_ptr->pi_over_2));
+ 
+-  /* Use split Estrin scheme for P(z^2) with deg(P)=7.  */
++  /* Use pure Estrin scheme for P(z^2) with deg(P)=7.  */
+   svfloat32_t z2 = svmul_x (pg, z, z);
+   svfloat32_t z4 = svmul_x (pg, z2, z2);
+   svfloat32_t z8 = svmul_x (pg, z4, z4);
+@@ -101,10 +101,12 @@ svfloat32_t SV_NAME_F2 (atan2) (svfloat32_t y, svfloat32_t x, const svbool_t pg)
+   ret = svadd_m (pg, ret, shift);
+ 
+   /* Account for the sign of x and y.  */
+-  ret = svreinterpret_f32 (sveor_x (pg, svreinterpret_u32 (ret), sign_xy));
+ 
+   if (__glibc_unlikely (svptest_any (pg, cmp_xy)))
+-    return special_case (y, x, ret, cmp_xy);
++    return special_case (
++	y, x,
++	svreinterpret_f32 (sveor_x (pg, svreinterpret_u32 (ret), sign_xy)),
++	cmp_xy);
+ 
+-  return ret;
++  return svreinterpret_f32 (sveor_x (pg, svreinterpret_u32 (ret), sign_xy));
+ }
+diff --git a/sysdeps/aarch64/fpu/cos_advsimd.c b/sysdeps/aarch64/fpu/cos_advsimd.c
+index 2897e8b909..3924c9ce44 100644
+--- a/sysdeps/aarch64/fpu/cos_advsimd.c
++++ b/sysdeps/aarch64/fpu/cos_advsimd.c
+@@ -63,8 +63,7 @@ float64x2_t VPCS_ATTR V_NAME_D1 (cos) (float64x2_t x)
+        special-case handler later.  */
+     r = vbslq_f64 (cmp, v_f64 (1.0), r);
+ #else
+-  cmp = vcageq_f64 (d->range_val, x);
+-  cmp = vceqzq_u64 (cmp); /* cmp = ~cmp.  */
++  cmp = vcageq_f64 (x, d->range_val);
+   r = x;
+ #endif
+ 
+diff --git a/sysdeps/aarch64/fpu/cosf_advsimd.c b/sysdeps/aarch64/fpu/cosf_advsimd.c
+index 60abc8dfcf..d0c285b03a 100644
+--- a/sysdeps/aarch64/fpu/cosf_advsimd.c
++++ b/sysdeps/aarch64/fpu/cosf_advsimd.c
+@@ -64,8 +64,7 @@ float32x4_t VPCS_ATTR NOINLINE V_NAME_F1 (cos) (float32x4_t x)
+        special-case handler later.  */
+     r = vbslq_f32 (cmp, v_f32 (1.0f), r);
+ #else
+-  cmp = vcageq_f32 (d->range_val, x);
+-  cmp = vceqzq_u32 (cmp); /* cmp = ~cmp.  */
++  cmp = vcageq_f32 (x, d->range_val);
+   r = x;
+ #endif
+ 
+diff --git a/sysdeps/aarch64/fpu/exp10_advsimd.c b/sysdeps/aarch64/fpu/exp10_advsimd.c
+index fe7149b191..eeb31ca839 100644
+--- a/sysdeps/aarch64/fpu/exp10_advsimd.c
++++ b/sysdeps/aarch64/fpu/exp10_advsimd.c
+@@ -57,7 +57,7 @@ const static struct data
+ # define BigBound v_u64 (0x4070000000000000)  /* asuint64 (0x1p8).  */
+ # define Thres v_u64 (0x2070000000000000)     /* BigBound - TinyBound.  */
+ 
+-static inline float64x2_t VPCS_ATTR
++static float64x2_t VPCS_ATTR NOINLINE
+ special_case (float64x2_t x, float64x2_t y, uint64x2_t cmp)
+ {
+   /* If fenv exceptions are to be triggered correctly, fall back to the scalar
+@@ -72,7 +72,7 @@ special_case (float64x2_t x, float64x2_t y, uint64x2_t cmp)
+ # define SpecialBias1 v_u64 (0x7000000000000000)  /* 0x1p769.  */
+ # define SpecialBias2 v_u64 (0x3010000000000000)  /* 0x1p-254.  */
+ 
+-static float64x2_t VPCS_ATTR NOINLINE
++static inline float64x2_t VPCS_ATTR
+ special_case (float64x2_t s, float64x2_t y, float64x2_t n,
+ 	      const struct data *d)
+ {
+diff --git a/sysdeps/aarch64/fpu/exp10f_advsimd.c b/sysdeps/aarch64/fpu/exp10f_advsimd.c
+index 7ee0c90948..ab117b69da 100644
+--- a/sysdeps/aarch64/fpu/exp10f_advsimd.c
++++ b/sysdeps/aarch64/fpu/exp10f_advsimd.c
+@@ -25,7 +25,8 @@
+ static const struct data
+ {
+   float32x4_t poly[5];
+-  float32x4_t shift, log10_2, log2_10_hi, log2_10_lo;
++  float32x4_t log10_2_and_inv, shift;
++
+ #if !WANT_SIMD_EXCEPT
+   float32x4_t scale_thresh;
+ #endif
+@@ -38,9 +39,9 @@ static const struct data
+   .poly = { V4 (0x1.26bb16p+1f), V4 (0x1.5350d2p+1f), V4 (0x1.04744ap+1f),
+ 	    V4 (0x1.2d8176p+0f), V4 (0x1.12b41ap-1f) },
+   .shift = V4 (0x1.8p23f),
+-  .log10_2 = V4 (0x1.a934fp+1),
+-  .log2_10_hi = V4 (0x1.344136p-2),
+-  .log2_10_lo = V4 (-0x1.ec10cp-27),
++
++  /* Stores constants 1/log10(2), log10(2)_high, log10(2)_low, 0.  */
++  .log10_2_and_inv = { 0x1.a934fp+1, 0x1.344136p-2, -0x1.ec10cp-27, 0 },
+ #if !WANT_SIMD_EXCEPT
+   .scale_thresh = V4 (ScaleBound)
+ #endif
+@@ -98,24 +99,22 @@ float32x4_t VPCS_ATTR NOINLINE V_NAME_F1 (exp10) (float32x4_t x)
+ #if WANT_SIMD_EXCEPT
+   /* asuint(x) - TinyBound >= BigBound - TinyBound.  */
+   uint32x4_t cmp = vcgeq_u32 (
+-      vsubq_u32 (vandq_u32 (vreinterpretq_u32_f32 (x), v_u32 (0x7fffffff)),
+-		 TinyBound),
+-      Thres);
++      vsubq_u32 (vreinterpretq_u32_f32 (vabsq_f32 (x)), TinyBound), Thres);
+   float32x4_t xm = x;
+   /* If any lanes are special, mask them with 1 and retain a copy of x to allow
+      special case handler to fix special lanes later. This is only necessary if
+      fenv exceptions are to be triggered correctly.  */
+   if (__glibc_unlikely (v_any_u32 (cmp)))
+-    x = vbslq_f32 (cmp, v_f32 (1), x);
++    x = v_zerofy_f32 (x, cmp);
+ #endif
+ 
+   /* exp10(x) = 2^n * 10^r = 2^n * (1 + poly (r)),
+      with poly(r) in [1/sqrt(2), sqrt(2)] and
+      x = r + n * log10 (2), with r in [-log10(2)/2, log10(2)/2].  */
+-  float32x4_t z = vfmaq_f32 (d->shift, x, d->log10_2);
++  float32x4_t z = vfmaq_laneq_f32 (d->shift, x, d->log10_2_and_inv, 0);
+   float32x4_t n = vsubq_f32 (z, d->shift);
+-  float32x4_t r = vfmsq_f32 (x, n, d->log2_10_hi);
+-  r = vfmsq_f32 (r, n, d->log2_10_lo);
++  float32x4_t r = vfmsq_laneq_f32 (x, n, d->log10_2_and_inv, 1);
++  r = vfmsq_laneq_f32 (r, n, d->log10_2_and_inv, 2);
+   uint32x4_t e = vshlq_n_u32 (vreinterpretq_u32_f32 (z), 23);
+ 
+   float32x4_t scale = vreinterpretq_f32_u32 (vaddq_u32 (e, ExponentBias));
+diff --git a/sysdeps/aarch64/fpu/exp2_advsimd.c b/sysdeps/aarch64/fpu/exp2_advsimd.c
+index 391a93180c..ae1e63d503 100644
+--- a/sysdeps/aarch64/fpu/exp2_advsimd.c
++++ b/sysdeps/aarch64/fpu/exp2_advsimd.c
+@@ -24,6 +24,7 @@
+ #define IndexMask (N - 1)
+ #define BigBound 1022.0
+ #define UOFlowBound 1280.0
++#define TinyBound 0x2000000000000000 /* asuint64(0x1p-511).  */
+ 
+ static const struct data
+ {
+@@ -48,14 +49,13 @@ lookup_sbits (uint64x2_t i)
+ 
+ #if WANT_SIMD_EXCEPT
+ 
+-# define TinyBound 0x2000000000000000 /* asuint64(0x1p-511).  */
+ # define Thres 0x2080000000000000     /* asuint64(512.0) - TinyBound.  */
+ 
+ /* Call scalar exp2 as a fallback.  */
+ static float64x2_t VPCS_ATTR NOINLINE
+-special_case (float64x2_t x)
++special_case (float64x2_t x, float64x2_t y, uint64x2_t is_special)
+ {
+-  return v_call_f64 (exp2, x, x, v_u64 (0xffffffffffffffff));
++  return v_call_f64 (exp2, x, y, is_special);
+ }
+ 
+ #else
+@@ -65,7 +65,7 @@ special_case (float64x2_t x)
+ # define SpecialBias1 0x7000000000000000 /* 0x1p769.  */
+ # define SpecialBias2 0x3010000000000000 /* 0x1p-254.  */
+ 
+-static float64x2_t VPCS_ATTR
++static inline float64x2_t VPCS_ATTR
+ special_case (float64x2_t s, float64x2_t y, float64x2_t n,
+ 	      const struct data *d)
+ {
+@@ -94,10 +94,10 @@ float64x2_t V_NAME_D1 (exp2) (float64x2_t x)
+ #if WANT_SIMD_EXCEPT
+   uint64x2_t ia = vreinterpretq_u64_f64 (vabsq_f64 (x));
+   cmp = vcgeq_u64 (vsubq_u64 (ia, v_u64 (TinyBound)), v_u64 (Thres));
+-  /* If any special case (inf, nan, small and large x) is detected,
+-     fall back to scalar for all lanes.  */
+-  if (__glibc_unlikely (v_any_u64 (cmp)))
+-    return special_case (x);
++  /* Mask special lanes and retain a copy of x for passing to special-case
++     handler.  */
++  float64x2_t xc = x;
++  x = v_zerofy_f64 (x, cmp);
+ #else
+   cmp = vcagtq_f64 (x, d->scale_big_bound);
+ #endif
+@@ -120,9 +120,11 @@ float64x2_t V_NAME_D1 (exp2) (float64x2_t x)
+   float64x2_t y = v_pairwise_poly_3_f64 (r, r2, d->poly);
+   y = vmulq_f64 (r, y);
+ 
+-#if !WANT_SIMD_EXCEPT
+   if (__glibc_unlikely (v_any_u64 (cmp)))
++#if !WANT_SIMD_EXCEPT
+     return special_case (s, y, n, d);
++#else
++    return special_case (xc, vfmaq_f64 (s, s, y), cmp);
+ #endif
+   return vfmaq_f64 (s, s, y);
+ }
+diff --git a/sysdeps/aarch64/fpu/exp2f_sve.c b/sysdeps/aarch64/fpu/exp2f_sve.c
+index 9a5a523a10..8a686e3e05 100644
+--- a/sysdeps/aarch64/fpu/exp2f_sve.c
++++ b/sysdeps/aarch64/fpu/exp2f_sve.c
+@@ -20,6 +20,8 @@
+ #include "sv_math.h"
+ #include "poly_sve_f32.h"
+ 
++#define Thres 0x1.5d5e2ap+6f
++
+ static const struct data
+ {
+   float poly[5];
+@@ -33,7 +35,7 @@ static const struct data
+   .shift = 0x1.903f8p17f,
+   /* Roughly 87.3. For x < -Thres, the result is subnormal and not handled
+      correctly by FEXPA.  */
+-  .thres = 0x1.5d5e2ap+6f,
++  .thres = Thres,
+ };
+ 
+ static svfloat32_t NOINLINE
+diff --git a/sysdeps/aarch64/fpu/exp_advsimd.c b/sysdeps/aarch64/fpu/exp_advsimd.c
+index fd215f1d2c..5e3a9a0d44 100644
+--- a/sysdeps/aarch64/fpu/exp_advsimd.c
++++ b/sysdeps/aarch64/fpu/exp_advsimd.c
+@@ -54,7 +54,7 @@ const static volatile struct
+ # define BigBound v_u64 (0x4080000000000000) /* asuint64 (0x1p9).  */
+ # define SpecialBound v_u64 (0x2080000000000000) /* BigBound - TinyBound.  */
+ 
+-static inline float64x2_t VPCS_ATTR
++static float64x2_t VPCS_ATTR NOINLINE
+ special_case (float64x2_t x, float64x2_t y, uint64x2_t cmp)
+ {
+   /* If fenv exceptions are to be triggered correctly, fall back to the scalar
+@@ -69,7 +69,7 @@ special_case (float64x2_t x, float64x2_t y, uint64x2_t cmp)
+ # define SpecialBias1 v_u64 (0x7000000000000000) /* 0x1p769.  */
+ # define SpecialBias2 v_u64 (0x3010000000000000) /* 0x1p-254.  */
+ 
+-static float64x2_t VPCS_ATTR NOINLINE
++static inline float64x2_t VPCS_ATTR
+ special_case (float64x2_t s, float64x2_t y, float64x2_t n)
+ {
+   /* 2^(n/N) may overflow, break it up into s1*s2.  */
+diff --git a/sysdeps/aarch64/fpu/expm1_advsimd.c b/sysdeps/aarch64/fpu/expm1_advsimd.c
+index 0b85bd06f3..3628398674 100644
+--- a/sysdeps/aarch64/fpu/expm1_advsimd.c
++++ b/sysdeps/aarch64/fpu/expm1_advsimd.c
+@@ -23,7 +23,7 @@
+ static const struct data
+ {
+   float64x2_t poly[11];
+-  float64x2_t invln2, ln2_lo, ln2_hi, shift;
++  float64x2_t invln2, ln2, shift;
+   int64x2_t exponent_bias;
+ #if WANT_SIMD_EXCEPT
+   uint64x2_t thresh, tiny_bound;
+@@ -38,8 +38,7 @@ static const struct data
+ 	    V2 (0x1.71ddf82db5bb4p-19), V2 (0x1.27e517fc0d54bp-22),
+ 	    V2 (0x1.af5eedae67435p-26), V2 (0x1.1f143d060a28ap-29) },
+   .invln2 = V2 (0x1.71547652b82fep0),
+-  .ln2_hi = V2 (0x1.62e42fefa39efp-1),
+-  .ln2_lo = V2 (0x1.abc9e3b39803fp-56),
++  .ln2 = { 0x1.62e42fefa39efp-1, 0x1.abc9e3b39803fp-56 },
+   .shift = V2 (0x1.8p52),
+   .exponent_bias = V2 (0x3ff0000000000000),
+ #if WANT_SIMD_EXCEPT
+@@ -83,7 +82,7 @@ float64x2_t VPCS_ATTR V_NAME_D1 (expm1) (float64x2_t x)
+     x = v_zerofy_f64 (x, special);
+ #else
+   /* Large input, NaNs and Infs.  */
+-  uint64x2_t special = vceqzq_u64 (vcaltq_f64 (x, d->oflow_bound));
++  uint64x2_t special = vcageq_f64 (x, d->oflow_bound);
+ #endif
+ 
+   /* Reduce argument to smaller range:
+@@ -93,8 +92,8 @@ float64x2_t VPCS_ATTR V_NAME_D1 (expm1) (float64x2_t x)
+      where 2^i is exact because i is an integer.  */
+   float64x2_t n = vsubq_f64 (vfmaq_f64 (d->shift, d->invln2, x), d->shift);
+   int64x2_t i = vcvtq_s64_f64 (n);
+-  float64x2_t f = vfmsq_f64 (x, n, d->ln2_hi);
+-  f = vfmsq_f64 (f, n, d->ln2_lo);
++  float64x2_t f = vfmsq_laneq_f64 (x, n, d->ln2, 0);
++  f = vfmsq_laneq_f64 (f, n, d->ln2, 1);
+ 
+   /* Approximate expm1(f) using polynomial.
+      Taylor expansion for expm1(x) has the form:
+diff --git a/sysdeps/aarch64/fpu/expm1f_advsimd.c b/sysdeps/aarch64/fpu/expm1f_advsimd.c
+index 8d4c9a2193..93db200f61 100644
+--- a/sysdeps/aarch64/fpu/expm1f_advsimd.c
++++ b/sysdeps/aarch64/fpu/expm1f_advsimd.c
+@@ -23,7 +23,8 @@
+ static const struct data
+ {
+   float32x4_t poly[5];
+-  float32x4_t invln2, ln2_lo, ln2_hi, shift;
++  float32x4_t invln2_and_ln2;
++  float32x4_t shift;
+   int32x4_t exponent_bias;
+ #if WANT_SIMD_EXCEPT
+   uint32x4_t thresh;
+@@ -34,9 +35,8 @@ static const struct data
+   /* Generated using fpminimax with degree=5 in [-log(2)/2, log(2)/2].  */
+   .poly = { V4 (0x1.fffffep-2), V4 (0x1.5554aep-3), V4 (0x1.555736p-5),
+ 	    V4 (0x1.12287cp-7), V4 (0x1.6b55a2p-10) },
+-  .invln2 = V4 (0x1.715476p+0f),
+-  .ln2_hi = V4 (0x1.62e4p-1f),
+-  .ln2_lo = V4 (0x1.7f7d1cp-20f),
++  /* Stores constants: invln2, ln2_hi, ln2_lo, 0.  */
++  .invln2_and_ln2 = { 0x1.715476p+0f, 0x1.62e4p-1f, 0x1.7f7d1cp-20f, 0 },
+   .shift = V4 (0x1.8p23f),
+   .exponent_bias = V4 (0x3f800000),
+ #if !WANT_SIMD_EXCEPT
+@@ -80,7 +80,7 @@ float32x4_t VPCS_ATTR NOINLINE V_NAME_F1 (expm1) (float32x4_t x)
+     x = v_zerofy_f32 (x, special);
+ #else
+   /* Handles very large values (+ve and -ve), +/-NaN, +/-Inf.  */
+-  uint32x4_t special = vceqzq_u32 (vcaltq_f32 (x, d->oflow_bound));
++  uint32x4_t special = vcagtq_f32 (x, d->oflow_bound);
+ #endif
+ 
+   /* Reduce argument to smaller range:
+@@ -88,10 +88,11 @@ float32x4_t VPCS_ATTR NOINLINE V_NAME_F1 (expm1) (float32x4_t x)
+      and f = x - i * ln2, then f is in [-ln2/2, ln2/2].
+      exp(x) - 1 = 2^i * (expm1(f) + 1) - 1
+      where 2^i is exact because i is an integer.  */
+-  float32x4_t j = vsubq_f32 (vfmaq_f32 (d->shift, d->invln2, x), d->shift);
++  float32x4_t j = vsubq_f32 (
++      vfmaq_laneq_f32 (d->shift, x, d->invln2_and_ln2, 0), d->shift);
+   int32x4_t i = vcvtq_s32_f32 (j);
+-  float32x4_t f = vfmsq_f32 (x, j, d->ln2_hi);
+-  f = vfmsq_f32 (f, j, d->ln2_lo);
++  float32x4_t f = vfmsq_laneq_f32 (x, j, d->invln2_and_ln2, 1);
++  f = vfmsq_laneq_f32 (f, j, d->invln2_and_ln2, 2);
+ 
+   /* Approximate expm1(f) using polynomial.
+      Taylor expansion for expm1(x) has the form:
+diff --git a/sysdeps/aarch64/fpu/log_advsimd.c b/sysdeps/aarch64/fpu/log_advsimd.c
+index 067ae79613..21df61728c 100644
+--- a/sysdeps/aarch64/fpu/log_advsimd.c
++++ b/sysdeps/aarch64/fpu/log_advsimd.c
+@@ -58,8 +58,13 @@ lookup (uint64x2_t i)
+   uint64_t i1 = (i[1] >> (52 - V_LOG_TABLE_BITS)) & IndexMask;
+   float64x2_t e0 = vld1q_f64 (&__v_log_data.table[i0].invc);
+   float64x2_t e1 = vld1q_f64 (&__v_log_data.table[i1].invc);
++#if __BYTE_ORDER == __LITTLE_ENDIAN
+   e.invc = vuzp1q_f64 (e0, e1);
+   e.logc = vuzp2q_f64 (e0, e1);
++#else
++  e.invc = vuzp1q_f64 (e1, e0);
++  e.logc = vuzp2q_f64 (e1, e0);
++#endif
+   return e;
+ }
+ 
+diff --git a/sysdeps/aarch64/fpu/sin_advsimd.c b/sysdeps/aarch64/fpu/sin_advsimd.c
+index efce183e86..a0d9d3b819 100644
+--- a/sysdeps/aarch64/fpu/sin_advsimd.c
++++ b/sysdeps/aarch64/fpu/sin_advsimd.c
+@@ -75,8 +75,7 @@ float64x2_t VPCS_ATTR V_NAME_D1 (sin) (float64x2_t x)
+   r = vbslq_f64 (cmp, vreinterpretq_f64_u64 (cmp), x);
+ #else
+   r = x;
+-  cmp = vcageq_f64 (d->range_val, x);
+-  cmp = vceqzq_u64 (cmp); /* cmp = ~cmp.  */
++  cmp = vcageq_f64 (x, d->range_val);
+ #endif
+ 
+   /* n = rint(|x|/pi).  */
+diff --git a/sysdeps/aarch64/fpu/sinf_advsimd.c b/sysdeps/aarch64/fpu/sinf_advsimd.c
+index 60cf3f2ca1..375dfc3331 100644
+--- a/sysdeps/aarch64/fpu/sinf_advsimd.c
++++ b/sysdeps/aarch64/fpu/sinf_advsimd.c
+@@ -67,8 +67,7 @@ float32x4_t VPCS_ATTR NOINLINE V_NAME_F1 (sin) (float32x4_t x)
+   r = vbslq_f32 (cmp, vreinterpretq_f32_u32 (cmp), x);
+ #else
+   r = x;
+-  cmp = vcageq_f32 (d->range_val, x);
+-  cmp = vceqzq_u32 (cmp); /* cmp = ~cmp.  */
++  cmp = vcageq_f32 (x, d->range_val);
+ #endif
+ 
+   /* n = rint(|x|/pi) */
+diff --git a/sysdeps/aarch64/fpu/tan_advsimd.c b/sysdeps/aarch64/fpu/tan_advsimd.c
+index d7e5ba7b1a..0459821ab2 100644
+--- a/sysdeps/aarch64/fpu/tan_advsimd.c
++++ b/sysdeps/aarch64/fpu/tan_advsimd.c
+@@ -23,7 +23,7 @@
+ static const struct data
+ {
+   float64x2_t poly[9];
+-  float64x2_t half_pi_hi, half_pi_lo, two_over_pi, shift;
++  float64x2_t half_pi, two_over_pi, shift;
+ #if !WANT_SIMD_EXCEPT
+   float64x2_t range_val;
+ #endif
+@@ -34,8 +34,7 @@ static const struct data
+ 	    V2 (0x1.226e5e5ecdfa3p-7), V2 (0x1.d6c7ddbf87047p-9),
+ 	    V2 (0x1.7ea75d05b583ep-10), V2 (0x1.289f22964a03cp-11),
+ 	    V2 (0x1.4e4fd14147622p-12) },
+-  .half_pi_hi = V2 (0x1.921fb54442d18p0),
+-  .half_pi_lo = V2 (0x1.1a62633145c07p-54),
++  .half_pi = { 0x1.921fb54442d18p0, 0x1.1a62633145c07p-54 },
+   .two_over_pi = V2 (0x1.45f306dc9c883p-1),
+   .shift = V2 (0x1.8p52),
+ #if !WANT_SIMD_EXCEPT
+@@ -56,15 +55,15 @@ special_case (float64x2_t x)
+ 
+ /* Vector approximation for double-precision tan.
+    Maximum measured error is 3.48 ULP:
+-   __v_tan(0x1.4457047ef78d8p+20) got -0x1.f6ccd8ecf7dedp+37
+-				 want -0x1.f6ccd8ecf7deap+37.   */
++   _ZGVnN2v_tan(0x1.4457047ef78d8p+20) got -0x1.f6ccd8ecf7dedp+37
++				      want -0x1.f6ccd8ecf7deap+37.  */
+ float64x2_t VPCS_ATTR V_NAME_D1 (tan) (float64x2_t x)
+ {
+   const struct data *dat = ptr_barrier (&data);
+-  /* Our argument reduction cannot calculate q with sufficient accuracy for very
+-     large inputs. Fall back to scalar routine for all lanes if any are too
+-     large, or Inf/NaN. If fenv exceptions are expected, also fall back for tiny
+-     input to avoid underflow.  */
++  /* Our argument reduction cannot calculate q with sufficient accuracy for
++     very large inputs. Fall back to scalar routine for all lanes if any are
++     too large, or Inf/NaN. If fenv exceptions are expected, also fall back for
++     tiny input to avoid underflow.  */
+ #if WANT_SIMD_EXCEPT
+   uint64x2_t iax = vreinterpretq_u64_f64 (vabsq_f64 (x));
+   /* iax - tiny_bound > range_val - tiny_bound.  */
+@@ -82,8 +81,8 @@ float64x2_t VPCS_ATTR V_NAME_D1 (tan) (float64x2_t x)
+   /* Use q to reduce x to r in [-pi/4, pi/4], by:
+      r = x - q * pi/2, in extended precision.  */
+   float64x2_t r = x;
+-  r = vfmsq_f64 (r, q, dat->half_pi_hi);
+-  r = vfmsq_f64 (r, q, dat->half_pi_lo);
++  r = vfmsq_laneq_f64 (r, q, dat->half_pi, 0);
++  r = vfmsq_laneq_f64 (r, q, dat->half_pi, 1);
+   /* Further reduce r to [-pi/8, pi/8], to be reconstructed using double angle
+      formula.  */
+   r = vmulq_n_f64 (r, 0.5);
+@@ -106,14 +105,15 @@ float64x2_t VPCS_ATTR V_NAME_D1 (tan) (float64x2_t x)
+      and reciprocity around pi/2:
+      tan(x) = 1 / (tan(pi/2 - x))
+      to assemble result using change-of-sign and conditional selection of
+-     numerator/denominator, dependent on odd/even-ness of q (hence quadrant). */
++     numerator/denominator, dependent on odd/even-ness of q (hence quadrant).
++   */
+   float64x2_t n = vfmaq_f64 (v_f64 (-1), p, p);
+   float64x2_t d = vaddq_f64 (p, p);
+ 
+   uint64x2_t no_recip = vtstq_u64 (vreinterpretq_u64_s64 (qi), v_u64 (1));
+ 
+ #if !WANT_SIMD_EXCEPT
+-  uint64x2_t special = vceqzq_u64 (vcaleq_f64 (x, dat->range_val));
++  uint64x2_t special = vcageq_f64 (x, dat->range_val);
+   if (__glibc_unlikely (v_any_u64 (special)))
+     return special_case (x);
+ #endif
+diff --git a/sysdeps/aarch64/fpu/tanf_advsimd.c b/sysdeps/aarch64/fpu/tanf_advsimd.c
+index 1f16103f8a..5a7489390a 100644
+--- a/sysdeps/aarch64/fpu/tanf_advsimd.c
++++ b/sysdeps/aarch64/fpu/tanf_advsimd.c
+@@ -23,7 +23,8 @@
+ static const struct data
+ {
+   float32x4_t poly[6];
+-  float32x4_t neg_half_pi_1, neg_half_pi_2, neg_half_pi_3, two_over_pi, shift;
++  float32x4_t pi_consts;
++  float32x4_t shift;
+ #if !WANT_SIMD_EXCEPT
+   float32x4_t range_val;
+ #endif
+@@ -31,10 +32,9 @@ static const struct data
+   /* Coefficients generated using FPMinimax.  */
+   .poly = { V4 (0x1.55555p-2f), V4 (0x1.11166p-3f), V4 (0x1.b88a78p-5f),
+ 	    V4 (0x1.7b5756p-6f), V4 (0x1.4ef4cep-8f), V4 (0x1.0e1e74p-7f) },
+-  .neg_half_pi_1 = V4 (-0x1.921fb6p+0f),
+-  .neg_half_pi_2 = V4 (0x1.777a5cp-25f),
+-  .neg_half_pi_3 = V4 (0x1.ee59dap-50f),
+-  .two_over_pi = V4 (0x1.45f306p-1f),
++  /* Stores constants: (-pi/2)_high, (-pi/2)_mid, (-pi/2)_low, and 2/pi.  */
++  .pi_consts
++  = { -0x1.921fb6p+0f, 0x1.777a5cp-25f, 0x1.ee59dap-50f, 0x1.45f306p-1f },
+   .shift = V4 (0x1.8p+23f),
+ #if !WANT_SIMD_EXCEPT
+   .range_val = V4 (0x1p15f),
+@@ -58,10 +58,11 @@ eval_poly (float32x4_t z, const struct data *d)
+ {
+   float32x4_t z2 = vmulq_f32 (z, z);
+ #if WANT_SIMD_EXCEPT
+-  /* Tiny z (<= 0x1p-31) will underflow when calculating z^4. If fp exceptions
+-     are to be triggered correctly, sidestep this by fixing such lanes to 0.  */
++  /* Tiny z (<= 0x1p-31) will underflow when calculating z^4.
++     If fp exceptions are to be triggered correctly,
++     sidestep this by fixing such lanes to 0.  */
+   uint32x4_t will_uflow
+-    = vcleq_u32 (vreinterpretq_u32_f32 (vabsq_f32 (z)), TinyBound);
++      = vcleq_u32 (vreinterpretq_u32_f32 (vabsq_f32 (z)), TinyBound);
+   if (__glibc_unlikely (v_any_u32 (will_uflow)))
+     z2 = vbslq_f32 (will_uflow, v_f32 (0), z2);
+ #endif
+@@ -94,16 +95,16 @@ float32x4_t VPCS_ATTR NOINLINE V_NAME_F1 (tan) (float32x4_t x)
+ #endif
+ 
+   /* n = rint(x/(pi/2)).  */
+-  float32x4_t q = vfmaq_f32 (d->shift, d->two_over_pi, x);
++  float32x4_t q = vfmaq_laneq_f32 (d->shift, x, d->pi_consts, 3);
+   float32x4_t n = vsubq_f32 (q, d->shift);
+   /* Determine if x lives in an interval, where |tan(x)| grows to infinity.  */
+   uint32x4_t pred_alt = vtstq_u32 (vreinterpretq_u32_f32 (q), v_u32 (1));
+ 
+   /* r = x - n * (pi/2)  (range reduction into -pi./4 .. pi/4).  */
+   float32x4_t r;
+-  r = vfmaq_f32 (x, d->neg_half_pi_1, n);
+-  r = vfmaq_f32 (r, d->neg_half_pi_2, n);
+-  r = vfmaq_f32 (r, d->neg_half_pi_3, n);
++  r = vfmaq_laneq_f32 (x, n, d->pi_consts, 0);
++  r = vfmaq_laneq_f32 (r, n, d->pi_consts, 1);
++  r = vfmaq_laneq_f32 (r, n, d->pi_consts, 2);
+ 
+   /* If x lives in an interval, where |tan(x)|
+      - is finite, then use a polynomial approximation of the form
+
+commit 395a89f61e19fa916ae4cc93fc10d81a28ce3039
+Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
+Date:   Wed Mar 13 14:34:14 2024 +0000
+
+    aarch64: fix check for SVE support in assembler
+    
+    Due to GCC bug 110901 -mcpu can override -march setting when compiling
+    asm code and thus a compiler targetting a specific cpu can fail the
+    configure check even when binutils gas supports SVE.
+    
+    The workaround is that explicit .arch directive overrides both -mcpu
+    and -march, and since that's what the actual SVE memcpy uses the
+    configure check should use that too even if the GCC issue is fixed
+    independently.
+    
+    Reviewed-by: Florian Weimer <fweimer@redhat.com>
+    (cherry picked from commit 73c26018ed0ecd9c807bb363cc2c2ab4aca66a82)
+
+diff --git a/sysdeps/aarch64/configure b/sysdeps/aarch64/configure
+old mode 100644
+new mode 100755
+index ca57edce47..9606137e8d
+--- a/sysdeps/aarch64/configure
++++ b/sysdeps/aarch64/configure
+@@ -325,9 +325,10 @@ then :
+   printf %s "(cached) " >&6
+ else $as_nop
+   cat > conftest.s <<\EOF
+-        ptrue p0.b
++	.arch armv8.2-a+sve
++	ptrue p0.b
+ EOF
+-if { ac_try='${CC-cc} -c -march=armv8.2-a+sve conftest.s 1>&5'
++if { ac_try='${CC-cc} -c conftest.s 1>&5'
+   { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
+   (eval $ac_try) 2>&5
+   ac_status=$?
+diff --git a/sysdeps/aarch64/configure.ac b/sysdeps/aarch64/configure.ac
+index 27874eceb4..56d12d661d 100644
+--- a/sysdeps/aarch64/configure.ac
++++ b/sysdeps/aarch64/configure.ac
+@@ -90,9 +90,10 @@ LIBC_CONFIG_VAR([aarch64-variant-pcs], [$libc_cv_aarch64_variant_pcs])
+ # Check if asm support armv8.2-a+sve
+ AC_CACHE_CHECK([for SVE support in assembler], [libc_cv_aarch64_sve_asm], [dnl
+ cat > conftest.s <<\EOF
+-        ptrue p0.b
++	.arch armv8.2-a+sve
++	ptrue p0.b
+ EOF
+-if AC_TRY_COMMAND(${CC-cc} -c -march=armv8.2-a+sve conftest.s 1>&AS_MESSAGE_LOG_FD); then
++if AC_TRY_COMMAND(${CC-cc} -c conftest.s 1>&AS_MESSAGE_LOG_FD); then
+   libc_cv_aarch64_sve_asm=yes
+ else
+   libc_cv_aarch64_sve_asm=no
+
+commit 9d92452c70805a2e2dbbdb2b1ffc34bd86e1c8df
+Author: Wilco Dijkstra <wilco.dijkstra@arm.com>
+Date:   Thu Mar 21 16:48:33 2024 +0000
+
+    AArch64: Check kernel version for SVE ifuncs
+    
+    Old Linux kernels disable SVE after every system call.  Calling the
+    SVE-optimized memcpy afterwards will then cause a trap to reenable SVE.
+    As a result, applications with a high use of syscalls may run slower with
+    the SVE memcpy.  This is true for kernels between 4.15.0 and before 6.2.0,
+    except for 5.14.0 which was patched.  Avoid this by checking the kernel
+    version and selecting the SVE ifunc on modern kernels.
+    
+    Parse the kernel version reported by uname() into a 24-bit kernel.major.minor
+    value without calling any library functions.  If uname() is not supported or
+    if the version format is not recognized, assume the kernel is modern.
+    
+    Tested-by: Florian Weimer <fweimer@redhat.com>
+    Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
+    (cherry picked from commit 2e94e2f5d2bf2de124c8ad7da85463355e54ccb2)
+
+diff --git a/sysdeps/aarch64/cpu-features.h b/sysdeps/aarch64/cpu-features.h
+index 77a782422a..5f2da91ebb 100644
+--- a/sysdeps/aarch64/cpu-features.h
++++ b/sysdeps/aarch64/cpu-features.h
+@@ -71,6 +71,7 @@ struct cpu_features
+   /* Currently, the GLIBC memory tagging tunable only defines 8 bits.  */
+   uint8_t mte_state;
+   bool sve;
++  bool prefer_sve_ifuncs;
+   bool mops;
+ };
+ 
+diff --git a/sysdeps/aarch64/multiarch/init-arch.h b/sysdeps/aarch64/multiarch/init-arch.h
+index c52860efb2..61dc40088f 100644
+--- a/sysdeps/aarch64/multiarch/init-arch.h
++++ b/sysdeps/aarch64/multiarch/init-arch.h
+@@ -36,5 +36,7 @@
+     MTE_ENABLED ();							      \
+   bool __attribute__((unused)) sve =					      \
+     GLRO(dl_aarch64_cpu_features).sve;					      \
++  bool __attribute__((unused)) prefer_sve_ifuncs =			      \
++    GLRO(dl_aarch64_cpu_features).prefer_sve_ifuncs;			      \
+   bool __attribute__((unused)) mops =					      \
+     GLRO(dl_aarch64_cpu_features).mops;
+diff --git a/sysdeps/aarch64/multiarch/memcpy.c b/sysdeps/aarch64/multiarch/memcpy.c
+index d12eccfca5..ce53567dab 100644
+--- a/sysdeps/aarch64/multiarch/memcpy.c
++++ b/sysdeps/aarch64/multiarch/memcpy.c
+@@ -47,7 +47,7 @@ select_memcpy_ifunc (void)
+     {
+       if (IS_A64FX (midr))
+ 	return __memcpy_a64fx;
+-      return __memcpy_sve;
++      return prefer_sve_ifuncs ? __memcpy_sve : __memcpy_generic;
+     }
+ 
+   if (IS_THUNDERX (midr))
+diff --git a/sysdeps/aarch64/multiarch/memmove.c b/sysdeps/aarch64/multiarch/memmove.c
+index 2081eeb4d4..fe95037be3 100644
+--- a/sysdeps/aarch64/multiarch/memmove.c
++++ b/sysdeps/aarch64/multiarch/memmove.c
+@@ -47,7 +47,7 @@ select_memmove_ifunc (void)
+     {
+       if (IS_A64FX (midr))
+ 	return __memmove_a64fx;
+-      return __memmove_sve;
++      return prefer_sve_ifuncs ? __memmove_sve : __memmove_generic;
+     }
+ 
+   if (IS_THUNDERX (midr))
+diff --git a/sysdeps/unix/sysv/linux/aarch64/cpu-features.c b/sysdeps/unix/sysv/linux/aarch64/cpu-features.c
+index b1a3f673f0..c0b047bc0d 100644
+--- a/sysdeps/unix/sysv/linux/aarch64/cpu-features.c
++++ b/sysdeps/unix/sysv/linux/aarch64/cpu-features.c
+@@ -21,6 +21,7 @@
+ #include <sys/auxv.h>
+ #include <elf/dl-hwcaps.h>
+ #include <sys/prctl.h>
++#include <sys/utsname.h>
+ #include <dl-tunables-parse.h>
+ 
+ #define DCZID_DZP_MASK (1 << 4)
+@@ -62,6 +63,46 @@ get_midr_from_mcpu (const struct tunable_str_t *mcpu)
+   return UINT64_MAX;
+ }
+ 
++#if __LINUX_KERNEL_VERSION < 0x060200
++
++/* Return true if we prefer using SVE in string ifuncs.  Old kernels disable
++   SVE after every system call which results in unnecessary traps if memcpy
++   uses SVE.  This is true for kernels between 4.15.0 and before 6.2.0, except
++   for 5.14.0 which was patched.  For these versions return false to avoid using
++   SVE ifuncs.
++   Parse the kernel version into a 24-bit kernel.major.minor value without
++   calling any library functions.  If uname() is not supported or if the version
++   format is not recognized, assume the kernel is modern and return true.  */
++
++static inline bool
++prefer_sve_ifuncs (void)
++{
++  struct utsname buf;
++  const char *p = &buf.release[0];
++  int kernel = 0;
++  int val;
++
++  if (__uname (&buf) < 0)
++    return true;
++
++  for (int shift = 16; shift >= 0; shift -= 8)
++    {
++      for (val = 0; *p >= '0' && *p <= '9'; p++)
++	val = val * 10 + *p - '0';
++      kernel |= (val & 255) << shift;
++      if (*p++ != '.')
++	break;
++    }
++
++  if (kernel >= 0x060200 || kernel == 0x050e00)
++    return true;
++  if (kernel >= 0x040f00)
++    return false;
++  return true;
++}
++
++#endif
++
+ static inline void
+ init_cpu_features (struct cpu_features *cpu_features)
+ {
+@@ -126,6 +167,13 @@ init_cpu_features (struct cpu_features *cpu_features)
+   /* Check if SVE is supported.  */
+   cpu_features->sve = GLRO (dl_hwcap) & HWCAP_SVE;
+ 
++  cpu_features->prefer_sve_ifuncs = cpu_features->sve;
++
++#if __LINUX_KERNEL_VERSION < 0x060200
++  if (cpu_features->sve)
++    cpu_features->prefer_sve_ifuncs = prefer_sve_ifuncs ();
++#endif
++
+   /* Check if MOPS is supported.  */
+   cpu_features->mops = GLRO (dl_hwcap2) & HWCAP2_MOPS;
+ }
+
+commit 9883f4304cfb1558d0f1e6d9f48c4ab0a35355fe
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Wed Feb 28 09:51:14 2024 -0800
+
+    x86-64: Don't use SSE resolvers for ISA level 3 or above
+    
+    When glibc is built with ISA level 3 or above enabled, SSE resolvers
+    aren't available and glibc fails to build:
+    
+    ld: .../elf/librtld.os: in function `init_cpu_features':
+    .../elf/../sysdeps/x86/cpu-features.c:1200:(.text+0x1445f): undefined reference to `_dl_runtime_resolve_fxsave'
+    ld: .../elf/librtld.os: relocation R_X86_64_PC32 against undefined hidden symbol `_dl_runtime_resolve_fxsave' can not be used when making a shared object
+    /usr/local/bin/ld: final link failed: bad value
+    
+    For ISA level 3 or above, don't use _dl_runtime_resolve_fxsave nor
+    _dl_tlsdesc_dynamic_fxsave.
+    
+    This fixes BZ #31429.
+    Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
+    
+    (cherry picked from commit befe2d3c4dec8be2cdd01a47132e47bdb7020922)
+
+diff --git a/sysdeps/x86/cpu-features.c b/sysdeps/x86/cpu-features.c
+index 6fe1b728c6..b8abe733ab 100644
+--- a/sysdeps/x86/cpu-features.c
++++ b/sysdeps/x86/cpu-features.c
+@@ -18,6 +18,7 @@
+ 
+ #include <dl-hwcap.h>
+ #include <libc-pointer-arith.h>
++#include <isa-level.h>
+ #include <get-isa-level.h>
+ #include <cacheinfo.h>
+ #include <dl-cacheinfo.h>
+@@ -1198,7 +1199,9 @@ no_cpuid:
+ 	       TUNABLE_CALLBACK (set_x86_shstk));
+ #endif
+ 
++#if MINIMUM_X86_ISA_LEVEL < AVX_X86_ISA_LEVEL
+   if (GLRO(dl_x86_cpu_features).xsave_state_size != 0)
++#endif
+     {
+       if (CPU_FEATURE_USABLE_P (cpu_features, XSAVEC))
+ 	{
+@@ -1219,22 +1222,24 @@ no_cpuid:
+ #endif
+ 	}
+     }
++#if MINIMUM_X86_ISA_LEVEL < AVX_X86_ISA_LEVEL
+   else
+     {
+-#ifdef __x86_64__
++# ifdef __x86_64__
+       GLRO(dl_x86_64_runtime_resolve) = _dl_runtime_resolve_fxsave;
+-# ifdef SHARED
++#  ifdef SHARED
+       GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_fxsave;
+-# endif
+-#else
+-# ifdef SHARED
++#  endif
++# else
++#  ifdef SHARED
+       if (CPU_FEATURE_USABLE_P (cpu_features, FXSR))
+ 	GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_fxsave;
+       else
+ 	GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_fnsave;
++#  endif
+ # endif
+-#endif
+     }
++#endif
+ 
+ #ifdef SHARED
+ # ifdef __x86_64__
+diff --git a/sysdeps/x86_64/dl-tlsdesc.S b/sysdeps/x86_64/dl-tlsdesc.S
+index ea69f5223a..057a10862a 100644
+--- a/sysdeps/x86_64/dl-tlsdesc.S
++++ b/sysdeps/x86_64/dl-tlsdesc.S
+@@ -20,6 +20,7 @@
+ #include <tls.h>
+ #include <cpu-features-offsets.h>
+ #include <features-offsets.h>
++#include <isa-level.h>
+ #include "tlsdesc.h"
+ #include "dl-trampoline-save.h"
+ 
+@@ -79,12 +80,14 @@ _dl_tlsdesc_undefweak:
+ 	.size	_dl_tlsdesc_undefweak, .-_dl_tlsdesc_undefweak
+ 
+ #ifdef SHARED
+-# define USE_FXSAVE
+-# define STATE_SAVE_ALIGNMENT	16
+-# define _dl_tlsdesc_dynamic	_dl_tlsdesc_dynamic_fxsave
+-# include "dl-tlsdesc-dynamic.h"
+-# undef _dl_tlsdesc_dynamic
+-# undef USE_FXSAVE
++# if MINIMUM_X86_ISA_LEVEL < AVX_X86_ISA_LEVEL
++#  define USE_FXSAVE
++#  define STATE_SAVE_ALIGNMENT	16
++#  define _dl_tlsdesc_dynamic	_dl_tlsdesc_dynamic_fxsave
++#  include "dl-tlsdesc-dynamic.h"
++#  undef _dl_tlsdesc_dynamic
++#  undef USE_FXSAVE
++# endif
+ 
+ # define USE_XSAVE
+ # define STATE_SAVE_ALIGNMENT	64
+
+commit 7b92f46f04c6cbce19d19ae1099628431858996c
+Author: Sunil K Pandey <skpgkp2@gmail.com>
+Date:   Thu Feb 29 17:57:02 2024 -0800
+
+    x86-64: Simplify minimum ISA check ifdef conditional with if
+    
+    Replace minimum ISA check ifdef conditional with if.  Since
+    MINIMUM_X86_ISA_LEVEL and AVX_X86_ISA_LEVEL are compile time constants,
+    compiler will perform constant folding optimization, getting same
+    results.
+    
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    (cherry picked from commit b6e3898194bbae78910bbe9cd086937014961e45)
+
+diff --git a/sysdeps/x86/cpu-features.c b/sysdeps/x86/cpu-features.c
+index b8abe733ab..3d7c2819d7 100644
+--- a/sysdeps/x86/cpu-features.c
++++ b/sysdeps/x86/cpu-features.c
+@@ -1199,9 +1199,8 @@ no_cpuid:
+ 	       TUNABLE_CALLBACK (set_x86_shstk));
+ #endif
+ 
+-#if MINIMUM_X86_ISA_LEVEL < AVX_X86_ISA_LEVEL
+-  if (GLRO(dl_x86_cpu_features).xsave_state_size != 0)
+-#endif
++  if (MINIMUM_X86_ISA_LEVEL >= AVX_X86_ISA_LEVEL
++      || (GLRO(dl_x86_cpu_features).xsave_state_size != 0))
+     {
+       if (CPU_FEATURE_USABLE_P (cpu_features, XSAVEC))
+ 	{
+@@ -1222,24 +1221,22 @@ no_cpuid:
+ #endif
+ 	}
+     }
+-#if MINIMUM_X86_ISA_LEVEL < AVX_X86_ISA_LEVEL
+   else
+     {
+-# ifdef __x86_64__
++#ifdef __x86_64__
+       GLRO(dl_x86_64_runtime_resolve) = _dl_runtime_resolve_fxsave;
+-#  ifdef SHARED
++# ifdef SHARED
+       GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_fxsave;
+-#  endif
+-# else
+-#  ifdef SHARED
++# endif
++#else
++# ifdef SHARED
+       if (CPU_FEATURE_USABLE_P (cpu_features, FXSR))
+ 	GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_fxsave;
+       else
+ 	GLRO(dl_x86_tlsdesc_dynamic) = _dl_tlsdesc_dynamic_fnsave;
+-#  endif
+ # endif
+-    }
+ #endif
++    }
+ 
+ #ifdef SHARED
+ # ifdef __x86_64__
+
+commit edb9a76e3008725e9dc035d38a58e849a3bde0f1
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Sun Apr 14 08:24:51 2024 +0200
+
+    powerpc: Fix ld.so address determination for PCREL mode (bug 31640)
+    
+    This seems to have stopped working with some GCC 14 versions,
+    which clobber r2.  With other compilers, the kernel-provided
+    r2 value is still available at this point.
+    
+    Reviewed-by: Peter Bergner <bergner@linux.ibm.com>
+    (cherry picked from commit 14e56bd4ce15ac2d1cc43f762eb2e6b83fec1afe)
+
+diff --git a/sysdeps/powerpc/powerpc64/dl-machine.h b/sysdeps/powerpc/powerpc64/dl-machine.h
+index c6682f3445..2b6f5d2b08 100644
+--- a/sysdeps/powerpc/powerpc64/dl-machine.h
++++ b/sysdeps/powerpc/powerpc64/dl-machine.h
+@@ -78,6 +78,7 @@ elf_host_tolerates_class (const Elf64_Ehdr *ehdr)
+ static inline Elf64_Addr
+ elf_machine_load_address (void) __attribute__ ((const));
+ 
++#ifndef __PCREL__
+ static inline Elf64_Addr
+ elf_machine_load_address (void)
+ {
+@@ -105,6 +106,24 @@ elf_machine_dynamic (void)
+   /* Then subtract off the load address offset.  */
+   return runtime_dynamic - elf_machine_load_address() ;
+ }
++#else /* __PCREL__ */
++/* In PCREL mode, r2 may have been clobbered.  Rely on relative
++   relocations instead.  */
++
++static inline ElfW(Addr)
++elf_machine_load_address (void)
++{
++  extern const ElfW(Ehdr) __ehdr_start attribute_hidden;
++  return (ElfW(Addr)) &__ehdr_start;
++}
++
++static inline ElfW(Addr)
++elf_machine_dynamic (void)
++{
++  extern ElfW(Dyn) _DYNAMIC[] attribute_hidden;
++  return (ElfW(Addr)) _DYNAMIC - elf_machine_load_address ();
++}
++#endif /* __PCREL__ */
+ 
+ /* The PLT uses Elf64_Rela relocs.  */
+ #define elf_machine_relplt elf_machine_rela
+
+commit 04df8652eb1919da18d54b3dcd6db1675993d45d
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Thu Feb 15 11:19:56 2024 -0800
+
+    Apply the Makefile sorting fix
+    
+    Apply the Makefile sorting fix generated by sort-makefile-lines.py.
+    
+    (cherry picked from commit ef7f4b1fef67430a8f3cfc77fa6aada2add851d7)
+
+diff --git a/sysdeps/loongarch/lp64/multiarch/Makefile b/sysdeps/loongarch/lp64/multiarch/Makefile
+index fe863e1ba4..01762ef526 100644
+--- a/sysdeps/loongarch/lp64/multiarch/Makefile
++++ b/sysdeps/loongarch/lp64/multiarch/Makefile
+@@ -1,52 +1,52 @@
+ ifeq ($(subdir),string)
+ sysdep_routines += \
+-  strlen-aligned \
+-  strlen-lsx \
+-  strlen-lasx \
+-  strnlen-aligned \
+-  strnlen-lsx \
+-  strnlen-lasx \
++  memchr-aligned \
++  memchr-lasx \
++  memchr-lsx \
++  memcmp-aligned \
++  memcmp-lasx \
++  memcmp-lsx \
++  memcpy-aligned \
++  memcpy-unaligned \
++  memmove-lasx \
++  memmove-lsx \
++  memmove-unaligned \
++  memrchr-generic \
++  memrchr-lasx \
++  memrchr-lsx \
++  memset-aligned \
++  memset-lasx \
++  memset-lsx \
++  memset-unaligned \
++  rawmemchr-aligned \
++  rawmemchr-lasx \
++  rawmemchr-lsx \
++  stpcpy-aligned \
++  stpcpy-lasx \
++  stpcpy-lsx \
++  stpcpy-unaligned \
+   strchr-aligned \
+-  strchr-lsx \
+   strchr-lasx \
+-  strrchr-aligned \
+-  strrchr-lsx \
+-  strrchr-lasx \
++  strchr-lsx \
+   strchrnul-aligned \
+-  strchrnul-lsx \
+   strchrnul-lasx \
++  strchrnul-lsx \
+   strcmp-aligned \
+   strcmp-lsx \
+-  strncmp-aligned \
+-  strncmp-lsx \
+   strcpy-aligned \
+-  strcpy-unaligned \
+-  strcpy-lsx \
+   strcpy-lasx \
+-  stpcpy-aligned \
+-  stpcpy-unaligned \
+-  stpcpy-lsx \
+-  stpcpy-lasx \
+-  memcpy-aligned \
+-  memcpy-unaligned \
+-  memmove-unaligned \
+-  memmove-lsx \
+-  memmove-lasx \
+-  rawmemchr-aligned \
+-  rawmemchr-lsx \
+-  rawmemchr-lasx \
+-  memchr-aligned \
+-  memchr-lsx \
+-  memchr-lasx \
+-  memrchr-generic \
+-  memrchr-lsx \
+-  memrchr-lasx \
+-  memset-aligned \
+-  memset-unaligned \
+-  memset-lsx \
+-  memset-lasx \
+-  memcmp-aligned \
+-  memcmp-lsx \
+-  memcmp-lasx \
++  strcpy-lsx \
++  strcpy-unaligned \
++  strlen-aligned \
++  strlen-lasx \
++  strlen-lsx \
++  strncmp-aligned \
++  strncmp-lsx \
++  strnlen-aligned \
++  strnlen-lasx \
++  strnlen-lsx \
++  strrchr-aligned \
++  strrchr-lasx \
++  strrchr-lsx \
+ # sysdep_routines
+ endif
+diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile
+index 992aabe43e..5311b594af 100644
+--- a/sysdeps/x86/Makefile
++++ b/sysdeps/x86/Makefile
+@@ -15,18 +15,18 @@ CFLAGS-dl-get-cpu-features.os += $(rtld-early-cflags)
+ CFLAGS-get-cpuid-feature-leaf.o += $(no-stack-protector)
+ 
+ tests += \
+-  tst-get-cpu-features \
+-  tst-get-cpu-features-static \
+   tst-cpu-features-cpuinfo \
+   tst-cpu-features-cpuinfo-static \
+   tst-cpu-features-supports \
+   tst-cpu-features-supports-static \
++  tst-get-cpu-features \
++  tst-get-cpu-features-static \
+   tst-hwcap-tunables \
+ # tests
+ tests-static += \
+-  tst-get-cpu-features-static \
+   tst-cpu-features-cpuinfo-static \
+   tst-cpu-features-supports-static \
++  tst-get-cpu-features-static \
+ # tests-static
+ ifeq (yes,$(have-ifunc))
+ ifeq (yes,$(have-gcc-ifunc))
+diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile
+index 9d374a3299..0ede447405 100644
+--- a/sysdeps/x86_64/Makefile
++++ b/sysdeps/x86_64/Makefile
+@@ -252,6 +252,10 @@ sysdep-dl-routines += dl-cet
+ 
+ tests += \
+   tst-cet-legacy-1 \
++  tst-cet-legacy-10 \
++  tst-cet-legacy-10-static \
++  tst-cet-legacy-10a \
++  tst-cet-legacy-10a-static \
+   tst-cet-legacy-1a \
+   tst-cet-legacy-2 \
+   tst-cet-legacy-2a \
+@@ -263,15 +267,11 @@ tests += \
+   tst-cet-legacy-8 \
+   tst-cet-legacy-9 \
+   tst-cet-legacy-9-static \
+-  tst-cet-legacy-10 \
+-  tst-cet-legacy-10-static \
+-  tst-cet-legacy-10a \
+-  tst-cet-legacy-10a-static \
+ # tests
+ tests-static += \
+-  tst-cet-legacy-9-static \
+   tst-cet-legacy-10-static \
+   tst-cet-legacy-10a-static \
++  tst-cet-legacy-9-static \
+ # tests-static
+ tst-cet-legacy-1a-ARGS = -- $(host-test-program-cmd)
+ 
+diff --git a/sysdeps/x86_64/fpu/multiarch/Makefile b/sysdeps/x86_64/fpu/multiarch/Makefile
+index ea81753b70..e1a490dd98 100644
+--- a/sysdeps/x86_64/fpu/multiarch/Makefile
++++ b/sysdeps/x86_64/fpu/multiarch/Makefile
+@@ -4,10 +4,10 @@ libm-sysdep_routines += \
+   s_ceilf-c \
+   s_floor-c \
+   s_floorf-c \
+-  s_rint-c \
+-  s_rintf-c \
+   s_nearbyint-c \
+   s_nearbyintf-c \
++  s_rint-c \
++  s_rintf-c \
+   s_roundeven-c \
+   s_roundevenf-c \
+   s_trunc-c \
+@@ -21,10 +21,10 @@ libm-sysdep_routines += \
+   s_floorf-sse4_1 \
+   s_nearbyint-sse4_1 \
+   s_nearbyintf-sse4_1 \
+-  s_roundeven-sse4_1 \
+-  s_roundevenf-sse4_1 \
+   s_rint-sse4_1 \
+   s_rintf-sse4_1 \
++  s_roundeven-sse4_1 \
++  s_roundevenf-sse4_1 \
+   s_trunc-sse4_1 \
+   s_truncf-sse4_1 \
+ # libm-sysdep_routines
+@@ -84,12 +84,12 @@ CFLAGS-s_cosf-fma.c = -mfma -mavx2
+ CFLAGS-s_sincosf-fma.c = -mfma -mavx2
+ 
+ libm-sysdep_routines += \
++  e_asin-fma4 \
++  e_atan2-fma4 \
+   e_exp-fma4 \
+   e_log-fma4 \
+   e_pow-fma4 \
+-  e_asin-fma4 \
+   s_atan-fma4 \
+-  e_atan2-fma4 \
+   s_sin-fma4 \
+   s_sincos-fma4 \
+   s_tan-fma4 \
+@@ -106,10 +106,10 @@ CFLAGS-s_tan-fma4.c = -mfma4
+ CFLAGS-s_sincos-fma4.c = -mfma4
+ 
+ libm-sysdep_routines += \
++  e_atan2-avx \
+   e_exp-avx \
+   e_log-avx \
+   s_atan-avx \
+-  e_atan2-avx \
+   s_sin-avx \
+   s_sincos-avx \
+   s_tan-avx \
+diff --git a/sysdeps/x86_64/multiarch/Makefile b/sysdeps/x86_64/multiarch/Makefile
+index e1e894c963..d3d2270394 100644
+--- a/sysdeps/x86_64/multiarch/Makefile
++++ b/sysdeps/x86_64/multiarch/Makefile
+@@ -4,8 +4,8 @@ sysdep_routines += \
+   memchr-avx2 \
+   memchr-avx2-rtm \
+   memchr-evex \
+-  memchr-evex512 \
+   memchr-evex-rtm \
++  memchr-evex512 \
+   memchr-sse2 \
+   memcmp-avx2-movbe \
+   memcmp-avx2-movbe-rtm \
+@@ -37,8 +37,8 @@ sysdep_routines += \
+   rawmemchr-avx2 \
+   rawmemchr-avx2-rtm \
+   rawmemchr-evex \
+-  rawmemchr-evex512 \
+   rawmemchr-evex-rtm \
++  rawmemchr-evex512 \
+   rawmemchr-sse2 \
+   stpcpy-avx2 \
+   stpcpy-avx2-rtm \
+
+commit 423099a03264ea28298f47355d7811b8efe03c97
+Author: Sunil K Pandey <skpgkp2@gmail.com>
+Date:   Tue Feb 13 12:23:14 2024 -0800
+
+    x86_64: Exclude SSE, AVX and FMA4 variants in libm multiarch
+    
+    When glibc is built with ISA level 3 or higher by default, the resulting
+    glibc binaries won't run on SSE or FMA4 processors.  Exclude SSE, AVX and
+    FMA4 variants in libm multiarch when ISA level 3 or higher is enabled by
+    default.
+    
+    When glibc is built with ISA level 2 enabled by default, only keep SSE4.1
+    variant.
+    
+    Fixes BZ 31335.
+    
+    NB: elf/tst-valgrind-smoke test fails with ISA level 4, because valgrind
+    doesn't support AVX512 instructions:
+    
+    https://bugs.kde.org/show_bug.cgi?id=383010
+    
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    (cherry picked from commit 9f78a7c1d0963282608da836b840f0d5ae1c478e)
+
+diff --git a/sysdeps/x86/configure b/sysdeps/x86/configure
+index 1f4c2d67fd..2a5421bb31 100644
+--- a/sysdeps/x86/configure
++++ b/sysdeps/x86/configure
+@@ -98,6 +98,7 @@ printf "%s\n" "$libc_cv_have_x86_lahf_sahf" >&6; }
+   if test $libc_cv_have_x86_lahf_sahf = yes; then
+     printf "%s\n" "#define HAVE_X86_LAHF_SAHF 1" >>confdefs.h
+ 
++    ISAFLAG="-DHAVE_X86_LAHF_SAHF"
+   fi
+   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for MOVBE instruction support" >&5
+ printf %s "checking for MOVBE instruction support... " >&6; }
+@@ -120,9 +121,41 @@ printf "%s\n" "$libc_cv_have_x86_movbe" >&6; }
+   if test $libc_cv_have_x86_movbe = yes; then
+     printf "%s\n" "#define HAVE_X86_MOVBE 1" >>confdefs.h
+ 
++    ISAFLAG="$ISAFLAG -DHAVE_X86_MOVBE"
+   fi
++
++  # Check for ISA level support.
++  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ISA level support" >&5
++printf %s "checking for ISA level support... " >&6; }
++if test ${libc_cv_have_x86_isa_level+y}
++then :
++  printf %s "(cached) " >&6
++else $as_nop
++  cat > conftest.c <<EOF
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL >= 4
++libc_cv_have_x86_isa_level=4
++#elif MINIMUM_X86_ISA_LEVEL == 3
++libc_cv_have_x86_isa_level=3
++#elif MINIMUM_X86_ISA_LEVEL == 2
++libc_cv_have_x86_isa_level=2
++#else
++libc_cv_have_x86_isa_level=baseline
++#endif
++EOF
++		 eval `${CC-cc} $CFLAGS $CPPFLAGS $ISAFLAG -I$srcdir -E conftest.c | grep libc_cv_have_x86_isa_level`
++		 rm -rf conftest*
++fi
++{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $libc_cv_have_x86_isa_level" >&5
++printf "%s\n" "$libc_cv_have_x86_isa_level" >&6; }
++else
++  libc_cv_have_x86_isa_level=baseline
+ fi
+ config_vars="$config_vars
++have-x86-isa-level = $libc_cv_have_x86_isa_level"
++config_vars="$config_vars
++x86-isa-level-3-or-above = 3 4"
++config_vars="$config_vars
+ enable-x86-isa-level = $libc_cv_include_x86_isa_level"
+ 
+ printf "%s\n" "#define SUPPORT_STATIC_PIE 1" >>confdefs.h
+diff --git a/sysdeps/x86/configure.ac b/sysdeps/x86/configure.ac
+index 437a50623b..78ff7c8f41 100644
+--- a/sysdeps/x86/configure.ac
++++ b/sysdeps/x86/configure.ac
+@@ -72,6 +72,7 @@ if test $libc_cv_include_x86_isa_level = yes; then
+     fi])
+   if test $libc_cv_have_x86_lahf_sahf = yes; then
+     AC_DEFINE(HAVE_X86_LAHF_SAHF)
++    ISAFLAG="-DHAVE_X86_LAHF_SAHF"
+   fi
+   AC_CACHE_CHECK([for MOVBE instruction support],
+ 		 libc_cv_have_x86_movbe, [dnl
+@@ -81,8 +82,31 @@ if test $libc_cv_include_x86_isa_level = yes; then
+     fi])
+   if test $libc_cv_have_x86_movbe = yes; then
+     AC_DEFINE(HAVE_X86_MOVBE)
++    ISAFLAG="$ISAFLAG -DHAVE_X86_MOVBE"
+   fi
++
++  # Check for ISA level support.
++  AC_CACHE_CHECK([for ISA level support],
++		 libc_cv_have_x86_isa_level, [dnl
++cat > conftest.c <<EOF
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL >= 4
++libc_cv_have_x86_isa_level=4
++#elif MINIMUM_X86_ISA_LEVEL == 3
++libc_cv_have_x86_isa_level=3
++#elif MINIMUM_X86_ISA_LEVEL == 2
++libc_cv_have_x86_isa_level=2
++#else
++libc_cv_have_x86_isa_level=baseline
++#endif
++EOF
++		 eval `${CC-cc} $CFLAGS $CPPFLAGS $ISAFLAG -I$srcdir -E conftest.c | grep libc_cv_have_x86_isa_level`
++		 rm -rf conftest*])
++else
++  libc_cv_have_x86_isa_level=baseline
+ fi
++LIBC_CONFIG_VAR([have-x86-isa-level], [$libc_cv_have_x86_isa_level])
++LIBC_CONFIG_VAR([x86-isa-level-3-or-above], [3 4])
+ LIBC_CONFIG_VAR([enable-x86-isa-level], [$libc_cv_include_x86_isa_level])
+ 
+ dnl Static PIE is supported.
+diff --git a/sysdeps/x86_64/fpu/multiarch/Makefile b/sysdeps/x86_64/fpu/multiarch/Makefile
+index e1a490dd98..6ddd50240c 100644
+--- a/sysdeps/x86_64/fpu/multiarch/Makefile
++++ b/sysdeps/x86_64/fpu/multiarch/Makefile
+@@ -1,49 +1,4 @@
+ ifeq ($(subdir),math)
+-libm-sysdep_routines += \
+-  s_ceil-c \
+-  s_ceilf-c \
+-  s_floor-c \
+-  s_floorf-c \
+-  s_nearbyint-c \
+-  s_nearbyintf-c \
+-  s_rint-c \
+-  s_rintf-c \
+-  s_roundeven-c \
+-  s_roundevenf-c \
+-  s_trunc-c \
+-  s_truncf-c \
+-# libm-sysdep_routines
+-
+-libm-sysdep_routines += \
+-  s_ceil-sse4_1 \
+-  s_ceilf-sse4_1 \
+-  s_floor-sse4_1 \
+-  s_floorf-sse4_1 \
+-  s_nearbyint-sse4_1 \
+-  s_nearbyintf-sse4_1 \
+-  s_rint-sse4_1 \
+-  s_rintf-sse4_1 \
+-  s_roundeven-sse4_1 \
+-  s_roundevenf-sse4_1 \
+-  s_trunc-sse4_1 \
+-  s_truncf-sse4_1 \
+-# libm-sysdep_routines
+-
+-libm-sysdep_routines += \
+-  e_asin-fma \
+-  e_atan2-fma \
+-  e_exp-fma \
+-  e_log-fma \
+-  e_log2-fma \
+-  e_pow-fma \
+-  s_atan-fma \
+-  s_expm1-fma \
+-  s_log1p-fma \
+-  s_sin-fma \
+-  s_sincos-fma \
+-  s_tan-fma \
+-# libm-sysdep_routines
+-
+ CFLAGS-e_asin-fma.c = -mfma -mavx2
+ CFLAGS-e_atan2-fma.c = -mfma -mavx2
+ CFLAGS-e_exp-fma.c = -mfma -mavx2
+@@ -57,23 +12,6 @@ CFLAGS-s_sin-fma.c = -mfma -mavx2
+ CFLAGS-s_tan-fma.c = -mfma -mavx2
+ CFLAGS-s_sincos-fma.c = -mfma -mavx2
+ 
+-libm-sysdep_routines += \
+-  s_cosf-sse2 \
+-  s_sincosf-sse2 \
+-  s_sinf-sse2 \
+-# libm-sysdep_routines
+-
+-libm-sysdep_routines += \
+-  e_exp2f-fma \
+-  e_expf-fma \
+-  e_log2f-fma \
+-  e_logf-fma \
+-  e_powf-fma \
+-  s_cosf-fma \
+-  s_sincosf-fma \
+-  s_sinf-fma \
+-# libm-sysdep_routines
+-
+ CFLAGS-e_exp2f-fma.c = -mfma -mavx2
+ CFLAGS-e_expf-fma.c = -mfma -mavx2
+ CFLAGS-e_log2f-fma.c = -mfma -mavx2
+@@ -83,17 +21,93 @@ CFLAGS-s_sinf-fma.c = -mfma -mavx2
+ CFLAGS-s_cosf-fma.c = -mfma -mavx2
+ CFLAGS-s_sincosf-fma.c = -mfma -mavx2
+ 
++# Check if ISA level is 3 or above.
++ifneq (,$(filter $(have-x86-isa-level),$(x86-isa-level-3-or-above)))
+ libm-sysdep_routines += \
++  s_ceil-avx \
++  s_ceilf-avx \
++  s_floor-avx \
++  s_floorf-avx \
++  s_nearbyint-avx \
++  s_nearbyintf-avx \
++  s_rint-avx \
++  s_rintf-avx \
++  s_roundeven-avx \
++  s_roundevenf-avx \
++  s_trunc-avx \
++  s_truncf-avx \
++# libm-sysdep_routines
++else
++libm-sysdep_routines += \
++  e_asin-fma \
+   e_asin-fma4 \
++  e_atan2-avx \
++  e_atan2-fma \
+   e_atan2-fma4 \
++  e_exp-avx \
++  e_exp-fma \
+   e_exp-fma4 \
++  e_exp2f-fma \
++  e_expf-fma \
++  e_log-avx \
++  e_log-fma \
+   e_log-fma4 \
++  e_log2-fma \
++  e_log2f-fma \
++  e_logf-fma \
++  e_pow-fma \
+   e_pow-fma4 \
++  e_powf-fma \
++  s_atan-avx \
++  s_atan-fma \
+   s_atan-fma4 \
++  s_ceil-sse4_1 \
++  s_ceilf-sse4_1 \
++  s_cosf-fma \
++  s_cosf-sse2 \
++  s_expm1-fma \
++  s_floor-sse4_1 \
++  s_floorf-sse4_1 \
++  s_log1p-fma \
++  s_nearbyint-sse4_1 \
++  s_nearbyintf-sse4_1 \
++  s_rint-sse4_1 \
++  s_rintf-sse4_1 \
++  s_roundeven-sse4_1 \
++  s_roundevenf-sse4_1 \
++  s_sin-avx \
++  s_sin-fma \
+   s_sin-fma4 \
++  s_sincos-avx \
++  s_sincos-fma \
+   s_sincos-fma4 \
++  s_sincosf-fma \
++  s_sincosf-sse2 \
++  s_sinf-fma \
++  s_sinf-sse2 \
++  s_tan-avx \
++  s_tan-fma \
+   s_tan-fma4 \
++  s_trunc-sse4_1 \
++  s_truncf-sse4_1 \
+ # libm-sysdep_routines
++ifeq ($(have-x86-isa-level),baseline)
++libm-sysdep_routines += \
++  s_ceil-c \
++  s_ceilf-c \
++  s_floor-c \
++  s_floorf-c \
++  s_nearbyint-c \
++  s_nearbyintf-c \
++  s_rint-c \
++  s_rintf-c \
++  s_roundeven-c \
++  s_roundevenf-c \
++  s_trunc-c \
++  s_truncf-c \
++# libm-sysdep_routines
++endif
++endif
+ 
+ CFLAGS-e_asin-fma4.c = -mfma4
+ CFLAGS-e_atan2-fma4.c = -mfma4
+@@ -105,16 +119,6 @@ CFLAGS-s_sin-fma4.c = -mfma4
+ CFLAGS-s_tan-fma4.c = -mfma4
+ CFLAGS-s_sincos-fma4.c = -mfma4
+ 
+-libm-sysdep_routines += \
+-  e_atan2-avx \
+-  e_exp-avx \
+-  e_log-avx \
+-  s_atan-avx \
+-  s_sin-avx \
+-  s_sincos-avx \
+-  s_tan-avx \
+-# libm-sysdep_routines
+-
+ CFLAGS-e_atan2-avx.c = -msse2avx -DSSE2AVX
+ CFLAGS-e_exp-avx.c = -msse2avx -DSSE2AVX
+ CFLAGS-e_log-avx.c = -msse2avx -DSSE2AVX
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_asin.c b/sysdeps/x86_64/fpu/multiarch/e_asin.c
+index 2eaa6c2c04..d64fca2586 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_asin.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_asin.c
+@@ -16,26 +16,29 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-finite.h>
+ 
+ extern double __redirect_ieee754_asin (double);
+ extern double __redirect_ieee754_acos (double);
+ 
+-#define SYMBOL_NAME ieee754_asin
+-#include "ifunc-fma4.h"
++# define SYMBOL_NAME ieee754_asin
++# include "ifunc-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_ieee754_asin, __ieee754_asin,
+ 		       IFUNC_SELECTOR ());
+ libm_alias_finite (__ieee754_asin, __asin)
+ 
+-#undef SYMBOL_NAME
+-#define SYMBOL_NAME ieee754_acos
+-#include "ifunc-fma4.h"
++# undef SYMBOL_NAME
++# define SYMBOL_NAME ieee754_acos
++# include "ifunc-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_ieee754_acos, __ieee754_acos,
+ 		       IFUNC_SELECTOR ());
+ libm_alias_finite (__ieee754_acos, __acos)
+ 
+-#define __ieee754_acos __ieee754_acos_sse2
+-#define __ieee754_asin __ieee754_asin_sse2
++# define __ieee754_acos __ieee754_acos_sse2
++# define __ieee754_asin __ieee754_asin_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/e_asin.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_atan2.c b/sysdeps/x86_64/fpu/multiarch/e_atan2.c
+index 17ee4f3c36..8a86c14ded 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_atan2.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_atan2.c
+@@ -16,16 +16,19 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-finite.h>
+ 
+ extern double __redirect_ieee754_atan2 (double, double);
+ 
+-#define SYMBOL_NAME ieee754_atan2
+-#include "ifunc-avx-fma4.h"
++# define SYMBOL_NAME ieee754_atan2
++# include "ifunc-avx-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_ieee754_atan2,
+ 		       __ieee754_atan2, IFUNC_SELECTOR ());
+ libm_alias_finite (__ieee754_atan2, __atan2)
+ 
+-#define __ieee754_atan2 __ieee754_atan2_sse2
++# define __ieee754_atan2 __ieee754_atan2_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/e_atan2.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_exp.c b/sysdeps/x86_64/fpu/multiarch/e_exp.c
+index 406b7ebd44..d56329291a 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_exp.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_exp.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <math.h>
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <math.h>
++# include <libm-alias-finite.h>
+ 
+ extern double __redirect_ieee754_exp (double);
+ 
+-#define SYMBOL_NAME ieee754_exp
+-#include "ifunc-avx-fma4.h"
++# define SYMBOL_NAME ieee754_exp
++# include "ifunc-avx-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_ieee754_exp, __ieee754_exp,
+ 		       IFUNC_SELECTOR ());
+ libm_alias_finite (__ieee754_exp, __exp)
+ 
+-#define __exp __ieee754_exp_sse2
++# define __exp __ieee754_exp_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/e_exp.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_exp2f.c b/sysdeps/x86_64/fpu/multiarch/e_exp2f.c
+index 804fd6be85..06fe5028d6 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_exp2f.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_exp2f.c
+@@ -16,25 +16,28 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-float.h>
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# include <libm-alias-finite.h>
+ 
+ extern float __redirect_exp2f (float);
+ 
+-#define SYMBOL_NAME exp2f
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME exp2f
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_exp2f, __exp2f, IFUNC_SELECTOR ());
+ 
+-#ifdef SHARED
++# ifdef SHARED
+ versioned_symbol (libm, __ieee754_exp2f, exp2f, GLIBC_2_27);
+ libm_alias_float_other (__exp2, exp2)
+-#else
++# else
+ libm_alias_float (__exp2, exp2)
+-#endif
++# endif
+ 
+ strong_alias (__exp2f, __ieee754_exp2f)
+ libm_alias_finite (__exp2f, __exp2f)
+ 
+-#define __exp2f __exp2f_sse2
++# define __exp2f __exp2f_sse2
++#endif
+ #include <sysdeps/ieee754/flt-32/e_exp2f.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_expf.c b/sysdeps/x86_64/fpu/multiarch/e_expf.c
+index 4a7e2a5bce..19d767f636 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_expf.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_expf.c
+@@ -16,28 +16,31 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-float.h>
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# include <libm-alias-finite.h>
+ 
+ extern float __redirect_expf (float);
+ 
+-#define SYMBOL_NAME expf
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME expf
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_expf, __expf, IFUNC_SELECTOR ());
+ 
+-#ifdef SHARED
++# ifdef SHARED
+ __hidden_ver1 (__expf, __GI___expf, __redirect_expf)
+   __attribute__ ((visibility ("hidden")));
+ 
+ versioned_symbol (libm, __ieee754_expf, expf, GLIBC_2_27);
+ libm_alias_float_other (__exp, exp)
+-#else
++# else
+ libm_alias_float (__exp, exp)
+-#endif
++# endif
+ 
+ strong_alias (__expf, __ieee754_expf)
+ libm_alias_finite (__expf, __expf)
+ 
+-#define __expf __expf_sse2
++# define __expf __expf_sse2
++#endif
+ #include <sysdeps/ieee754/flt-32/e_expf.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_log.c b/sysdeps/x86_64/fpu/multiarch/e_log.c
+index 067fbf58c3..d80c1b1463 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_log.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_log.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <math.h>
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <math.h>
++# include <libm-alias-finite.h>
+ 
+ extern double __redirect_ieee754_log (double);
+ 
+-#define SYMBOL_NAME ieee754_log
+-#include "ifunc-avx-fma4.h"
++# define SYMBOL_NAME ieee754_log
++# include "ifunc-avx-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_ieee754_log, __ieee754_log,
+ 		       IFUNC_SELECTOR ());
+ libm_alias_finite (__ieee754_log, __log)
+ 
+-#define __log __ieee754_log_sse2
++# define __log __ieee754_log_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/e_log.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_log2.c b/sysdeps/x86_64/fpu/multiarch/e_log2.c
+index 9c57a2f6cc..9686782c09 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_log2.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_log2.c
+@@ -16,28 +16,31 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-double.h>
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-double.h>
++# include <libm-alias-finite.h>
+ 
+ extern double __redirect_log2 (double);
+ 
+-#define SYMBOL_NAME log2
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME log2
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_log2, __log2, IFUNC_SELECTOR ());
+ 
+-#ifdef SHARED
++# ifdef SHARED
+ __hidden_ver1 (__log2, __GI___log2, __redirect_log2)
+   __attribute__ ((visibility ("hidden")));
+ 
+ versioned_symbol (libm, __ieee754_log2, log2, GLIBC_2_29);
+ libm_alias_double_other (__log2, log2)
+-#else
++# else
+ libm_alias_double (__log2, log2)
+-#endif
++# endif
+ 
+ strong_alias (__log2, __ieee754_log2)
+ libm_alias_finite (__log2, __log2)
+ 
+-#define __log2 __log2_sse2
++# define __log2 __log2_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/e_log2.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_log2f.c b/sysdeps/x86_64/fpu/multiarch/e_log2f.c
+index 2b45c87f38..8ada46e11e 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_log2f.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_log2f.c
+@@ -16,28 +16,31 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-float.h>
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# include <libm-alias-finite.h>
+ 
+ extern float __redirect_log2f (float);
+ 
+-#define SYMBOL_NAME log2f
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME log2f
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_log2f, __log2f, IFUNC_SELECTOR ());
+ 
+-#ifdef SHARED
++# ifdef SHARED
+ __hidden_ver1 (__log2f, __GI___log2f, __redirect_log2f)
+   __attribute__ ((visibility ("hidden")));
+ 
+ versioned_symbol (libm, __ieee754_log2f, log2f, GLIBC_2_27);
+ libm_alias_float_other (__log2, log2)
+-#else
++# else
+ libm_alias_float (__log2, log2)
+-#endif
++# endif
+ 
+ strong_alias (__log2f, __ieee754_log2f)
+ libm_alias_finite (__log2f, __log2f)
+ 
+-#define __log2f __log2f_sse2
++# define __log2f __log2f_sse2
++#endif
+ #include <sysdeps/ieee754/flt-32/e_log2f.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_logf.c b/sysdeps/x86_64/fpu/multiarch/e_logf.c
+index 97e23c8fea..a3978d9a8e 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_logf.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_logf.c
+@@ -16,28 +16,31 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-float.h>
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# include <libm-alias-finite.h>
+ 
+ extern float __redirect_logf (float);
+ 
+-#define SYMBOL_NAME logf
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME logf
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_logf, __logf, IFUNC_SELECTOR ());
+ 
+-#ifdef SHARED
++# ifdef SHARED
+ __hidden_ver1 (__logf, __GI___logf, __redirect_logf)
+   __attribute__ ((visibility ("hidden")));
+ 
+ versioned_symbol (libm, __ieee754_logf, logf, GLIBC_2_27);
+ libm_alias_float_other (__log, log)
+-#else
++# else
+ libm_alias_float (__log, log)
+-#endif
++# endif
+ 
+ strong_alias (__logf, __ieee754_logf)
+ libm_alias_finite (__logf, __logf)
+ 
+-#define __logf __logf_sse2
++# define __logf __logf_sse2
++#endif
+ #include <sysdeps/ieee754/flt-32/e_logf.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_pow.c b/sysdeps/x86_64/fpu/multiarch/e_pow.c
+index 42618e7112..f8f17aff9f 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_pow.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_pow.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <math.h>
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <math.h>
++# include <libm-alias-finite.h>
+ 
+ extern double __redirect_ieee754_pow (double, double);
+ 
+-#define SYMBOL_NAME ieee754_pow
+-#include "ifunc-fma4.h"
++# define SYMBOL_NAME ieee754_pow
++# include "ifunc-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_ieee754_pow,
+ 		       __ieee754_pow, IFUNC_SELECTOR ());
+ libm_alias_finite (__ieee754_pow, __pow)
+ 
+-#define __pow __ieee754_pow_sse2
++# define __pow __ieee754_pow_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/e_pow.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/e_powf.c b/sysdeps/x86_64/fpu/multiarch/e_powf.c
+index 8e6ce13cc1..8b1a4c7d04 100644
+--- a/sysdeps/x86_64/fpu/multiarch/e_powf.c
++++ b/sysdeps/x86_64/fpu/multiarch/e_powf.c
+@@ -16,31 +16,34 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-float.h>
+-#include <libm-alias-finite.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# include <libm-alias-finite.h>
+ 
+-#define powf __redirect_powf
+-#define __DECL_SIMD___redirect_powf
+-#include <math.h>
+-#undef powf
++# define powf __redirect_powf
++# define __DECL_SIMD___redirect_powf
++# include <math.h>
++# undef powf
+ 
+-#define SYMBOL_NAME powf
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME powf
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_powf, __powf, IFUNC_SELECTOR ());
+ 
+-#ifdef SHARED
++# ifdef SHARED
+ __hidden_ver1 (__powf, __GI___powf, __redirect_powf)
+   __attribute__ ((visibility ("hidden")));
+ 
+ versioned_symbol (libm, __ieee754_powf, powf, GLIBC_2_27);
+ libm_alias_float_other (__pow, pow)
+-#else
++# else
+ libm_alias_float (__pow, pow)
+-#endif
++# endif
+ 
+ strong_alias (__powf, __ieee754_powf)
+ libm_alias_finite (__powf, __powf)
+ 
+-#define __powf __powf_sse2
++# define __powf __powf_sse2
++#endif
+ #include <sysdeps/ieee754/flt-32/e_powf.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_atan.c b/sysdeps/x86_64/fpu/multiarch/s_atan.c
+index 71bad096a9..4d2c6ce006 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_atan.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_atan.c
+@@ -16,15 +16,18 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-double.h>
+ 
+ extern double __redirect_atan (double);
+ 
+-#define SYMBOL_NAME atan
+-#include "ifunc-avx-fma4.h"
++# define SYMBOL_NAME atan
++# include "ifunc-avx-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_atan, __atan, IFUNC_SELECTOR ());
+ libm_alias_double (__atan, atan)
+ 
+-#define __atan __atan_sse2
++# define __atan __atan_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/s_atan.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_ceil-avx.S b/sysdeps/x86_64/fpu/multiarch/s_ceil-avx.S
+new file mode 100644
+index 0000000000..e6c1106753
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_ceil-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of ceil function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-double.h>
++
++	.text
++ENTRY(__ceil)
++	vroundsd $10, %xmm0, %xmm0, %xmm0
++	ret
++END(__ceil)
++
++libm_alias_double (__ceil, ceil)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_ceil-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_ceil-sse4_1.S
+index 64119011ad..dba756c38f 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_ceil-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_ceil-sse4_1.S
+@@ -17,8 +17,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-double.h>
++# define __ceil_sse41 __ceil
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__ceil_sse41)
+ 	roundsd	$10, %xmm0, %xmm0
+ 	ret
+ END(__ceil_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_double (__ceil, ceil)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_ceil.c b/sysdeps/x86_64/fpu/multiarch/s_ceil.c
+index cc028addee..46c8e91e19 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_ceil.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_ceil.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#define NO_MATH_REDIRECT
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# define NO_MATH_REDIRECT
++# include <libm-alias-double.h>
+ 
+-#define ceil __redirect_ceil
+-#define __ceil __redirect___ceil
+-#include <math.h>
+-#undef ceil
+-#undef __ceil
++# define ceil __redirect_ceil
++# define __ceil __redirect___ceil
++# include <math.h>
++# undef ceil
++# undef __ceil
+ 
+-#define SYMBOL_NAME ceil
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME ceil
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_ceil, __ceil, IFUNC_SELECTOR ());
+ libm_alias_double (__ceil, ceil)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_ceilf-avx.S b/sysdeps/x86_64/fpu/multiarch/s_ceilf-avx.S
+new file mode 100644
+index 0000000000..b4d8ac0455
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_ceilf-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of ceilf function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-float.h>
++
++	.text
++ENTRY(__ceilf)
++	vroundss $10, %xmm0, %xmm0, %xmm0
++	ret
++END(__ceilf)
++
++libm_alias_float (__ceil, ceil)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_ceilf-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_ceilf-sse4_1.S
+index dd9a9f6b71..9abc87b91a 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_ceilf-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_ceilf-sse4_1.S
+@@ -17,8 +17,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# define __ceilf_sse41 __ceilf
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__ceilf_sse41)
+ 	roundss	$10, %xmm0, %xmm0
+ 	ret
+ END(__ceilf_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_float (__ceil, ceil)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_ceilf.c b/sysdeps/x86_64/fpu/multiarch/s_ceilf.c
+index 97a0ca7d19..bb53108f73 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_ceilf.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_ceilf.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#define NO_MATH_REDIRECT
+-#include <libm-alias-float.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# define NO_MATH_REDIRECT
++# include <libm-alias-float.h>
+ 
+-#define ceilf __redirect_ceilf
+-#define __ceilf __redirect___ceilf
+-#include <math.h>
+-#undef ceilf
+-#undef __ceilf
++# define ceilf __redirect_ceilf
++# define __ceilf __redirect___ceilf
++# include <math.h>
++# undef ceilf
++# undef __ceilf
+ 
+-#define SYMBOL_NAME ceilf
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME ceilf
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_ceilf, __ceilf, IFUNC_SELECTOR ());
+ libm_alias_float (__ceil, ceil)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_cosf.c b/sysdeps/x86_64/fpu/multiarch/s_cosf.c
+index 2703c576df..8a02e04538 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_cosf.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_cosf.c
+@@ -16,13 +16,18 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-float.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-float.h>
+ 
+ extern float __redirect_cosf (float);
+ 
+-#define SYMBOL_NAME cosf
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME cosf
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_cosf, __cosf, IFUNC_SELECTOR ());
+ 
+ libm_alias_float (__cos, cos)
++#else
++# include <sysdeps/ieee754/flt-32/s_cosf.c>
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_expm1.c b/sysdeps/x86_64/fpu/multiarch/s_expm1.c
+index 8a2d69f9b2..d58ef3d8f5 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_expm1.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_expm1.c
+@@ -16,21 +16,24 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-double.h>
+ 
+ extern double __redirect_expm1 (double);
+ 
+-#define SYMBOL_NAME expm1
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME expm1
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_expm1, __expm1, IFUNC_SELECTOR ());
+ libm_alias_double (__expm1, expm1)
+ 
+-#define __expm1 __expm1_sse2
++# define __expm1 __expm1_sse2
+ 
+ /* NB: __expm1 may be expanded to __expm1_sse2 in the following
+    prototypes.  */
+ extern long double __expm1l (long double);
+ extern long double __expm1f128 (long double);
+ 
++#endif
+ #include <sysdeps/ieee754/dbl-64/s_expm1.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_floor-avx.S b/sysdeps/x86_64/fpu/multiarch/s_floor-avx.S
+new file mode 100644
+index 0000000000..ff74b5a8bf
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_floor-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of floor function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-double.h>
++
++	.text
++ENTRY(__floor)
++	vroundsd $9, %xmm0, %xmm0, %xmm0
++	ret
++END(__floor)
++
++libm_alias_double (__floor, floor)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_floor-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_floor-sse4_1.S
+index 2f7521f39f..c9b9b0639b 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_floor-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_floor-sse4_1.S
+@@ -17,8 +17,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-double.h>
++# define __floor_sse41 __floor
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__floor_sse41)
+ 	roundsd	$9, %xmm0, %xmm0
+ 	ret
+ END(__floor_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_double (__floor, floor)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_floor.c b/sysdeps/x86_64/fpu/multiarch/s_floor.c
+index 8cebd48e10..2c87dd0056 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_floor.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_floor.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#define NO_MATH_REDIRECT
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# define NO_MATH_REDIRECT
++# include <libm-alias-double.h>
+ 
+-#define floor __redirect_floor
+-#define __floor __redirect___floor
+-#include <math.h>
+-#undef floor
+-#undef __floor
++# define floor __redirect_floor
++# define __floor __redirect___floor
++# include <math.h>
++# undef floor
++# undef __floor
+ 
+-#define SYMBOL_NAME floor
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME floor
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_floor, __floor, IFUNC_SELECTOR ());
+ libm_alias_double (__floor, floor)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_floorf-avx.S b/sysdeps/x86_64/fpu/multiarch/s_floorf-avx.S
+new file mode 100644
+index 0000000000..c378baae8e
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_floorf-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of floorf function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-float.h>
++
++	.text
++ENTRY(__floorf)
++	vroundss $9, %xmm0, %xmm0, %xmm0
++	ret
++END(__floorf)
++
++libm_alias_float (__floor, floor)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_floorf-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_floorf-sse4_1.S
+index 5f6020d27d..c2216899db 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_floorf-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_floorf-sse4_1.S
+@@ -17,8 +17,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# define __floorf_sse41 __floorf
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__floorf_sse41)
+ 	roundss	$9, %xmm0, %xmm0
+ 	ret
+ END(__floorf_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_float (__floor, floor)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_floorf.c b/sysdeps/x86_64/fpu/multiarch/s_floorf.c
+index a14e18b03c..a277802b6d 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_floorf.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_floorf.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#define NO_MATH_REDIRECT
+-#include <libm-alias-float.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# define NO_MATH_REDIRECT
++# include <libm-alias-float.h>
+ 
+-#define floorf __redirect_floorf
+-#define __floorf __redirect___floorf
+-#include <math.h>
+-#undef floorf
+-#undef __floorf
++# define floorf __redirect_floorf
++# define __floorf __redirect___floorf
++# include <math.h>
++# undef floorf
++# undef __floorf
+ 
+-#define SYMBOL_NAME floorf
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME floorf
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_floorf, __floorf, IFUNC_SELECTOR ());
+ libm_alias_float (__floor, floor)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_log1p.c b/sysdeps/x86_64/fpu/multiarch/s_log1p.c
+index a8e1a3f21b..3fa1185d81 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_log1p.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_log1p.c
+@@ -16,14 +16,17 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-double.h>
+ 
+ extern double __redirect_log1p (double);
+ 
+-#define SYMBOL_NAME log1p
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME log1p
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_log1p, __log1p, IFUNC_SELECTOR ());
+ 
+-#define __log1p __log1p_sse2
++# define __log1p __log1p_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/s_log1p.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_nearbyint-avx.S b/sysdeps/x86_64/fpu/multiarch/s_nearbyint-avx.S
+new file mode 100644
+index 0000000000..5bfdf73c28
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_nearbyint-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of nearbyint function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-double.h>
++
++	.text
++ENTRY(__nearbyint)
++	vroundsd $0xc, %xmm0, %xmm0, %xmm0
++	ret
++END(__nearbyint)
++
++libm_alias_double (__nearbyint, nearbyint)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_nearbyint-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_nearbyint-sse4_1.S
+index 674f7eb40a..9d84410a1f 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_nearbyint-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_nearbyint-sse4_1.S
+@@ -17,8 +17,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-double.h>
++# define __nearbyint_sse41 __nearbyint
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__nearbyint_sse41)
+ 	roundsd	$0xc, %xmm0, %xmm0
+ 	ret
+ END(__nearbyint_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_double (__nearbyint, nearbyint)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_nearbyint.c b/sysdeps/x86_64/fpu/multiarch/s_nearbyint.c
+index 693e42dd4e..057a7ca60f 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_nearbyint.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_nearbyint.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-double.h>
+ 
+-#define nearbyint __redirect_nearbyint
+-#define __nearbyint __redirect___nearbyint
+-#include <math.h>
+-#undef nearbyint
+-#undef __nearbyint
++# define nearbyint __redirect_nearbyint
++# define __nearbyint __redirect___nearbyint
++# include <math.h>
++# undef nearbyint
++# undef __nearbyint
+ 
+-#define SYMBOL_NAME nearbyint
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME nearbyint
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_nearbyint, __nearbyint,
+ 		       IFUNC_SELECTOR ());
+ libm_alias_double (__nearbyint, nearbyint)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_nearbyintf-avx.S b/sysdeps/x86_64/fpu/multiarch/s_nearbyintf-avx.S
+new file mode 100644
+index 0000000000..1dbaed0324
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_nearbyintf-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implmentation of nearbyintf function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-float.h>
++
++	.text
++ENTRY(__nearbyintf)
++	vroundss $0xc, %xmm0, %xmm0, %xmm0
++	ret
++END(__nearbyintf)
++
++libm_alias_float (__nearbyint, nearbyint)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_nearbyintf-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_nearbyintf-sse4_1.S
+index 5892bd7563..3cf35f92d6 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_nearbyintf-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_nearbyintf-sse4_1.S
+@@ -17,8 +17,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# define __nearbyintf_sse41 __nearbyintf
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__nearbyintf_sse41)
+ 	roundss	$0xc, %xmm0, %xmm0
+ 	ret
+ END(__nearbyintf_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_float (__nearbyint, nearbyint)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_nearbyintf.c b/sysdeps/x86_64/fpu/multiarch/s_nearbyintf.c
+index a0ac009f4b..41f374ba72 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_nearbyintf.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_nearbyintf.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-float.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-float.h>
+ 
+-#define nearbyintf __redirect_nearbyintf
+-#define __nearbyintf __redirect___nearbyintf
+-#include <math.h>
+-#undef nearbyintf
+-#undef __nearbyintf
++# define nearbyintf __redirect_nearbyintf
++# define __nearbyintf __redirect___nearbyintf
++# include <math.h>
++# undef nearbyintf
++# undef __nearbyintf
+ 
+-#define SYMBOL_NAME nearbyintf
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME nearbyintf
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_nearbyintf, __nearbyintf,
+ 		       IFUNC_SELECTOR ());
+ libm_alias_float (__nearbyint, nearbyint)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_rint-avx.S b/sysdeps/x86_64/fpu/multiarch/s_rint-avx.S
+new file mode 100644
+index 0000000000..2b403b331f
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_rint-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of rint function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-double.h>
++
++	.text
++ENTRY(__rint)
++	vroundsd $4, %xmm0, %xmm0, %xmm0
++	ret
++END(__rint)
++
++libm_alias_double (__rint, rint)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_rint-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_rint-sse4_1.S
+index 405372991b..8cd9cf759f 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_rint-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_rint-sse4_1.S
+@@ -17,8 +17,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-double.h>
++# define __rint_sse41 __rint
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__rint_sse41)
+ 	roundsd	$4, %xmm0, %xmm0
+ 	ret
+ END(__rint_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_double (__rint, rint)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_rint.c b/sysdeps/x86_64/fpu/multiarch/s_rint.c
+index 754c87e004..18623b7d99 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_rint.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_rint.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#define NO_MATH_REDIRECT
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# define NO_MATH_REDIRECT
++# include <libm-alias-double.h>
+ 
+-#define rint __redirect_rint
+-#define __rint __redirect___rint
+-#include <math.h>
+-#undef rint
+-#undef __rint
++# define rint __redirect_rint
++# define __rint __redirect___rint
++# include <math.h>
++# undef rint
++# undef __rint
+ 
+-#define SYMBOL_NAME rint
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME rint
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_rint, __rint, IFUNC_SELECTOR ());
+ libm_alias_double (__rint, rint)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_rintf-avx.S b/sysdeps/x86_64/fpu/multiarch/s_rintf-avx.S
+new file mode 100644
+index 0000000000..171c2867f4
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_rintf-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of rintf function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-float.h>
++
++	.text
++ENTRY(__rintf)
++	vroundss $4, %xmm0, %xmm0, %xmm0
++	ret
++END(__rintf)
++
++libm_alias_float (__rint, rint)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_rintf-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_rintf-sse4_1.S
+index 8ac67ce767..fc1e70f0c9 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_rintf-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_rintf-sse4_1.S
+@@ -17,8 +17,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# define __rintf_sse41 __rintf
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__rintf_sse41)
+ 	roundss	$4, %xmm0, %xmm0
+ 	ret
+ END(__rintf_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_float (__rint, rint)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_rintf.c b/sysdeps/x86_64/fpu/multiarch/s_rintf.c
+index e9d6b7a5f2..e275368dec 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_rintf.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_rintf.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#define NO_MATH_REDIRECT
+-#include <libm-alias-float.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# define NO_MATH_REDIRECT
++# include <libm-alias-float.h>
+ 
+-#define rintf __redirect_rintf
+-#define __rintf __redirect___rintf
+-#include <math.h>
+-#undef rintf
+-#undef __rintf
++# define rintf __redirect_rintf
++# define __rintf __redirect___rintf
++# include <math.h>
++# undef rintf
++# undef __rintf
+ 
+-#define SYMBOL_NAME rintf
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME rintf
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_rintf, __rintf, IFUNC_SELECTOR ());
+ libm_alias_float (__rint, rint)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_roundeven-avx.S b/sysdeps/x86_64/fpu/multiarch/s_roundeven-avx.S
+new file mode 100644
+index 0000000000..576790355c
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_roundeven-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of roundeven function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-double.h>
++
++	.text
++ENTRY(__roundeven)
++	vroundsd $8, %xmm0, %xmm0, %xmm0
++	ret
++END(__roundeven)
++
++libm_alias_double (__roundeven, roundeven)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_roundeven-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_roundeven-sse4_1.S
+index 5ef102336b..f00be56c59 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_roundeven-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_roundeven-sse4_1.S
+@@ -17,8 +17,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-double.h>
++# define __roundeven_sse41 __roundeven
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__roundeven_sse41)
+ 	roundsd	$8, %xmm0, %xmm0
+ 	ret
+ END(__roundeven_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_double (__roundeven, roundeven)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_roundeven.c b/sysdeps/x86_64/fpu/multiarch/s_roundeven.c
+index 8737b32e26..139aad088f 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_roundeven.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_roundeven.c
+@@ -16,16 +16,19 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-double.h>
+ 
+-#define roundeven __redirect_roundeven
+-#define __roundeven __redirect___roundeven
+-#include <math.h>
+-#undef roundeven
+-#undef __roundeven
++# define roundeven __redirect_roundeven
++# define __roundeven __redirect___roundeven
++# include <math.h>
++# undef roundeven
++# undef __roundeven
+ 
+-#define SYMBOL_NAME roundeven
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME roundeven
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_roundeven, __roundeven, IFUNC_SELECTOR ());
+ libm_alias_double (__roundeven, roundeven)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_roundevenf-avx.S b/sysdeps/x86_64/fpu/multiarch/s_roundevenf-avx.S
+new file mode 100644
+index 0000000000..42c359f4cd
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_roundevenf-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of roundevenf function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-float.h>
++
++	.text
++ENTRY(__roundevenf)
++	vroundss $8, %xmm0, %xmm0, %xmm0
++	ret
++END(__roundevenf)
++
++libm_alias_float (__roundeven, roundeven)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_roundevenf-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_roundevenf-sse4_1.S
+index 792c90ba07..6b148e4353 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_roundevenf-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_roundevenf-sse4_1.S
+@@ -17,8 +17,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# define __roundevenf_sse41 __roundevenf
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__roundevenf_sse41)
+ 	roundss	$8, %xmm0, %xmm0
+ 	ret
+ END(__roundevenf_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_float (__roundeven, roundeven)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_roundevenf.c b/sysdeps/x86_64/fpu/multiarch/s_roundevenf.c
+index e96016a4d5..2fb090075d 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_roundevenf.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_roundevenf.c
+@@ -16,16 +16,19 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-float.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-float.h>
+ 
+-#define roundevenf __redirect_roundevenf
+-#define __roundevenf __redirect___roundevenf
+-#include <math.h>
+-#undef roundevenf
+-#undef __roundevenf
++# define roundevenf __redirect_roundevenf
++# define __roundevenf __redirect___roundevenf
++# include <math.h>
++# undef roundevenf
++# undef __roundevenf
+ 
+-#define SYMBOL_NAME roundevenf
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME roundevenf
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_roundevenf, __roundevenf, IFUNC_SELECTOR ());
+ libm_alias_float (__roundeven, roundeven)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_sin.c b/sysdeps/x86_64/fpu/multiarch/s_sin.c
+index 355cc0092e..21e77943a3 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_sin.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_sin.c
+@@ -16,24 +16,27 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-double.h>
+ 
+ extern double __redirect_sin (double);
+ extern double __redirect_cos (double);
+ 
+-#define SYMBOL_NAME sin
+-#include "ifunc-avx-fma4.h"
++# define SYMBOL_NAME sin
++# include "ifunc-avx-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_sin, __sin, IFUNC_SELECTOR ());
+ libm_alias_double (__sin, sin)
+ 
+-#undef SYMBOL_NAME
+-#define SYMBOL_NAME cos
+-#include "ifunc-avx-fma4.h"
++# undef SYMBOL_NAME
++# define SYMBOL_NAME cos
++# include "ifunc-avx-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_cos, __cos, IFUNC_SELECTOR ());
+ libm_alias_double (__cos, cos)
+ 
+-#define __cos __cos_sse2
+-#define __sin __sin_sse2
++# define __cos __cos_sse2
++# define __sin __sin_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/s_sin.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_sincos.c b/sysdeps/x86_64/fpu/multiarch/s_sincos.c
+index 70107e999c..b35757f8de 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_sincos.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_sincos.c
+@@ -16,15 +16,18 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-double.h>
+ 
+ extern void __redirect_sincos (double, double *, double *);
+ 
+-#define SYMBOL_NAME sincos
+-#include "ifunc-fma4.h"
++# define SYMBOL_NAME sincos
++# include "ifunc-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_sincos, __sincos, IFUNC_SELECTOR ());
+ libm_alias_double (__sincos, sincos)
+ 
+-#define __sincos __sincos_sse2
++# define __sincos __sincos_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/s_sincos.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_sincosf.c b/sysdeps/x86_64/fpu/multiarch/s_sincosf.c
+index 80bc028451..0ea9b40e84 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_sincosf.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_sincosf.c
+@@ -16,13 +16,18 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-float.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-float.h>
+ 
+ extern void __redirect_sincosf (float, float *, float *);
+ 
+-#define SYMBOL_NAME sincosf
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME sincosf
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_sincosf, __sincosf, IFUNC_SELECTOR ());
+ 
+ libm_alias_float (__sincos, sincos)
++#else
++# include <sysdeps/ieee754/flt-32/s_sincosf.c>
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_sinf.c b/sysdeps/x86_64/fpu/multiarch/s_sinf.c
+index a32b9e9550..c61624e3ee 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_sinf.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_sinf.c
+@@ -16,13 +16,18 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-float.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-float.h>
+ 
+ extern float __redirect_sinf (float);
+ 
+-#define SYMBOL_NAME sinf
+-#include "ifunc-fma.h"
++# define SYMBOL_NAME sinf
++# include "ifunc-fma.h"
+ 
+ libc_ifunc_redirected (__redirect_sinf, __sinf, IFUNC_SELECTOR ());
+ 
+ libm_alias_float (__sin, sin)
++#else
++# include <sysdeps/ieee754/flt-32/s_sinf.c>
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_tan.c b/sysdeps/x86_64/fpu/multiarch/s_tan.c
+index f9a2474a13..125d992ba1 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_tan.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_tan.c
+@@ -16,15 +16,18 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < AVX2_X86_ISA_LEVEL
++# include <libm-alias-double.h>
+ 
+ extern double __redirect_tan (double);
+ 
+-#define SYMBOL_NAME tan
+-#include "ifunc-avx-fma4.h"
++# define SYMBOL_NAME tan
++# include "ifunc-avx-fma4.h"
+ 
+ libc_ifunc_redirected (__redirect_tan, __tan, IFUNC_SELECTOR ());
+ libm_alias_double (__tan, tan)
+ 
+-#define __tan __tan_sse2
++# define __tan __tan_sse2
++#endif
+ #include <sysdeps/ieee754/dbl-64/s_tan.c>
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_trunc-avx.S b/sysdeps/x86_64/fpu/multiarch/s_trunc-avx.S
+new file mode 100644
+index 0000000000..b3e87e9606
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_trunc-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of trunc function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-double.h>
++
++	.text
++ENTRY(__trunc)
++	vroundsd $11, %xmm0, %xmm0, %xmm0
++	ret
++END(__trunc)
++
++libm_alias_double (__trunc, trunc)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_trunc-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_trunc-sse4_1.S
+index b496a6ef49..2b79174eed 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_trunc-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_trunc-sse4_1.S
+@@ -18,8 +18,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-double.h>
++# define __trunc_sse41 __trunc
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__trunc_sse41)
+ 	roundsd	$11, %xmm0, %xmm0
+ 	ret
+ END(__trunc_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_double (__trunc, trunc)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_trunc.c b/sysdeps/x86_64/fpu/multiarch/s_trunc.c
+index 9bc9df8744..ea89c4f85d 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_trunc.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_trunc.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#define NO_MATH_REDIRECT
+-#include <libm-alias-double.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# define NO_MATH_REDIRECT
++# include <libm-alias-double.h>
+ 
+-#define trunc __redirect_trunc
+-#define __trunc __redirect___trunc
+-#include <math.h>
+-#undef trunc
+-#undef __trunc
++# define trunc __redirect_trunc
++# define __trunc __redirect___trunc
++# include <math.h>
++# undef trunc
++# undef __trunc
+ 
+-#define SYMBOL_NAME trunc
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME trunc
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_trunc, __trunc, IFUNC_SELECTOR ());
+ libm_alias_double (__trunc, trunc)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_truncf-avx.S b/sysdeps/x86_64/fpu/multiarch/s_truncf-avx.S
+new file mode 100644
+index 0000000000..f31ac7d7f7
+--- /dev/null
++++ b/sysdeps/x86_64/fpu/multiarch/s_truncf-avx.S
+@@ -0,0 +1,28 @@
++/* AVX implementation of truncf function.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <sysdep.h>
++#include <libm-alias-float.h>
++
++	.text
++ENTRY(__truncf)
++	vroundss $11, %xmm0, %xmm0, %xmm0
++	ret
++END(__truncf)
++
++libm_alias_float (__trunc, trunc)
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_truncf-sse4_1.S b/sysdeps/x86_64/fpu/multiarch/s_truncf-sse4_1.S
+index 22e9a83307..60498b2cb2 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_truncf-sse4_1.S
++++ b/sysdeps/x86_64/fpu/multiarch/s_truncf-sse4_1.S
+@@ -18,8 +18,20 @@
+ 
+ #include <sysdep.h>
+ 
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++# include <libm-alias-float.h>
++# define __truncf_sse41 __truncf
++	.text
++#else
+ 	.section .text.sse4.1,"ax",@progbits
++#endif
++
+ ENTRY(__truncf_sse41)
+ 	roundss	$11, %xmm0, %xmm0
+ 	ret
+ END(__truncf_sse41)
++
++#if MINIMUM_X86_ISA_LEVEL == SSE4_1_X86_ISA_LEVEL
++libm_alias_float (__trunc, trunc)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/s_truncf.c b/sysdeps/x86_64/fpu/multiarch/s_truncf.c
+index dae01d166a..92435ce39d 100644
+--- a/sysdeps/x86_64/fpu/multiarch/s_truncf.c
++++ b/sysdeps/x86_64/fpu/multiarch/s_truncf.c
+@@ -16,17 +16,20 @@
+    License along with the GNU C Library; if not, see
+    <https://www.gnu.org/licenses/>.  */
+ 
+-#define NO_MATH_REDIRECT
+-#include <libm-alias-float.h>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL < SSE4_1_X86_ISA_LEVEL
++# define NO_MATH_REDIRECT
++# include <libm-alias-float.h>
+ 
+-#define truncf __redirect_truncf
+-#define __truncf __redirect___truncf
+-#include <math.h>
+-#undef truncf
+-#undef __truncf
++# define truncf __redirect_truncf
++# define __truncf __redirect___truncf
++# include <math.h>
++# undef truncf
++# undef __truncf
+ 
+-#define SYMBOL_NAME truncf
+-#include "ifunc-sse4_1.h"
++# define SYMBOL_NAME truncf
++# include "ifunc-sse4_1.h"
+ 
+ libc_ifunc_redirected (__redirect_truncf, __truncf, IFUNC_SELECTOR ());
+ libm_alias_float (__trunc, trunc)
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/w_exp.c b/sysdeps/x86_64/fpu/multiarch/w_exp.c
+index 27eee98a0a..3584187e0e 100644
+--- a/sysdeps/x86_64/fpu/multiarch/w_exp.c
++++ b/sysdeps/x86_64/fpu/multiarch/w_exp.c
+@@ -1 +1,6 @@
+-#include <sysdeps/../math/w_exp.c>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL >= AVX2_X86_ISA_LEVEL
++# include <sysdeps/ieee754/dbl-64/w_exp.c>
++#else
++# include <sysdeps/../math/w_exp.c>
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/w_log.c b/sysdeps/x86_64/fpu/multiarch/w_log.c
+index 9b2b018711..414ca3ca3d 100644
+--- a/sysdeps/x86_64/fpu/multiarch/w_log.c
++++ b/sysdeps/x86_64/fpu/multiarch/w_log.c
+@@ -1 +1,6 @@
+-#include <sysdeps/../math/w_log.c>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL >= AVX2_X86_ISA_LEVEL
++# include <sysdeps/ieee754/dbl-64/w_log.c>
++#else
++# include <sysdeps/../math/w_log.c>
++#endif
+diff --git a/sysdeps/x86_64/fpu/multiarch/w_pow.c b/sysdeps/x86_64/fpu/multiarch/w_pow.c
+index b50c1988de..d5fcc4f871 100644
+--- a/sysdeps/x86_64/fpu/multiarch/w_pow.c
++++ b/sysdeps/x86_64/fpu/multiarch/w_pow.c
+@@ -1 +1,6 @@
+-#include <sysdeps/../math/w_pow.c>
++#include <sysdeps/x86/isa-level.h>
++#if MINIMUM_X86_ISA_LEVEL >= AVX2_X86_ISA_LEVEL
++# include <sysdeps/ieee754/dbl-64/w_pow.c>
++#else
++# include <sysdeps/../math/w_pow.c>
++#endif
+
+commit 31da30f23cddd36db29d5b6a1c7619361b271fb4
+Author: Charles Fol <folcharles@gmail.com>
+Date:   Thu Mar 28 12:25:38 2024 -0300
+
+    iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961)
+    
+    ISO-2022-CN-EXT uses escape sequences to indicate character set changes
+    (as specified by RFC 1922).  While the SOdesignation has the expected
+    bounds checks, neither SS2designation nor SS3designation have its;
+    allowing a write overflow of 1, 2, or 3 bytes with fixed values:
+    '$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'.
+    
+    Checked on aarch64-linux-gnu.
+    
+    Co-authored-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Tested-by: Carlos O'Donell <carlos@redhat.com>
+    
+    (cherry picked from commit f9dc609e06b1136bb0408be9605ce7973a767ada)
+
+diff --git a/iconvdata/Makefile b/iconvdata/Makefile
+index ea019ce5c0..7196a8744b 100644
+--- a/iconvdata/Makefile
++++ b/iconvdata/Makefile
+@@ -75,7 +75,8 @@ ifeq (yes,$(build-shared))
+ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
+ 	tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
+ 	bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \
+-	bug-iconv13 bug-iconv14 bug-iconv15
++	bug-iconv13 bug-iconv14 bug-iconv15 \
++	tst-iconv-iso-2022-cn-ext
+ ifeq ($(have-thread-library),yes)
+ tests += bug-iconv3
+ endif
+@@ -330,6 +331,8 @@ $(objpfx)bug-iconv14.out: $(addprefix $(objpfx), $(gconv-modules)) \
+ 			  $(addprefix $(objpfx),$(modules.so))
+ $(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \
+ 			  $(addprefix $(objpfx),$(modules.so))
++$(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) \
++					$(addprefix $(objpfx),$(modules.so))
+ 
+ $(objpfx)iconv-test.out: run-iconv-test.sh \
+ 			 $(addprefix $(objpfx), $(gconv-modules)) \
+diff --git a/iconvdata/iso-2022-cn-ext.c b/iconvdata/iso-2022-cn-ext.c
+index b34c8a36f4..cce29b1969 100644
+--- a/iconvdata/iso-2022-cn-ext.c
++++ b/iconvdata/iso-2022-cn-ext.c
+@@ -574,6 +574,12 @@ DIAG_IGNORE_Os_NEEDS_COMMENT (5, "-Wmaybe-uninitialized");
+ 	      {								      \
+ 		const char *escseq;					      \
+ 									      \
++		if (outptr + 4 > outend)				      \
++		  {							      \
++		    result = __GCONV_FULL_OUTPUT;			      \
++		    break;						      \
++		  }							      \
++									      \
+ 		assert (used == CNS11643_2_set); /* XXX */		      \
+ 		escseq = "*H";						      \
+ 		*outptr++ = ESC;					      \
+@@ -587,6 +593,12 @@ DIAG_IGNORE_Os_NEEDS_COMMENT (5, "-Wmaybe-uninitialized");
+ 	      {								      \
+ 		const char *escseq;					      \
+ 									      \
++		if (outptr + 4 > outend)				      \
++		  {							      \
++		    result = __GCONV_FULL_OUTPUT;			      \
++		    break;						      \
++		  }							      \
++									      \
+ 		assert ((used >> 5) >= 3 && (used >> 5) <= 7);		      \
+ 		escseq = "+I+J+K+L+M" + ((used >> 5) - 3) * 2;		      \
+ 		*outptr++ = ESC;					      \
+diff --git a/iconvdata/tst-iconv-iso-2022-cn-ext.c b/iconvdata/tst-iconv-iso-2022-cn-ext.c
+new file mode 100644
+index 0000000000..96a8765fd5
+--- /dev/null
++++ b/iconvdata/tst-iconv-iso-2022-cn-ext.c
+@@ -0,0 +1,128 @@
++/* Verify ISO-2022-CN-EXT does not write out of the bounds.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdio.h>
++#include <string.h>
++
++#include <errno.h>
++#include <iconv.h>
++#include <sys/mman.h>
++
++#include <support/xunistd.h>
++#include <support/check.h>
++#include <support/support.h>
++
++/* The test sets up a two memory page buffer with the second page marked
++   PROT_NONE to trigger a fault if the conversion writes beyond the exact
++   expected amount.  Then we carry out various conversions and precisely
++   place the start of the output buffer in order to trigger a SIGSEGV if the
++   process writes anywhere between 1 and page sized bytes more (only one
++   PROT_NONE page is setup as a canary) than expected.  These tests exercise
++   all three of the cases in ISO-2022-CN-EXT where the converter must switch
++   character sets and may run out of buffer space while doing the
++   operation.  */
++
++static int
++do_test (void)
++{
++  iconv_t cd = iconv_open ("ISO-2022-CN-EXT", "UTF-8");
++  TEST_VERIFY_EXIT (cd != (iconv_t) -1);
++
++  char *ntf;
++  size_t ntfsize;
++  char *outbufbase;
++  {
++    int pgz = getpagesize ();
++    TEST_VERIFY_EXIT (pgz > 0);
++    ntfsize = 2 * pgz;
++
++    ntf = xmmap (NULL, ntfsize, PROT_READ | PROT_WRITE, MAP_PRIVATE
++		 | MAP_ANONYMOUS, -1);
++    xmprotect (ntf + pgz, pgz, PROT_NONE);
++
++    outbufbase = ntf + pgz;
++  }
++
++  /* Check if SOdesignation escape sequence does not trigger an OOB write.  */
++  {
++    char inbuf[] = "\xe4\xba\xa4\xe6\x8d\xa2";
++
++    for (int i = 0; i < 9; i++)
++      {
++	char *inp = inbuf;
++	size_t inleft = sizeof (inbuf) - 1;
++
++	char *outp = outbufbase - i;
++	size_t outleft = i;
++
++	TEST_VERIFY_EXIT (iconv (cd, &inp, &inleft, &outp, &outleft)
++			  == (size_t) -1);
++	TEST_COMPARE (errno, E2BIG);
++
++	TEST_VERIFY_EXIT (iconv (cd, NULL, NULL, NULL, NULL) == 0);
++      }
++  }
++
++  /* Same as before for SS2designation.  */
++  {
++    char inbuf[] = "㴽 \xe3\xb4\xbd";
++
++    for (int i = 0; i < 14; i++)
++      {
++	char *inp = inbuf;
++	size_t inleft = sizeof (inbuf) - 1;
++
++	char *outp = outbufbase - i;
++	size_t outleft = i;
++
++	TEST_VERIFY_EXIT (iconv (cd, &inp, &inleft, &outp, &outleft)
++			  == (size_t) -1);
++	TEST_COMPARE (errno, E2BIG);
++
++	TEST_VERIFY_EXIT (iconv (cd, NULL, NULL, NULL, NULL) == 0);
++      }
++  }
++
++  /* Same as before for SS3designation.  */
++  {
++    char inbuf[] = "劄 \xe5\x8a\x84";
++
++    for (int i = 0; i < 14; i++)
++      {
++	char *inp = inbuf;
++	size_t inleft = sizeof (inbuf) - 1;
++
++	char *outp = outbufbase - i;
++	size_t outleft = i;
++
++	TEST_VERIFY_EXIT (iconv (cd, &inp, &inleft, &outp, &outleft)
++			  == (size_t) -1);
++	TEST_COMPARE (errno, E2BIG);
++
++	TEST_VERIFY_EXIT (iconv (cd, NULL, NULL, NULL, NULL) == 0);
++      }
++  }
++
++  TEST_VERIFY_EXIT (iconv_close (cd) != -1);
++
++  xmunmap (ntf, ntfsize);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 4d6fb5a54b398..7418abaa1ba5c 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -36,6 +36,7 @@
 , withLinuxHeaders ? false
 , profilingLibraries ? false
 , withGd ? false
+, enableCET ? false
 , extraBuildInputs ? []
 , extraNativeBuildInputs ? []
 , ...
@@ -43,7 +44,7 @@
 
 let
   version = "2.39";
-  patchSuffix = "-5";
+  patchSuffix = "-31";
   sha256 = "sha256-93vUfPgXDFc2Wue/hmlsEYrbOxINMlnGTFAtPcHi2SY=";
 in
 
@@ -59,11 +60,15 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.39/master && git describe
-          glibc-2.39-5-ge0910f1d32
-          $ git show --minimal --reverse glibc-2.39.. > 2.39-master.patch
+          glibc-2.39-31-g31da30f23c
+          $ git show --minimal --reverse glibc-2.39.. ':!ADVISORIES' > 2.39-master.patch
 
          To compare the archive contents zdiff can be used.
           $ diff -u 2.39-master.patch ../nixpkgs/pkgs/development/libraries/glibc/2.39-master.patch
+
+         Please note that each commit has changes to the file ADVISORIES excluded since
+         that conflicts with the directory advisories/ making cross-builds from
+         hosts with case-insensitive file-systems impossible.
        */
       ./2.39-master.patch
 
@@ -154,9 +159,9 @@ stdenv.mkDerivation ({
       # and on aarch64 with binutils 2.30 or later.
       # https://sourceware.org/glibc/wiki/PortStatus
       "--enable-static-pie"
-    ] ++ lib.optionals stdenv.hostPlatform.isx86_64 [
+    ] ++ lib.optionals (enableCET != false) [
       # Enable Intel Control-flow Enforcement Technology (CET) support
-      "--enable-cet"
+      "--enable-cet${if builtins.isString enableCET then "=${enableCET}"  else ""}"
     ] ++ lib.optionals withLinuxHeaders [
       "--enable-kernel=3.10.0" # RHEL 7 and derivatives, seems oldest still supported kernel
     ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
@@ -208,7 +213,7 @@ stdenv.mkDerivation ({
   passthru = { inherit version; minorRelease = version; };
 }
 
-// (removeAttrs args [ "withLinuxHeaders" "withGd" "postInstall" "makeFlags" ]) //
+// (removeAttrs args [ "withLinuxHeaders" "withGd" "enableCET" "postInstall" "makeFlags" ]) //
 
 {
   src = fetchurl {
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 3f7331461fea5..e07c354aa4e09 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -2,6 +2,7 @@
 , withLinuxHeaders ? true
 , profilingLibraries ? false
 , withGd ? false
+, enableCET ? if stdenv.hostPlatform.isx86_64 then "permissive" else false
 , pkgsBuildBuild
 , libgcc
 }:
@@ -15,7 +16,7 @@ let
 in
 
 (callPackage ./common.nix { inherit stdenv; } {
-  inherit withLinuxHeaders withGd profilingLibraries;
+  inherit withLinuxHeaders withGd profilingLibraries enableCET;
   pname = "glibc" + lib.optionalString withGd "-gd" + lib.optionalString (stdenv.cc.isGNU && libgcc==null) "-nolibgcc";
 }).overrideAttrs(previousAttrs: {
 
diff --git a/pkgs/development/libraries/glibmm/2.68.nix b/pkgs/development/libraries/glibmm/2.68.nix
index c3c444f407e00..acace1c6a5bfe 100644
--- a/pkgs/development/libraries/glibmm/2.68.nix
+++ b/pkgs/development/libraries/glibmm/2.68.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glibmm";
-  version = "2.78.1";
+  version = "2.80.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-9HPyl10mw0CeES7RHtNkBvs4Q/qXXfV1wi1MuEMIX2E=";
+    hash = "sha256-U5sKKeFalmdsTwWUVBJQVmxcpE2l1Nh6NzL6LQeQnko=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/glibmm/default.nix b/pkgs/development/libraries/glibmm/default.nix
index 8800070ab61fb..f9f8a4568a579 100644
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "glibmm";
-  version = "2.66.6";
+  version = "2.66.7";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-U1h0JZgYHlNR17+NoHK/k+bdXxeNJ2QNTkYryPFOFS8=";
+    hash = "sha256-/gLB5fWCWUDYK1a27DGhLAbAXBWDz+Yvk00HY+HlQrM=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gnome-online-accounts/default.nix b/pkgs/development/libraries/gnome-online-accounts/default.nix
index c06e45356ac8a..740f7d94f1d99 100644
--- a/pkgs/development/libraries/gnome-online-accounts/default.nix
+++ b/pkgs/development/libraries/gnome-online-accounts/default.nix
@@ -7,38 +7,37 @@
 , meson
 , ninja
 , libxslt
-, gtk3
+, gtk4
 , enableBackend ? stdenv.isLinux
-, webkitgtk_4_1
 , json-glib
+, libadwaita
 , librest_1_0
 , libxml2
 , libsecret
 , gtk-doc
 , gobject-introspection
 , gettext
-, icu
 , glib-networking
 , libsoup_3
 , docbook-xsl-nons
 , docbook_xml_dtd_412
 , gnome
-, gcr
+, gcr_4
 , libkrb5
 , gvfs
 , dbus
-, wrapGAppsHook
+, wrapGAppsHook4
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-online-accounts";
-  version = "3.48.1";
+  version = "3.50.1";
 
   outputs = [ "out" "dev" ] ++ lib.optionals enableBackend [ "man" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-online-accounts/${lib.versions.majorMinor finalAttrs.version}/gnome-online-accounts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-PqDHEIS/WVzOXKo3zv8uhT0OyWRLsB/UZDMArblRf4o=";
+    hash = "sha256-Qu5D/R4pQrn/YQYlLM3INGAoFVCL96OlLAvf/6Vur0A=";
   };
 
   mesonFlags = [
@@ -46,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dgoabackend=${lib.boolToString enableBackend}"
     "-Dgtk_doc=${lib.boolToString enableBackend}"
     "-Dman=${lib.boolToString enableBackend}"
-    "-Dmedia_server=true"
+    "-Dwebdav=true"
   ];
 
   nativeBuildInputs = [
@@ -61,28 +60,24 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook4
   ];
 
   buildInputs = [
-    gcr
+    gcr_4
     glib
     glib-networking
-    gtk3
+    gtk4
+    libadwaita
     gvfs # OwnCloud, Google Drive
-    icu
     json-glib
     libkrb5
     librest_1_0
     libxml2
     libsecret
     libsoup_3
-  ] ++ lib.optionals enableBackend [
-    webkitgtk_4_1
   ];
 
-  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
-
   separateDebugInfo = true;
 
   passthru = {
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 3817d8bb9ced8..23f1e2262d128 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -22,6 +22,7 @@
 , nixStoreDir ? builtins.storeDir
 , x11Support ? true
 , testers
+, propagateFullGlib ? true
 }:
 
 # now that gobject-introspection creates large .gir files (eg gtk3 case)
@@ -33,10 +34,13 @@ let
     pp.mako
     pp.markdown
   ];
+
+  # https://discourse.gnome.org/t/dealing-with-glib-and-gobject-introspection-circular-dependency/18701
+  glib' = glib.override { withIntrospection = false; };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gobject-introspection";
-  version = "1.78.1";
+  version = "1.80.1";
 
   # outputs TODO: share/gobject-introspection-1.0/tests is needed during build
   # by pygobject3 (and maybe others), but it's only searched in $out
@@ -45,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gobject-introspection/${lib.versions.majorMinor finalAttrs.version}/gobject-introspection-${finalAttrs.version}.tar.xz";
-    sha256 = "vXur2Zr3JY52gZ5Fukprw5lgj+di2D/ePKwDPFCEG7Q=";
+    hash = "sha256-od98Qk4VvaGrY5wA6QUbmt9c6hqeUS+KYDtTzRmbxtg=";
   };
 
   patches = [
@@ -92,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = [
     libffi
-    glib
+    (if propagateFullGlib then glib else glib')
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/gsettings-desktop-schemas/default.nix b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
index f898f3d3bcd87..c33011f4b01de 100644
--- a/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
+++ b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gsettings-desktop-schemas";
-  version = "45.0";
+  version = "46.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "NlyNBNr3mzjIs9yWJjSaAk+eS+/dMf7edLQvep++CuI=";
+    hash = "sha256-STpGoRYbY4jVeqcvYyp5zpbELV/70dCwD0luxYdvhXU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index bec1cb762ce4f..b94769af76f44 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -18,13 +18,14 @@
 , opencv4
 , faad2
 , ldacbt
+, liblc3
 , libass
 , libkate
 , lrdf
 , ladspaH
 , lcms2
 , libnice
-, webrtc-audio-processing
+, webrtc-audio-processing_1
 , lilv
 , lv2
 , serd
@@ -44,6 +45,7 @@
 , flite
 , gsm
 , json-glib
+, libajantv2
 , libaom
 , libdc1394
 , libde265
@@ -68,6 +70,7 @@
 , zbar
 , wayland-protocols
 , wildmidi
+, svt-av1
 , fluidsynth
 , libva
 , libvdpau
@@ -109,13 +112,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.22.9";
+  version = "1.24.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-G8ZdD9X1OjY2Vk79P88xjD7c3sOcQQmlA8H8ggOECh0=";
+    hash = "sha256-RI4yeHvIK1hsbLL4HJqO9AT+pPd/JVZv4G5Zej9ZE2s=";
   };
 
   patches = [
@@ -147,10 +150,10 @@ stdenv.mkDerivation rec {
     json-glib
     lcms2
     ldacbt
+    liblc3
     libass
     libkate
-    webrtc-audio-processing # required by webrtcdsp
-    #webrtc-audio-processing_1 # required by isac
+    webrtc-audio-processing_1
     libbs2b
     libmodplug
     openjpeg
@@ -192,6 +195,7 @@ stdenv.mkDerivation rec {
     zxing-cpp
     usrsctp
     wildmidi
+    svt-av1
   ] ++ lib.optionals opencvSupport [
     opencv4
   ] ++ lib.optionals enableZbar [
@@ -217,6 +221,7 @@ stdenv.mkDerivation rec {
 
     chromaprint
     flite
+    libajantv2
     libdrm
     libgudev
     sbc
@@ -260,6 +265,7 @@ stdenv.mkDerivation rec {
     "-Damfcodec=disabled" # Windows-only
     "-Davtp=disabled"
     "-Ddirectshow=disabled" # Windows-only
+    "-Dqt6d3d11=disabled" # Windows-only
     "-Ddts=disabled" # required `libdca` library not packaged in nixpkgs as of writing, and marked as "BIG FAT WARNING: libdca is still in early development"
     "-Dzbar=${if enableZbar then "enabled" else "disabled"}"
     "-Dfaac=${if faacSupport then "enabled" else "disabled"}"
@@ -287,11 +293,11 @@ stdenv.mkDerivation rec {
     "-Dwasapi=disabled" # not packaged in nixpkgs as of writing / no Windows support
     "-Dwasapi2=disabled" # not packaged in nixpkgs as of writing / no Windows support
     "-Dwpe=disabled" # required `wpe-webkit` library not packaged in nixpkgs as of writing
-    "-Disac=disabled" # depends on `webrtc-audio-coding-1` not compatible with 0.3
     "-Dgs=disabled" # depends on `google-cloud-cpp`
     "-Donnx=disabled" # depends on `libonnxruntime` not packaged in nixpkgs as of writing
     "-Dopenaptx=enabled" # since gstreamer-1.20.1 `libfreeaptx` is supported for circumventing the dubious license conflict with `libopenaptx`
     "-Dopencv=${if opencvSupport then "enabled" else "disabled"}" # Reduces rebuild size when `config.cudaSupport = true`
+    "-Daja=disabled" # should pass libajantv2 via aja-sdk-dir instead
     "-Dmicrodns=${if microdnsSupport then "enabled" else "disabled"}"
     "-Dbluez=${if bluezSupport then "enabled" else "disabled"}"
     (lib.mesonEnable "doc" enableDocumentation)
@@ -302,8 +308,8 @@ stdenv.mkDerivation rec {
     "-Dva=disabled" # see comment on `libva` in `buildInputs`
   ] ++ lib.optionals (!stdenv.isLinux || !guiSupport) [
     "-Ddirectfb=disabled"
-  ]
-  ++ lib.optionals stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-Daja=disabled"
     "-Dchromaprint=disabled"
     "-Dflite=disabled"
     "-Dkms=disabled" # renders to libdrm output
@@ -312,6 +318,7 @@ stdenv.mkDerivation rec {
     "-Dspandsp=disabled"
     "-Ddvb=disabled"
     "-Dfbdev=disabled"
+    "-Duvcgadget=disabled" # requires gudev
     "-Duvch264=disabled" # requires gudev
     "-Dv4l2codecs=disabled" # requires gudev
     "-Dladspa=disabled" # requires lrdf
@@ -319,7 +326,7 @@ stdenv.mkDerivation rec {
     "-Dqsv=disabled" # Linux (and Windows) x86 only
   ] ++ lib.optionals (!gst-plugins-base.glEnabled) [
     "-Dgl=disabled"
-  ] ++ lib.optionals (!gst-plugins-base.waylandEnabled) [
+  ] ++ lib.optionals (!gst-plugins-base.waylandEnabled || !guiSupport) [
     "-Dgtk3=disabled" # Wayland-based GTK sink
     "-Dwayland=disabled"
   ] ++ lib.optionals (!gst-plugins-base.glEnabled) [
diff --git a/pkgs/development/libraries/gstreamer/bad/fix-paths.patch b/pkgs/development/libraries/gstreamer/bad/fix-paths.patch
index ea832cc9f60b1..207ed16aa0b08 100644
--- a/pkgs/development/libraries/gstreamer/bad/fix-paths.patch
+++ b/pkgs/development/libraries/gstreamer/bad/fix-paths.patch
@@ -1,24 +1,24 @@
-diff --git a/gst-libs/gst/cuda/gstcudaloader.c b/gst-libs/gst/cuda/gstcudaloader.c
-index fffcbefd2b..6f738d3af3 100644
---- a/gst-libs/gst/cuda/gstcudaloader.c
-+++ b/gst-libs/gst/cuda/gstcudaloader.c
-@@ -165,6 +165,11 @@ gst_cuda_load_library (void)
-     return TRUE;
+diff --git a/gst-libs/gst/cuda/gstcudaloader.cpp b/gst-libs/gst/cuda/gstcudaloader.cpp
+index 11718b8..d4144c1 100644
+--- a/gst-libs/gst/cuda/gstcudaloader.cpp
++++ b/gst-libs/gst/cuda/gstcudaloader.cpp
+@@ -229,6 +229,11 @@ gst_cuda_load_library_once_func (void)
+       "CUDA plugin loader");
  
    module = g_module_open (filename, G_MODULE_BIND_LAZY);
 +
-+  if (module == NULL) {
++  if (module == nullptr) {
 +    module = g_module_open ("@driverLink@/lib/" CUDA_LIBNAME, G_MODULE_BIND_LAZY);
 +  }
 +
-   if (module == NULL) {
+   if (module == nullptr) {
      GST_WARNING ("Could not open library %s, %s", filename, g_module_error ());
-     return FALSE;
+     return;
 diff --git a/sys/nvcodec/gstcuvidloader.c b/sys/nvcodec/gstcuvidloader.c
-index e957e062e0..004ec2dcd5 100644
+index c51a428..ea0e1b5 100644
 --- a/sys/nvcodec/gstcuvidloader.c
 +++ b/sys/nvcodec/gstcuvidloader.c
-@@ -85,6 +85,11 @@ gst_cuvid_load_library (guint api_major_ver, guint api_minor_ver)
+@@ -87,6 +87,11 @@ gst_cuvid_load_library (guint api_major_ver, guint api_minor_ver)
      return TRUE;
  
    module = g_module_open (filename, G_MODULE_BIND_LAZY);
@@ -31,10 +31,10 @@ index e957e062e0..004ec2dcd5 100644
      GST_WARNING ("Could not open library %s, %s", filename, g_module_error ());
      return FALSE;
 diff --git a/sys/nvcodec/gstnvenc.c b/sys/nvcodec/gstnvenc.c
-index 106857a954..3bab9989f0 100644
+index c65c85a..57232bb 100644
 --- a/sys/nvcodec/gstnvenc.c
 +++ b/sys/nvcodec/gstnvenc.c
-@@ -907,6 +907,11 @@ gst_nvenc_load_library (guint * api_major_ver, guint * api_minor_ver)
+@@ -919,6 +919,11 @@ gst_nvenc_load_library (guint * api_major_ver, guint * api_minor_ver)
    };
  
    module = g_module_open (NVENC_LIBRARY_NAME, G_MODULE_BIND_LAZY);
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 066ffbc1308e0..72dbef5c6dee0 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -24,6 +24,7 @@
 , libXext
 , libXi
 , libXv
+, libdrm
 , enableWayland ? stdenv.isLinux
 , wayland
 , wayland-protocols
@@ -45,7 +46,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.22.9";
+  version = "1.24.2";
 
   outputs = [ "out" "dev" ];
 
@@ -53,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-+sPg3S2Ok3A4izS/jCG4nV9jvDz8Es1/3I/GwcugMzQ=";
+    hash = "sha256-KC8cyAZcm2Lragog+56DKPjlKW3yRYtyNtqnKcQa52k=";
   };
 
   strictDeps = true;
@@ -88,6 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
     tremor
     pango
   ] ++ lib.optionals (!stdenv.isDarwin) [
+    libdrm
     libGL
     libvisual
   ] ++ lib.optionals stdenv.isDarwin [
@@ -106,6 +108,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = [
     gstreamer
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libdrm
   ];
 
   mesonFlags = [
@@ -122,6 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional (!enableAlsa) "-Dalsa=disabled"
   ++ lib.optional (!enableCdparanoia) "-Dcdparanoia=disabled"
   ++ lib.optionals stdenv.isDarwin [
+    "-Ddrm=disabled"
     "-Dlibvisual=disabled"
   ];
 
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index be56527ec47bd..eb9231155b80a 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -17,6 +17,7 @@
 , Cocoa
 , CoreServices
 , gobject-introspection
+, rustc
 , testers
 # Checks meson.is_cross_build(), so even canExecute isn't enough.
 , enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc
@@ -24,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.22.9";
+  version = "1.24.2";
 
   outputs = [
     "bin"
@@ -36,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-HnEk00fozcgPCOwdNwwgG+UTACrxECuyDoPFJ5y0jr0=";
+    hash = "sha256-nK/dI70YDxaBxWzTpoeahJfM8k2m9CKmtvNW+gdKhIE=";
   };
 
   depsBuildBuild = [
@@ -56,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     glib
     bash-completion
     gobject-introspection
+    rustc
   ] ++ lib.optionals stdenv.isLinux [
     libcap # for setcap binary
   ] ++ lib.optionals enableDocumentation [
@@ -94,7 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
       gst/parse/gen_grammar.py.in \
       gst/parse/gen_lex.py.in \
       libs/gst/helpers/ptp_helper_post_install.sh \
-      scripts/extract-release-date-from-doap-file.py
+      scripts/extract-release-date-from-doap-file.py \
+      docs/gst-plugins-doc-cache-generator.py
   '';
 
   postInstall = ''
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index 343f161cc3d48..5b1d4c8618cea 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.22.9";
+  version = "1.24.2";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-AuKUALROnMYDqmRE3uVya1ftq+9kVebQkh/+1vE4QO4=";
+    hash = "sha256-/dfDDBqhuweADdmKUeVSEQZWGYNeSIn1yS/oI7hs2PQ=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index adb737bb1be71..0838dec0fdb06 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.22.9";
+  version = "1.24.2";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-NVOtOALczeDA7xRhiBrNm1W934rfdR3ky1G3+MtQRA0=";
+    hash = "sha256-cgF3jqXZN0QMU9dDndEqpaxoQGiK8fBJmFInUHS5kHM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index fbb79028bdaf7..1cf3fef79f08a 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -16,7 +16,9 @@
 , libavc1394
 , libiec61883
 , libvpx
+, libdrm
 , speex
+, opencore-amr
 , flac
 , taglib
 , libshout
@@ -39,6 +41,7 @@
 , enableJack ? true, libjack2
 , enableX11 ? stdenv.isLinux, xorg
 , ncurses
+, enableWayland ? stdenv.isLinux
 , wayland
 , wayland-protocols
 , libgudev
@@ -55,13 +58,13 @@ assert raspiCameraSupport -> (stdenv.isLinux && stdenv.isAarch32);
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.22.9";
+  version = "1.24.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-JpWfz+v/9jfU6gjvQDFrrzG2G7dymCCwaE6ADDoUeLY=";
+    hash = "sha256-bjR8ctS4sohtiQ/+n2dnqe2wLyAViOjDpXLc0I2YUr0=";
   };
 
   patches = [
@@ -94,7 +97,7 @@ stdenv.mkDerivation rec {
   ]) ++ lib.optionals qt6Support (with qt6; [
     qtbase
     qttools
-  ]) ++ lib.optionals stdenv.isLinux [
+  ]) ++ lib.optionals enableWayland [
     wayland-protocols
   ];
 
@@ -105,6 +108,7 @@ stdenv.mkDerivation rec {
     libdv
     libvpx
     speex
+    opencore-amr
     flac
     taglib
     cairo
@@ -127,6 +131,8 @@ stdenv.mkDerivation rec {
     xorg.libXext
     xorg.libXfixes
     xorg.libXdamage
+    xorg.libXtst
+    xorg.libXi
   ] ++ lib.optionals gtkSupport [
     # for gtksink
     gtk3
@@ -142,12 +148,14 @@ stdenv.mkDerivation rec {
   ]) ++ lib.optionals stdenv.isDarwin [
     Cocoa
   ] ++ lib.optionals stdenv.isLinux [
+    libdrm
     libGL
     libv4l
     libpulseaudio
     libavc1394
     libiec61883
     libgudev
+  ] ++ lib.optionals enableWayland [
     wayland
   ] ++ lib.optionals enableJack [
     libjack2
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index ae54995a1c3e2..35d0b461d9bc9 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.22.9";
+  version = "1.24.2";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-GS99J9IcHnxywzmiZHqbDCR/7cYupQKRFfjD4i67h9g=";
+    hash = "sha256-lig4ZI4Uzop4Miqxb4TH2E2Gpte+u2V0rAXeqEp8fJs=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index b49da94955e3a..cb848efca39f9 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.22.9";
+  version = "1.24.2";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-gIrxSPiUBP90hQ+MpScr7Uv+Z/liAjHcRRT9B+sm0KQ=";
+    hash = "sha256-5MhKeGdefv7zsm6cueLkJzGEIbStnuS1E2767rtrugw=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index d64fcae68965b..40b6e169c225a 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -15,7 +15,6 @@
 , x264
 , libintl
 , lib
-, opencore-amr
 , IOKit
 , CoreFoundation
 , DiskArbitration
@@ -26,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.22.9";
+  version = "1.24.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-C/aF1mAVoB3T/BZxtkocissyHdnUq54Fopqxl4KqYjY=";
+    hash = "sha256-RdqYvxBAyUcv1Z9icSgt4lo3IauFt4qq+BBJSVUPvvU=";
   };
 
   nativeBuildInputs = [
@@ -49,7 +48,6 @@ stdenv.mkDerivation rec {
     gst-plugins-base
     orc
     libintl
-    opencore-amr
   ] ++ lib.optionals enableGplPlugins [
     a52dec
     libcdio
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 1a63588397075..a5cd9cace4e74 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.22.9";
+  version = "1.24.2";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-i6INqMTL9bKVPbqQRnLEJ10AU+FSj5f9+OWZQseIPKg=";
+    hash = "sha256-zFq4yIRD4PW/I9YRC0qsM99Z5K5ib1NtlosWBcx7li8=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/viperfx/default.nix b/pkgs/development/libraries/gstreamer/viperfx/default.nix
index 83c7d75e98c1a..0f8e8914e2e9c 100644
--- a/pkgs/development/libraries/gstreamer/viperfx/default.nix
+++ b/pkgs/development/libraries/gstreamer/viperfx/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gst_all_1
 , cmake
 }:
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0so4jV56nl3tZHuZpvtyMrpOZ4tNJ59Pyj6zbV5bJ5Y=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 ];
 
   propagatedBuildInputs = [
     gst_all_1.gstreamer
diff --git a/pkgs/development/libraries/gtk-frdp/default.nix b/pkgs/development/libraries/gtk-frdp/default.nix
index 72cefea7e59a6..3819c2043a1da 100644
--- a/pkgs/development/libraries/gtk-frdp/default.nix
+++ b/pkgs/development/libraries/gtk-frdp/default.nix
@@ -8,21 +8,21 @@
 , gobject-introspection
 , glib
 , gtk3
-, freerdp
+, freerdp3
 , fuse3
 , unstableGitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "gtk-frdp";
-  version = "unstable-2023-09-16";
+  version = "unstable-2024-03-01";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = pname;
-    rev = "62fc62c5ccb7634f0bc87c57a4673877c24c94ed";
-    sha256 = "H+ebFWjpmp4Ua22Bd6K3LsxNHqEbtpawnzA5ry8+XFc=";
+    rev = "11e9fcbee8ca5ec70456dd5b616b2560d7f73adc";
+    sha256 = "2e/bAZFRTbBU4ZfgMFHiN9JwVm4qXSRtirPvbC3oT5s=";
   };
 
   nativeBuildInputs = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib
     gtk3
-    freerdp
+    freerdp3
     fuse3
   ];
 
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 036d1ab0d49d0..341827b248e0d 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -39,10 +39,11 @@
 , waylandSupport ? stdenv.isLinux
 , libGL
 # experimental and can cause crashes in inspector
-, vulkanSupport ? false
+, vulkanSupport ? stdenv.isLinux
 , shaderc
 , vulkan-loader
 , vulkan-headers
+, libdrm
 , wayland
 , wayland-protocols
 , wayland-scanner
@@ -69,7 +70,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk4";
-  version = "4.12.5";
+  version = "4.14.3";
 
   outputs = [ "out" "dev" ] ++ lib.optionals x11Support [ "devdoc" ];
   outputBin = "dev";
@@ -81,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = with finalAttrs; "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    sha256 = "KLNW1ZDuaO9ibi75ggst0hRBSEqaBCpaPwxA6d/E9Pg=";
+    hash = "sha256-K+XIWL3vEQTTeEjJd5wIk3LI0xUD9u/EuU5TtUb8mkM=";
   };
 
   depsBuildBuild = [
@@ -116,6 +117,7 @@ stdenv.mkDerivation (finalAttrs: {
     isocodes
   ] ++ lib.optionals vulkanSupport [
     vulkan-headers
+    libdrm
   ] ++ [
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-bad
@@ -161,7 +163,7 @@ stdenv.mkDerivation (finalAttrs: {
     vulkan-loader
   ] ++ [
     # Required for GSettings schemas at runtime.
-    # Will be picked up by wrapGAppsHook.
+    # Will be picked up by wrapGAppsHook4.
     gsettings-desktop-schemas
   ];
 
@@ -199,7 +201,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace 'if not meson.is_cross_build()' 'if ${lib.boolToString compileSchemas}'
 
     files=(
-      build-aux/meson/gen-demo-header.py
+      build-aux/meson/gen-profile-conf.py
       build-aux/meson/gen-visibility-macros.py
       demos/gtk-demo/geninclude.py
       gdk/broadway/gen-c-array.py
diff --git a/pkgs/development/libraries/gtkmm/4.x.nix b/pkgs/development/libraries/gtkmm/4.x.nix
index 21bfdd858c294..36ff98d9f1654 100644
--- a/pkgs/development/libraries/gtkmm/4.x.nix
+++ b/pkgs/development/libraries/gtkmm/4.x.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkmm";
-  version = "4.12.0";
+  version = "4.14.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "+8PnYYEjNFwBSO9xq7ZUjUIfUrsiT72jSHW2d9wDLJI=";
+    hash = "sha256-k1CgREt0TKPcaVhuvRtnB1IJIrbZ9PIyEDzmA6Jx7No=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gtksourceview/5.x.nix b/pkgs/development/libraries/gtksourceview/5.x.nix
index c54017312e1ed..93f5bb519495d 100644
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
-  version = "5.10.0";
+  version = "5.12.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "s4owEMNPWeE7BRdenSDKAqMRBEP+wrHldHQTgBvJwj8=";
+    hash = "sha256-2vMv9dMVDWOFkX01A6hbngR7oViysDB5MUycAIE/oB8=";
   };
 
   patches = [
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    "-Dgtk_doc=true"
+    "-Ddocumentation=true"
   ];
 
   doCheck = stdenv.isLinux;
diff --git a/pkgs/development/libraries/gvfs/default.nix b/pkgs/development/libraries/gvfs/default.nix
index 20278435cedfa..aba944becf763 100644
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -29,10 +29,10 @@
 , libmtp
 , gnomeSupport ? false
 , gnome
-, gcr
+, gcr_4
 , glib-networking
 , gnome-online-accounts
-, wrapGAppsHook
+, wrapGAppsHook3
 , libimobiledevice
 , libbluray
 , libcdio-paranoia
@@ -40,17 +40,19 @@
 , openssh
 , libsecret
 , libgdata
+, libmsgraph
 , python3
+, python3Packages
 , gsettings-desktop-schemas
 }:
 
 stdenv.mkDerivation rec {
   pname = "gvfs";
-  version = "1.52.2";
+  version = "1.54.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gvfs/${lib.versions.majorMinor version}/gvfs-${version}.tar.xz";
-    hash = "sha256-pkOs6qBTyqwNjv+aAV9jbkvRuwnP4nhk40fbZ0YOe5E=";
+    hash = "sha256-9T2B34bC6GzdJRgsLYpmmiI3HoNiPe0bnVQW3Pxt42Y=";
   };
 
   patches = [
@@ -70,7 +72,7 @@ stdenv.mkDerivation rec {
     python3
     pkg-config
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
     libxslt
     docbook_xsl
     docbook_xml_dtd_42
@@ -100,11 +102,12 @@ stdenv.mkDerivation rec {
     polkit
     libcdio-paranoia
   ] ++ lib.optionals gnomeSupport [
-    gcr
+    gcr_4
     glib-networking # TLS support
     gnome-online-accounts
     libsecret
     libgdata
+    libmsgraph
   ];
 
   mesonFlags = [
@@ -126,6 +129,7 @@ stdenv.mkDerivation rec {
     "-Dgoa=false"
     "-Dkeyring=false"
     "-Dgoogle=false"
+    "-Donedrive=false"
   ] ++ lib.optionals (avahi == null) [
     "-Ddnssd=false"
   ] ++ lib.optionals (samba == null) [
diff --git a/pkgs/development/libraries/hyena/default.nix b/pkgs/development/libraries/hyena/default.nix
index 177f6fe7909df..0a4e89b3b2de3 100644
--- a/pkgs/development/libraries/hyena/default.nix
+++ b/pkgs/development/libraries/hyena/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   inherit monoDLLFixer;
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Attic/Hyena";
+    homepage = "https://gitlab.gnome.org/Archive/hyena";
     description = "A C# library which contains a hodge-podge of random stuff";
     longDescription = ''
       Hyena is a C# library used to make awesome applications. It contains a lot of random things,
diff --git a/pkgs/development/libraries/icu/make-icu.nix b/pkgs/development/libraries/icu/make-icu.nix
index 836a7e3c73a69..b130c346dbaa3 100644
--- a/pkgs/development/libraries/icu/make-icu.nix
+++ b/pkgs/development/libraries/icu/make-icu.nix
@@ -75,6 +75,8 @@ let
         { from = "\${pkglibdir}/pkgdata.inc"; to = "${placeholder "dev"}/lib/icu/pkgdata.inc"; } # --incpkgdatafile
       ];
     in ''
+      rm $out/share/icu/${version}/install-sh $out/share/icu/${version}/mkinstalldirs # Avoid having a runtime dependency on bash
+
       substituteInPlace "$dev/bin/icu-config" \
         ${lib.concatMapStringsSep " " (r: "--replace '${r.from}' '${r.to}'") replacements}
     '');
diff --git a/pkgs/development/libraries/intel-gmmlib/default.nix b/pkgs/development/libraries/intel-gmmlib/default.nix
index 6d21c7bc6e1a3..5c647aaadfe62 100644
--- a/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/pkgs/development/libraries/intel-gmmlib/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-gmmlib";
-  version = "22.3.18";
+  version = "22.3.19";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
     rev = "intel-gmmlib-${version}";
-    sha256 = "sha256-woEYEgvwf12aWCeYqSiosQAUJErGaEP3q8JER971lys=";
+    sha256 = "sha256-y35rcAo1CR8HvKD4hCtdMSSPSSnGaUf4l2Tdzbq5fFw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/kde-frameworks/kded.nix b/pkgs/development/libraries/kde-frameworks/kded.nix
index 02364ba72f367..e369b8fbae41f 100644
--- a/pkgs/development/libraries/kde-frameworks/kded.nix
+++ b/pkgs/development/libraries/kde-frameworks/kded.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, propagate, wrapGAppsHook,
+  mkDerivation, lib, propagate, wrapGAppsHook3,
   extra-cmake-modules, kdoctools,
   gsettings-desktop-schemas, kconfig, kcoreaddons, kcrash, kdbusaddons,
   kservice, qtbase,
@@ -7,7 +7,7 @@
 
 mkDerivation {
   pname = "kded";
-  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook3 ];
   buildInputs = [
     gsettings-desktop-schemas kconfig kcoreaddons kcrash kdbusaddons
     kservice qtbase
diff --git a/pkgs/development/libraries/libadwaita/default.nix b/pkgs/development/libraries/libadwaita/default.nix
index bb520e7c2274f..1301f9fe923d9 100644
--- a/pkgs/development/libraries/libadwaita/default.nix
+++ b/pkgs/development/libraries/libadwaita/default.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.4.4";
+  version = "1.5.0";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc"; # demo app
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     rev = finalAttrs.version;
-    hash = "sha256-AZP5OH/LIroBeKioe7AIVx0FvFdTpWJ1INdRPZcjmHQ=";
+    hash = "sha256-uEaBI2jHlMdVprMGRZe/8HszO3nEBUJaJtvJjrMOjE4=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libajantv2/default.nix b/pkgs/development/libraries/libajantv2/default.nix
index 89d609b327abe..278752b18738d 100644
--- a/pkgs/development/libraries/libajantv2/default.nix
+++ b/pkgs/development/libraries/libajantv2/default.nix
@@ -28,6 +28,21 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
+  postInstall = ''
+    mkdir -p "$out/lib/pkgconfig"
+    cat >"$out/lib/pkgconfig/libajantv2.pc" <<EOF
+    prefix=$out
+    libdir=\''${prefix}/lib
+    includedir=\''${prefix}/include/ajalibraries
+
+    Name: libajantv2
+    Description: Library for controlling AJA NTV2 video devices
+    Version: ${version}
+    Libs: -L\''${libdir} -lajantv2
+    Cflags: -I\''${includedir} -I\''${includedir}/ajantv2/includes
+    EOF
+  '';
+
   meta = with lib; {
     description = "AJA NTV2 Open Source Static Libs and Headers for building applications that only wish to statically link against";
     homepage = "https://github.com/aja-video/ntv2";
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index ac8ebcb3eb1cb..11a065654c9cf 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -1,12 +1,12 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , acl
 , attr
 , autoreconfHook
 , bzip2
 , e2fsprogs
+, glibcLocalesUtf8
 , lzo
 , openssl
 , pkg-config
@@ -28,29 +28,15 @@
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
-  version = "3.7.2";
+  version = "3.7.3";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-p2JgJ/rvqaQ6yyXSh+ehScUH565ud5bQncl+lOnsWfc=";
+    hash = "sha256-bfuEhw8l/flGyHNRguVcygyTYCLdnv5PAo7QGb2LybQ=";
   };
 
-  patches = [
-    # Pull fix for test failure on 32-bit systems:
-    (fetchpatch {
-      name = "32-bit-tests-fix.patch";
-      url = "https://github.com/libarchive/libarchive/commit/3bd918d92f8c34ba12de9c6604d96f9e262a59fc.patch";
-      hash = "sha256-RM3xFM6S2DkM5DJ0kAba8eLzEXuY5/7AaU06maHJ6rM=";
-    })
-    (fetchpatch {
-      name = "fix-suspicious-commit-from-known-bad-actor.patch";
-      url = "https://github.com/libarchive/libarchive/commit/6110e9c82d8ba830c3440f36b990483ceaaea52c.patch";
-      hash = "sha256-/j6rJ0xWhtXU0YCu1LOokxxNppy5Of6Q0XyO4U6la7M=";
-    })
-  ];
-
   outputs = [ "out" "lib" "dev" ];
 
   postPatch = let
@@ -70,17 +56,18 @@ stdenv.mkDerivation (finalAttrs: {
       "cpio/test/test_format_newc.c"
     ];
     removeTest = testPath: ''
-      substituteInPlace Makefile.am --replace "${testPath}" ""
+      substituteInPlace Makefile.am --replace-fail "${testPath}" ""
       rm "${testPath}"
     '';
   in ''
-    substituteInPlace Makefile.am --replace '/bin/pwd' "$(type -P pwd)"
+    substituteInPlace Makefile.am --replace-fail '/bin/pwd' "$(type -P pwd)"
 
     ${lib.concatStringsSep "\n" (map removeTest skipTestPaths)}
   '';
 
   nativeBuildInputs = [
     autoreconfHook
+    glibcLocalesUtf8 # test_I test requires an UTF-8 locale
     pkg-config
   ];
 
@@ -107,6 +94,11 @@ stdenv.mkDerivation (finalAttrs: {
   # https://github.com/libarchive/libarchive/issues/1475
   doCheck = !stdenv.hostPlatform.isMusl;
 
+  preCheck = ''
+    # Need an UTF-8 locale for test_I test.
+    export LANG=en_US.UTF-8
+  '';
+
   preFixup = ''
     sed -i $lib/lib/libarchive.la \
       -e 's|-lcrypto|-L${lib.getLib openssl}/lib -lcrypto|' \
diff --git a/pkgs/development/libraries/libbluray/default.nix b/pkgs/development/libraries/libbluray/default.nix
index bc10d06b846cc..552259ce3babe 100644
--- a/pkgs/development/libraries/libbluray/default.nix
+++ b/pkgs/development/libraries/libbluray/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch, pkg-config, fontconfig, autoreconfHook, DiskArbitration
-, withJava ? false, jdk, ant
+, withJava ? false, jdk17, ant, stripJavaArchivesHook
 , withAACS ? false, libaacs
 , withBDplus ? false, libbdplus
 , withMetadata ? true, libxml2
@@ -19,23 +19,18 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ]
-    ++ lib.optionals withJava [ ant ];
+    ++ lib.optionals withJava [ jdk17 ant stripJavaArchivesHook ];
 
   buildInputs = [ fontconfig ]
-    ++ lib.optional withJava jdk
     ++ lib.optional withMetadata libxml2
     ++ lib.optional withFonts freetype
     ++ lib.optional stdenv.isDarwin DiskArbitration;
 
   propagatedBuildInputs = lib.optional withAACS libaacs;
 
-  NIX_LDFLAGS = lib.optionalString withAACS "-L${libaacs}/lib -laacs"
+  env.NIX_LDFLAGS = lib.optionalString withAACS "-L${libaacs}/lib -laacs"
     + lib.optionalString withBDplus " -L${libbdplus}/lib -lbdplus";
 
-  preConfigure = lib.optionalString withJava ''
-    export JDK_HOME="${jdk.home}"
-  '';
-
   configureFlags = lib.optional (!withJava) "--disable-bdjava-jar"
     ++ lib.optional (!withMetadata) "--without-libxml2"
     ++ lib.optional (!withFonts) "--without-freetype";
diff --git a/pkgs/development/libraries/libcloudproviders/default.nix b/pkgs/development/libraries/libcloudproviders/default.nix
index 6161ea78174d4..8b6722d9cde7d 100644
--- a/pkgs/development/libraries/libcloudproviders/default.nix
+++ b/pkgs/development/libraries/libcloudproviders/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libcloudproviders/${lib.versions.majorMinor version}/libcloudproviders-${version}.tar.xz";
-    sha256 = "O3URCzpP3vTFxaRA5IcB/gVNKuBh0VbIkTa7W6BedLc=";
+    hash = "sha256-O3URCzpP3vTFxaRA5IcB/gVNKuBh0VbIkTa7W6BedLc=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libdazzle/default.nix b/pkgs/development/libraries/libdazzle/default.nix
index 38ba2e3b36156..1e7bb7d05e3ab 100644
--- a/pkgs/development/libraries/libdazzle/default.nix
+++ b/pkgs/development/libraries/libdazzle/default.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
       for those libraries. In other cases, our design isn't quite generic
       enough to work for everyone.
     '';
-    homepage = "https://wiki.gnome.org/Apps/Builder";
+    homepage = "https://gitlab.gnome.org/GNOME/libdazzle";
     license = licenses.gpl3Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/libdex/default.nix b/pkgs/development/libraries/libdex/default.nix
index 2837086934217..a81cc2669529f 100644
--- a/pkgs/development/libraries/libdex/default.nix
+++ b/pkgs/development/libraries/libdex/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchFromGitLab
+, fetchurl
 , gi-docgen
 , gobject-introspection
 , meson
@@ -14,16 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdex";
-  version = "0.4.3";
+  version = "0.6.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "GNOME";
-    repo = "libdex";
-    rev = version;
-    sha256 = "0GNlgJgAOE3JGwu/6Zsh4sjFapA7nUcGD3lgZZJ0BfQ=";
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    hash = "sha256-HojSsAYo5Ya3I7f7pRXM6XUvrxISLN5aPA1biDmYUio=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libgnome-games-support/2.0.nix b/pkgs/development/libraries/libgnome-games-support/2.0.nix
index 03166a423c3a5..bc8da8045899a 100644
--- a/pkgs/development/libraries/libgnome-games-support/2.0.nix
+++ b/pkgs/development/libraries/libgnome-games-support/2.0.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Small library intended for internal use by GNOME Games, but it may be used by others";
-    homepage = "https://wiki.gnome.org/Apps/Games";
+    homepage = "https://gitlab.gnome.org/GNOME/libgnome-games-support";
     license = licenses.lgpl3Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/libgnome-games-support/default.nix b/pkgs/development/libraries/libgnome-games-support/default.nix
index e63d7f8fe656f..bdbdc10f514c8 100644
--- a/pkgs/development/libraries/libgnome-games-support/default.nix
+++ b/pkgs/development/libraries/libgnome-games-support/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Small library intended for internal use by GNOME Games, but it may be used by others";
-    homepage = "https://wiki.gnome.org/Apps/Games";
+    homepage = "https://gitlab.gnome.org/GNOME/libgnome-games-support";
     license = licenses.lgpl3;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/libgnomekbd/default.nix b/pkgs/development/libraries/libgnomekbd/default.nix
index fc9924b508342..a5c278956f2d7 100644
--- a/pkgs/development/libraries/libgnomekbd/default.nix
+++ b/pkgs/development/libraries/libgnomekbd/default.nix
@@ -8,7 +8,7 @@
 , glib
 , gtk3
 , libxklavier
-, wrapGAppsHook
+, wrapGAppsHook3
 , gnome
 }:
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     glib
     gobject-introspection
   ];
diff --git a/pkgs/development/libraries/libgweather/default.nix b/pkgs/development/libraries/libgweather/default.nix
index 58fb14167bd39..971b234364704 100644
--- a/pkgs/development/libraries/libgweather/default.nix
+++ b/pkgs/development/libraries/libgweather/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libgweather";
-  version = "4.4.0";
+  version = "4.4.2";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Nm6Gb/KnCLiUz+qUdbjo/1TLPitHfqcqit4Nq+5fSKQ=";
+    hash = "sha256-puQntHcK2kiUXzqpBq9xD8gzz/DULfkfGCgwJ0DXlOw=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libhandy/default.nix b/pkgs/development/libraries/libhandy/default.nix
index 19dcb4248f9b5..a43ee0986be81 100644
--- a/pkgs/development/libraries/libhandy/default.nix
+++ b/pkgs/development/libraries/libhandy/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-BbSXIpBz/1V/ELMm4HTFBm+HQ6MC1IIKuXvLXNLasIc=";
+    hash = "sha256-BbSXIpBz/1V/ELMm4HTFBm+HQ6MC1IIKuXvLXNLasIc=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 9cfe47fcb4d53..45ca2faf30b9f 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -81,6 +81,14 @@ stdenv.mkDerivation rec {
     ./respect-env-tzdir.patch
   ];
 
+  postPatch = ''
+    # Fix typo in test env setup
+    # https://github.com/libical/libical/commit/03c02ced21494413920744a400c638b0cb5d493f
+    substituteInPlace src/test/libical-glib/CMakeLists.txt \
+      --replace-fail "''${CMAKE_BINARY_DIR}/src/libical-glib;\$ENV{GI_TYPELIB_PATH}" "''${CMAKE_BINARY_DIR}/src/libical-glib:\$ENV{GI_TYPELIB_PATH}" \
+      --replace-fail "''${LIBRARY_OUTPUT_PATH};\$ENV{LD_LIBRARY_PATH}" "''${LIBRARY_OUTPUT_PATH}:\$ENV{LD_LIBRARY_PATH}"
+  '';
+
   # Using install check so we do not have to manually set
   # LD_LIBRARY_PATH and GI_TYPELIB_PATH variables
   # Musl does not support TZDIR.
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index c91ae27f68054..ab9ff488b3518 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -27,7 +27,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libjxl";
-  version = "0.9.1";
+  version = "0.10.2";
 
   outputs = [ "out" "dev" ];
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     owner = "libjxl";
     repo = "libjxl";
     rev = "v${version}";
-    hash = "sha256-n5KNbbw6NQRROEM7Cojla/igRCFNawUq7nfhzJlMlPI=";
+    hash = "sha256-Ip/5fbzt6OfIrHJajnxEe14ppvX1hJ1FSJUBEE/h5YQ=";
     # There are various submodules in `third_party/`.
     fetchSubmodules = true;
   };
diff --git a/pkgs/development/libraries/liblc3/default.nix b/pkgs/development/libraries/liblc3/default.nix
index bcefd8311fbf2..3e1be4ba272ec 100644
--- a/pkgs/development/libraries/liblc3/default.nix
+++ b/pkgs/development/libraries/liblc3/default.nix
@@ -7,7 +7,7 @@
 
 let
   name = "liblc3";
-  version = "1.1.0";
+  version = "1.1.1";
 in
 stdenv.mkDerivation {
   pname = name;
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     owner = "google";
     repo = "liblc3";
     rev = "v${version}";
-    sha256 = "sha256-pKd9wOrDjKhWX8vTsg6qkE71FQlsC7VM/uq0ss1vsAQ=";
+    sha256 = "sha256-h9qy04FqlHXp0bOUoP4+WqI0yrM78e56S+DEn3HztYo=";
   };
 
   outputs = [ "out" "dev" ];
@@ -27,11 +27,14 @@ stdenv.mkDerivation {
     ninja
   ];
 
+  # LTO does not work on Darwin: https://github.com/NixOS/nixpkgs/issues/19098
+  mesonFlags = lib.optionals stdenv.isDarwin [ "-Db_lto=false" ];
+
   meta = with lib; {
     description = "LC3 (Low Complexity Communication Codec) is an efficient low latency audio codec";
     homepage = "https://github.com/google/liblc3";
     license = licenses.asl20;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ jansol ];
   };
 }
diff --git a/pkgs/development/libraries/libmodulemd/default.nix b/pkgs/development/libraries/libmodulemd/default.nix
index ce16753cf5405..93e7eb9933fc8 100644
--- a/pkgs/development/libraries/libmodulemd/default.nix
+++ b/pkgs/development/libraries/libmodulemd/default.nix
@@ -1,6 +1,7 @@
-{ lib, stdenv
-, substituteAll
+{ stdenv
+, lib
 , fetchFromGitHub
+, fetchpatch2
 , pkg-config
 , meson
 , ninja
@@ -29,10 +30,15 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # Use proper glib devdoc path.
-    (substituteAll {
-      src = ./glib-devdoc.patch;
-      glib_devdoc = glib.devdoc;
+    # Adapt to GLib 2.79 documentation
+    # https://github.com/fedora-modularity/libmodulemd/pull/612
+    (fetchpatch2 {
+      url = "https://github.com/fedora-modularity/libmodulemd/commit/9d2809090cc0cccd7bab67453dc00cf43a289082.patch";
+      hash = "sha256-dMtc6GN6lIDjUReFUhEFJ/8wosASo3tLu4ve72BCXQ8=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/fedora-modularity/libmodulemd/commit/29c339a31b1c753dcdef041e5c2e0e600e48b59d.patch";
+      hash = "sha256-uniHrQdbcXlJk2hq106SgV/E330LfxDc07E4FbOMLr0=";
     })
   ];
 
@@ -57,6 +63,12 @@ stdenv.mkDerivation rec {
     "-Dgobject_overrides_dir_py3=${placeholder "py"}/${python3.sitePackages}/gi/overrides"
   ];
 
+  postPatch = ''
+    # Use proper glib devdoc path
+    substituteInPlace meson.build --replace-fail \
+      "glib_docpath = join_paths(glib_prefix," "glib_docpath = join_paths('${lib.getOutput "devdoc" glib}',"
+  '';
+
   postFixup = ''
     # Python overrides depend our own typelibs and other packages
     mkdir -p "$py/nix-support"
@@ -69,6 +81,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/fedora-modularity/libmodulemd";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
-    platforms = platforms.linux ++ platforms.darwin ;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/libraries/libmodulemd/glib-devdoc.patch b/pkgs/development/libraries/libmodulemd/glib-devdoc.patch
deleted file mode 100644
index cde42d8e0b2e8..0000000000000
--- a/pkgs/development/libraries/libmodulemd/glib-devdoc.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/meson.build b/meson.build
-index a8b02b4..dd31a76 100644
---- a/meson.build
-+++ b/meson.build
-@@ -67,7 +67,7 @@ test = find_program('test')
- with_docs = get_option('with_docs')
- if with_docs
-   gtkdoc = dependency('gtk-doc')
--  glib_docpath = join_paths(glib_prefix, 'share', 'gtk-doc', 'html')
-+  glib_docpath = join_paths('@glib_devdoc@', 'share', 'gtk-doc', 'html')
- 
-   ret = run_command ([test, '-e', join_paths(glib_docpath, 'glib/index.html')])
-   if ret.returncode() != 0
diff --git a/pkgs/development/libraries/libopus/default.nix b/pkgs/development/libraries/libopus/default.nix
index 3592c537ac441..d247b8b0efa6c 100644
--- a/pkgs/development/libraries/libopus/default.nix
+++ b/pkgs/development/libraries/libopus/default.nix
@@ -18,15 +18,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libopus";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchurl {
     url = "https://downloads.xiph.org/releases/opus/opus-${finalAttrs.version}.tar.gz";
-    hash = "sha256-uEYQlZuNQXthGqEqIlZeCjcyCXxjidGQmNhEVD40D4U=";
+    hash = "sha256-ZcHS94ufL7IAgsOMvkfJUa1YOTRYduRpQWEu6H+afOE=";
   };
 
   patches = [
-    ./fix-pkg-config-paths.patch
     # Some tests time out easily on slower machines
     ./test-timeout.patch
   ];
diff --git a/pkgs/development/libraries/libopus/fix-pkg-config-paths.patch b/pkgs/development/libraries/libopus/fix-pkg-config-paths.patch
deleted file mode 100644
index d54b7f5558c9f..0000000000000
--- a/pkgs/development/libraries/libopus/fix-pkg-config-paths.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- i/meson.build
-+++ w/meson.build
-@@ -591,8 +591,8 @@ pkgconf = configuration_data()
- 
- pkgconf.set('prefix', join_paths(get_option('prefix')))
- pkgconf.set('exec_prefix', '${prefix}')
--pkgconf.set('libdir', '${prefix}/@0@'.format(get_option('libdir')))
--pkgconf.set('includedir', '${prefix}/@0@'.format(get_option('includedir')))
-+pkgconf.set('libdir', '${prefix}' / get_option('libdir'))
-+pkgconf.set('includedir', '${prefix}' / get_option('includedir'))
- pkgconf.set('VERSION', opus_version)
- pkgconf.set('PC_BUILD', pc_build)
- pkgconf.set('LIBM', libm.found() ? '-lm' : '')
diff --git a/pkgs/development/libraries/libpanel/default.nix b/pkgs/development/libraries/libpanel/default.nix
index 05b863ad20114..55faa7e628603 100644
--- a/pkgs/development/libraries/libpanel/default.nix
+++ b/pkgs/development/libraries/libpanel/default.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libpanel";
-  version = "1.4.1";
+  version = "1.6.0";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
   src = fetchurl {
     url = "mirror://gnome/sources/libpanel/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "mEENAOc0hX7N8zuaIN17D7ONi20x1Dabr8HGc5Krud4=";
+    hash = "sha256-t3NJSjxpMANFzY4nAnRI0RiRgwJswTeAL4hkF8bqMLY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libpeas/2.x.nix b/pkgs/development/libraries/libpeas/2.x.nix
index 61fe424e2c224..141114f0f34ce 100644
--- a/pkgs/development/libraries/libpeas/2.x.nix
+++ b/pkgs/development/libraries/libpeas/2.x.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libpeas";
-  version = "2.0.1";
+  version = "2.0.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-ndwdUfOGY9pN9SFjBRt7LOo6JCz67p9afhQPB4TIqnc=";
+    hash = "sha256-8w3/7WPKL0BHe0DhccCjH4DZFCW6Hh5HMg7mQlSA7MM=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libpeas/default.nix b/pkgs/development/libraries/libpeas/default.nix
index 922bfba9ad232..9a94b2aa93263 100644
--- a/pkgs/development/libraries/libpeas/default.nix
+++ b/pkgs/development/libraries/libpeas/default.nix
@@ -13,7 +13,7 @@
 , gobject-introspection
 , python3
 , ncurses
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     gettext
     gi-docgen
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/librealsense/default.nix b/pkgs/development/libraries/librealsense/default.nix
index fe35759da63a9..cb69770f054a0 100644
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
   # ( https://github.com/IntelRealSense/meta-intel-realsense/issues/20 )
   postInstall = ''
     substituteInPlace $out/lib/cmake/realsense2/realsense2Targets.cmake \
-    --replace "\''${_IMPORT_PREFIX}/include" "$dev/include"
+    --replace-fail "\''${_IMPORT_PREFIX}/include" "$dev/include"
   '' + lib.optionalString enablePython  ''
     cp ../wrappers/python/pyrealsense2/__init__.py $out/${pythonPackages.python.sitePackages}/pyrealsense2
   '';
diff --git a/pkgs/development/libraries/libsecret/default.nix b/pkgs/development/libraries/libsecret/default.nix
index 040722ea406e8..10eee1a6bbb00 100644
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch2
 , glib
 , meson
 , ninja
@@ -33,6 +34,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-Fj0I14O+bUq5qXnOtaT+y8HZZg08NBaMWBMBzVORKyA=";
   };
 
+  patches = [
+    # https://gitlab.gnome.org/GNOME/libsecret/-/merge_requests/141
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/libsecret/-/commit/208989323211c756dff690115e5cbde5ef7491ce.patch";
+      hash = "sha256-DtRbqyyoMttEYf6B16m9O72Yjurv6rpbnqH7AlrAU4k=";
+    })
+  ];
+
   depsBuildBuild = [
     pkg-config
   ];
diff --git a/pkgs/development/libraries/libshumate/default.nix b/pkgs/development/libraries/libshumate/default.nix
index 6306fd2a55487..cc6723162a085 100644
--- a/pkgs/development/libraries/libshumate/default.nix
+++ b/pkgs/development/libraries/libshumate/default.nix
@@ -1,37 +1,46 @@
 { lib
 , stdenv
-, fetchFromGitLab
+, fetchurl
+, fetchpatch2
 , gi-docgen
 , meson
 , ninja
 , pkg-config
 , vala
 , gobject-introspection
+, gperf
 , glib
 , cairo
 , sqlite
 , libsoup_3
 , gtk4
 , libsysprof-capture
+, json-glib
+, protobufc
 , xvfb-run
 , gnome
 }:
 
 stdenv.mkDerivation rec {
   pname = "libshumate";
-  version = "1.1.3";
+  version = "1.2.1";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc"; # demo app
 
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "GNOME";
-    repo = "libshumate";
-    rev = version;
-    sha256 = "+h0dKLECtvfsxwD5aRTIgiNI9jG/tortUJYFiYMe60g=";
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    hash = "sha256-EQXuB34hR/KgOc3fphb6XLlDiIPdlAQn4RaZ3NZUnBE=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # Fix tests https://gitlab.gnome.org/GNOME/libshumate/-/merge_requests/236
+      url = "https://gitlab.gnome.org/GNOME/libshumate/-/commit/852615b0df2252ea67f4f82e9ace2fc2794467b3.patch";
+      hash = "sha256-Ksye3zNNYmzP4O+QFDVODXUkFJOLDVMEZNfGXwbxWhs=";
+    })
+  ];
+
   depsBuildBuild = [
     # required to find native gi-docgen when cross compiling
     pkg-config
@@ -44,6 +53,7 @@ stdenv.mkDerivation rec {
     pkg-config
     vala
     gobject-introspection
+    gperf
   ];
 
   buildInputs = [
@@ -53,6 +63,8 @@ stdenv.mkDerivation rec {
     libsoup_3
     gtk4
     libsysprof-capture
+    json-glib
+    protobufc
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/libraries/libunique/3.x.nix b/pkgs/development/libraries/libunique/3.x.nix
index 780ae7418dded..678f685d4882d 100644
--- a/pkgs/development/libraries/libunique/3.x.nix
+++ b/pkgs/development/libraries/libunique/3.x.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ dbus dbus-glib gtk3 gtk-doc docbook_xml_dtd_45 docbook_xsl libxslt libxml2 ];
 
   meta = {
-    homepage = "https://wiki.gnome.org/Attic/LibUnique";
+    homepage = "https://gitlab.gnome.org/Archive/unique";
     description = "A library for writing single instance applications";
     license = lib.licenses.lgpl21;
     maintainers = [ lib.maintainers.AndersonTorres ];
diff --git a/pkgs/development/libraries/libunique/default.nix b/pkgs/development/libraries/libunique/default.nix
index 13dc13e5e968e..f75aed442a852 100644
--- a/pkgs/development/libraries/libunique/default.nix
+++ b/pkgs/development/libraries/libunique/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = {
-    homepage = "https://wiki.gnome.org/Attic/LibUnique";
+    homepage = "https://gitlab.gnome.org/Archive/unique";
     description = "A library for writing single instance applications";
     license = lib.licenses.lgpl21;
     platforms = with lib.platforms; linux ++ darwin;
diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index 66f9f076dab49..5144abc6dc5b6 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     description = "A portable and efficient API to determine the call-chain of a program";
     maintainers = with maintainers; [ orivej ];
     # https://github.com/libunwind/libunwind#libunwind
-    platforms = [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-freebsd13" "i686-linux" "loongarch64-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv64-linux" "s390x-linux" "x86_64-freebsd13" "x86_64-linux" "x86_64-solaris" ];
+    platforms = [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-freebsd" "i686-linux" "loongarch64-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv64-linux" "s390x-linux" "x86_64-freebsd" "x86_64-linux" "x86_64-solaris" ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index 9103689546173..9114fe5ec47f5 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , fetchpatch
 , autoreconfHook
+, doxygen
 , pkg-config
 , enableUdev ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
 , udev
@@ -11,6 +12,7 @@
 , Security
 , withExamples ? false
 , withStatic ? false
+, withDocs ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
 }:
 
 stdenv.mkDerivation rec {
@@ -24,9 +26,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-OtzYxWwiba0jRK9X+4deWWDDTeZWlysEt0qMyGUarDo=";
   };
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" ] ++ lib.optionals withDocs [ "doc" ];
 
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+  ] ++ lib.optionals withDocs [ doxygen ];
   propagatedBuildInputs =
     lib.optional enableUdev udev ++
     lib.optionals stdenv.isDarwin [ libobjc IOKit Security ];
@@ -40,6 +45,12 @@ stdenv.mkDerivation rec {
     lib.optional (!enableUdev) "--disable-udev"
     ++ lib.optional (withExamples) "--enable-examples-build";
 
+  postBuild = lib.optionalString withDocs ''
+    make -C doc
+    mkdir -p "$doc/share/doc/libusb"
+    cp -r doc/api-1.0/* "$doc/share/doc/libusb/"
+  '';
+
   preFixup = lib.optionalString enableUdev ''
     sed 's,-ludev,-L${lib.getLib udev}/lib -ludev,' -i $out/lib/libusb-1.0.la
   '';
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 8e9840325bb96..58c9b7c7f6669 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "2.10.0";
+  version = "2.11.0";
 
   outputs = [ "out" "dev" ];
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    hash = "sha256-mH0aBDXeaz0tZLwNPSWUepHu52DnlvPyQFw3EByIwys=";
+    hash = "sha256-TQOe954Zos3VpAG5M/O5je9dr8d4gOXIwy4xl3o+e1g=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index 2605dabf125a0..2662d4e940081 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libwebp";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner  = "webmproject";
     repo   = pname;
     rev    = "v${version}";
-    hash   = "sha256-UYO2Fmm8nzQR8VBC26wEwWd3qZTD+6MHKcmKBoNcpEE=";
+    hash   = "sha256-OR/VzKNn3mnwjf+G+RkEGAaaKrhVlAu1e2oTRwdsPj8=";
   };
 
   configureFlags = [
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   passthru.tests = {
-    inherit freeimage gd graphicsmagick imagemagick imlib2 libjxl opencv vips;
+    inherit gd graphicsmagick imagemagick imlib2 libjxl opencv vips;
     inherit (python3.pkgs) pillow imread;
     haskell-webp = haskellPackages.webp;
   };
diff --git a/pkgs/development/libraries/llhttp/default.nix b/pkgs/development/libraries/llhttp/default.nix
index 8bd80151c0940..dfdd8200b5565 100644
--- a/pkgs/development/libraries/llhttp/default.nix
+++ b/pkgs/development/libraries/llhttp/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, cmake, testers }:
+{ lib, stdenv, fetchFromGitHub, cmake, testers, python3 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "llhttp";
-  version = "9.2.0";
+  version = "9.2.1";
 
   src = fetchFromGitHub {
     owner = "nodejs";
     repo = "llhttp";
     rev = "release/v${finalAttrs.version}";
-    hash = "sha256-DX/CuTyvc2OfAVWvlJr6wVHwSuqWmqQt34vM1FEazwE=";
+    hash = "sha256-cnEp7Ds32bqu3jeUU/rqJOr/VW3KNmJU4pmNNaTpXRs=";
   };
 
   outputs = [ "out" "dev" ];
@@ -21,8 +21,13 @@ stdenv.mkDerivation (finalAttrs: {
     "-DBUILD_STATIC_LIBS=ON"
   ];
 
-  passthru.tests.pkg-config = testers.hasPkgConfigModules {
-    package = finalAttrs.finalPackage;
+  passthru.tests = {
+    inherit (python3.pkgs) aiohttp;
+
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [ "libllhttp" ];
+    };
   };
 
   meta = with lib; {
@@ -30,7 +35,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://llhttp.org/";
     changelog = "https://github.com/nodejs/llhttp/releases/tag/release/v${finalAttrs.version}";
     license = licenses.mit;
-    pkgConfigModules = [ "libllhttp" ];
     maintainers = [ ];
     platforms = platforms.all;
   };
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index a544e1b25466e..7568ec0de1580 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,80 +1,110 @@
-{ stdenv, lib, fetchurl, fetchpatch, fetchCrate, buildPackages
-, meson, pkg-config, ninja
-, intltool, bison, flex, file, python3Packages, wayland-scanner
-, expat, libdrm, xorg, wayland, wayland-protocols, openssl
-, llvmPackages, libffi, libomxil-bellagio, libva-minimal
-, elfutils, libvdpau
-, libglvnd, libunwind, lm_sensors
-, vulkan-loader, glslang
-, galliumDrivers ?
-  if stdenv.isLinux then
-    [
-      "d3d12" # WSL emulated GPU (aka Dozen)
-      "kmsro" # special "render only" driver for GPUs without a display controller
-      "nouveau" # Nvidia
-      "radeonsi" # new AMD (GCN+)
-      "r300" # very old AMD
-      "r600" # less old AMD
-      "swrast" # software renderer (aka LLVMPipe)
-      "svga" # VMWare virtualized GPU
-      "virgl" # QEMU virtualized GPU (aka VirGL)
-      "zink" # generic OpenGL over Vulkan, experimental
-    ] ++ lib.optionals (stdenv.isAarch64 || stdenv.isAarch32) [
-      "etnaviv" # Vivante GPU designs (mostly NXP/Marvell SoCs)
-      "freedreno" # Qualcomm Adreno (all Qualcomm SoCs)
-      "lima" # ARM Mali 4xx
-      "panfrost" # ARM Mali Midgard and up (T/G series)
-      "vc4" # Broadcom VC4 (Raspberry Pi 0-3)
-    ] ++ lib.optionals stdenv.isAarch64 [
-      "tegra" # Nvidia Tegra SoCs
-      "v3d" # Broadcom VC5 (Raspberry Pi 4)
-    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
-      "iris" # new Intel, could work on non-x86 with PCIe cards, but doesn't build as of 22.3.4
-      "crocus" # Intel legacy, x86 only
-      "i915" # Intel extra legacy, x86 only
-    ]
-  else [ "auto" ]
-, vulkanDrivers ?
-  if stdenv.isLinux then
-    [
-      "amd" # AMD (aka RADV)
-      "microsoft-experimental" # WSL virtualized GPU (aka DZN/Dozen)
-      "nouveau-experimental" # Nouveau (aka NVK)
-      "swrast" # software renderer (aka Lavapipe)
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") [
-      # QEMU virtualized GPU (aka VirGL)
-      # Requires ATOMIC_INT_LOCK_FREE == 2.
-      "virtio"
-    ]
-    ++ lib.optionals stdenv.isAarch64 [
-      "broadcom" # Broadcom VC5 (Raspberry Pi 4, aka V3D)
-      "freedreno" # Qualcomm Adreno (all Qualcomm SoCs)
-      "imagination-experimental" # PowerVR Rogue (currently N/A)
-      "panfrost" # ARM Mali Midgard and up (T/G series)
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isx86 [
-      "intel" # Intel (aka ANV), could work on non-x86 with PCIe cards, but doesn't build
-      "intel_hasvk" # Intel Haswell/Broadwell, "legacy" Vulkan driver (https://www.phoronix.com/news/Intel-HasVK-Drop-Dead-Code)
-    ]
-  else [ "auto" ]
-, eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
-, vulkanLayers ? lib.optionals (!stdenv.isDarwin) [ "device-select" "overlay" "intel-nullhw" ] # No Vulkan support on Darwin
-, OpenGL, Xplugin
-, withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind-light && !valgrind-light.meta.broken, valgrind-light
-, withLibunwind ? lib.meta.availableOn stdenv.hostPlatform libunwind
-, enableGalliumNine ? stdenv.isLinux
-, enableOSMesa ? stdenv.isLinux
-, enableOpenCL ? stdenv.isLinux && stdenv.isx86_64
-, enablePatentEncumberedCodecs ? true
+{ lib
+, OpenGL
+, Xplugin
+, bison
+, buildPackages
+, directx-headers
+, elfutils
+, expat
+, fetchCrate
+, fetchpatch
+, fetchurl
+, file
+, flex
+, glslang
+, intltool
 , jdupes
-, rustPlatform
+, libdrm
+, libffi
+, libglvnd
+, libomxil-bellagio
+, libunwind
+, libva-minimal
+, libvdpau
+, llvmPackages
+, lm_sensors
+, meson
+, ninja
+, openssl
+, pkg-config
+, python3Packages
 , rust-bindgen
+, rustPlatform
 , rustc
 , spirv-llvm-translator
-, zstd
-, directx-headers
+, stdenv
 , udev
+, valgrind-light
+, vulkan-loader
+, wayland
+, wayland-protocols
+, wayland-scanner
+, xorg
+, zstd
+, withValgrind ?
+  lib.meta.availableOn stdenv.hostPlatform valgrind-light
+  && !valgrind-light.meta.broken
+, withLibunwind ? lib.meta.availableOn stdenv.hostPlatform libunwind
+, enableGalliumNine ? stdenv.isLinux
+, enableOSMesa ? stdenv.isLinux
+, enableOpenCL ? stdenv.isLinux && stdenv.isx86_64
+, enablePatentEncumberedCodecs ? true
+
+, galliumDrivers ?
+  if stdenv.isLinux
+  then [
+    "d3d12" # WSL emulated GPU (aka Dozen)
+    "kmsro" # special "render only" driver for GPUs without a display controller
+    "nouveau" # Nvidia
+    "radeonsi" # new AMD (GCN+)
+    "r300" # very old AMD
+    "r600" # less old AMD
+    "swrast" # software renderer (aka LLVMPipe)
+    "svga" # VMWare virtualized GPU
+    "virgl" # QEMU virtualized GPU (aka VirGL)
+    "zink" # generic OpenGL over Vulkan, experimental
+  ] ++ lib.optionals (stdenv.isAarch64 || stdenv.isAarch32) [
+    "etnaviv" # Vivante GPU designs (mostly NXP/Marvell SoCs)
+    "freedreno" # Qualcomm Adreno (all Qualcomm SoCs)
+    "lima" # ARM Mali 4xx
+    "panfrost" # ARM Mali Midgard and up (T/G series)
+    "vc4" # Broadcom VC4 (Raspberry Pi 0-3)
+  ] ++ lib.optionals stdenv.isAarch64 [
+    "tegra" # Nvidia Tegra SoCs
+    "v3d" # Broadcom VC5 (Raspberry Pi 4)
+  ] ++ lib.optionals stdenv.hostPlatform.isx86 [
+    "iris" # new Intel, could work on non-x86 with PCIe cards, but doesn't build as of 22.3.4
+    "crocus" # Intel legacy, x86 only
+    "i915" # Intel extra legacy, x86 only
+  ]
+  else [ "auto" ]
+, vulkanDrivers ?
+  if stdenv.isLinux
+  then [
+    "amd" # AMD (aka RADV)
+    "microsoft-experimental" # WSL virtualized GPU (aka DZN/Dozen)
+    "nouveau-experimental" # Nouveau (aka NVK)
+    "swrast" # software renderer (aka Lavapipe)
+  ] ++ lib.optionals (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") [
+    # QEMU virtualized GPU (aka VirGL)
+    # Requires ATOMIC_INT_LOCK_FREE == 2.
+    "virtio"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    "broadcom" # Broadcom VC5 (Raspberry Pi 4, aka V3D)
+    "freedreno" # Qualcomm Adreno (all Qualcomm SoCs)
+    "imagination-experimental" # PowerVR Rogue (currently N/A)
+    "panfrost" # ARM Mali Midgard and up (T/G series)
+  ] ++ lib.optionals stdenv.hostPlatform.isx86 [
+    "intel" # Intel (aka ANV), could work on non-x86 with PCIe cards, but doesn't build
+    "intel_hasvk" # Intel Haswell/Broadwell, "legacy" Vulkan driver (https://www.phoronix.com/news/Intel-HasVK-Drop-Dead-Code)
+  ]
+  else [ "auto" ]
+, eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
+, vulkanLayers ? lib.optionals (!stdenv.isDarwin) [ # No Vulkan support on Darwin
+  "device-select"
+  "overlay"
+  "intel-nullhw"
+]
 }:
 
 # When updating this package, please verify at least these build (assuming x86_64-linux):
@@ -106,7 +136,7 @@ let
       hash = "sha256-VWRCZJO0/DJbNu0/V9TLaqlwMot65YjInWT9VWg57DY=";
     }
     {
-    pname = "syn";
+      pname = "syn";
       version = "2.0.39";
       hash = "sha256-Mjen2L/omhVbhU/+Ao65mogs3BP3fY+Bodab3uU63EI=";
     }
@@ -157,14 +187,20 @@ self = stdenv.mkDerivation {
     ${copyRustDeps}
   '';
 
-  outputs = [ "out" "dev" "drivers" ]
-    ++ lib.optional enableOSMesa "osmesa"
-    ++ lib.optional stdenv.isLinux "driversdev"
-    ++ lib.optional enableOpenCL "opencl"
+  outputs = [
+    "out" "dev" "drivers"
+  ] ++ lib.optionals enableOSMesa [
+    "osmesa"
+  ] ++ lib.optionals stdenv.isLinux [
+    "driversdev"
+  ] ++ lib.optionals enableOpenCL [
+    "opencl"
+  ] ++ lib.optionals haveDozen [
     # the Dozen drivers depend on libspirv2dxil, but link it statically, and
-    # libspirv2dxil itself is pretty chonky, so relocate it to its own output
-    # in case anything wants to use it at some point
-    ++ lib.optional haveDozen "spirv2dxil";
+    # libspirv2dxil itself is pretty chonky, so relocate it to its own output in
+    # case anything wants to use it at some point
+    "spirv2dxil"
+  ];
 
   # Keep build-ids so drivers can use them for caching, etc.
   # Also some drivers segfault without this.
@@ -181,101 +217,152 @@ self = stdenv.mkDerivation {
 
     # Don't build in debug mode
     # https://gitlab.freedesktop.org/mesa/mesa/blob/master/docs/meson.html#L327
-    "-Db_ndebug=true"
+    (lib.mesonBool "b_ndebug" true)
 
-    "-Ddri-search-path=${libglvnd.driverLink}/lib/dri"
+    (lib.mesonOption "dri-search-path" "${libglvnd.driverLink}/lib/dri")
 
-    "-Dplatforms=${lib.concatStringsSep "," eglPlatforms}"
-    "-Dgallium-drivers=${lib.concatStringsSep "," galliumDrivers}"
-    "-Dvulkan-drivers=${lib.concatStringsSep "," vulkanDrivers}"
+    (lib.mesonOption "platforms" (lib.concatStringsSep "," eglPlatforms))
+    (lib.mesonOption "gallium-drivers" (lib.concatStringsSep "," galliumDrivers))
+    (lib.mesonOption "vulkan-drivers" (lib.concatStringsSep "," vulkanDrivers))
 
-    "-Ddri-drivers-path=${placeholder "drivers"}/lib/dri"
-    "-Dvdpau-libs-path=${placeholder "drivers"}/lib/vdpau"
-    "-Domx-libs-path=${placeholder "drivers"}/lib/bellagio"
-    "-Dva-libs-path=${placeholder "drivers"}/lib/dri"
-    "-Dd3d-drivers-path=${placeholder "drivers"}/lib/d3d"
+    (lib.mesonOption "dri-drivers-path" "${placeholder "drivers"}/lib/dri")
+    (lib.mesonOption "vdpau-libs-path" "${placeholder "drivers"}/lib/vdpau")
+    (lib.mesonOption "omx-libs-path" "${placeholder "drivers"}/lib/bellagio")
+    (lib.mesonOption "va-libs-path" "${placeholder "drivers"}/lib/dri")
+    (lib.mesonOption "d3d-drivers-path" "${placeholder "drivers"}/lib/d3d")
 
-    "-Dgallium-nine=${lib.boolToString enableGalliumNine}" # Direct3D in Wine
-    "-Dosmesa=${lib.boolToString enableOSMesa}" # used by wine
-    "-Dmicrosoft-clc=disabled" # Only relevant on Windows (OpenCL 1.2 API on top of D3D12)
+    (lib.mesonBool "gallium-nine" enableGalliumNine) # Direct3D in Wine
+    (lib.mesonBool "osmesa" enableOSMesa) # used by wine
+    (lib.mesonEnable "microsoft-clc" false) # Only relevant on Windows (OpenCL 1.2 API on top of D3D12)
 
     # To enable non-mesa gbm backends to be found (e.g. Nvidia)
-    "-Dgbm-backends-path=${libglvnd.driverLink}/lib/gbm:${placeholder "out"}/lib/gbm"
+    (lib.mesonOption "gbm-backends-path" "${libglvnd.driverLink}/lib/gbm:${placeholder "out"}/lib/gbm")
 
     # meson auto_features enables these features, but we do not want them
-    "-Dandroid-libbacktrace=disabled"
-
+    (lib.mesonEnable "android-libbacktrace" false)
   ] ++ lib.optionals stdenv.isLinux [
-    "-Dglvnd=true"
+    (lib.mesonBool "glvnd" true)
 
     # Enable RT for Intel hardware
     # https://gitlab.freedesktop.org/mesa/mesa/-/issues/9080
     (lib.mesonEnable "intel-clc" (stdenv.buildPlatform == stdenv.hostPlatform))
   ] ++ lib.optionals stdenv.isDarwin [
     # Disable features that are explicitly unsupported on the platform
-    "-Dgbm=disabled"
-    "-Dxlib-lease=disabled"
-    "-Degl=disabled"
-    "-Dgallium-vdpau=disabled"
-    "-Dgallium-va=disabled"
-    "-Dgallium-xa=disabled"
-    "-Dlmsensors=disabled"
+    (lib.mesonEnable "gbm" false)
+    (lib.mesonEnable "xlib-lease" false)
+    (lib.mesonEnable "egl" false)
+    (lib.mesonEnable "gallium-vdpau" false)
+    (lib.mesonEnable "gallium-va" false)
+    (lib.mesonEnable "gallium-xa" false)
+    (lib.mesonEnable "lmsensors" false)
   ] ++ lib.optionals enableOpenCL [
     # Clover, old OpenCL frontend
-    "-Dgallium-opencl=icd"
-    "-Dopencl-spirv=true"
+    (lib.mesonOption "gallium-opencl" "icd")
+    (lib.mesonBool "opencl-spirv" true)
 
     # Rusticl, new OpenCL frontend
-    "-Dgallium-rusticl=true"
-    "-Dclang-libdir=${llvmPackages.clang-unwrapped.lib}/lib"
-  ]  ++ lib.optionals (!withValgrind) [
-    "-Dvalgrind=disabled"
-  ]  ++ lib.optionals (!withLibunwind) [
-    "-Dlibunwind=disabled"
-  ] ++ lib.optional enablePatentEncumberedCodecs
-    "-Dvideo-codecs=all"
-  ++ lib.optional (vulkanLayers != []) "-D vulkan-layers=${builtins.concatStringsSep "," vulkanLayers}";
+    (lib.mesonBool "gallium-rusticl" true)
+    (lib.mesonOption "clang-libdir" "${llvmPackages.clang-unwrapped.lib}/lib")
+  ] ++ lib.optionals (!withValgrind) [
+    (lib.mesonEnable "valgrind" false)
+  ] ++ lib.optionals (!withLibunwind) [
+    (lib.mesonEnable "libunwind" false)
+  ]
+  ++ lib.optionals enablePatentEncumberedCodecs [
+    (lib.mesonOption "video-codecs" "all")
+  ] ++ lib.optionals (vulkanLayers != []) [
+    (lib.mesonOption "vulkan-layers" (builtins.concatStringsSep "," vulkanLayers))
+  ];
 
   strictDeps = true;
 
   buildInputs = with xorg; [
-    expat glslang llvmPackages.libllvm libglvnd xorgproto
-    libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
-    libffi libvdpau libXvMC
-    libpthreadstubs openssl
+    expat
+    glslang
+    libffi
+    libglvnd
+    libvdpau
+    llvmPackages.libllvm
+    openssl
     zstd
-  ] ++ lib.optionals withLibunwind [
+  ] ++ (with xorg; [
+    libX11
+    libXext
+    libXfixes
+    libXrandr
+    libXt
+    libXvMC
+    libpthreadstubs
+    libxcb
+    libxshmfence
+    xorgproto
+  ]) ++ lib.optionals withLibunwind [
     libunwind
   ] ++ [
     python3Packages.python # for shebang
-  ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
-    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [ elfutils ]
-    ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped spirv-llvm-translator ]
-    ++ lib.optional withValgrind valgrind-light
-    ++ lib.optional haveZink vulkan-loader
-    ++ lib.optional haveDozen directx-headers;
-
-  depsBuildBuild = [ pkg-config ]
-    # Adding this unconditionally makes x86_64-darwin pick up an older toolchain, as
-    # we explicitly call Mesa with 11.0 stdenv, but buildPackages is still 10.something,
-    # and Mesa can't build with that.
+  ] ++ lib.optionals haveWayland [
+    wayland
+    wayland-protocols
+  ] ++ lib.optionals stdenv.isLinux [
+    libomxil-bellagio
+    libva-minimal
+    lm_sensors
+    udev
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
+    elfutils
+  ] ++ lib.optionals enableOpenCL [
+    llvmPackages.libclc
+    llvmPackages.clang
+    llvmPackages.clang-unwrapped
+    spirv-llvm-translator
+  ] ++ lib.optionals withValgrind [
+    valgrind-light
+  ] ++ lib.optionals haveZink [
+    vulkan-loader
+  ] ++ lib.optionals haveDozen [
+    directx-headers
+  ];
+
+  depsBuildBuild = [
+    pkg-config
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    # Adding this unconditionally makes x86_64-darwin pick up an older
+    # toolchain, as we explicitly call Mesa with 11.0 stdenv, but buildPackages
+    # is still 10.something, and Mesa can't build with that.
     # FIXME: figure this out, or figure out how to get rid of Mesa on Darwin,
     # whichever is easier.
-    ++ lib.optional (!stdenv.isDarwin) buildPackages.stdenv.cc;
+    buildPackages.stdenv.cc
+  ];
 
   nativeBuildInputs = [
-    meson pkg-config ninja
-    intltool bison flex file
-    python3Packages.python python3Packages.mako python3Packages.ply
-    jdupes glslang
-    rustc rust-bindgen rustPlatform.bindgenHook
-  ] ++ lib.optional haveWayland wayland-scanner;
-
-  propagatedBuildInputs = with xorg; [
-    libXdamage libXxf86vm
-  ] ++ lib.optional withLibdrm libdrm
-    ++ lib.optionals stdenv.isDarwin [ OpenGL Xplugin ];
+    meson
+    pkg-config
+    ninja
+    intltool
+    bison
+    flex
+    file
+    python3Packages.python
+    python3Packages.mako
+    python3Packages.ply
+    jdupes
+    glslang
+    rustc
+    rust-bindgen
+    rustPlatform.bindgenHook
+  ] ++ lib.optionals haveWayland [
+    wayland-scanner
+  ];
+
+  propagatedBuildInputs = (with xorg; [
+    libXdamage
+    libXxf86vm
+  ]) ++ lib.optionals withLibdrm [
+    libdrm
+  ] ++ lib.optionals stdenv.isDarwin [
+    OpenGL
+    Xplugin
+  ];
 
   doCheck = false;
 
@@ -373,9 +460,12 @@ self = stdenv.mkDerivation {
     ''}
   '';
 
-  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [ "-fno-common" ] ++ lib.optionals enableOpenCL [
-    "-UPIPE_SEARCH_DIR"
-    "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.isDarwin [
+      "-fno-common"
+    ] ++ lib.optionals enableOpenCL [
+      "-UPIPE_SEARCH_DIR"
+      "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
   ]);
 
   passthru = {
@@ -395,7 +485,7 @@ self = stdenv.mkDerivation {
     };
   };
 
-  meta = with lib; {
+  meta = {
     description = "An open source 3D graphics library";
     longDescription = ''
       The Mesa project began as an open-source implementation of the OpenGL
@@ -408,9 +498,9 @@ self = stdenv.mkDerivation {
     '';
     homepage = "https://www.mesa3d.org/";
     changelog = "https://www.mesa3d.org/relnotes/${version}.html";
-    license = licenses.mit; # X11 variant, in most files
-    platforms = platforms.mesaPlatforms;
-    maintainers = with maintainers; [ primeos vcunat ]; # Help is welcome :)
+    license = with lib.licenses; [ mit ]; # X11 variant, in most files
+    platforms = lib.platforms.mesaPlatforms;
+    maintainers = with lib.maintainers; [ primeos vcunat ]; # Help is welcome :)
   };
 };
 
diff --git a/pkgs/development/libraries/mlt/default.nix b/pkgs/development/libraries/mlt/default.nix
index abe368f2ea62a..672bb36609ec5 100644
--- a/pkgs/development/libraries/mlt/default.nix
+++ b/pkgs/development/libraries/mlt/default.nix
@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlt";
-  version = "7.22.0";
+  version = "7.24.0";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "mlt";
     rev = "v${version}";
-    hash = "sha256-vJKpeEdQIWBQRRdDui5ibSZtD8qUlDZBD+UQE+0cQqk=";
+    hash = "sha256-nQ9uRip6i9+/MziU4gQq1ah712J6f94cFQWTDYRjzyE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/msgpack-c/default.nix b/pkgs/development/libraries/msgpack-c/default.nix
index 41d174bce7d9f..63a712b0881e3 100644
--- a/pkgs/development/libraries/msgpack-c/default.nix
+++ b/pkgs/development/libraries/msgpack-c/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "msgpack-c";
-  version = "6.0.0";
+  version = "6.0.1";
 
   src = fetchFromGitHub {
     owner = "msgpack";
     repo = "msgpack-c";
     rev = "refs/tags/c-${finalAttrs.version}";
-    hash = "sha256-TfC37QKwqvHxsLPgsEqJYkb7mpRQekbntbBPV4v4FO8=";
+    hash = "sha256-BXnK7xNRdZvbSz7tERf/PDJkmxbqAC6trH+h36O/v6k=";
   };
 
   strictDeps = true;
@@ -24,8 +24,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DMSGPACK_BUILD_EXAMPLES=OFF" # examples are not installed even if built
-  ] ++ lib.optional (!finalAttrs.finalPackage.doCheck) "-DMSGPACK_BUILD_TESTS=OFF";
+    (lib.cmakeBool "MSGPACK_BUILD_EXAMPLES" false) # examples are not installed even if built
+    (lib.cmakeBool "MSGPACK_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+  ];
 
   checkInputs = [
     gtest
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 359ed2832d24d..0e144726cf85f 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -237,6 +237,8 @@ let
 in {
   # intended version "policy":
   # - 1.1 as long as some package exists, which does not build without it
+  #   (tracking issue: https://github.com/NixOS/nixpkgs/issues/269713)
+  #   try to remove in 24.05 for the first time, if possible then
   # - latest 3.x LTS
   # - latest 3.x non-LTS as preview/for development
   #
@@ -245,7 +247,7 @@ in {
 
   # If you do upgrade here, please update in pkgs/top-level/release.nix
   # the permitted insecure version to ensure it gets cached for our users
-  # and backport this to stable release (23.05).
+  # and backport this to stable release (at time of writing this 23.11).
   openssl_1_1 = common {
     version = "1.1.1w";
     hash = "sha256-zzCYlQy02FOtlcCEHx+cbT3BAtzPys1SHZOSUgi3asg=";
@@ -259,7 +261,7 @@ in {
     withDocs = true;
     extraMeta = {
       knownVulnerabilities = [
-        "OpenSSL 1.1 is reaching its end of life on 2023/09/11 and cannot be supported through the NixOS 23.05 release cycle. https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/"
+        "OpenSSL 1.1 is reaching its end of life on 2023/09/11 and cannot be supported through the NixOS 23.11 release cycle. https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/"
       ];
     };
   };
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index 34288773705a6..70408877fe0e9 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pango";
-  version = "1.51.2";
+  version = "1.52.2";
 
   outputs = [ "bin" "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = with finalAttrs; "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-PbpAfytfwRfhkvMCXwocyO3B/ZuTSxxXiyuXNCE5QVo=";
+    hash = "sha256-0Adq/gEIKBS4U97smfk0ns5fLOg5CLjlj/c2tB94qWs=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/pangomm/2.48.nix b/pkgs/development/libraries/pangomm/2.48.nix
index 0e8bbe80dd843..fa4148e06aa02 100644
--- a/pkgs/development/libraries/pangomm/2.48.nix
+++ b/pkgs/development/libraries/pangomm/2.48.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pangomm";
-  version= "2.50.2";
+  version= "2.52.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-G8WrTqMoBEJYDWgxgibas2zu38Moj52DcRz3z6tQqfs=";
+    hash = "sha256-NKE0EmpkhP8S93Q1jDbsxE0OnfCU4bg3ltl3S7fSSUc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/python-qt/default.nix b/pkgs/development/libraries/python-qt/default.nix
index 16c2124cf0831..2b7ac684974e6 100644
--- a/pkgs/development/libraries/python-qt/default.nix
+++ b/pkgs/development/libraries/python-qt/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "python-qt";
-  version = "3.5.1";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "MeVisLab";
     repo = "pythonqt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-IED6UFk8UTle7g/yPC0nXOEgJwrs6sB/Dk3OTyVgHPo=";
+    hash = "sha256-Mpi1pAPS/UuzaBK7I1kI0HlS3dphcKiVXIPuJwdEDXM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/qtkeychain/default.nix b/pkgs/development/libraries/qtkeychain/default.nix
index 564eb31a71395..9d27d92c62f84 100644
--- a/pkgs/development/libraries/qtkeychain/default.nix
+++ b/pkgs/development/libraries/qtkeychain/default.nix
@@ -23,9 +23,6 @@ stdenv.mkDerivation rec {
 
   dontWrapQtApps = true;
 
-  # HACK `propagatedSandboxProfile` does not appear to actually propagate the sandbox profile from `qtbase`
-  sandboxProfile = toString qtbase.__propagatedSandboxProfile or null;
-
   cmakeFlags = [
     "-DBUILD_WITH_QT6=${if lib.versions.major qtbase.version == "6" then "ON" else "OFF"}"
     "-DQT_TRANSLATIONS_DIR=share/qt/translations"
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index d1223811c686c..0254a42416bae 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re2";
-  version = "2024-03-01";
+  version = "2024-04-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
     rev = version;
-    hash = "sha256-VuI9OsfGTdVywdyVfBrSzXSjbSfevne+YQ2oOz4R3DM=";
+    hash = "sha256-qRNV0O55L+r2rNSUJjU6nMqkPWXENZQvyr5riTU3e5o=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index 8ef3df4992618..36f11372775d7 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.4.9";
+  version = "1.4.12";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YH35+kCvPjeBYMMJi7YdAGk/ds3YPm5SSKpoWfbCI3M=";
+    hash = "sha256-gOCnRuJ1YM+SkrOJ/5TGANl442e7Umh3HK5DFNLJi/A=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 7ecd6a88d13c9..842bc3af9834a 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -142,7 +142,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.26";
+  version = "0.3.27";
 
   outputs = [ "out" "dev" ];
 
@@ -150,9 +150,17 @@ stdenv.mkDerivation rec {
     owner = "OpenMathLib";
     repo = "OpenBLAS";
     rev = "v${version}";
-    hash = "sha256-AA3+x3SXkcg3g7bROZYLpWAbxnRedmQBZPe+rBJKxJ8=";
+    hash = "sha256-VKDFSPwHGZMa2DoOXbSKNQRsl07LatMLK1lHVcEep8U=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "no-gemm3m-tests-static.patch";
+      url = "https://github.com/OpenMathLib/OpenBLAS/commit/48e017de095018c60d83355804a3075658b4970c.patch";
+      hash = "sha256-Wa6EE0M1H0efVn26pOKpi0dFGLuPuzmvAzpBLrAYe5k=";
+    })
+  ];
+
   postPatch = ''
     # cc1: error: invalid feature modifier 'sve2' in '-march=armv8.5-a+sve+sve2+bf16'
     substituteInPlace Makefile.arm64 --replace "+sve2+bf16" ""
@@ -255,7 +263,7 @@ EOF
   '';
 
   passthru.tests = {
-    inherit (python3.pkgs) numpy scipy;
+    inherit (python3.pkgs) numpy scipy scikit-learn;
     inherit ceres-solver giac octave opencv;
   };
 
diff --git a/pkgs/development/libraries/snappy/default.nix b/pkgs/development/libraries/snappy/default.nix
index 004dd388385fd..869c56ed73007 100644
--- a/pkgs/development/libraries/snappy/default.nix
+++ b/pkgs/development/libraries/snappy/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "snappy";
-  version = "1.1.10";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "snappy";
     rev = version;
-    hash = "sha256-wYZkKVDXKCugycx/ZYhjV0BjM/NrEM0R6A4WFhs/WPU=";
+    hash = "sha256-mpEeUoJs+lGlqh1m6Mmr8UnbtQDn/8kfkeQdFwo2rQ0=";
   };
 
   patches = [
@@ -23,11 +23,6 @@ stdenv.mkDerivation rec {
       url = "https://build.opensuse.org/public/source/openSUSE:Factory/snappy/reenable-rtti.patch?rev=a759aa6fba405cd40025e3f0ab89941d";
       sha256 = "sha256-RMuM5yd6zP1eekN/+vfS54EyY4cFbGDVor1E1vj3134=";
     })
-    # Fix -Wsign-compare warning on clang.
-    (fetchpatch {
-      url = "https://github.com/google/snappy/commit/27f34a580be4a3becf5f8c0cba13433f53c21337.patch";
-      sha256 = "sha256-eq6ueeMAkd2bYmPJcKAZZzd5QlXyeWOrsxFIwR8KOpQ=";
-    })
   ];
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/spice-gtk/default.nix b/pkgs/development/libraries/spice-gtk/default.nix
index d160a6a5f6dc6..fd7428213fc9c 100644
--- a/pkgs/development/libraries/spice-gtk/default.nix
+++ b/pkgs/development/libraries/spice-gtk/default.nix
@@ -36,7 +36,7 @@
 , wayland-protocols
 , wayland-scanner
 , zlib
-, wrapGAppsHook
+, wrapGAppsHook3
 , withPolkit ? stdenv.isLinux
 }:
 
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
     python3.pkgs.pyparsing
     python3.pkgs.six
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     mesonEmulatorHook
   ] ++ lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/libraries/template-glib/default.nix b/pkgs/development/libraries/template-glib/default.nix
index fae25d959d3d0..71960010d56da 100644
--- a/pkgs/development/libraries/template-glib/default.nix
+++ b/pkgs/development/libraries/template-glib/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "template-glib";
-  version = "3.36.1";
+  version = "3.36.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "OxZ6Fzha10WvviD634EGxm0wxb10bVqh2b236AP2pQM=";
+    hash = "sha256-ACDzpAGIjOdjs6F1CML1jpGXKkg6DFR6/bfMviVhmUg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/totem-pl-parser/default.nix b/pkgs/development/libraries/totem-pl-parser/default.nix
index 871b724029c80..6598da9a6f821 100644
--- a/pkgs/development/libraries/totem-pl-parser/default.nix
+++ b/pkgs/development/libraries/totem-pl-parser/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Videos";
+    homepage = "https://gitlab.gnome.org/GNOME/totem-pl-parser";
     description = "Simple GObject-based library to parse and save a host of playlist formats";
     maintainers = teams.gnome.members;
     license = licenses.lgpl2;
diff --git a/pkgs/development/libraries/tracker-miners/default.nix b/pkgs/development/libraries/tracker-miners/default.nix
index 6d9d1628e4e70..21cb3f97b3be8 100644
--- a/pkgs/development/libraries/tracker-miners/default.nix
+++ b/pkgs/development/libraries/tracker-miners/default.nix
@@ -47,11 +47,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker-miners";
-  version = "3.6.2";
+  version = "3.7.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Ctci89Uywh11fPSI+UKWBnnqj0V5Je+pdlbtTJ6bpP8=";
+    hash = "sha256-UKOr5Az7CzXO1D7HFtvxNomS5ETvegur8gLHrGqy9vQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index 48fc561ddd13b..5c1e088592e54 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -25,6 +25,7 @@
 , libsoup
 , libsoup_3
 , json-glib
+, avahi
 , systemd
 , dbus
 , writeText
@@ -33,13 +34,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tracker";
-  version = "3.6.0";
+  version = "3.7.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = with finalAttrs; "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Ulks/hm6/9FtvkdHW+fadQ29C2Mz/XrLYPqp2lvEDfI=";
+    hash = "sha256-zZG4he6YOc3lOH+OBe0kpxCNFidinLaxsqpRqWA+Ewo=";
   };
 
   strictDeps = true;
@@ -75,6 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
     libsoup_3
     libuuid
     json-glib
+    avahi
     libstemmer
     dbus
   ] ++ lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index be55952fe2e1a..3473b96f494c8 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -22,7 +22,7 @@
 , pcre2
 , cairo
 , fribidi
-, zlib
+, lz4
 , icu
 , systemd
 , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd
@@ -31,14 +31,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vte";
-  version = "0.74.2";
+  version = "0.76.0";
 
   outputs = [ "out" "dev" ]
     ++ lib.optional (gtkVersion != null) "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/vte/${lib.versions.majorMinor finalAttrs.version}/vte-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-pTX7Kpj+qKJEnNGgLMz1GQEx3d/1LnFa/azj/rU26uc=";
+    hash = "sha256-u84wuPUENwsS1kOcB6gpk+l9fpr+LdNngXzVj/Ap/9o=";
   };
 
   patches = [
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     (fetchpatch {
       name = "0001-Add-W_EXITCODE-macro-for-non-glibc-systems.patch";
       url = "https://git.alpinelinux.org/aports/plain/community/vte3/fix-W_EXITCODE.patch?id=4d35c076ce77bfac7655f60c4c3e4c86933ab7dd";
-      sha256 = "FkVyhsM0mRUzZmS2Gh172oqwcfXv6PyD6IEgjBhy2uU=";
+      hash = "sha256-FkVyhsM0mRUzZmS2Gh172oqwcfXv6PyD6IEgjBhy2uU=";
     })
   ];
 
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     gnutls
     pango # duplicated with propagatedBuildInputs to support gtkVersion == null
     pcre2
-    zlib
+    lz4
     icu
   ] ++ lib.optionals systemdSupport [
     systemd
diff --git a/pkgs/development/libraries/wildmidi/default.nix b/pkgs/development/libraries/wildmidi/default.nix
index c09ee248d2113..19a8ae3d3957e 100644
--- a/pkgs/development/libraries/wildmidi/default.nix
+++ b/pkgs/development/libraries/wildmidi/default.nix
@@ -1,17 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, writeTextFile, cmake, alsa-lib, OpenAL, freepats }:
+{ lib, stdenv, fetchFromGitHub, writeTextFile, cmake, alsa-lib, OpenAL, CoreAudioKit, freepats }:
 
 let
   defaultCfgPath = "${placeholder "out"}/etc/wildmidi/wildmidi.cfg";
 in
 stdenv.mkDerivation rec {
   pname = "wildmidi";
-  version = "0.4.5";
+  version = "0.4.6";
 
   src = fetchFromGitHub {
     owner = "Mindwerks";
     repo = "wildmidi";
     rev = "${pname}-${version}";
-    sha256 = "sha256-5El8aDpAgjrW0/4lphZEF+Hfv9Xr7J4DMk1b/Tb+0TU=";
+    sha256 = "sha256-syjs8y75M2ul7whiZxnWMSskRJd0ixFqnep7qsTbiDE=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   buildInputs = lib.optionals stdenv.buildPlatform.isLinux [
     alsa-lib stdenv.cc.libc/*couldn't find libm*/
   ] ++ lib.optionals stdenv.buildPlatform.isDarwin [
-    OpenAL
+    OpenAL CoreAudioKit
   ];
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK32.nix b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
index 5bba7315f5cc4..3094f253a01ab 100644
--- a/pkgs/development/libraries/wxwidgets/wxGTK32.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
@@ -109,6 +109,8 @@ stdenv.mkDerivation rec {
     "--disable-monolithic"
     "--enable-mediactrl"
     "--with-nanosvg"
+    "--disable-rpath"
+    "--enable-repro-build"
     (if compat28 then "--enable-compat28" else "--disable-compat28")
     (if compat30 then "--enable-compat30" else "--disable-compat30")
   ] ++ lib.optional unicode "--enable-unicode"
diff --git a/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix b/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix
index 966109fa00864..e28ea0da6b0a7 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-gnome/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-gnome";
-  version = "45.1";
+  version = "46.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "PpyoIQRABfs3vWjr5K0Zb8PQcoNVgUZ6IqSHnax7X90=";
+    hash = "sha256-fo2WI+nZaonAiXYWgnzUQdzygykn048TXHIlUrEXKqE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix b/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
index e44ffe1ec1d29..e1a51284927a3 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
@@ -9,7 +9,7 @@
 , gnome
 , gnome-desktop
 , glib
-, wrapGAppsHook
+, wrapGAppsHook3
 , gsettings-desktop-schemas
 , buildPortalsInGnome ? true
 }:
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/xdg-desktop-portal-xapp/default.nix b/pkgs/development/libraries/xdg-desktop-portal-xapp/default.nix
index e2d12c250171d..d614627a07493 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-xapp/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-xapp/default.nix
@@ -4,7 +4,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , cinnamon
 , glib
 , gsettings-desktop-schemas
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/xdg-desktop-portal/default.nix b/pkgs/development/libraries/xdg-desktop-portal/default.nix
index 626c40f3bb336..53a0d3b617e8f 100644
--- a/pkgs/development/libraries/xdg-desktop-portal/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal/default.nix
@@ -20,11 +20,12 @@
 , pipewire
 , gdk-pixbuf
 , librsvg
+, gobject-introspection
 , python3
 , pkg-config
 , stdenv
 , runCommand
-, wrapGAppsHook
+, wrapGAppsHook3
 , xmlto
 , enableGeoLocation ? true
 }:
@@ -69,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     xmlto
   ];
 
@@ -97,6 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeCheckInputs = [
+    gobject-introspection
     python3.pkgs.pytest
     python3.pkgs.python-dbusmock
     python3.pkgs.pygobject3
diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 3866cc7dd2c77..fbee5e84d00f4 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -514,7 +514,7 @@ let
       (asdf:operate :program-op :nyxt/gi-gtk-application)
     '';
 
-    # TODO(kasper): use wrapGAppsHook
+    # TODO(kasper): use wrapGAppsHook3
     installPhase = ''
       mkdir -pv $out
       cp -r * $out
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 2948a293645d6..8200381b5994c 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1,5 +1,5 @@
 /* pkgs/development/lua-modules/generated-packages.nix is an auto-generated file -- DO NOT EDIT!
-Regenerate it with: nix run nixpkgs#update-luarocks-packages
+Regenerate it with: nix run nixpkgs#luarocks-packages-updater
 You can customize the generated packages in pkgs/development/lua-modules/overrides.nix
 */
 
@@ -267,14 +267,14 @@ buildLuarocksPackage {
 compat53 = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "compat53";
-  version = "0.12-1";
+  version = "0.13-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/compat53-0.12-1.rockspec";
-    sha256 = "0ijp8ch3927rnj872l6cq79fd53dyfc2qg82y9b0g6kqs7cdl348";
+    url    = "mirror://luarocks/compat53-0.13-1.rockspec";
+    sha256 = "10gmhd526a5q0dl4dvjq7a5c7f3i7hcdla8hpygl79dhgbm649i3";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/lunarmodules/lua-compat-5.3/archive/v0.12.zip";
-    sha256 = "177zk7rww76wqxqsd2kxwfzb0nd7wfacm81vxwqsc84bfccsl3j4";
+    url    = "https://github.com/lunarmodules/lua-compat-5.3/archive/v0.13.zip";
+    sha256 = "06kpx5qyk1zki2r2g6z3alwhvmays50670z7mbl55h7s0kff2cpz";
   };
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
@@ -353,17 +353,17 @@ buildLuarocksPackage {
 cqueues = callPackage({ buildLuarocksPackage, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "cqueues";
-  version = "20200726.51-0";
+  version = "20200726.52-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/cqueues-20200726.51-0.rockspec";
-    sha256 = "1y7dqvw75cj9ifn7cyhd98znaga4lksnbddcqmh512crawlf5sxv";
+    url    = "mirror://luarocks/cqueues-20200726.52-0.rockspec";
+    sha256 = "0w2kq9w0wda56k02rjmvmzccz6bc3mn70s9v7npjadh85i5zlhhp";
   }).outPath;
   src = fetchurl {
     url    = "https://github.com/wahern/cqueues/archive/rel-20200726.tar.gz";
     sha256 = "0lhd02ag3r1sxr2hx847rdjkddm04l1vf5234v5cz9bd4kfjw4cy";
   };
 
-  disabled = (lua.luaversion != "5.1");
+  disabled = (lua.luaversion != "5.2");
   propagatedBuildInputs = [ lua ];
 
   meta = {
@@ -384,11 +384,11 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/teal-language/cyan",
-  "rev": "57650a3a0314a5e894c6ead30a5a52f7825f009c",
-  "date": "2023-12-07T02:47:54-06:00",
-  "path": "/nix/store/g3rqlf5cj06y2qqjlhkms51y4l142waf-cyan",
-  "sha256": "0xww1p3l0rbm7xiyax37524zybgmbrsjkpvgg327w8yndqysidfd",
-  "hash": "sha256-zbWoPW7WI37EeG/fKXVe9S3/iShndOVjP3VlQMcNnHc=",
+  "rev": "51649e4a814c05deaf5dde929ba82803f5170bbc",
+  "date": "2024-02-18T03:16:47-06:00",
+  "path": "/nix/store/dg57a34dhah1gvlvj9y2crmngb5rrg5c-cyan",
+  "sha256": "0kjvgm2hpgdk2bb4fn426v8yy13gycyzmd4kjwwbh70pa227cwgk",
+  "hash": "sha256-83F2hFAXHLg4l5O0+j3zbwTv0TaCWEfWErO9C0V9W04=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -460,14 +460,14 @@ buildLuarocksPackage {
 fennel = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "fennel";
-  version = "1.4.0-1";
+  version = "1.4.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/fennel-1.4.0-1.rockspec";
-    sha256 = "1ldbcrzap8ajgwmxf70g0nw7sjdpabba56y2lg3z4hpnxccpb80n";
+    url    = "mirror://luarocks/fennel-1.4.2-1.rockspec";
+    sha256 = "17ygacyqdvplyz3046ay3xr4z83sdjrxkcl21mklpxx29j8p0bv1";
   }).outPath;
   src = fetchurl {
-    url    = "https://fennel-lang.org/downloads/fennel-1.4.0.tar.gz";
-    sha256 = "0g1lzkpmzhvhkc08kmn48k3m02pkcwgslz29fb23apbhydkavlx2";
+    url    = "https://fennel-lang.org/downloads/fennel-1.4.2.tar.gz";
+    sha256 = "1inhy8rrywx8svdzhy1yaaa0cfyrmi21ckj7h8xmd7yqaw66ma86";
   };
 
   disabled = (luaOlder "5.1");
@@ -587,14 +587,14 @@ buildLuarocksPackage {
 fzf-lua = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "fzf-lua";
-  version = "0.0.1195-1";
+  version = "0.0.1220-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/fzf-lua-0.0.1195-1.rockspec";
-    sha256 = "1bcjis9mkbzq7178fkpqkafs6656bhvq1wh13vm1r3khbvi0jkp1";
+    url    = "mirror://luarocks/fzf-lua-0.0.1220-1.rockspec";
+    sha256 = "1l9fhd3akahf6v1x7i9zn6z5gflkh7c3d79m23ijqs4m70kpbik0";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/ibhagwan/fzf-lua/archive/0c884bb24ab0fef204f315f34e711b13ece0ea9f.zip";
-    sha256 = "04gif5hyb6qzh649xzcwzx81rlrk2glking05q8wxp2cpa3nifpw";
+    url    = "https://github.com/ibhagwan/fzf-lua/archive/36df11e3bbb6453014ff4736f6805b5a91dda56d.zip";
+    sha256 = "1nw3j1g3kqn36lqdslgb7nxcmm5knhwvfadip46milq0qc73yx1p";
   };
 
   disabled = (luaOlder "5.1");
@@ -608,34 +608,25 @@ buildLuarocksPackage {
   };
 }) {};
 
-fzy = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
+fzy = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "fzy";
-  version = "1.0-1";
+  version = "1.0.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/fzy-1.0-1.rockspec";
-    sha256 = "1v050lm3rn1k5wwi2nimlbp1b7j6b8vkwvhc1npyqzj8jv7w9w9n";
+    url    = "mirror://luarocks/fzy-1.0.3-1.rockspec";
+    sha256 = "07d07afjs73bl5krfbaqx4pw2wpfrkyw2iksamkfa8dlqn9ajn1a";
   }).outPath;
-  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-  "url": "https://github.com/swarn/fzy-lua",
-  "rev": "2d018a56e3a240bca4b3142a723b2f56392f3e4a",
-  "date": "2023-01-29T07:05:02-06:00",
-  "path": "/nix/store/nz19glmy52jbz46wl7xf0jd8m441klf0-fzy-lua",
-  "sha256": "0xknm5513a6nlariwxgqndf3wj8xals26swjsv06hx133ihna01x",
-  "hash": "sha256-PQBlYRwjdGjA1pJrIzRVHUk+XLP4dR6zotaoEUqpdnY=",
-  "fetchLFS": false,
-  "fetchSubmodules": true,
-  "deepClone": false,
-  "leaveDotGit": false
-}
- '') ["date" "path" "sha256"]) ;
+  src = fetchzip {
+    url    = "https://github.com/swarn/fzy-lua/archive/v1.0.3.zip";
+    sha256 = "0w3alddhn0jd19vmminbi1b79mzlagyl1lygmfpxhzzccdv4vapm";
+  };
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
     homepage = "https://github.com/swarn/fzy-lua";
-    description = "A fuzzy string-matching algorithm";
+    description = "A lua implementation of the fzy fuzzy matching algorithm";
     maintainers = with lib.maintainers; [ mrcjkb ];
     license.fullName = "MIT";
   };
@@ -648,11 +639,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lewis6991/gitsigns.nvim",
-  "rev": "6ef8c54fb526bf3a0bc4efb0b2fe8e6d9a7daed2",
-  "date": "2023-11-29T12:07:41+00:00",
-  "path": "/nix/store/2ihnjknz2xdwsijjimqk8i3pi9cbpvhf-gitsigns.nvim",
-  "sha256": "086jmhzgpavwjvp7ssd8ga0wxgnz480zzjiv84h4ivva2nv3lnvi",
-  "hash": "sha256-cVs6thVq70ggQTvK/wEi377OgXqoaX3ulnyr+z6s0iA=",
+  "rev": "d96ef3bbff0bdbc3916a220f5c74a04c4db033f2",
+  "date": "2024-04-12T16:53:20+01:00",
+  "path": "/nix/store/q2wga9cw7f4sgklgjygk6gkfd1zqnp5m-gitsigns.nvim",
+  "sha256": "1lngbagsnk8zmq034j6jq3nl25crvdjvb73y7da7m282cbm3547j",
+  "hash": "sha256-8pAy6mICiXpUO36ctWXbmRVB7cDSSDIArh9Nq59az9I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -673,14 +664,14 @@ buildLuarocksPackage {
 haskell-tools-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "haskell-tools.nvim";
-  version = "3.0.2-1";
+  version = "3.1.8-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/haskell-tools.nvim-3.0.2-1.rockspec";
-    sha256 = "1gls4dc4b8p0827jsvzf1n3gxfmqn1r7n8hi1rnfxwcragjxxn8x";
+    url    = "mirror://luarocks/haskell-tools.nvim-3.1.8-1.rockspec";
+    sha256 = "1jhms5gpah8lk0mn1gx127afmihyaq1fj8qrd6a8yh3wy12k1qxc";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/3.0.2.zip";
-    sha256 = "1rv1r0laizq866lj06akhy97zr9wdfczp1caql36k2xk4d8sbzx7";
+    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/3.1.8.zip";
+    sha256 = "14nk6jyq2y4q93ij56bdjy17h3jlmjwsspw3l6ahvjsl6yg1lv75";
   };
 
   disabled = (luaOlder "5.1");
@@ -717,8 +708,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-image-nvim = callPackage(
-{ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, magick }:
+image-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, magick }:
 buildLuarocksPackage {
   pname = "image.nvim";
   version = "1.2.0-1";
@@ -737,6 +727,7 @@ buildLuarocksPackage {
   meta = {
     homepage = "https://github.com/3rd/image.nvim";
     description = "🖼️ Bringing images to Neovim.";
+    maintainers = with lib.maintainers; [ teto ];
     license.fullName = "MIT";
   };
 }) {};
@@ -767,18 +758,18 @@ buildLuarocksPackage {
 jsregexp = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "jsregexp";
-  version = "0.0.6-1";
+  version = "0.0.7-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/jsregexp-0.0.6-1.rockspec";
-    sha256 = "1m3vqv1p44akk020c3l3n8pdxs30rl5509gbs3rr13hmqlvil4cs";
+    url    = "mirror://luarocks/jsregexp-0.0.7-1.rockspec";
+    sha256 = "1yx0340h51xk23n0g8irj5c9bs35zy6p1zl5kp7vy2cwxazbipbl";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/kmarius/jsregexp.git",
-  "rev": "b5a81e21d0875667ba2458ac8ae903afd5568698",
-  "date": "2023-02-12T14:19:03+01:00",
-  "path": "/nix/store/aj42wy1yp53w406id33dyxpv1ws23g4b-jsregexp",
-  "sha256": "0l7hn5f2jl4n2bpikb72szfzgc192jy3ig5pxx9061j44amyq89m",
-  "hash": "sha256-NSHsqyJEBgNS77e8OLwUKbD33dfirBnvEpZQKVyx8FA=",
+  "rev": "d76a7d656a122de38789f4b4a345de6290ed83cc",
+  "date": "2024-01-11T15:13:03+01:00",
+  "path": "/nix/store/zxx7v0r88k4wz438509sbsw6h1hymqba-jsregexp",
+  "sha256": "1m0ndsivx98znbc7gh4kcg9c4q8lbflc108xjl53ivmhisd4cx39",
+  "hash": "sha256-aXRGmo6w7jgKlR2BwKhbFGHC0mOTwHfYsh+lvqNuFtQ=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1380,18 +1371,18 @@ buildLuarocksPackage {
 lua-protobuf = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-protobuf";
-  version = "0.5.0-1";
+  version = "0.5.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-protobuf-0.5.0-1.rockspec";
-    sha256 = "08z73rsqi7ysdyjcwfqyr8z6i5r43kx5fd8l32wlzv6cx6yvlqc9";
+    url    = "mirror://luarocks/lua-protobuf-0.5.1-1.rockspec";
+    sha256 = "1ljn0xwrhcr49k4fzrh0g1q13j16sa6h3wd5q62995q4jlrmnhja";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/starwing/lua-protobuf.git",
-  "rev": "a256c34e12cad643d6ad189bddcbc314da9b0658",
-  "date": "2023-04-30T02:11:27+08:00",
-  "path": "/nix/store/n7ihjh36kp2f80016f9y8xydia2pclzq-lua-protobuf",
-  "sha256": "1kbanbgvmzcfnxq30f8hmirgc1d768lacpjihis9961pc7w96l9n",
-  "hash": "sha256-NlGT+GE3mJR0hFFepigypwX2cqwQOTBwt479ut+yas0=",
+  "rev": "5e998726522725138fb4066f03a5cc478c7f7b2c",
+  "date": "2024-04-01T17:44:38+08:00",
+  "path": "/nix/store/rdayi9dlv3r62pb1lrl7xg6s1wib3n4v-lua-protobuf",
+  "sha256": "0vzm2x7vlfby8xqiqa68bqjki3h5775jhfhkvg4mfk152rm1ybhf",
+  "hash": "sha256-Di4fahYlTFfJ2xM6KMs5BY44JV7IKBxxR345uk8X9W8=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1413,18 +1404,18 @@ buildLuarocksPackage {
 lua-resty-http = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-resty-http";
-  version = "0.17.1-0";
+  version = "0.17.2-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-resty-http-0.17.1-0.rockspec";
-    sha256 = "05gid7c5i459clw707z1jic42s52ap4z66dbr9ims5znaq5s3wdk";
+    url    = "mirror://luarocks/lua-resty-http-0.17.2-0.rockspec";
+    sha256 = "10swbq779d1q794d17269v0ln26hblsk7kvxj9s60rx71skzql6s";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/ledgetech/lua-resty-http",
-  "rev": "4ab4269cf442ba52507aa2c718f606054452fcad",
-  "date": "2023-03-22T09:48:56+00:00",
-  "path": "/nix/store/ykd1d5fa56i1c286k58jm233lqvdv2mi-lua-resty-http",
-  "sha256": "0xdhygjqjpfkq1bq8b09fichww57q1z694lz16i3hcc3g4sr4hxg",
-  "hash": "sha256-r0OSNXmDMTiiCZ+SZH7Ap3AOWXQJLIRXwNNdieXzsHU=",
+  "rev": "183310324026120ab7eaf5dd82b9be90ae63aadf",
+  "date": "2024-02-29T19:43:47+00:00",
+  "path": "/nix/store/wv99dz7m98dps8qbg5bgvddbgwyw7v84-lua-resty-http",
+  "sha256": "0xllxaph4r5sk2xc6cpji9i537vr2cgc7n7q7qpq6a8q6jkwy79y",
+  "hash": "sha256-Ph3PpzQYKYMvPvjYwx4TeZ9RYoryMsO6mLpkAq/qlHY=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1509,18 +1500,18 @@ buildLuarocksPackage {
 lua-resty-openssl = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "lua-resty-openssl";
-  version = "1.0.2-1";
+  version = "1.2.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-resty-openssl-1.0.2-1.rockspec";
-    sha256 = "000ak4rfm56z7g2b7jr7k2m4hp6kcx970cnv29acjazrz6kr60r2";
+    url    = "mirror://luarocks/lua-resty-openssl-1.2.1-1.rockspec";
+    sha256 = "1xd3z9kgns4p7v725kb781kg6v5fq8yibvarlqvz368l24js63ak";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/fffonion/lua-resty-openssl.git",
-  "rev": "5aba923e78ae0f213f3b4719effa879e3971821f",
-  "date": "2023-11-22T15:44:01+08:00",
-  "path": "/nix/store/fww02frnja73z8bhxqz5nyji5nam77ab-lua-resty-openssl",
-  "sha256": "10fxfjafl9wyv2jz7j25xkklx1c2ykvi0yqskyij45d0rzimil5z",
-  "hash": "sha256-v9BY48+gFSKjnxp7EPf0goVO5+xFyPOl2J4n6pR03YE=",
+  "rev": "58c6ce6885556ed7cb85dde83d673fad05ba73aa",
+  "date": "2024-02-28T12:55:27+08:00",
+  "path": "/nix/store/5827180ly4rwyb07d6gb6f5g713j3w2b-lua-resty-openssl",
+  "sha256": "1m7bvxplg47c5dy9faahjy620bc179kld77v4mysw489kqd7zkc0",
+  "hash": "sha256-gM1/Gp4JEa59JfucRmc6gS0gjJdQKZd8K+yQR2/f69Q=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1631,14 +1622,14 @@ buildLuarocksPackage {
 lua-term = callPackage({ buildLuarocksPackage, fetchurl }:
 buildLuarocksPackage {
   pname = "lua-term";
-  version = "0.7-1";
+  version = "0.8-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-term-0.7-1.rockspec";
-    sha256 = "0r9g5jw7pqr1dyj6w58dqlr7y7l0jp077n8nnji4phf10biyrvg2";
+    url    = "mirror://luarocks/lua-term-0.8-1.rockspec";
+    sha256 = "1728lj3x8shc5m1yczrl75szq15rnfpzk36n0m49181ly9wxn7s0";
   }).outPath;
   src = fetchurl {
-    url    = "https://github.com/hoelzro/lua-term/archive/0.07.tar.gz";
-    sha256 = "0c3zc0cl3a5pbdn056vnlan16g0wimv0p9bq52h7w507f72x18f1";
+    url    = "https://github.com/hoelzro/lua-term/archive/0.08.tar.gz";
+    sha256 = "1vfdg5dzqdi3gn6wpc9a3djhsl6fn2ikqdwr8rrqrnd91qwlzycg";
   };
 
 
@@ -1681,6 +1672,30 @@ buildLuarocksPackage {
   };
 }) {};
 
+lua-utils-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
+buildLuarocksPackage {
+  pname = "lua-utils.nvim";
+  version = "1.0.2-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/lua-utils.nvim-1.0.2-1.rockspec";
+    sha256 = "0s11j4vd26haz72rb0c5m5h953292rh8r62mvlxbss6i69v2dkr9";
+  }).outPath;
+  src = fetchzip {
+    url    = "https://github.com/nvim-neorg/lua-utils.nvim/archive/v1.0.2.zip";
+    sha256 = "0bnl2kvxs55l8cjhfpa834bm010n8r4gmsmivjcp548c076msagn";
+  };
+
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github.com/nvim-neorg/lua-utils.nvim";
+    description = "A set of utility functions for Neovim plugins.";
+    maintainers = with lib.maintainers; [ mrcjkb ];
+    license.fullName = "MIT";
+  };
+}) {};
+
 lua-yajl = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-yajl";
@@ -1747,26 +1762,35 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua_cliargs = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
+lua_cliargs = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua_cliargs";
-  version = "3.0-2";
+  version = "3.0.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua_cliargs-3.0-2.rockspec";
-    sha256 = "0vlmwrldwlxdfkak9kapydfs4ny4pwg3qpkv5agn6lw6gq0aq5za";
+    url    = "mirror://luarocks/lua_cliargs-3.0.2-1.rockspec";
+    sha256 = "1gp3n9ipaqdk59ilqx1ci5faxmx4dh9sgg3279jb8yfa7wg5b8pf";
   }).outPath;
-  src = fetchurl {
-    url    = "https://github.com/amireh/lua_cliargs/archive/v3.0-2.tar.gz";
-    sha256 = "0vhpgmy9a8wlxp8a15pnfqfk0aj7pyyb5m41nnfxynx580a6y7cp";
-  };
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "https://github.com/lunarmodules/lua_cliargs.git",
+  "rev": "5e77d9e2295abd3a67af509090ac7b430f4ad266",
+  "date": "2023-12-18T14:11:33+03:00",
+  "path": "/nix/store/0lzpybn6s27nhia20kcsa6n1bsm32ki4-lua_cliargs",
+  "sha256": "0a4920kyqf4qc12srg8yvwfwh33n6pm6k2md1jy7mfqb1w2ymgf0",
+  "hash": "sha256-wL3qBQ8Lu3q8DK2Kaeo1dgzIHd8evaxFYJg47CcQiSg=",
+  "fetchLFS": false,
+  "fetchSubmodules": true,
+  "deepClone": false,
+  "leaveDotGit": false
+}
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "https://github.com/amireh/lua_cliargs";
-    description = "A command-line argument parser.";
-    license.fullName = "MIT <http://opensource.org/licenses/MIT>";
+    homepage = "https://github.com/lunarmodules/lua_cliargs.git";
+    description = "A command-line argument parsing module for Lua";
+    license.fullName = "MIT";
   };
 }) {};
 
@@ -1802,18 +1826,18 @@ buildLuarocksPackage {
 luacheck = callPackage({ argparse, buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "luacheck";
-  version = "1.1.1-1";
+  version = "1.1.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luacheck-1.1.1-1.rockspec";
-    sha256 = "11nrryqff2yis5s7jscbyv221p21i9sh924x7g9l3d6ijns8zmba";
+    url    = "mirror://luarocks/luacheck-1.1.2-1.rockspec";
+    sha256 = "11p7kf7v1b5rhi3m57g2zqwzmnnp79v76gh13b0fg2c78ljkq1k9";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/luacheck.git",
-  "rev": "ababb6d403d634eb74d2c541035e9ede966e710d",
-  "date": "2023-06-10T11:27:25+03:00",
-  "path": "/nix/store/wkrhda7nww45g1waxdv9ghm35mwbvlfq-luacheck",
-  "sha256": "0abd5rfxv667n8d8v3g9cnkyghiwzhj3yk498gr2agd3mfcni7d7",
-  "hash": "sha256-p51omaujPSXyQ4lMPyT8PMLnp2XpjY0asseY3V0ubSk=",
+  "rev": "418f48976c73be697fe64b0eba9ea9821ac9bca8",
+  "date": "2023-12-08T15:44:11+03:00",
+  "path": "/nix/store/yf6mjkl5vw6fx57p0f0b046q0yfsn0h0-luacheck",
+  "sha256": "12jlp2a9l3x9a52b6za6h3jfx31kwg3cv4b10nqpp5jxx530fh81",
+  "hash": "sha256-AUEHRuldlnuxBWGRzcbjM4zu5IBGfbNEUakPmpS4VIo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1866,18 +1890,18 @@ buildLuarocksPackage {
 luadbi = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luadbi";
-  version = "0.7.2-1";
+  version = "0.7.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luadbi-0.7.2-1.rockspec";
-    sha256 = "0lj1qki20w6bl76cvlcazlmwh170b9wkv5nwlxbrr3cn6w7h370b";
+    url    = "mirror://luarocks/luadbi-0.7.3-1.rockspec";
+    sha256 = "0lyiwyg6qnnj7d5rxim6b9p68nbszmwhg57xjlvalbcgwgipk1ns";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/mwild1/luadbi",
-  "rev": "73a234c4689e4f87b7520276b6159cc7f6cfd6e0",
-  "date": "2019-01-14T09:39:17+00:00",
-  "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
-  "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
-  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
+  "rev": "eee6ef21c75cfb25c5166fd94c0c5a2ed2bf0f85",
+  "date": "2024-03-04T17:01:25-05:00",
+  "path": "/nix/store/ryvf83j6b2j4c40jlam6ccf75fn6rrfh-luadbi",
+  "sha256": "1wivk3z1vab4izfn3jnqj7rcw3797x0sby5131hz9g07irxvys1g",
+  "hash": "sha256-L2i/e44HvPRhGKH4pUE/6QzO8pHYymHdj2SpHf6YO/I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1885,7 +1909,7 @@ buildLuarocksPackage {
 }
  '') ["date" "path" "sha256"]) ;
 
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
 
   meta = {
@@ -1898,18 +1922,18 @@ buildLuarocksPackage {
 luadbi-mysql = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder, luadbi }:
 buildLuarocksPackage {
   pname = "luadbi-mysql";
-  version = "0.7.2-1";
+  version = "0.7.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luadbi-mysql-0.7.2-1.rockspec";
-    sha256 = "0gnyqnvcfif06rzzrdw6w6hchp4jrjiwm0rmfx2r8ljchj2bvml5";
+    url    = "mirror://luarocks/luadbi-mysql-0.7.3-1.rockspec";
+    sha256 = "1x0pl6qpdi4vmhxs2076kkxmikbv0asndh8lp34r47lym37hcrr3";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/mwild1/luadbi",
-  "rev": "73a234c4689e4f87b7520276b6159cc7f6cfd6e0",
-  "date": "2019-01-14T09:39:17+00:00",
-  "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
-  "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
-  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
+  "rev": "eee6ef21c75cfb25c5166fd94c0c5a2ed2bf0f85",
+  "date": "2024-03-04T17:01:25-05:00",
+  "path": "/nix/store/ryvf83j6b2j4c40jlam6ccf75fn6rrfh-luadbi",
+  "sha256": "1wivk3z1vab4izfn3jnqj7rcw3797x0sby5131hz9g07irxvys1g",
+  "hash": "sha256-L2i/e44HvPRhGKH4pUE/6QzO8pHYymHdj2SpHf6YO/I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1917,7 +1941,7 @@ buildLuarocksPackage {
 }
  '') ["date" "path" "sha256"]) ;
 
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua luadbi ];
 
   meta = {
@@ -1930,18 +1954,18 @@ buildLuarocksPackage {
 luadbi-postgresql = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder, luadbi }:
 buildLuarocksPackage {
   pname = "luadbi-postgresql";
-  version = "0.7.2-1";
+  version = "0.7.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luadbi-postgresql-0.7.2-1.rockspec";
-    sha256 = "07rx4agw4hjyzf8157apdwfqh9s26nqndmkr3wm7v09ygjvdjiix";
+    url    = "mirror://luarocks/luadbi-postgresql-0.7.3-1.rockspec";
+    sha256 = "1bnjsgk7cl6wmfhmn8b0av49yabf8flhdi1jhczksvvpf32p77bw";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/mwild1/luadbi",
-  "rev": "73a234c4689e4f87b7520276b6159cc7f6cfd6e0",
-  "date": "2019-01-14T09:39:17+00:00",
-  "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
-  "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
-  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
+  "rev": "eee6ef21c75cfb25c5166fd94c0c5a2ed2bf0f85",
+  "date": "2024-03-04T17:01:25-05:00",
+  "path": "/nix/store/ryvf83j6b2j4c40jlam6ccf75fn6rrfh-luadbi",
+  "sha256": "1wivk3z1vab4izfn3jnqj7rcw3797x0sby5131hz9g07irxvys1g",
+  "hash": "sha256-L2i/e44HvPRhGKH4pUE/6QzO8pHYymHdj2SpHf6YO/I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1949,7 +1973,7 @@ buildLuarocksPackage {
 }
  '') ["date" "path" "sha256"]) ;
 
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua luadbi ];
 
   meta = {
@@ -1962,18 +1986,18 @@ buildLuarocksPackage {
 luadbi-sqlite3 = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder, luadbi }:
 buildLuarocksPackage {
   pname = "luadbi-sqlite3";
-  version = "0.7.2-1";
+  version = "0.7.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luadbi-sqlite3-0.7.2-1.rockspec";
-    sha256 = "022iba0jbiafz8iv1h0iv95rhcivbfq5yg341nxk3dm87yf220vh";
+    url    = "mirror://luarocks/luadbi-sqlite3-0.7.3-1.rockspec";
+    sha256 = "0ppkk1jkxw2fhc4x26h7h2bks51shl3am552phn7all5h3k7h3by";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/mwild1/luadbi",
-  "rev": "73a234c4689e4f87b7520276b6159cc7f6cfd6e0",
-  "date": "2019-01-14T09:39:17+00:00",
-  "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
-  "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
-  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
+  "rev": "eee6ef21c75cfb25c5166fd94c0c5a2ed2bf0f85",
+  "date": "2024-03-04T17:01:25-05:00",
+  "path": "/nix/store/ryvf83j6b2j4c40jlam6ccf75fn6rrfh-luadbi",
+  "sha256": "1wivk3z1vab4izfn3jnqj7rcw3797x0sby5131hz9g07irxvys1g",
+  "hash": "sha256-L2i/e44HvPRhGKH4pUE/6QzO8pHYymHdj2SpHf6YO/I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1981,7 +2005,7 @@ buildLuarocksPackage {
 }
  '') ["date" "path" "sha256"]) ;
 
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua luadbi ];
 
   meta = {
@@ -2056,11 +2080,11 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/luaexpat.git",
-  "rev": "57f8966088abf8a00f8ab0bf88e1b6deea89c0bb",
-  "date": "2022-10-04T16:36:23+02:00",
-  "path": "/nix/store/dgrdkalikpqdap642qhppha1ajdnsvx0-luaexpat",
-  "sha256": "1b4ck23p01ks3hgayan9n33f2kb6jvv63v4ww2mqczc09rqi0q46",
-  "hash": "sha256-hmAQcU6AfYar4JzsYfaWZk3hxrDJKq8eHHoGcIeYjKw=",
+  "rev": "e0dd18e946f079a1308497cfde1f6ad482858e15",
+  "date": "2024-04-09T09:50:02+02:00",
+  "path": "/nix/store/3n2hssn7d5wzvi127hy0am64yv0i2q9a-luaexpat",
+  "sha256": "14x4wqjcjd6v6zirpkkm7d9vbv4y897v598jbwrql4w0hw7z5xqj",
+  "hash": "sha256-EvfyD4eAE4ozXxKlsk9Cnuy1Uzt1zpvjN9s0ySTmpJM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2280,18 +2304,18 @@ buildLuarocksPackage {
 luarocks-build-rust-mlua = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "luarocks-build-rust-mlua";
-  version = "0.1.2-1";
+  version = "0.2.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luarocks-build-rust-mlua-0.1.2-1.rockspec";
-    sha256 = "1sx908fm2ihpxz2mm54xzkfmdzlqdvrqjkh1zz7rcjgmqba4mh1j";
+    url    = "mirror://luarocks/luarocks-build-rust-mlua-0.2.0-1.rockspec";
+    sha256 = "0mpxj2wpzgqffic1j6agisaawbfhh16gis29x6y60kyjq446mv0z";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/khvzak/luarocks-build-rust-mlua",
-  "rev": "c8080aa0832563b7f8b2cb85a195c1598ce312e0",
-  "date": "2023-06-29T16:47:41+01:00",
-  "path": "/nix/store/n7id28r1m11xd550hayv99xhz96vpdjq-luarocks-build-rust-mlua",
-  "sha256": "1zh1p5k7xpczi5db3k0fw0ljw9w0xxk1qjjcfg5rcznqjf48i3x7",
-  "hash": "sha256-p4+IiJPYfpbLc0xKHGbvgCcuKeAOzLFaiZ/dfma5Af4=",
+  "rev": "461a9a3b717d4a34d29b6a324046ff8773ebe943",
+  "date": "2023-08-29T00:54:12+01:00",
+  "path": "/nix/store/qcls9aqaahfpykfphrnivg2wh7jdpcfv-luarocks-build-rust-mlua",
+  "sha256": "071lpnzn49fn8gvkcqkryl1h934yv5x1rw5mnki3d0xzzmg6pavz",
+  "hash": "sha256-f6trXv2/gzbitLXwHHrZnowEA/V5Yjb3Q9YlYr+9NBw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2344,14 +2368,14 @@ buildLuarocksPackage {
 luasnip = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, jsregexp, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luasnip";
-  version = "2.1.1-1";
+  version = "2.2.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luasnip-2.1.1-1.rockspec";
-    sha256 = "1jrdai8qsanr6x2vqp70hipsxrxh0abvwr2xwh9p4wr29k4wyycb";
+    url    = "mirror://luarocks/luasnip-2.2.0-1.rockspec";
+    sha256 = "08q98dficqzrq0jd8iqbpij9ywv2q4bm2k8l3s3spfvwqhm93zrp";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/L3MON4D3/LuaSnip/archive/v2.1.1.zip";
-    sha256 = "0mbpwf3sxfrmrza13d9w0hlcmzlrj551g332syp1qhs94abfnnrd";
+    url    = "https://github.com/L3MON4D3/LuaSnip/archive/v2.2.0.zip";
+    sha256 = "05d5ks3g6a9dl3bmap8m60hnx3hc4acvcp2jzkw85r4anaawl45b";
   };
 
   disabled = (luaOlder "5.1");
@@ -2399,18 +2423,18 @@ buildLuarocksPackage {
 luasql-sqlite3 = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luasql-sqlite3";
-  version = "2.6.0-2";
+  version = "2.6.1-3";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luasql-sqlite3-2.6.0-2.rockspec";
-    sha256 = "1xpbcpl4qhnzpyyszhdsrxhx2qc1dmndh926lv91xwphw7inwdwg";
+    url    = "mirror://luarocks/luasql-sqlite3-2.6.1-3.rockspec";
+    sha256 = "1qf8cx4cmsngwp65ksdsf5dsv6yhb4qwdrd2lkpyqaq6p55jfkyb";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-  "url": "https://github.com/keplerproject/luasql.git",
-  "rev": "25bf4ffce9323d28cb6f382f7ec9e8951e3084f9",
-  "date": "2023-07-19T14:20:27-03:00",
-  "path": "/nix/store/949886jxp7sx3yx910lc6d1yf3ym9mx5-luasql",
-  "sha256": "00q73j2nzqsm0vmxjkv83qh1dncmr5dgmkrkyxnb5ggygvcbh7w5",
-  "hash": "sha256-hR+42H7+vbJs9zPP+lrJldkWIB5oT9nrBlXjb4UcBwM=",
+  "url": "https://github.com/lunarmodules/luasql.git",
+  "rev": "930aeb330781b9d77daff9d87ba31314939ebc23",
+  "date": "2024-02-07T15:31:36-03:00",
+  "path": "/nix/store/6sljqfgnipf4l8czzgry0y408y5818f4-luasql",
+  "sha256": "1f911s111h613b8psmqwknmm13z644rfdl4n6crs3n1v63n4dsmc",
+  "hash": "sha256-rOpG7DA72KEzM5bQ5jIh5o9Qq50cV33RGsHAEIIOIbk=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2422,7 +2446,7 @@ buildLuarocksPackage {
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "http://www.keplerproject.org/luasql/";
+    homepage = "https://lunarmodules.github.io/luasql/";
     description = "Database connectivity for Lua (SQLite3 driver)";
     maintainers = with lib.maintainers; [ vyp ];
     license.fullName = "MIT/X11";
@@ -2461,24 +2485,33 @@ buildLuarocksPackage {
   };
 }) {};
 
-luasystem = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
+luasystem = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luasystem";
-  version = "0.2.1-0";
+  version = "0.3.0-2";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luasystem-0.2.1-0.rockspec";
-    sha256 = "0xj5q7lzsbmlw5d3zbjqf3jpj78wcn348h2jcxn5ph4n4hx73z3n";
+    url    = "mirror://luarocks/luasystem-0.3.0-2.rockspec";
+    sha256 = "02kwkcwf81v6ncxl1ng2pxlhalz78q2476snh5xxv3wnwqwbp10a";
   }).outPath;
-  src = fetchurl {
-    url    = "https://github.com/o-lim/luasystem/archive/v0.2.1.tar.gz";
-    sha256 = "150bbklchh02gsvpngv56xrrlxxvwpqwrh0yy6z95fnvks7gd0qb";
-  };
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "https://github.com/lunarmodules/luasystem.git",
+  "rev": "c06963917ccc951a1058d7b7f412c52d3c4f443a",
+  "date": "2023-12-16T00:18:54+01:00",
+  "path": "/nix/store/kbal1mi8j60d3nm2mf7kdhz55dv23qk6-luasystem",
+  "sha256": "11d65rnf8y2jnr5nc5gij666p1bsw701ldd9n8sjm0bq3z9lfcd1",
+  "hash": "sha256-oTFH0x94gSo1sqk1GsDheoVrjJHxFWZLtlJ45GwupoU=",
+  "fetchLFS": false,
+  "fetchSubmodules": true,
+  "deepClone": false,
+  "leaveDotGit": false
+}
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "http://olivinelabs.com/luasystem/";
+    homepage = "https://github.com/lunarmodules/luasystem";
     description = "Platform independent system calls for Lua.";
     license.fullName = "MIT <http://opensource.org/licenses/MIT>";
   };
@@ -2555,30 +2588,6 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-utils-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
-buildLuarocksPackage {
-  pname = "lua-utils.nvim";
-  version = "1.0.2-1";
-  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-utils.nvim-1.0.2-1.rockspec";
-    sha256 = "0s11j4vd26haz72rb0c5m5h953292rh8r62mvlxbss6i69v2dkr9";
-  }).outPath;
-  src = fetchzip {
-    url    = "https://github.com/nvim-neorg/lua-utils.nvim/archive/v1.0.2.zip";
-    sha256 = "0bnl2kvxs55l8cjhfpa834bm010n8r4gmsmivjcp548c076msagn";
-  };
-
-  disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ lua ];
-
-  meta = {
-    homepage = "https://github.com/nvim-neorg/lua-utils.nvim";
-    description = "A set of utility functions for Neovim plugins.";
-    maintainers = with lib.maintainers; [ mrcjkb ];
-    license.fullName = "MIT";
-  };
-}) {};
-
 luazip = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luazip";
@@ -2618,11 +2627,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rktjmp/lush.nvim",
-  "rev": "f76741886b356586f9dfe8e312fbd1ab0fd1084f",
-  "date": "2023-12-06T09:56:43+11:00",
-  "path": "/nix/store/m0zsbahbzqxfzvbgw93qw78g7r4fjhdb-lush.nvim",
-  "sha256": "1jvfycqg5s72gmib8038kzyy8fyanl06mkz74rjy878zv8r6nf59",
-  "hash": "sha256-qThrMtofHeRlJufPagC1yjvk/Z9oALRifeLo8jDzbss=",
+  "rev": "bc12f010b34cfeefac35720656eb777753b165d9",
+  "date": "2024-03-17T14:18:46+11:00",
+  "path": "/nix/store/9i1sasxxkjc8gbmnhlm0hq5x19hpcyzx-lush.nvim",
+  "sha256": "06am05fcipfxz8nfr6yg8yhkcdir53asl9h3k40hl0sscx4a03s9",
+  "hash": "sha256-SQ+gSGdaAwoBmQMmqtUoOTY2oUfPm+ws+t3dyFwBVRk=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2641,7 +2650,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luuid = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder}:
+luuid = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luuid";
   version = "20120509-2";
@@ -2845,7 +2854,6 @@ buildLuarocksPackage {
   };
 }) {};
 
-
 moonscript = callPackage({ argparse, buildLuarocksPackage, fetchgit, lpeg, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "moonscript";
@@ -2879,14 +2887,14 @@ buildLuarocksPackage {
 mpack = callPackage({ buildLuarocksPackage, fetchurl }:
 buildLuarocksPackage {
   pname = "mpack";
-  version = "1.0.11-0";
+  version = "1.0.12-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/mpack-1.0.11-0.rockspec";
-    sha256 = "0alydkccamxldij7ki42imd37630d9qnqg22pndcgkawfclfqzqa";
+    url    = "mirror://luarocks/mpack-1.0.12-0.rockspec";
+    sha256 = "01jr8vvkqdvadr5kpgsd17gjyz729hbd609qsm682ylggabgqsyy";
   }).outPath;
   src = fetchurl {
-    url    = "https://github.com/libmpack/libmpack-lua/releases/download/1.0.11/libmpack-lua-1.0.11.tar.gz";
-    sha256 = "15np7603rijavycvrjgjp12y64zs36390lg2hsnr5av790cfrnd2";
+    url    = "https://github.com/libmpack/libmpack-lua/releases/download/1.0.12/libmpack-lua-1.0.12.tar.gz";
+    sha256 = "1gzqks9cq3krd9rs3dq9jm1m23pjpqjv9ymkxj9gbyjcy6qn5dh6";
   };
 
 
@@ -2940,6 +2948,7 @@ buildLuarocksPackage {
   meta = {
     homepage = "https://github.com/mfussenegger/nlua";
     description = "Neovim as Lua interpreter";
+    maintainers = with lib.maintainers; [ teto ];
     license.fullName = "GPL-3.0";
   };
 }) {};
@@ -2947,18 +2956,18 @@ buildLuarocksPackage {
 nui-nvim = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "nui.nvim";
-  version = "0.2.0-1";
+  version = "0.3.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/nui.nvim-0.2.0-1.rockspec";
-    sha256 = "0v2z6lgl6hrzcjlzhis8nrkdkh9kvx8zg3q5svi5gyklg7vmcbc2";
+    url    = "mirror://luarocks/nui.nvim-0.3.0-1.rockspec";
+    sha256 = "0ng75wzbc0bn4zgwqk7dx5hazybfqxpjfzp7k2syh7kajmsy8z8b";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/MunifTanjim/nui.nvim.git",
-  "rev": "9e3916e784660f55f47daa6f26053ad044db5d6a",
-  "date": "2023-07-20T10:45:09+06:00",
-  "path": "/nix/store/8zdhjgipjjhi9b1y40r2yk5np4lp39as-nui.nvim",
-  "sha256": "14a73dwl56kah9h36b40ir6iylvfs261ysz17qvi9vhp63vjq9cx",
-  "hash": "sha256-nSUs9zAX7hQ3PuFrH4zQblMfTY6ALDNggmqaQnkbR5E=",
+  "rev": "a0fd35fcbb4cb479366f1dc5f20145fd718a3733",
+  "date": "2024-02-17T02:19:19+06:00",
+  "path": "/nix/store/llww4x7kg89998avrv3h15zhsajsr37h-nui.nvim",
+  "sha256": "0fjrnhfhq7sn3am7283adar0jlf6gcyq303kxkwqvxzvvdg9nirg",
+  "hash": "sha256-L0ebXtv794357HOAgT17xlEJsmpqIHGqGlYfDB20WTo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2982,11 +2991,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/hrsh7th/nvim-cmp",
-  "rev": "0b751f6beef40fd47375eaf53d3057e0bfa317e4",
-  "date": "2023-11-06T17:58:22+09:00",
-  "path": "/nix/store/4z8lkalcj6sk2s5aw2xcalimh3rcgixj-nvim-cmp",
-  "sha256": "1qp7s2iam9zzdlw5sgkk6c623z7vjgga0rcg63ja0f836l90grba",
-  "hash": "sha256-auUHEjUDOaDkMI9loN6T+/whDDNzPl04bf+nqqLQ5+I=",
+  "rev": "ce16de5665c766f39c271705b17fff06f7bcb84f",
+  "date": "2024-04-02T16:05:54+09:00",
+  "path": "/nix/store/f9ax2s683i9q6gr4mwh85fil8lqz00ax-nvim-cmp",
+  "sha256": "10i720fidv41421as9i2xp4d4kr69zfyvkxjhgv6h41fdi75070c",
+  "hash": "sha256-DBxQTmwuEGj2g7LP7d1PJk/SyO0iJq2CIIHsFh0QJ4I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3007,14 +3016,14 @@ buildLuarocksPackage {
 nvim-nio = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "nvim-nio";
-  version = "1.8.1-1";
+  version = "1.9.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/nvim-nio-1.8.1-1.rockspec";
-    sha256 = "0f9ccrli5jcvcyawkjd99nm6himnnnd6z54938rd0wjp21d8s4s9";
+    url    = "mirror://luarocks/nvim-nio-1.9.0-1.rockspec";
+    sha256 = "0hwjkz0pjd8dfc4l7wk04ddm8qzrv5m15gskhz9gllb4frnk6hik";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neotest/nvim-nio/archive/v1.8.1.zip";
-    sha256 = "0zax50chrh7qrgh56avd5ny0lb3i0y906wk13mhbkp9i5d9anw1h";
+    url    = "https://github.com/nvim-neotest/nvim-nio/archive/v1.9.0.zip";
+    sha256 = "0y3afl42z41ymksk29al5knasmm9wmqzby860x8zj0i0mfb1q5k5";
   };
 
   disabled = (luaOlder "5.1");
@@ -3058,11 +3067,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/penlight.git",
-  "rev": "dc6d19c5c1e1b4ac55b14df17b7645af6b410140",
-  "date": "2023-09-21T10:51:09+02:00",
-  "path": "/nix/store/vbi0d32mbaqcra3jligv8ajq17m1wxa4-penlight",
-  "sha256": "12ppgby8ldh4zxwcr7cknacbdvk30fi92sgyzh1zbgvym4l44g0c",
-  "hash": "sha256-DDxCKKl+v/UD/P5pkaIDY+62mLKTncx4/wQ2ivx694o=",
+  "rev": "ba1c8e51e047e9f33fa45c6a5f3b93fe4a35727b",
+  "date": "2024-04-02T13:58:00+02:00",
+  "path": "/nix/store/ypgbcsi4n5pvjlzgq64qv0xvs7s01c4a-penlight",
+  "sha256": "0dw7ggnzwxaax1hvw6h4lb9ff0ap2wnaf3ma0fv1jqwaaav1gfd2",
+  "hash": "sha256-orkXtlKKYxm2A6oOpywXVwHn0qIEGr5h6Ep1/u17hzc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3088,11 +3097,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-lua/plenary.nvim",
-  "rev": "55d9fe89e33efd26f532ef20223e5f9430c8b0c0",
-  "date": "2023-11-30T12:17:20+01:00",
-  "path": "/nix/store/wf35h8i4s3fdskvcy376vvzp5gi6s6mx-plenary.nvim",
-  "sha256": "1f6vqqafk78njpl47xgsf8p199mmvw4h4b9axab9rl86fdlibikz",
-  "hash": "sha256-f8YVaXMG0ZyW6iotAgnftaYULnL69UPolRad6RTG27g=",
+  "rev": "8aad4396840be7fc42896e3011751b7609ca4119",
+  "date": "2024-03-25T13:22:05+01:00",
+  "path": "/nix/store/jni4wdb67id5s257ps8ld4is7m3cpqxr-plenary.nvim",
+  "sha256": "06ahw1mxjp5g1kbsdza29hyawr4blqzw3vb9d4rg2d5qmnwcbky0",
+  "hash": "sha256-wM/FuK24NPEyaWntwT+mi2SuPExC/abXDK9c2WvgUBk=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3139,41 +3148,41 @@ buildLuarocksPackage {
   };
 }) {};
 
-rest-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
+rest-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, lua-curl, luaOlder, mimetypes, nvim-nio, xml2lua }:
 buildLuarocksPackage {
   pname = "rest.nvim";
-  version = "0.2-1";
+  version = "2.0.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rest.nvim-0.2-1.rockspec";
-    sha256 = "1yq8gx585c10j8kybp20swyv9q0i3lm5k0rrv4bgsbwz3ychn0k1";
+    url    = "mirror://luarocks/rest.nvim-2.0.1-1.rockspec";
+    sha256 = "1ra76wnhi4nh56amyd8zqmg0mpsnhp3m41m3iyiq4hp1fah6nbqb";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/rest-nvim/rest.nvim/archive/0.2.zip";
-    sha256 = "0ycjrrl37z465p71bdkas3q2ky1jmgr2cjnirnskdc6wz14wl09g";
+    url    = "https://github.com/rest-nvim/rest.nvim/archive/v2.0.1.zip";
+    sha256 = "09rs04d5h061zns1kdfycryx4ll8ix15q3ybpmqsdyp2gn8l77df";
   };
 
   disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ lua ];
+  propagatedBuildInputs = [ lua lua-curl mimetypes nvim-nio xml2lua ];
 
   meta = {
     homepage = "https://github.com/rest-nvim/rest.nvim";
     description = "A fast Neovim http client written in Lua";
     maintainers = with lib.maintainers; [ teto ];
-    license.fullName = "MIT";
+    license.fullName = "GPL-3.0";
   };
 }) {};
 
 rocks-config-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, rocks-nvim }:
 buildLuarocksPackage {
   pname = "rocks-config.nvim";
-  version = "1.2.3-1";
+  version = "1.4.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rocks-config.nvim-1.2.3-1.rockspec";
-    sha256 = "0lwy0fkmrxbnj46jh35i9l1hmfa88a879spmasmh7kw4vpd1bbpr";
+    url    = "mirror://luarocks/rocks-config.nvim-1.4.0-1.rockspec";
+    sha256 = "0q630hxcxx05v6agddm4f9hhp433hipsyhqy0m7y8fcgxkh6qxiz";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/rocks-config.nvim/archive/v1.2.3.zip";
-    sha256 = "0byf1q18ykgs3hsz8wyjimkcnq0pl26ikxjlv0ly0acxrg9x9kcp";
+    url    = "https://github.com/nvim-neorocks/rocks-config.nvim/archive/v1.4.0.zip";
+    sha256 = "0yw7am97q3ybifqfnzy8b505cp8hwzlnycqvsjdwr16dl2ihn6v7";
   };
 
   disabled = (luaOlder "5.1");
@@ -3214,14 +3223,14 @@ buildLuarocksPackage {
 rocks-git-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, nvim-nio, rocks-nvim }:
 buildLuarocksPackage {
   pname = "rocks-git.nvim";
-  version = "1.3.0-1";
+  version = "1.4.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rocks-git.nvim-1.3.0-1.rockspec";
-    sha256 = "196wjjdkjgqdx1lj8cxcn1xh6dysn0a0w544yc62vg6h227c6igi";
+    url    = "mirror://luarocks/rocks-git.nvim-1.4.0-1.rockspec";
+    sha256 = "04zx6yvp5pg306wqaw6fymqci5qnzpzg27xjrycflcyxxq4xmnmg";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/rocks-git.nvim/archive/v1.3.0.zip";
-    sha256 = "024zvl91ixb25rkpikwcxb73qfd6wsc2a5qwkwfy6sibkff7jgaq";
+    url    = "https://github.com/nvim-neorocks/rocks-git.nvim/archive/v1.4.0.zip";
+    sha256 = "0yjigf9pzy53yylznnnb68dwmylx9a3qv84kdc2whsf4cj23m2nj";
   };
 
   disabled = (luaOlder "5.1");
@@ -3235,26 +3244,26 @@ buildLuarocksPackage {
   };
 }) {};
 
-rocks-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, fidget-nvim, fzy, lua, luaOlder, nvim-nio, toml, toml-edit }:
+rocks-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, fidget-nvim, fzy, lua, luaOlder, nvim-nio, toml-edit }:
 buildLuarocksPackage {
   pname = "rocks.nvim";
-  version = "2.19.1-1";
+  version = "2.21.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rocks.nvim-2.19.1-1.rockspec";
-    sha256 = "1n712a8wqhli2hbq8s6isa9jaxxvqy20737njakqdkakqp2xsdbs";
+    url    = "mirror://luarocks/rocks.nvim-2.21.1-1.rockspec";
+    sha256 = "0qf0hbknn87y6fp49r9810fbnwprv6rmwdqj96c8iibxg7qzda23";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/rocks.nvim/archive/v2.19.1.zip";
-    sha256 = "1n3za055vdi6v1hx72sdrh9dpgs6g58b2haq0ad3q5ncsy951h0q";
+    url    = "https://github.com/nvim-neorocks/rocks.nvim/archive/v2.21.1.zip";
+    sha256 = "1va06snki6m93hs62ypy94chcjvg09pilqiivvr401vp2jzsmydx";
   };
 
   disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ fidget-nvim fzy lua nvim-nio toml toml-edit ];
+  propagatedBuildInputs = [ fidget-nvim fzy lua nvim-nio toml-edit ];
 
   meta = {
     homepage = "https://github.com/nvim-neorocks/rocks.nvim";
-    description = "Neovim plugin management inspired by Cargo.";
-    maintainers = with lib.maintainers; [ mrcjkb ];
+    description = "Neovim plugin management inspired by Cargo, powered by luarocks";
+    maintainers = with lib.maintainers; [ teto mrcjkb ];
     license.fullName = "GPL-3.0";
   };
 }) {};
@@ -3262,14 +3271,14 @@ buildLuarocksPackage {
 rustaceanvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "rustaceanvim";
-  version = "3.9.6-1";
+  version = "4.21.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rustaceanvim-3.9.6-1.rockspec";
-    sha256 = "1wlzqm8x2w9clskj2k9n9i4f0pn17dsp99a3gwwrypdlbvm9x77k";
+    url    = "mirror://luarocks/rustaceanvim-4.21.1-1.rockspec";
+    sha256 = "11z9rwnnqsmdrmzah2lwfxl01zk3yr0dnf9c2xqbcpfvq08v8p2c";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/rustaceanvim/archive/3.9.6.zip";
-    sha256 = "0qmifxb0xgyym0zbizqds5scy4qrnp0hr17rg0synp2fk5iv6s5b";
+    url    = "https://github.com/mrcjkb/rustaceanvim/archive/4.21.1.zip";
+    sha256 = "0zb8h8m9ypdl9i8dvgm3lb9b7fgw746wq7y94b8dbqjmbwrdsspl";
   };
 
   disabled = (luaOlder "5.1");
@@ -3486,14 +3495,14 @@ buildLuarocksPackage {
 telescope-manix = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, telescope-nvim }:
 buildLuarocksPackage {
   pname = "telescope-manix";
-  version = "1.0.0-1";
+  version = "1.0.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/telescope-manix-1.0.0-1.rockspec";
-    sha256 = "0fhcglrnsjyhg1g2ldlb24fck9b5fnzy7kc67yjgkw62d557vjgk";
+    url    = "mirror://luarocks/telescope-manix-1.0.2-1.rockspec";
+    sha256 = "0a5cg3kx2pv8jsr0jdpxd1ahprh55n12ggzlqiailyyskzpx94bl";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/telescope-manix/archive/1.0.0.zip";
-    sha256 = "1svw724jlhchsl191bmgr50zbjl9vghkaxk3j8g0nzvrn9677b22";
+    url    = "https://github.com/mrcjkb/telescope-manix/archive/1.0.2.zip";
+    sha256 = "0y3n270zkii123r3987xzvp194dl0q1hy234v95w7l48cf4v495k";
   };
 
   disabled = (luaOlder "5.1");
@@ -3516,11 +3525,11 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-telescope/telescope.nvim",
-  "rev": "6213322ab56eb27356fdc09a5078e41e3ea7f3bc",
-  "date": "2023-12-06T03:50:38+00:00",
-  "path": "/nix/store/h1v5377aylxb6vq8v7m7wrl585vb1dzi-telescope.nvim",
-  "sha256": "074bq8p1bkyr12z1wy31bipb97vmqia4lsmdp2aj1v1r5x5ph736",
-  "hash": "sha256-Zhx4Sy857CCVuK1qSlTEdZ+0blxheB6+CNnPFS7Cixw=",
+  "rev": "5a701e99906961218b55d7ad6c2a998f066c6fe0",
+  "date": "2024-04-10T01:26:51+00:00",
+  "path": "/nix/store/xipvnxyxi80swp58xvpfwh48pjbdxl0i-telescope.nvim",
+  "sha256": "02d877a6lp3fgh75m10n3scyk4sdran10pbsp0ghp7xids1fg985",
+  "hash": "sha256-BaXngm6xnwsfuHpdEKzKTZPpmR4WhFoOfG5catQ5qAk=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3606,18 +3615,18 @@ buildLuarocksPackage {
 toml = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "toml";
-  version = "0.3.0-0";
+  version = "0.4.0-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/toml-0.3.0-0.rockspec";
-    sha256 = "0y4qdzsvf4xwnr49xcpbqclrq9d6snv83cbdkrchl0cn4cx6zpxy";
+    url    = "mirror://luarocks/toml-0.4.0-0.rockspec";
+    sha256 = "17yr5gj9yyax3wzn7cv3vvkjrg5qq4yfw8sc6v72ivg79fhvwnli";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/LebJe/toml.lua.git",
-  "rev": "319e9accf8c5cedf68795354ba81e54c817d1277",
-  "date": "2023-02-19T23:00:49-05:00",
-  "path": "/nix/store/p6a98sqp9a4jwsw6ghqcwpn9lxmhvkdg-toml.lua",
-  "sha256": "05p33bq0ajl41vbsw9bx73shpf0p11n5gb6yy8asvp93zh2m51hq",
-  "hash": "sha256-GIZSBfwj3a0V8t6sV2wIF7gL9Th9Ja7XDoRKBfAa4xY=",
+  "rev": "1a9b2a5726b9ba7b5d328e54ae36047ffe1730f2",
+  "date": "2024-01-02T12:05:36-05:00",
+  "path": "/nix/store/2d6rhs6wdya63q86ca2gi59n8c3dc57c-toml.lua",
+  "sha256": "12cy73cni3h1mkmjagh58fv112kxfg2z624ssh2banw53pvphmfd",
+  "hash": "sha256-zVV49x2FW7UE1JoI88VzfYoQtkMFPiXrrAGOaNk4nok=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3636,7 +3645,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-toml-edit = callPackage({ buildLuarocksPackage, fetchzip, fetchurl, lua, luaOlder }:
+toml-edit = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "toml-edit";
   version = "0.3.6-1";
@@ -3663,15 +3672,15 @@ buildLuarocksPackage {
 vstruct = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "vstruct";
-  version = "2.1.1-1";
+  version = "2.2.0-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/ToxicFrog/vstruct.git",
-  "rev": "924d3dd63043189e4a7ef6b1b54b19208054cc0f",
-  "date": "2020-05-06T23:13:06-04:00",
-  "path": "/nix/store/a4i9k5hx9xiz38bij4hb505dg088jkss-vstruct",
-  "sha256": "0sl9v874mckhh6jbxsan48s5xajzx193k4qlphw69sdbf8kr3p57",
-  "hash": "sha256-p9yRJ3Kr6WQ4vBSTOVLoX6peNCJW6b6kgXCySg7aiWo=",
+  "rev": "227433d5d0ea69760c8ada1954e22d318aaafc30",
+  "date": "2024-02-26T20:52:23-05:00",
+  "path": "/nix/store/d6a7rz62m7s6k71v4cycq1yq9gpl9b04-vstruct",
+  "sha256": "1x8g9l28vqqyvhd9zr3a0ylh2fiihdf1x4jkh68cl6kqcnz3g7xk",
+  "hash": "sha256-s583vmV4GsqQgVOSHlyDMToBqQdq5J8a3B7jjQRND/U=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3688,21 +3697,21 @@ buildLuarocksPackage {
   };
 }) {};
 
-vusted = callPackage({ buildLuarocksPackage, busted, fetchgit, fetchurl }:
+vusted = callPackage({ buildLuarocksPackage, busted, fetchgit, fetchurl, luasystem }:
 buildLuarocksPackage {
   pname = "vusted";
-  version = "2.3.3-1";
+  version = "2.3.4-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/vusted-2.3.3-1.rockspec";
-    sha256 = "0h1v9p327yfqnbwi2rw3k47vwbpqx5rn679rfx5dszn3s6wp5g6p";
+    url    = "mirror://luarocks/vusted-2.3.4-1.rockspec";
+    sha256 = "1yzdr0xgsjfr4a80a2zrj58ls0gmms407q4h1dx75sszppzvm1wc";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/notomo/vusted.git",
-  "rev": "69a5a5f453cf2fc2984e1ba4eea91384e59f9da1",
-  "date": "2023-11-06T21:06:04+09:00",
-  "path": "/nix/store/85m6md82nl3jj853s9mhsc4dy0isws8b-vusted",
-  "sha256": "012n09hy4q0im2bv0vprkanv6xqdppaz6f7gwp87nxsmk88q8mxv",
-  "hash": "sha256-u1eEEZpVd3vQ5e8489W9DXezrZr5brCXqBFg4mECVgQ=",
+  "rev": "e0c5e542945844fdb4551b4dc7881b9ee780f57a",
+  "date": "2024-01-03T15:52:14+09:00",
+  "path": "/nix/store/4nacg6j8z42nz1114hrpap0z3x7jpgzy-vusted",
+  "sha256": "05mzhvv55gpj0qbq8i7y8fhknmzrdxsv2cr8mgwm2v3bffc7h7k6",
+  "hash": "sha256-Zh54mHNrbFH5qygzsXVv+Vc7oUP+RIQXBvK+UvaGvxY=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3710,7 +3719,7 @@ buildLuarocksPackage {
 }
  '') ["date" "path" "sha256"]) ;
 
-  propagatedBuildInputs = [ busted ];
+  propagatedBuildInputs = [ busted luasystem ];
 
   meta = {
     homepage = "https://github.com/notomo/vusted";
@@ -3748,9 +3757,11 @@ buildLuarocksPackage {
   meta = {
     homepage = "http://manoelcampos.github.io/xml2lua/";
     description = "An XML Parser written entirely in Lua that works for Lua 5.1+";
+    maintainers = with lib.maintainers; [ teto ];
     license.fullName = "MIT";
   };
 }) {};
 
+
 }
 /* GENERATED - do not edit this file */
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 45cd51b717538..b4b2bfe4af6af 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -91,7 +91,7 @@ in
     ];
     postConfigure = ''
       substituteInPlace ''${rockspecFilename} \
-        --replace "'lua_cliargs = 3.0-1'," "'lua_cliargs >= 3.0-1',"
+        --replace "'lua_cliargs = 3.0'," "'lua_cliargs >= 3.0',"
     '';
     postInstall = ''
       installShellCompletion --cmd busted \
@@ -146,16 +146,6 @@ in
     '';
   });
 
-  # Until https://github.com/swarn/fzy-lua/pull/8 is merged,
-  # we have to invoke busted manually
-  fzy = prev.fzy.overrideAttrs(oa: {
-    doCheck = true;
-    nativeCheckInputs = [ prev.busted ];
-    checkPhase = ''
-      busted test/test.lua
-    '';
-  });
-
   http = prev.http.overrideAttrs (oa: {
     patches = [
       (fetchpatch {
@@ -387,6 +377,14 @@ in
     ];
   });
 
+  luasnip = prev.luasnip.overrideAttrs (_: {
+    # Until https://github.com/L3MON4D3/LuaSnip/issues/1139 is solved
+    postConfigure = ''
+      substituteInPlace ''${rockspecFilename} \
+        --replace "'jsregexp >= 0.0.5, <= 0.0.6'" "'jsregexp >= 0.0.5'"
+    '';
+  });
+
   luaossl = prev.luaossl.overrideAttrs (_: {
     externalDeps = [
       { name = "CRYPTO"; dep = openssl; }
@@ -427,6 +425,13 @@ in
   #   meta.broken = true;
   # });
 
+  lua-resty-openidc =  prev.lua-resty-openidc.overrideAttrs (_: {
+    postConfigure = ''
+      substituteInPlace ''${rockspecFilename} \
+        --replace '"lua-resty-session >= 2.8, <= 3.10",' '"lua-resty-session >= 2.8",'
+    '';
+  });
+
   lua-yajl =  prev.lua-yajl.overrideAttrs (oa: {
     buildInputs = oa.buildInputs ++ [
       yajl
@@ -691,12 +696,13 @@ in
   toml = prev.toml.overrideAttrs (oa: {
     patches = [ ./toml.patch ];
 
-    propagatedBuildInputs = oa.propagatedBuildInputs ++ [ magic-enum sol2 ];
+    nativeBuildInputs = oa.nativeBuildInputs ++ [ tomlplusplus ];
+    propagatedBuildInputs = oa.propagatedBuildInputs ++ [ sol2 ];
 
     postPatch = ''
-      substituteInPlace CMakeLists.txt --replace \
-        "TOML_PLUS_PLUS_SRC" \
-        "${tomlplusplus.src}"
+      substituteInPlace CMakeLists.txt \
+        --replace "TOML_PLUS_PLUS_SRC" "${tomlplusplus.src}" \
+        --replace "MAGIC_ENUM_SRC" "${magic-enum.src}"
     '';
   });
 
@@ -724,6 +730,10 @@ in
   });
 
   vusted = prev.vusted.overrideAttrs (_: {
+    postConfigure = ''
+      substituteInPlace ''${rockspecFilename} \
+        --replace '"luasystem = 0.2.1",' '"luasystem",'
+    '';
     # make sure vusted_entry.vim doesn't get wrapped
     postInstall = ''
       chmod -x $out/bin/vusted_entry.vim
diff --git a/pkgs/development/lua-modules/toml.patch b/pkgs/development/lua-modules/toml.patch
index 5f9f57a445db0..db09dd66db5eb 100644
--- a/pkgs/development/lua-modules/toml.patch
+++ b/pkgs/development/lua-modules/toml.patch
@@ -1,5 +1,5 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index ab3884c..9432df7 100644
+index faae37a..6990d4a 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
 @@ -38,26 +38,17 @@ include(FetchContent)
@@ -9,8 +9,8 @@ index ab3884c..9432df7 100644
 -	GIT_REPOSITORY "https://github.com/marzer/tomlplusplus.git"
 -	GIT_SHALLOW ON
 -    GIT_SUBMODULES ""
--	GIT_TAG "v3.3.0"
-+  DOWNLOAD_COMMAND true
+-	GIT_TAG "v3.4.0"
++      DOWNLOAD_COMMAND true
  )
  
  FetchContent_Declare(
@@ -19,7 +19,7 @@ index ab3884c..9432df7 100644
 -	GIT_SHALLOW ON
 -    GIT_SUBMODULES ""
 -	GIT_TAG "v3.3.0"
-+  DOWNLOAD_COMMAND true
++      DOWNLOAD_COMMAND true
  )
  
  FetchContent_Declare(
@@ -27,17 +27,26 @@ index ab3884c..9432df7 100644
 -	GIT_REPOSITORY "https://github.com/Neargye/magic_enum.git"
 -	GIT_SHALLOW ON
 -    GIT_SUBMODULES ""
--	GIT_TAG "v0.8.2"
-+  DOWNLOAD_COMMAND true
+-	GIT_TAG "v0.9.5"
++      DOWNLOAD_COMMAND true
  )
  
  FetchContent_GetProperties(${TOML++})
-@@ -113,7 +104,7 @@ if(NOT LUA_INCLUDE_DIR OR (WIN32 AND NOT LUA_LIBRARIES))
+@@ -112,7 +103,7 @@ if(NOT LUA_INCLUDE_DIR OR (WIN32 AND NOT LUA_LIBRARIES))
      find_package(Lua)
  endif()
  
 -include_directories(${LUA_INCLUDE_DIR} src src/include ${${TOML++}_SOURCE_DIR} ${${SOL2}_SOURCE_DIR}/include ${${MAGIC_ENUM}_SOURCE_DIR}/include)
-+include_directories(${LUA_INCLUDE_DIR} src src/include TOML_PLUS_PLUS_SRC ${${SOL2}_SOURCE_DIR}/include ${${MAGIC_ENUM}_SOURCE_DIR}/include)
++include_directories(${LUA_INCLUDE_DIR} src src/include TOML_PLUS_PLUS_SRC ${${SOL2}_SOURCE_DIR}/include MAGIC_ENUM_SRC/include)
  
  set(SOURCES
      src/toml.cpp
+@@ -129,7 +120,7 @@ source_group(src FILES ${SOURCES})
+ if(WIN32 AND "${CMAKE_CXX_COMPILER_ID}" MATCHES "Clang" OR MSVC)
+ 	target_link_options(toml.lua PUBLIC ${PROJECT_SOURCE_DIR}\\libs\\lua51.lib)
+ else() 
+-    target_link_libraries(toml.lua ${LUA_LIBRARIES} tomlplusplus::tomlplusplus)    
++    target_link_libraries(toml.lua ${LUA_LIBRARIES} tomlplusplus)
+ endif()
+ 
+ if (LINK_FLAGS)
diff --git a/pkgs/development/misc/yelp-tools/default.nix b/pkgs/development/misc/yelp-tools/default.nix
index 088b4ccf48af8..97ec85f6f2e9e 100644
--- a/pkgs/development/misc/yelp-tools/default.nix
+++ b/pkgs/development/misc/yelp-tools/default.nix
@@ -53,7 +53,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Yelp/Tools";
+    homepage = "https://gitlab.gnome.org/GNOME/yelp-tools";
     description = "Small programs that help you create, edit, manage, and publish your Mallard or DocBook documentation";
     maintainers = teams.gnome.members ++ (with maintainers; [ domenkozar ]);
     license = licenses.gpl2Plus;
diff --git a/pkgs/development/python-modules/accelerate/default.nix b/pkgs/development/python-modules/accelerate/default.nix
index eecbd37a90634..d3bfb9cf1b0c1 100644
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@@ -2,6 +2,7 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pythonOlder
 , pytest7CheckHook
 , setuptools
@@ -20,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "accelerate";
-  version = "0.27.0";
+  version = "0.29.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -29,7 +30,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7rnI8UXyAql8fLMKoSRrWzVw5CnyYVE2o6dJOzSgWxw=";
+    hash = "sha256-oQGb/hlMN8JfwEyWufBvMk2Z1FMSl1lsdIbgZ3ZMdF8=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -73,6 +74,10 @@ buildPythonPackage rec {
 
     # set the environment variable, CC, which conflicts with standard environment
     "test_patch_environment_key_exists"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # RuntimeError: Dynamo is not supported on Python 3.12+
+    "test_convert_to_fp32"
+    "test_send_to_device_compiles"
   ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [
     # usual aarch64-linux RuntimeError: DataLoader worker (pid(s) <...>) exited unexpectedly
     "CheckpointTest"
diff --git a/pkgs/development/python-modules/aioairzone-cloud/default.nix b/pkgs/development/python-modules/aioairzone-cloud/default.nix
index c6c6e11e293fe..63815d39e47ad 100644
--- a/pkgs/development/python-modules/aioairzone-cloud/default.nix
+++ b/pkgs/development/python-modules/aioairzone-cloud/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone-cloud";
-  version = "0.4.7";
+  version = "0.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone-cloud";
     rev = "refs/tags/${version}";
-    hash = "sha256-DIWRYGDdK/wq1TrPSo9I1oZv5jX4rY4z+u7CTwJtyts=";
+    hash = "sha256-L5Gb+V0W+9duGV6lRc01jrAfh4U+MS77Y238EeXe0TU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiobotocore/default.nix b/pkgs/development/python-modules/aiobotocore/default.nix
index 525e482a42f72..5c421c99f6d02 100644
--- a/pkgs/development/python-modules/aiobotocore/default.nix
+++ b/pkgs/development/python-modules/aiobotocore/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "aiobotocore";
-  version = "2.12.1";
+  version = "2.12.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = "aiobotocore";
     rev = "refs/tags/${version}";
-    hash = "sha256-+CXKDk6crCPTVpVfcDWy+1UzS05oTu1RtIvDcVrEmFU=";
+    hash = "sha256-Us94kT7UhTTwMxF63iLLczXZhfr/Z8cJr12DKEphkog=";
   };
 
   # Relax version constraints: aiobotocore works with newer botocore versions
diff --git a/pkgs/development/python-modules/aiodns/default.nix b/pkgs/development/python-modules/aiodns/default.nix
index 1da999978b58d..95b17ac6a25ac 100644
--- a/pkgs/development/python-modules/aiodns/default.nix
+++ b/pkgs/development/python-modules/aiodns/default.nix
@@ -1,40 +1,34 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pycares
-, pythonOlder
-, setuptools
-
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pycares,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "aiodns";
-  version = "3.1.1";
+  version = "3.2.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "saghul";
     repo = "aiodns";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-JZS53kICsrXDot3CKjG30AOjkYycKpMJvC9yS3c1v5Q=";
+    hash = "sha256-aXae9/x0HVp4KqydCf5/+p5PlSKUQ5cE3iVeD08rtf0=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
-    pycares
-  ];
+  dependencies = [ pycares ];
 
   # Could not contact DNS servers
   doCheck = false;
 
-  pythonImportsCheck = [
-    "aiodns"
-  ];
+  pythonImportsCheck = [ "aiodns" ];
 
   meta = with lib; {
     description = "Simple DNS resolver for asyncio";
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index e46b5989dd762..a84a54e2c6fa0 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -5,6 +5,7 @@
 , fetchFromGitHub
 , substituteAll
 , llhttp
+, python
 # build_requires
 , cython
 , setuptools
@@ -29,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.9.3";
+  version = "3.9.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -38,7 +39,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = "aiohttp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dEeMHruFJ1o0J6VUJcpUk7LhEC8sV8hUKXoKcd618lE=";
+    hash = "sha256-FRtirmwgU8v+ee3db7rOFsmy0rNW8A7+yRZC5d6uYNA=";
   };
 
   patches = [
@@ -57,7 +58,7 @@ buildPythonPackage rec {
     touch .git  # tools/gen.py uses .git to find the project root
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     cython
     setuptools
   ];
@@ -66,7 +67,7 @@ buildPythonPackage rec {
     make cythonize
   '';
 
-  propagatedBuildInputs = [
+  dependencies = [
     attrs
     multidict
     async-timeout
@@ -77,6 +78,11 @@ buildPythonPackage rec {
     brotli
   ];
 
+  postInstall = ''
+    # remove source code file with reference to dev dependencies
+    rm $out/${python.sitePackages}/aiohttp/_cparser.pxd{,.orig}
+  '';
+
   # NOTE: pytest-xdist cannot be added because it is flaky. See https://github.com/NixOS/nixpkgs/issues/230597 for more info.
   nativeCheckInputs = [
     freezegun
@@ -96,14 +102,6 @@ buildPythonPackage rec {
     "test_client_session_timeout_zero"
     "test_mark_formdata_as_processed"
     "test_requote_redirect_url_default"
-    # Disable tests that trigger deprecation warnings in pytest
-    "test_async_with_session"
-    "test_session_close_awaitable"
-    "test_close_run_until_complete_not_deprecated"
-    # https://github.com/aio-libs/aiohttp/issues/7130
-    "test_static_file_if_none_match"
-    "test_static_file_if_match"
-    "test_static_file_if_modified_since_past_date"
     # don't run benchmarks
     "test_import_time"
   ] ++ lib.optionals stdenv.is32bit [
diff --git a/pkgs/development/python-modules/aiorpcx/default.nix b/pkgs/development/python-modules/aiorpcx/default.nix
index 09a2bfb8562d6..5686a7dafd126 100644
--- a/pkgs/development/python-modules/aiorpcx/default.nix
+++ b/pkgs/development/python-modules/aiorpcx/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "aiorpcx";
-  version = "0.22.1";
+  version = "0.23.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "aiorpcX";
-    sha256 = "0lx54bcinp44fmr8q4bbffsqbkg8kdcwykf9i5jj0bj3sfzgf9k0";
+    sha256 = "sha256-WyMALxpNXTCF4xVVoHUZxe+NTEAHHrSZVW/9qBFIYKI=";
   };
 
   propagatedBuildInputs = [ attrs ];
diff --git a/pkgs/development/python-modules/aiortm/default.nix b/pkgs/development/python-modules/aiortm/default.nix
index cbd44aa17016b..9e1384acc6792 100644
--- a/pkgs/development/python-modules/aiortm/default.nix
+++ b/pkgs/development/python-modules/aiortm/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "aiortm";
-  version = "0.8.12";
+  version = "0.8.13";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiortm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-X7MqBDmVfLy5ajqhFcvA8oCaoxy3zLusXkB659qWR5E=";
+    hash = "sha256-JoolmxZFN0UG8wAMxMAYL8APFjpEcMECirCKUA/UBlY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aiosmtpd/default.nix b/pkgs/development/python-modules/aiosmtpd/default.nix
index 2f3c5e3b836c0..39050153be2e5 100644
--- a/pkgs/development/python-modules/aiosmtpd/default.nix
+++ b/pkgs/development/python-modules/aiosmtpd/default.nix
@@ -6,23 +6,28 @@
 , pytest-mock
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "aiosmtpd";
   version = "1.4.5";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "aio-libs";
-    repo = pname;
+    repo = "aiosmtpd";
     rev = "refs/tags/v${version}";
     hash = "sha256-8nQ4BVSLYgZHRGkbujy/olV/+GABlkDhe5wef3hyQpQ=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     atpublic
     attrs
@@ -53,6 +58,7 @@ buildPythonPackage rec {
     description = "Asyncio based SMTP server";
     mainProgram = "aiosmtpd";
     homepage = "https://aiosmtpd.readthedocs.io/";
+    changelog = "https://github.com/aio-libs/aiosmtpd/releases/tag/v${version}";
     longDescription = ''
       This is a server for SMTP and related protocols, similar in utility to the
       standard library's smtpd.py module.
diff --git a/pkgs/development/python-modules/albumentations/default.nix b/pkgs/development/python-modules/albumentations/default.nix
index 17e9c7fc7974e..1de36e510197b 100644
--- a/pkgs/development/python-modules/albumentations/default.nix
+++ b/pkgs/development/python-modules/albumentations/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "albumentations";
-  version = "1.4.2";
+  version = "1.4.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lznWLJocXdfwnhAZ33V5ZdlFCAsNa0u/rjfkjmHBQOg=";
+    hash = "sha256-VNpClOBdoaQOqU92Mm/Z5Q7P+fZzR+m43SFA9pSi1M0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/allure-behave/default.nix b/pkgs/development/python-modules/allure-behave/default.nix
index 8f39c1fb628e2..ef9e8fc2bf208 100644
--- a/pkgs/development/python-modules/allure-behave/default.nix
+++ b/pkgs/development/python-modules/allure-behave/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "allure-behave";
-  version = "2.13.2";
+  version = "2.13.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mxXb7+1tvf5EmVbD6eOmGfza9lAjbEVoxWZBSeZmPxQ=";
+    hash = "sha256-M4yizHOV0e491y9dfZLYkg8a3g4H3evGN7OOYeBtyNw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/allure-pytest/default.nix b/pkgs/development/python-modules/allure-pytest/default.nix
index ba86e0723a5df..504f118bc3a76 100644
--- a/pkgs/development/python-modules/allure-pytest/default.nix
+++ b/pkgs/development/python-modules/allure-pytest/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "allure-pytest";
-  version = "2.13.2";
+  version = "2.13.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IiQxWejsgc4rUlS0ATgCGYghsbQvEY9p1KKJOWYHx7M=";
+    hash = "sha256-DvjheQxEqYjba4PE1PXpFFHixMjqEGAd+ohSjSOvz24=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/allure-python-commons-test/default.nix b/pkgs/development/python-modules/allure-python-commons-test/default.nix
index 4a75e18835a42..da1d4a3dca4ca 100644
--- a/pkgs/development/python-modules/allure-python-commons-test/default.nix
+++ b/pkgs/development/python-modules/allure-python-commons-test/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "allure-python-commons-test";
-  version = "2.13.4";
+  version = "2.13.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.4";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WPthxhyKlN6fGdKXJLrjh3nbQ8h6CacYToyadh/p49M=";
+    hash = "sha256-pWkLVfBrLEhdhuTE95K3aqrhEY2wEyo5uRzuJC3ngjE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/allure-python-commons/default.nix b/pkgs/development/python-modules/allure-python-commons/default.nix
index 2e6a38e51341c..c63466ce8e25c 100644
--- a/pkgs/development/python-modules/allure-python-commons/default.nix
+++ b/pkgs/development/python-modules/allure-python-commons/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "allure-python-commons";
-  version = "2.13.2";
+  version = "2.13.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-igNoEzAjGx3q3Ya5f/aIQcZZEyARSuY4Vw8e1g16IDM=";
+    hash = "sha256-ojLnlVgR+Yjkmkwd1sFszn6bgdDqBCKx5WVNMlTiyvM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/amaranth-boards/default.nix b/pkgs/development/python-modules/amaranth-boards/default.nix
index 01f5dde3b562f..2475c93f8c617 100644
--- a/pkgs/development/python-modules/amaranth-boards/default.nix
+++ b/pkgs/development/python-modules/amaranth-boards/default.nix
@@ -9,7 +9,7 @@
 buildPythonPackage rec {
   pname = "amaranth-boards";
   version = "0-unstable-2023-12-13";
-  format = "setuptools";
+  pyproject = true;
   # python setup.py --version
   realVersion = "0.1.dev202+g${lib.substring 0 7 src.rev}";
 
@@ -20,8 +20,8 @@ buildPythonPackage rec {
     hash = "sha256-dwZCKMJnEY9RjzkcJ9r3TEC7W+Wfi/P7Hjl4/d60/qo=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
-  propagatedBuildInputs = [ setuptools amaranth ];
+  nativeBuildInputs = [ setuptools setuptools-scm ];
+  dependencies = [ setuptools amaranth ];
 
   preBuild = ''
     export SETUPTOOLS_SCM_PRETEND_VERSION="${realVersion}"
diff --git a/pkgs/development/python-modules/amaranth-soc/default.nix b/pkgs/development/python-modules/amaranth-soc/default.nix
index b509ec551cf84..0742055e9cf24 100644
--- a/pkgs/development/python-modules/amaranth-soc/default.nix
+++ b/pkgs/development/python-modules/amaranth-soc/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [ pdm-backend ];
-  propagatedBuildInputs = [ amaranth ];
+  dependencies = [ amaranth ];
 
   preBuild = ''
     export PDM_BUILD_SCM_VERSION="${realVersion}"
diff --git a/pkgs/development/python-modules/amaranth/default.nix b/pkgs/development/python-modules/amaranth/default.nix
index a0e2675a0099a..5f2f072558dfe 100644
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     pdm-backend
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     jinja2
     pyvcd
   ] ++
diff --git a/pkgs/development/python-modules/anthropic/default.nix b/pkgs/development/python-modules/anthropic/default.nix
index 76b852c71f6dc..5eef6a51010a4 100644
--- a/pkgs/development/python-modules/anthropic/default.nix
+++ b/pkgs/development/python-modules/anthropic/default.nix
@@ -1,25 +1,27 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, hatchling
-, anyio
-, distro
-, dirty-equals
-, httpx
-, google-auth
-, sniffio
-, pydantic
-, pytest-asyncio
-, respx
-, tokenizers
-, typing-extensions
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  anyio,
+  buildPythonPackage,
+  dirty-equals,
+  distro,
+  fetchFromGitHub,
+  google-auth,
+  hatch-fancy-pypi-readme,
+  hatchling,
+  httpx,
+  pydantic,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  respx,
+  sniffio,
+  tokenizers,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "anthropic";
-  version = "0.19.1";
+  version = "0.25.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,14 +30,15 @@ buildPythonPackage rec {
     owner = "anthropics";
     repo = "anthropic-sdk-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-D9asbwZ9puOuIK6w7cWJ2HmC3JYjamUZPOxVKWq+Va4=";
+    hash = "sha256-83TufOgu6W9UvoCEUgDiw6gXDAdwyIKEALVF0hjj6wk=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     hatchling
+    hatch-fancy-pypi-readme
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     anyio
     distro
     httpx
@@ -56,13 +59,21 @@ buildPythonPackage rec {
     respx
   ];
 
+  pythonImportsCheck = [ "anthropic" ];
+
+  disabledTests = [
+    # Test require network access
+    "test_copy_build_request"
+  ];
+
   disabledTestPaths = [
-    # require network access
+    # Test require network access
     "tests/api_resources"
   ];
 
-  pythonImportsCheck = [
-    "anthropic"
+  pytestFlagsArray = [
+    "-W"
+    "ignore::DeprecationWarning"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/argcomplete/default.nix b/pkgs/development/python-modules/argcomplete/default.nix
index 4427e75089fad..363b07758a2a2 100644
--- a/pkgs/development/python-modules/argcomplete/default.nix
+++ b/pkgs/development/python-modules/argcomplete/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "argcomplete";
-  version = "3.2.3";
+  version = "3.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "kislyuk";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-sGXHRHmzapJM/c4D4j3QWhkTNzPNZPLO7JOptnTXuR8=";
+    hash = "sha256-ekTmT6jYkC36X2e0ukwHfDGwdPg3jK8jML2naBCgNI8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/astropy-healpix/default.nix b/pkgs/development/python-modules/astropy-healpix/default.nix
index 23db660f951bb..fa04d6595e8bf 100644
--- a/pkgs/development/python-modules/astropy-healpix/default.nix
+++ b/pkgs/development/python-modules/astropy-healpix/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "astropy-healpix";
-  version = "1.0.2";
+  version = "1.0.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = lib.replaceStrings ["-"] ["_"] pname;
-    hash = "sha256-BW+m7ZOWvtx3HTdNh3zeg9lGCj9ip4/gXb+boDlAMjo=";
+    hash = "sha256-3l0qfsl7FnBFBmlx8loVDR5AYfBxWb4jZJY02zbnl0Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/astroquery/default.nix b/pkgs/development/python-modules/astroquery/default.nix
index 610238559a2ce..070238d8b2c49 100644
--- a/pkgs/development/python-modules/astroquery/default.nix
+++ b/pkgs/development/python-modules/astroquery/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "astroquery";
-  version = "0.4.6";
+  version = "0.4.7";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MHylVMtzSgypoi+G9e/+fkE6+ROuZeFXiXLYR7H+E+4=";
+    hash = "sha256-BH+6ywpPrsTNtiZ16RnCRMHDXmYQRPy7bJqTMzF0fsk=";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/atpublic/default.nix b/pkgs/development/python-modules/atpublic/default.nix
index 41cbe28b8a268..616581ffc6f5e 100644
--- a/pkgs/development/python-modules/atpublic/default.nix
+++ b/pkgs/development/python-modules/atpublic/default.nix
@@ -3,25 +3,25 @@
 , fetchPypi
 , pytestCheckHook
 , pythonOlder
-, pdm-backend
+, hatchling
 , sybil
 , typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "atpublic";
-  version = "4.0";
+  version = "4.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-D0BDMhnhJO3xFcbDY4CMpvDhz6fRYNhrL7lHkwhtEpQ=";
+    hash = "sha256-0cjNkxr3Rh9tGLxgYzg+hlTZ6e8Z1Y7m3AHoUVu/Vd8=";
   };
 
   nativeBuildInputs = [
-    pdm-backend
+    hatchling
   ];
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
diff --git a/pkgs/development/python-modules/avro/default.nix b/pkgs/development/python-modules/avro/default.nix
index 21246fae47433..4b1f85e7d2037 100644
--- a/pkgs/development/python-modules/avro/default.nix
+++ b/pkgs/development/python-modules/avro/default.nix
@@ -12,6 +12,7 @@ buildPythonPackage rec {
   version = "1.11.3";
   pyproject = true;
 
+  # distutils usage: https://github.com/search?q=repo%3Aapache%2Favro%20distutils&type=code
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
diff --git a/pkgs/development/python-modules/azure-identity/default.nix b/pkgs/development/python-modules/azure-identity/default.nix
index add836eee03f4..18e21134a8dbb 100644
--- a/pkgs/development/python-modules/azure-identity/default.nix
+++ b/pkgs/development/python-modules/azure-identity/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "azure-identity";
-  version = "1.15.0";
+  version = "1.16.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TCj8JGt/kmVhDrUmHWWTEYPQGaI9Sw6ZNX+ssubCJ8g=";
+    hash = "sha256-b/HWZ83Ngdoc6rQvgKC+Y8qEZin1GKki9zF6fjyEThs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-cdn/default.nix b/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
index 3b6c5fd88b7bf..7c53f86ca6c4c 100644
--- a/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
@@ -9,14 +9,15 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cdn";
-  version = "13.0.0";
+  version = "13.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-yJ8jTeT4Gu23YSHl5GZ0+zdlC3s+GIxS4ir8z/HBkA4=";
+    pname = "azure_mgmt_cdn";
+    inherit version;
+    hash = "sha256-Igpr2snnXkwAyEGlnY3j7JAQ4LnhQS3snmwka2GeO/I=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/b2sdk/default.nix b/pkgs/development/python-modules/b2sdk/default.nix
index 9c00f0c49cc9d..266443af70f02 100644
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "b2sdk";
-  version = "2.0.0";
+  version = "2.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "Backblaze";
     repo = "b2-sdk-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0/UC4O19oO8SpboiPIhvkWBA8XHpc279fl377MooK54=";
+    hash = "sha256-/TuPT+Y0asGGtfRNxxvpX0WkS4O4asFmIuqSdQ4I9fQ=";
   };
 
   build-system = [ pdm-backend ];
@@ -60,6 +60,9 @@ buildPythonPackage rec {
     # requires aws s3 auth
     "test/integration/test_download.py"
     "test/integration/test_upload.py"
+
+    # Requires backblaze auth
+    "test/integration/test_bucket.py"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/bdffont/default.nix b/pkgs/development/python-modules/bdffont/default.nix
index baa20facc81fb..f5cd8f9431211 100644
--- a/pkgs/development/python-modules/bdffont/default.nix
+++ b/pkgs/development/python-modules/bdffont/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "bdffont";
-  version = "0.0.17";
+  version = "0.0.20";
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JBPo5tmwnXRzPpZbBrcW2wEC/XNd8M+mi58CRIpOVL0=";
+    hash = "sha256-T0gTtudsZmL0VZ3a3+C/v+dWAwbXUgf0PEdNtkxWROw=";
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/bids-validator/default.nix b/pkgs/development/python-modules/bids-validator/default.nix
index 7512515c706de..6779e42c580dc 100644
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "bids-validator";
-  version = "1.14.4";
+  version = "1.14.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Q0pghEFmK5qJ3sWgrxs4jWUm+Ox7LO5sDR8GUJWBr/o=";
+    hash = "sha256-TXIb1ff7D6aM+8L5F47O5Dvupp1Sn4Rnl+GQaUdEgno=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/birch/default.nix b/pkgs/development/python-modules/birch/default.nix
index 1dd4848427e52..56c95e415c319 100644
--- a/pkgs/development/python-modules/birch/default.nix
+++ b/pkgs/development/python-modules/birch/default.nix
@@ -31,20 +31,20 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pytest.ini \
-      --replace  \
+      --replace-fail  \
         "--cov" \
         "#--cov"
 
     # configure correct version, which fails due to missing .git
     substituteInPlace versioneer.py birch/_version.py \
-      --replace '"0+unknown"' '"${version}"'
+      --replace-fail '"0+unknown"' '"${version}"'
   '';
 
   nativeBuildInputs = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     strct
   ];
 
diff --git a/pkgs/development/python-modules/black/default.nix b/pkgs/development/python-modules/black/default.nix
index ec11de747c1e5..48f1c3305558b 100644
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "black";
-  version = "24.3.0";
+  version = "24.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oMnEoHca/GkZV4zscc6Co+MeBUkE5xl96svJOCZxxB8=";
+    hash = "sha256-8Htp/aIFeDZ+rrvWcP+PxlOrGB4f+V2ESX+fog59BkE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bokeh/default.nix b/pkgs/development/python-modules/bokeh/default.nix
index 63fa524f9fa30..8f052c4b5b179 100644
--- a/pkgs/development/python-modules/bokeh/default.nix
+++ b/pkgs/development/python-modules/bokeh/default.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , buildPythonPackage
 , fetchPypi
 , fetchFromGitHub
@@ -8,7 +7,6 @@
 , colorama
 , contourpy
 , jinja2
-, mock
 , numpy
 , nodejs
 , packaging
@@ -48,14 +46,14 @@
 buildPythonPackage rec {
   pname = "bokeh";
   # update together with panel which is not straightforward
-  version = "3.3.4";
+  version = "3.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-c7eYLcK43xW/Zgzd3I04JegpGVxDgBWl0Jgk8acCg2g=";
+    hash = "sha256-2CSWHkJlNnsHUM5YsH5WStC4PKZLM1UhzTQh6bnxDYk=";
   };
 
   src_test = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/bokeh/hardcode-nodejs-npmjs-paths.patch b/pkgs/development/python-modules/bokeh/hardcode-nodejs-npmjs-paths.patch
index 4ebfc7e3f2d63..6dcec9ae51777 100644
--- a/pkgs/development/python-modules/bokeh/hardcode-nodejs-npmjs-paths.patch
+++ b/pkgs/development/python-modules/bokeh/hardcode-nodejs-npmjs-paths.patch
@@ -1,14 +1,15 @@
-diff -ru a/src/bokeh/util/compiler.py b/src/bokeh/util/compiler.py
+diff --git a/src/bokeh/util/compiler.py b/src/bokeh/util/compiler.py
+index 4f4314ac8..726610f4c 100644
 --- a/src/bokeh/util/compiler.py
 +++ b/src/bokeh/util/compiler.py
-@@ -411,8 +411,8 @@
+@@ -411,8 +411,8 @@ def _detect_nodejs() -> Path:
      raise RuntimeError(f'node.js v{version_repr} or higher is needed to allow compilation of custom models ' +
                         '("conda install nodejs" or follow https://nodejs.org/en/download/)')
  
--_nodejs = None
--_npmjs = None
+-_nodejs: Path | None = None
+-_npmjs: Path | None = None
 +_nodejs = "@node_bin@"
 +_npmjs = "@npm_bin@"
  
- def _nodejs_path() -> str:
+ def _nodejs_path() -> Path:
      global _nodejs
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 53fa22914a9bf..06bbc1752fb47 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -366,7 +366,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.94";
+  version = "1.34.95";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -374,7 +374,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-ZyKwsCQpPrN3E7jsNdAuLELEi0NhWoVExAKXLbBTQS0=";
+    hash = "sha256-QSAGsn7nB+m1GghLAqySsUOvijtWcnWCr+wqds6Tw7Y=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index f956687016ef6..0c9dfaa7920a5 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.34.58"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.34.87"; # N.B: if you change this, change boto3 and awscli to a matching version
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-11IWlSiG3FE+obXil5pq8I/u0vU34/wQLkoKLq1WOjU=";
+    hash = "sha256-o6TYV/CUHZih5c6M1kw5BiJx/qC+TZ89DWr/bLWBI7k=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/boxx/default.nix b/pkgs/development/python-modules/boxx/default.nix
index a42cc2c0ee55e..67d862941c8ed 100644
--- a/pkgs/development/python-modules/boxx/default.nix
+++ b/pkgs/development/python-modules/boxx/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "boxx";
-  version = "0.10.13";
+  version = "0.10.14";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Z1mmNTGjK77GNdlYAXQzp+9Z7TeiKZGvio4SXGwgOPk=";
+    hash = "sha256-unGnmPksEuqFXHTWJkj9Gv2G/qPDgT6AZXYiG2gtkEA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/breathe/default.nix b/pkgs/development/python-modules/breathe/default.nix
index ca6c66261660c..35bc0b6986750 100644
--- a/pkgs/development/python-modules/breathe/default.nix
+++ b/pkgs/development/python-modules/breathe/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, defusedxml
 , docutils
 , fetchFromGitHub
 , fetchpatch
@@ -40,6 +41,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  checkInputs = [
+    defusedxml
+  ];
+
   pythonImportsCheck = [
     "breathe"
   ];
diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index 7d56257a377de..4f30c8f186293 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "build";
-  version = "1.1.1";
+  version = "1.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "pypa";
     repo = "build";
     rev = "refs/tags/${version}";
-    hash = "sha256-SGWpm+AGIfqKMpDfmz2aMYmcs+XVREbHIXSuU4R7U/k=";
+    hash = "sha256-G0g+1v19sQMUuQlZKGELZOwwX07i7TIdEdaYzr8bKtI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cachier/default.nix b/pkgs/development/python-modules/cachier/default.nix
index 037f02b4d3ee1..e8fe51d4ded7b 100644
--- a/pkgs/development/python-modules/cachier/default.nix
+++ b/pkgs/development/python-modules/cachier/default.nix
@@ -35,14 +35,14 @@ buildPythonPackage rec {
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     watchdog
     portalocker
   ];
 
   preCheck = ''
     substituteInPlace pyproject.toml \
-      --replace  \
+      --replace-fail  \
         '"--cov' \
         '#"--cov'
   '';
diff --git a/pkgs/development/python-modules/cartopy/default.nix b/pkgs/development/python-modules/cartopy/default.nix
index 05529a9c00da4..17d6b014caef0 100644
--- a/pkgs/development/python-modules/cartopy/default.nix
+++ b/pkgs/development/python-modules/cartopy/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "cartopy";
-  version = "0.22.0";
+  version = "0.23.0";
 
   disabled = pythonOlder "3.8";
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "Cartopy";
-    hash = "sha256-swD5ASCTHUPxHvh8Bk6h2s7BtZpJQKp26/gs8JVIu0k=";
+    hash = "sha256-Ix83s1cB8rox2UlZzKdebaBMLuo6fxTOHHXuOw6udnY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/casa-formats-io/default.nix b/pkgs/development/python-modules/casa-formats-io/default.nix
index 4e4d10bd2731f..2537c9e8e5f6c 100644
--- a/pkgs/development/python-modules/casa-formats-io/default.nix
+++ b/pkgs/development/python-modules/casa-formats-io/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "casa-formats-io";
-  version = "0.2.2";
+  version = "0.3.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EOX+tal9nrON2K7mHVYSTTxja6mu2k3Bag8bhL3JHJs=";
+    hash = "sha256-FpQj0XeZ7vvOzUM/+5qG6FRwNXl3gzoUBItYdQ1M4m4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cbor2/default.nix b/pkgs/development/python-modules/cbor2/default.nix
index 73f994cce5a8f..c9d2ecbaca4fb 100644
--- a/pkgs/development/python-modules/cbor2/default.nix
+++ b/pkgs/development/python-modules/cbor2/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "cbor2";
-  version = "5.6.2";
+  version = "5.6.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-t1E8LeqIaJkfrX74iZiQ68+LGZubRGHDwR160670gg0=";
+    hash = "sha256-5vCuJ1HC0zOpYOCAfAYRSU6xJFYxoWeWWsvBAFCUVdM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index a787e1fce4ea9..f628404909086 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -1,45 +1,57 @@
 { stdenv
 , lib
-, backports-zoneinfo
-, billiard
-, boto3
 , buildPythonPackage
-, case
+, fetchPypi
+, pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
+, billiard
+, kombu
+, vine
 , click
 , click-didyoumean
-, click-plugins
 , click-repl
-, dnspython
-, fetchPypi
-, kombu
+, click-plugins
+, tzdata
+, python-dateutil
+
+# optional-dependencies
+, google-cloud-storage
 , moto
+, msgpack
 , pymongo
+, pyyaml
+
+# tests
 , pytest-celery
 , pytest-click
 , pytest-subtests
 , pytest-timeout
 , pytest-xdist
 , pytestCheckHook
-, python-dateutil
-, pythonOlder
-, tzdata
-, vine
 , nixosTests
 }:
 
 buildPythonPackage rec {
   pname = "celery";
-  version = "5.3.6";
-  format = "setuptools";
+  version = "5.4.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hwzHHXN8AgDDlykNcwNEzJkdE6BXU0NT0STJOAJnqrk=";
+    hash = "sha256-UEoZFA6NMCnVrK2IMwxUHUw/ZMeJ2F+UdWdi2Lyn5wY=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     billiard
     click
     click-didyoumean
@@ -49,24 +61,29 @@ buildPythonPackage rec {
     python-dateutil
     tzdata
     vine
-  ]
-  ++ lib.optionals (pythonOlder "3.9") [
-    backports-zoneinfo
   ];
 
+  optional-dependencies = {
+    gcs = [ google-cloud-storage ];
+    mongodb = [ pymongo ];
+    msgpack = [ msgpack ];
+    yaml = [ pyyaml ];
+  };
+
   nativeCheckInputs = [
-    boto3
-    case
-    dnspython
     moto
-    pymongo
     pytest-celery
     pytest-click
     pytest-subtests
     pytest-timeout
     pytest-xdist
     pytestCheckHook
-  ];
+  ]
+  # based on https://github.com/celery/celery/blob/main/requirements/test.txt
+  ++ optional-dependencies.yaml
+  ++ optional-dependencies.msgpack
+  ++ optional-dependencies.mongodb
+  ++ optional-dependencies.gcs;
 
   disabledTestPaths = [
     # test_eventlet touches network
diff --git a/pkgs/development/python-modules/click-didyoumean/default.nix b/pkgs/development/python-modules/click-didyoumean/default.nix
index 8c1bf6f26e94f..110855c60a422 100644
--- a/pkgs/development/python-modules/click-didyoumean/default.nix
+++ b/pkgs/development/python-modules/click-didyoumean/default.nix
@@ -1,18 +1,29 @@
-{ lib, buildPythonPackage, fetchPypi,
-  click
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  click,
+  pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "click-didyoumean";
-  version = "0.3.0";
-  format = "setuptools";
+  version = "0.3.1";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "f184f0d851d96b6d29297354ed981b7dd71df7ff500d82fa6d11f0856bee8035";
+  src = fetchFromGitHub {
+    owner = "click-contrib";
+    repo = "click-didyoumean";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-C8OrJUfBFiDM/Jnf1iJo8pGEd0tUhar1vu4fVIfGzq8=";
   };
 
-  propagatedBuildInputs = [ click ];
+  build-system = [ poetry-core ];
+
+  dependencies = [ click ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Enable git-like did-you-mean feature in click";
diff --git a/pkgs/development/python-modules/controku/default.nix b/pkgs/development/python-modules/controku/default.nix
index e2dd1d32b76a3..80c4505175f25 100644
--- a/pkgs/development/python-modules/controku/default.nix
+++ b/pkgs/development/python-modules/controku/default.nix
@@ -8,7 +8,7 @@
 , pygobject3
 , gobject-introspection
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , buildApplication ? false
 }:
 
@@ -28,7 +28,7 @@ python3Packages.buildPythonPackage rec {
     setuptools
   ] ++ lib.optionals buildApplication [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index 4e4c86ae10634..43919f97fc2f5 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "7.4.3";
+  version = "7.4.4";
   pyproject = true;
 
   # uses f strings
@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J29gd6XGFEekjRM+0T51nAnmKv8NyEJ0po3BhmAQTVI=";
+    hash = "sha256-yQHfg9CXZJ4lfoA74iWSrt/VGC8Hs8yH1kC7ua/VD0k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/css-inline/Cargo.lock b/pkgs/development/python-modules/css-inline/Cargo.lock
index 429622a63cb85..de6ff84ce6a47 100644
--- a/pkgs/development/python-modules/css-inline/Cargo.lock
+++ b/pkgs/development/python-modules/css-inline/Cargo.lock
@@ -18,6 +18,24 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
+
+[[package]]
 name = "android-tzdata"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -34,15 +52,15 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
 
 [[package]]
 name = "backtrace"
-version = "0.3.69"
+version = "0.3.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
+checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
 dependencies = [
  "addr2line",
  "cc",
@@ -55,9 +73,9 @@ dependencies = [
 
 [[package]]
 name = "base64"
-version = "0.21.7"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
 
 [[package]]
 name = "bitflags"
@@ -67,15 +85,15 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.2"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "built"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38d17f4d6e4dc36d1a02fbedc2753a096848e7c1b0772f7654eab8e2c927dd53"
+checksum = "41bfbdb21256b87a8b5e80fab81a8eed158178e812fd7ba451907518b2742f16"
 dependencies = [
  "cargo-lock",
  "chrono",
@@ -83,9 +101,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.15.0"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d32a994c2b3ca201d9b263612a374263f05e7adde37c4707f693dcd375076d1f"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "byteorder"
@@ -95,9 +113,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "cargo-lock"
@@ -113,12 +131,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
-dependencies = [
- "libc",
-]
+checksum = "17f6e324229dc011159fcc089755d1e2e216a90d43a7dea6853ca740b84f35e7"
 
 [[package]]
 name = "cfg-if"
@@ -128,24 +143,14 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.34"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bc015644b92d5890fab7489e49d21f879d5c990186827d42ec511919404f38b"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
  "num-traits",
- "windows-targets 0.52.0",
-]
-
-[[package]]
-name = "core-foundation"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
-dependencies = [
- "core-foundation-sys",
- "libc",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -181,11 +186,12 @@ checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
 [[package]]
 name = "css-inline"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "cssparser",
  "html5ever",
  "indexmap",
+ "lru",
  "reqwest",
  "rustc-hash",
  "selectors",
@@ -195,7 +201,7 @@ dependencies = [
 
 [[package]]
 name = "css-inline-python"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "built",
  "css-inline",
@@ -225,7 +231,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
 dependencies = [
  "quote",
- "syn 2.0.49",
+ "syn 2.0.60",
 ]
 
 [[package]]
@@ -256,18 +262,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
-
-[[package]]
-name = "encoding_rs"
-version = "0.8.33"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
-dependencies = [
- "cfg-if",
-]
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
 
 [[package]]
 name = "equivalent"
@@ -307,6 +304,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
 dependencies = [
  "futures-core",
+ "futures-sink",
 ]
 
 [[package]]
@@ -341,6 +339,7 @@ checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
 dependencies = [
  "futures-core",
  "futures-io",
+ "futures-sink",
  "futures-task",
  "memchr",
  "pin-project-lite",
@@ -359,9 +358,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.12"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "libc",
@@ -375,29 +374,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
 [[package]]
-name = "h2"
-version = "0.3.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http",
- "indexmap",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
-[[package]]
 name = "hashbrown"
 version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
 
 [[package]]
 name = "heck"
@@ -407,29 +391,29 @@ checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.6"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd5256b483761cd23699d0da46cc6fd2ee3be420bbe6d020ae4a091e70b7e9fd"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
 [[package]]
 name = "html5ever"
-version = "0.26.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bea68cab48b8459f17cf1c944c67ddc572d272d9f2b274140f223ecb1da4a3b7"
+checksum = "c13771afe0e6e846f1e67d038d4cb29998a6779f93c809212e4e9c32efd244d4"
 dependencies = [
  "log",
  "mac",
  "markup5ever",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.60",
 ]
 
 [[package]]
 name = "http"
-version = "0.2.11"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
 dependencies = [
  "bytes",
  "fnv",
@@ -438,12 +422,24 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.6"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643"
 dependencies = [
  "bytes",
  "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -454,47 +450,59 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
 
 [[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
-[[package]]
 name = "hyper"
-version = "0.14.28"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
+checksum = "fe575dd17d0862a9a33781c8c4696a55c320909004a67a00fb286ba8b1bc496d"
 dependencies = [
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
- "h2",
  "http",
  "http-body",
  "httparse",
- "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2",
+ "smallvec",
  "tokio",
- "tower-service",
- "tracing",
  "want",
 ]
 
 [[package]]
 name = "hyper-rustls"
-version = "0.24.2"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
 dependencies = [
  "futures-util",
  "http",
  "hyper",
+ "hyper-util",
  "rustls",
+ "rustls-pki-types",
  "tokio",
  "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca38ef113da30126bbff9cd1705f9273e15d45498615d138b0c20279ac7a76aa"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower",
+ "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -532,9 +540,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.2.3"
+version = "2.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233cf39063f058ea2caae4091bf4a3ef70a653afbc026f5c4a4135d114e3c177"
+checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -542,9 +550,9 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "2.0.4"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e186cfbae8084e513daff4240b4797e342f988cecda4fb6c939150f96315fd8"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
 name = "ipnet"
@@ -554,15 +562,15 @@ checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
 name = "itoa"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "js-sys"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "406cda4b368d531c842222cf9d2600a9a4acce8d29423695379c6868a143a9ee"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -585,9 +593,18 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
+
+[[package]]
+name = "lru"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "d3262e75e648fce39813cb56ac41f3c3e3f65217ebf3844d818d1f9398cfb0dc"
+dependencies = [
+ "hashbrown",
+]
 
 [[package]]
 name = "mac"
@@ -597,13 +614,13 @@ checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
 
 [[package]]
 name = "markup5ever"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2629bb1404f3d34c2e921f21fd34ba00b206124c81f65c50b43b6aaefeb016"
+checksum = "c7940b09815a02810a42b9e1bc41c069880a87de68e9b1dcbe754a3ba3b47c20"
 dependencies = [
  "log",
- "phf 0.10.1",
- "phf_codegen",
+ "phf 0.11.2",
+ "phf_codegen 0.11.2",
  "string_cache",
  "string_cache_codegen",
  "tendril",
@@ -611,15 +628,15 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "memoffset"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
 dependencies = [
  "autocfg",
 ]
@@ -641,20 +658,20 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
  "wasi",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "new_debug_unreachable"
-version = "1.0.4"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4a24736216ec316047a1fc4252e27dabb04218aa4a3f37c6e7ddbf1f9782b54"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
 [[package]]
 name = "num-traits"
@@ -749,6 +766,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "phf_codegen"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8d39688d359e6b34654d328e262234662d16cc0f60ec8dcbe5e718709342a5a"
+dependencies = [
+ "phf_generator 0.11.2",
+ "phf_shared 0.11.2",
+]
+
+[[package]]
 name = "phf_generator"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -778,7 +805,7 @@ dependencies = [
  "phf_shared 0.11.2",
  "proc-macro2",
  "quote",
- "syn 2.0.49",
+ "syn 2.0.60",
 ]
 
 [[package]]
@@ -800,10 +827,30 @@ dependencies = [
 ]
 
 [[package]]
+name = "pin-project"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.60",
+]
+
+[[package]]
 name = "pin-project-lite"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 
 [[package]]
 name = "pin-utils"
@@ -812,6 +859,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
+name = "portable-atomic"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0"
+
+[[package]]
 name = "ppv-lite86"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -825,24 +878,25 @@ checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.78"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "pyo3"
-version = "0.20.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a89dc7a5850d0e983be1ec2a463a171d20990487c3cfcd68b5363f1ee3d6fe0"
+checksum = "a5e00b96a521718e08e03b1a622f01c8a8deb50719335de3f60b3b3950f069d8"
 dependencies = [
  "cfg-if",
  "indoc",
  "libc",
  "memoffset",
  "parking_lot",
+ "portable-atomic",
  "pyo3-build-config",
  "pyo3-ffi",
  "pyo3-macros",
@@ -851,9 +905,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.20.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07426f0d8fe5a601f26293f300afd1a7b1ed5e78b2a705870c5f30893c5163be"
+checksum = "7883df5835fafdad87c0d888b266c8ec0f4c9ca48a5bed6bbb592e8dedee1b50"
 dependencies = [
  "once_cell",
  "target-lexicon",
@@ -867,9 +921,9 @@ checksum = "be6d574e0f8cab2cdd1eeeb640cbf845c974519fa9e9b62fa9c08ecece0ca5de"
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.20.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb7dec17e17766b46bca4f1a4215a85006b4c2ecde122076c562dd058da6cf1"
+checksum = "01be5843dc60b916ab4dad1dca6d20b9b4e6ddc8e15f50c47fe6d85f1fb97403"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -877,33 +931,34 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.20.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f738b4e40d50b5711957f142878cfa0f28e054aa0ebdfc3fd137a843f74ed3"
+checksum = "77b34069fc0682e11b31dbd10321cbf94808394c56fd996796ce45217dfac53c"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
  "quote",
- "syn 2.0.49",
+ "syn 2.0.60",
 ]
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.20.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fc910d4851847827daf9d6cdd4a823fbdaab5b8818325c5e97a86da79e8881f"
+checksum = "08260721f32db5e1a5beae69a55553f56b99bd0e1c3e6e0a5e8851a9d0f5a85c"
 dependencies = [
  "heck",
  "proc-macro2",
+ "pyo3-build-config",
  "quote",
- "syn 2.0.49",
+ "syn 2.0.60",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -940,9 +995,9 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.8.1"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7237101a77a10773db45d62004a272517633fbcc3df19d96455ede1122e051"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
 dependencies = [
  "either",
  "rayon-core",
@@ -969,20 +1024,21 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.11.24"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6920094eb85afde5e4a138be3f2de8bbdf28000f0029e72c45025a56b042251"
+checksum = "3e6cc1e89e689536eb5aeede61520e874df5a4707df811cd5da4aa5fbb2aae19"
 dependencies = [
  "base64",
  "bytes",
- "encoding_rs",
+ "futures-channel",
  "futures-core",
  "futures-util",
- "h2",
  "http",
  "http-body",
+ "http-body-util",
  "hyper",
  "hyper-rustls",
+ "hyper-util",
  "ipnet",
  "js-sys",
  "log",
@@ -992,11 +1048,11 @@ dependencies = [
  "pin-project-lite",
  "rustls",
  "rustls-pemfile",
+ "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper",
- "system-configuration",
  "tokio",
  "tokio-rustls",
  "tower-service",
@@ -1010,16 +1066,17 @@ dependencies = [
 
 [[package]]
 name = "ring"
-version = "0.17.7"
+version = "0.17.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "688c63d65483050968b2a8937f7995f443e27041a0f7700aa59b0822aedebb74"
+checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
 dependencies = [
  "cc",
+ "cfg-if",
  "getrandom",
  "libc",
  "spin",
  "untrusted",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1036,40 +1093,50 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustls"
-version = "0.21.10"
+version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
+checksum = "99008d7ad0bbbea527ec27bddbc0e432c5b87d8175178cee68d2eec9c4a1813c"
 dependencies = [
  "log",
  "ring",
+ "rustls-pki-types",
  "rustls-webpki",
- "sct",
+ "subtle",
+ "zeroize",
 ]
 
 [[package]]
 name = "rustls-pemfile"
-version = "1.0.4"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
 dependencies = [
  "base64",
+ "rustls-pki-types",
 ]
 
 [[package]]
+name = "rustls-pki-types"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecd36cc4259e3e4514335c4a138c6b43171a8d61d8f5c9348f9fc7529416f247"
+
+[[package]]
 name = "rustls-webpki"
-version = "0.101.7"
+version = "0.102.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+checksum = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610"
 dependencies = [
  "ring",
+ "rustls-pki-types",
  "untrusted",
 ]
 
 [[package]]
 name = "ryu"
-version = "1.0.16"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f98d2aa92eebf49b69786be48e4477826b256916e84a57ff2a4f21923b48eb4c"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 
 [[package]]
 name = "scopeguard"
@@ -1078,29 +1145,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
-name = "sct"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring",
- "untrusted",
-]
-
-[[package]]
 name = "selectors"
 version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4eb30575f3638fc8f6815f448d50cb1a2e255b0897985c8c59f4d37b72a07b06"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "cssparser",
  "derive_more",
  "fxhash",
  "log",
  "new_debug_unreachable",
  "phf 0.10.1",
- "phf_codegen",
+ "phf_codegen 0.10.0",
  "precomputed-hash",
  "servo_arc",
  "smallvec",
@@ -1108,38 +1165,38 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.21"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0"
+checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "serde"
-version = "1.0.196"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "870026e60fa08c69f064aa766c10f10b1d62db9ccd4d0abb206472bee0ce3b32"
+checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.196"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33c85360c95e7d137454dc81d9a4ed2b8efd8fbe19cee57357b32b9771fccb67"
+checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.49",
+ "syn 2.0.60",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.113"
+version = "1.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69801b70b1c3dac963ecb03a364ba0ceda9cf60c71cfe475e99864759c8b8a79"
+checksum = "3e17db7126d17feb94eb3fad46bf1a96b034e8aacbc2e775fe81505f8b0b2813"
 dependencies = [
  "itoa",
  "ryu",
@@ -1193,18 +1250,18 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "socket2"
-version = "0.5.5"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b5fac59a5cb5dd637972e5fca70daf0523c9067fcdc4842f053dae04a18f8e9"
+checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
 dependencies = [
  "libc",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1246,6 +1303,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "subtle"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
+
+[[package]]
 name = "syn"
 version = "1.0.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1258,9 +1321,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.49"
+version = "2.0.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "915aea9e586f80826ee59f8453c1101f9d1c4b3964cd2460185ee8e299ada496"
+checksum = "909518bc7b1c9b779f1bbf07f2929d35af9f0f37e47c6e9ef7f9dddc1e1821f3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1274,31 +1337,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
 [[package]]
-name = "system-configuration"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
-dependencies = [
- "bitflags 1.3.2",
- "core-foundation",
- "system-configuration-sys",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
 name = "target-lexicon"
-version = "0.12.13"
+version = "0.12.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69758bda2e78f098e4ccb393021a0963bb3442eac05f135c30f61b7370bbafae"
+checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
 
 [[package]]
 name = "tendril"
@@ -1328,9 +1370,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.36.0"
+version = "1.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
+checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
 dependencies = [
  "backtrace",
  "bytes",
@@ -1339,34 +1381,21 @@ dependencies = [
  "num_cpus",
  "pin-project-lite",
  "socket2",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.24.1"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
 dependencies = [
  "rustls",
+ "rustls-pki-types",
  "tokio",
 ]
 
 [[package]]
-name = "tokio-util"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
-dependencies = [
- "bytes",
- "futures-core",
- "futures-sink",
- "pin-project-lite",
- "tokio",
- "tracing",
-]
-
-[[package]]
 name = "toml"
 version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1401,6 +1430,28 @@ dependencies = [
 ]
 
 [[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project",
+ "pin-project-lite",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
+
+[[package]]
 name = "tower-service"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1412,6 +1463,7 @@ version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-core",
 ]
@@ -1445,9 +1497,9 @@ checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
 dependencies = [
  "tinyvec",
 ]
@@ -1482,6 +1534,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
 [[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
 name = "want"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1498,9 +1556,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1e124130aee3fb58c5bdd6b639a0509486b0338acaaae0c84a5124b0f588b7f"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -1508,24 +1566,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e7e1900c352b609c8488ad12639a311045f40a35491fb69ba8c12f758af70b"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.49",
+ "syn 2.0.60",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.41"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877b9c3f61ceea0e56331985743b13f3d25c406a7098d45180fb5f09bc19ed97"
+checksum = "76bc14366121efc8dbb487ab05bcc9d346b3b5ec0eaa76e46594cabbe51762c0"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -1535,9 +1593,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b30af9e2d358182b5c7449424f017eba305ed32a7010509ede96cdc4696c46ed"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1545,28 +1603,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "642f325be6301eb8107a83d12a8ac6c1e1c54345a7ef1a9261962dfefda09e66"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.49",
+ "syn 2.0.60",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
 
 [[package]]
 name = "web-sys"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96565907687f7aceb35bc5fc03770a8a0471d82e479f25832f54a0e3f4b28446"
+checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -1574,9 +1632,12 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "0.25.4"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
+checksum = "b3de34ae270483955a94f4b21bdaaeb83d508bb84a01435f393818edb0012009"
+dependencies = [
+ "rustls-pki-types",
+]
 
 [[package]]
 name = "windows-core"
@@ -1584,7 +1645,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.0",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -1597,6 +1658,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.5",
+]
+
+[[package]]
 name = "windows-targets"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1613,17 +1683,18 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.0",
- "windows_aarch64_msvc 0.52.0",
- "windows_i686_gnu 0.52.0",
- "windows_i686_msvc 0.52.0",
- "windows_x86_64_gnu 0.52.0",
- "windows_x86_64_gnullvm 0.52.0",
- "windows_x86_64_msvc 0.52.0",
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]
 
 [[package]]
@@ -1634,9 +1705,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -1646,9 +1717,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -1658,9 +1729,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -1670,9 +1747,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -1682,9 +1759,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -1694,9 +1771,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -1706,9 +1783,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 
 [[package]]
 name = "winnow"
@@ -1721,10 +1798,36 @@ dependencies = [
 
 [[package]]
 name = "winreg"
-version = "0.50.0"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5"
 dependencies = [
  "cfg-if",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.60",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
diff --git a/pkgs/development/python-modules/css-inline/default.nix b/pkgs/development/python-modules/css-inline/default.nix
index 41caa34dedacf..e3a35ec65f722 100644
--- a/pkgs/development/python-modules/css-inline/default.nix
+++ b/pkgs/development/python-modules/css-inline/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "css-inline";
-  version = "0.13.0";
+  version = "0.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Stranger6667";
     repo = "css-inline";
     rev = "python-v${version}";
-    hash = "sha256-hhjeOr7EJc4Tmn/eQ1vF0xChSIlgfSmtqi6s7WCUq00=";
+    hash = "sha256-CdR90GGPWOerXWfVeHrFLAelL+MJ9bfoB4TjKBdRSL0=";
   };
 
   postPatch = ''
@@ -42,7 +42,7 @@ buildPythonPackage rec {
       ln -s ${./Cargo.lock} Cargo.lock
     '';
     name = "${pname}-${version}";
-    hash = "sha256-noYBSwCfdpuwb55toyx4K/16Z4A0NWjnMuzwTi5g8AU=";
+    hash = "sha256-/GO7OcUl0iFgEhr8ZWZQOTNqHn7bt38PpFs0HktmAhE=";
   };
 
   nativeBuildInputs = [
@@ -67,6 +67,7 @@ buildPythonPackage rec {
 
   disabledTests = [
     # fails to connect to local server
+    "test_cache"
     "test_remote_stylesheet"
   ] ++ lib.optionals (stdenv.isDarwin) [
     # pyo3_runtime.PanicException: event loop thread panicked
diff --git a/pkgs/development/python-modules/cvxpy/default.nix b/pkgs/development/python-modules/cvxpy/default.nix
index 16a5adbf15948..0d612e3d95a58 100644
--- a/pkgs/development/python-modules/cvxpy/default.nix
+++ b/pkgs/development/python-modules/cvxpy/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "cvxpy";
-  version = "1.4.2";
+  version = "1.4.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CjhqV4jb14t7IN0HFSTsY2yPpys2KOafGrxxTI+YEeU=";
+    hash = "sha256-sbB4yMBZI60Sjn2BSwvhwzesBSYqeLdXqOb5V2SK2VM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/cython/default.nix b/pkgs/development/python-modules/cython/default.nix
index 2062ae03863ba..e73c09f40b019 100644
--- a/pkgs/development/python-modules/cython/default.nix
+++ b/pkgs/development/python-modules/cython/default.nix
@@ -24,13 +24,13 @@ let
 
 in buildPythonPackage rec {
   pname = "cython";
-  version = "3.0.9";
+  version = "3.0.10";
   pyproject = true;
 
   src = fetchPypi {
     pname = "Cython";
     inherit version;
-    hash = "sha256-otNU8FnR8FXTTPqmLFtovHisLOq2QHFI1H+1CM87pPM=";
+    hash = "sha256-3MlnOTMfuFTc9QP5RgdXbP6EiAZsYcpQ39VYNvEy3pk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/databricks-connect/default.nix b/pkgs/development/python-modules/databricks-connect/default.nix
index 2e3132fb5b50f..85e64fea78231 100644
--- a/pkgs/development/python-modules/databricks-connect/default.nix
+++ b/pkgs/development/python-modules/databricks-connect/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "databricks-connect";
-  version = "11.3.26";
+  version = "11.3.33";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YjUY4i8PtXc+fWcGjvnRbZkiINprKcS1K9HT5+86E8c=";
+    hash = "sha256-KcqJ2B2df85H/VIx4ToX0pJ7rYbjDRp3eR7jAFW67do=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/development/python-modules/dbt-core/default.nix b/pkgs/development/python-modules/dbt-core/default.nix
index e440fb6919b11..db61698ebfaa0 100644
--- a/pkgs/development/python-modules/dbt-core/default.nix
+++ b/pkgs/development/python-modules/dbt-core/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "dbt-core";
-  version = "1.7.12";
+  version = "1.7.13";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mkqtlItr6oRsF5S+CPw4fAP/INJ2yw3vcKxEYeB3ItI=";
+    hash = "sha256-uai1ihdmJpFkQqpx7edWiwwy0ek4dbclR/2OuiNbaXM=";
   };
 
   sourceRoot = "${src.name}/core";
diff --git a/pkgs/development/python-modules/dbus-python/default.nix b/pkgs/development/python-modules/dbus-python/default.nix
index be7504e5dc372..4e6f67f0a8ec9 100644
--- a/pkgs/development/python-modules/dbus-python/default.nix
+++ b/pkgs/development/python-modules/dbus-python/default.nix
@@ -1,47 +1,99 @@
-{ lib, stdenv, fetchPypi, buildPythonPackage, python, pkg-config, dbus, dbus-glib, isPyPy
-, ncurses, pygobject3, isPy3k, pythonAtLeast }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, fetchpatch
+, isPyPy
+, python
+
+# build-system
+, meson
+, meson-python
+, pkg-config
+
+# native dependencies
+, dbus
+, dbus-glib
+}:
 
 buildPythonPackage rec {
   pname = "dbus-python";
-  version = "1.2.18";
+  version = "1.3.2";
+  pyproject = true;
 
-  # ModuleNotFoundError: No module named 'distutils'
-  disabled = isPyPy || pythonAtLeast "3.12";
-  format = "other";
-  outputs = [ "out" "dev" ];
+  disabled = isPyPy;
+
+  outputs = [
+    "out"
+    "dev"
+  ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0q3jrw515z98mqdk9x822nd95rky455zz9876f1nqna5igkd3gcj";
+    hash = "sha256-rWeBkwhhi1BpU3viN/jmjKHH/Mle5KEh/mhFsUGCSPg=";
   };
 
   patches = [
-    ./fix-includedir.patch
+    # reduce required dependencies
+    # https://gitlab.freedesktop.org/dbus/dbus-python/-/merge_requests/23
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch";
+      hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU=";
+    })
   ];
 
-  preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11" && stdenv.isDarwin) ''
-    MACOSX_DEPLOYMENT_TARGET=10.16
+  postPatch = ''
+    # we provide patchelf natively, not through the python package
+    sed -i '/patchelf/d' pyproject.toml
+
+    # dont run autotols configure phase
+    rm configure.ac configure
+
+    patchShebangs test/*.sh
   '';
 
-  configureFlags = [
-    "PYTHON=${python.pythonOnBuildForHost.interpreter}"
+  nativeBuildInputs = [
+    meson
+    meson-python
+    pkg-config
   ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ dbus dbus-glib ]
-    # My guess why it's sometimes trying to -lncurses.
-    # It seems not to retain the dependency anyway.
-    ++ lib.optional (! python ? modules) ncurses;
+  buildInputs = [
+    dbus
+    dbus-glib
+  ];
 
-  doCheck = isPy3k;
-  nativeCheckInputs = [ dbus.out pygobject3 ];
+  pypaBuildFlags = [
+    # Don't discard meson build directory, still needed for tests!
+    "-Cbuild-dir=_meson-build"
+  ];
 
+  # workaround bug in meson-python
+  # https://github.com/mesonbuild/meson-python/issues/240
   postInstall = ''
-    cp -r dbus_python.egg-info $out/${python.sitePackages}/
+    mkdir -p $dev/lib
+    mv $out/${python.sitePackages}/.dbus_python.mesonpy.libs/pkgconfig/ $dev/lib
+  '';
+
+  # make sure the Cflags in the pkgconfig file are correct and make the structure backwards compatible
+  postFixup = ''
+    ln -s $dev/include/*/dbus_python/dbus-1.0/ $dev/include/dbus-1.0
+  '';
+
+  nativeCheckInputs = [
+    dbus.out
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    meson test -C _meson-build --no-rebuild --print-errorlogs
+
+    runHook postCheck
   '';
 
   meta = with lib; {
     description = "Python DBus bindings";
+    homepage = "https://gitlab.freedesktop.org/dbus/dbus-python";
     license = licenses.mit;
     platforms = dbus.meta.platforms;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/dbus-python/fix-includedir.patch b/pkgs/development/python-modules/dbus-python/fix-includedir.patch
deleted file mode 100644
index e3bb0682b5c44..0000000000000
--- a/pkgs/development/python-modules/dbus-python/fix-includedir.patch
+++ /dev/null
@@ -1,8 +0,0 @@
---- a/dbus-python.pc.in
-+++ b/dbus-python.pc.in
-@@ -9,4 +9,4 @@
- Description: Python bindings for D-Bus
- Requires: dbus-1 >= 1.0
- Version: @VERSION@
--Cflags: -I${includedir}
-+Cflags: -I${includedir}/dbus-1.0
diff --git a/pkgs/development/python-modules/dbutils/default.nix b/pkgs/development/python-modules/dbutils/default.nix
index 570f770e7777b..6ad3438704700 100644
--- a/pkgs/development/python-modules/dbutils/default.nix
+++ b/pkgs/development/python-modules/dbutils/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "dbutils";
-  version = "3.0.3";
+  version = "3.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "DBUtils";
-    hash = "sha256-jkhWWxKtK0sfIU3gKU3utLKFePWyq7QNaMKSS2TX4Ac=";
+    hash = "sha256-6lKLoRBjJA7qgjRevG98yTJMBuQulCCwC80kWpW/zCQ=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/desktop-notifier/default.nix b/pkgs/development/python-modules/desktop-notifier/default.nix
index b56a6b0849d06..708c971943ec8 100644
--- a/pkgs/development/python-modules/desktop-notifier/default.nix
+++ b/pkgs/development/python-modules/desktop-notifier/default.nix
@@ -6,6 +6,7 @@
 , packaging
 , setuptools
 , dbus-next
+, rubicon-objc
 }:
 
 buildPythonPackage rec {
@@ -30,6 +31,8 @@ buildPythonPackage rec {
     packaging
   ] ++ lib.optionals stdenv.isLinux [
     dbus-next
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    rubicon-objc
   ];
 
   # no tests available, do the imports check instead
@@ -45,6 +48,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/samschott/desktop-notifier/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ sfrijters ];
-    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/python-modules/django-auth-ldap/default.nix b/pkgs/development/python-modules/django-auth-ldap/default.nix
index 3983cf3f3661a..b2f5fa74b41c5 100644
--- a/pkgs/development/python-modules/django-auth-ldap/default.nix
+++ b/pkgs/development/python-modules/django-auth-ldap/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "django-auth-ldap";
-  version = "4.7.0";
+  version = "4.8.0";
   format = "pyproject";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jeplN2uLL6G+7lI0h2DjCC5kKTmlA4y+iBpeY4G2W4o=";
+    hash = "sha256-YEJQk43cn9phnyR8elmwsvBuU6fT9GoVbyiqMN1xpzg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-bootstrap3/default.nix b/pkgs/development/python-modules/django-bootstrap3/default.nix
index 6a29fc7630aa1..4ac4695bd16c3 100644
--- a/pkgs/development/python-modules/django-bootstrap3/default.nix
+++ b/pkgs/development/python-modules/django-bootstrap3/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "django-bootstrap3";
-  version = "23.6";
+  version = "24.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "zostera";
     repo = "django-bootstrap3";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qqG9w0bQYoQgWXCks/WwwQVoh2DhIMLaFXDQ4z6D84g=";
+    hash = "sha256-5nBJ5vfsoGoaG1s3K1hCHcSnGf51ZirYYg+uJGsBmG8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-bootstrap4/default.nix b/pkgs/development/python-modules/django-bootstrap4/default.nix
index b0a11d9044d37..d148162b9ab09 100644
--- a/pkgs/development/python-modules/django-bootstrap4/default.nix
+++ b/pkgs/development/python-modules/django-bootstrap4/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "django-bootstrap4";
-  version = "24.1";
+  version = "24.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "zostera";
     repo = "django-bootstrap4";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TCHie5h/VRJ9NSg7wKnWotFHm328kxIp+xFXEa8wL1c=";
+    hash = "sha256-sZY/0f1PbYQu9fN65H6H7xLvsdE9AXK0cMt9TyAKuUw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-bootstrap5/default.nix b/pkgs/development/python-modules/django-bootstrap5/default.nix
index 76405e9e5cd61..ac983c5ac5e4d 100644
--- a/pkgs/development/python-modules/django-bootstrap5/default.nix
+++ b/pkgs/development/python-modules/django-bootstrap5/default.nix
@@ -4,35 +4,53 @@
 , pythonOlder
 
 # build-system
-, hatchling
+, setuptools
+, setuptools-scm
 
 # dependencies
+, django
+
+# tests
 , beautifulsoup4
 , pillow
-, django
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-bootstrap5";
-  version = "23.3";
-  format = "pyproject";
+  version = "24.1";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "zostera";
     repo = "django-bootstrap5";
     rev = "v${version}";
-    hash = "sha256-FIwDyZ5I/FSaEiQKRfanzAGij86u8y85Wal0B4TrI7c=";
+    hash = "sha256-JbmwEPkj34tsK3tUtb56FPjU0emwERVXEc4fzlepdXY=";
   };
 
-  nativeBuildInputs = [
-    hatchling
+  build-system = [
+    setuptools
+    setuptools-scm
   ];
 
-  propagatedBuildInputs = [
-    django
+  nativeCheckInputs = [
     beautifulsoup4
+    (django.override { withGdal = true; })
     pillow
+    pytest-django
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE=tests.app.settings
+  '';
+
+  disabledTests = [
+    # urllib.error.URLError: <urlopen error [Errno -3] Temporary failure in name resolution>
+    "test_get_bootstrap_setting"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/django-configurations/default.nix b/pkgs/development/python-modules/django-configurations/default.nix
index 087ffab301391..53d75bed9bfa1 100644
--- a/pkgs/development/python-modules/django-configurations/default.nix
+++ b/pkgs/development/python-modules/django-configurations/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "django-configurations";
-  version = "2.5";
+  version = "2.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Y/olLEDciOoXuLkPX0oxonJuWGrLH/Dtx0wijGHxnl0=";
+    hash = "sha256-blCDdX4rvfm7eFBWdTa5apNRX2sXUD10ko/2KNsuDpQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index 026788caf646e..094ca8a6d91da 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -2,7 +2,10 @@
 , buildPythonPackage
 , fetchPypi
 
-# propagates
+# build-system
+, pdm-backend
+
+# dependencies
 , django-gravatar2
 , django-allauth
 , mailmanclient
@@ -17,20 +20,20 @@
 
 buildPythonPackage rec {
   pname = "django-mailman3";
-  version = "1.3.11";
-  format = "setuptools";
+  version = "1.3.12";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-uIjJaZHWL2evj+oISLprvKWT5Sm5f2EKgUD1twL1VbQ=";
+    pname = "django_mailman3";
+    inherit version;
+    hash = "sha256-MnQlT5ElNnStLUKyOXnI7ZDDaBwfp+h9tbOC+cwB0es=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace 'django>=3.2,<4.2' 'django>=3.2,<4.3'
-  '';
+  build-system = [
+    pdm-backend
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     django-allauth
     django-gravatar2
     mailmanclient
@@ -43,6 +46,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE=django_mailman3.tests.settings_test
+  '';
+
   pythonImportsCheck = [
     "django_mailman3"
   ];
diff --git a/pkgs/development/python-modules/dkimpy/default.nix b/pkgs/development/python-modules/dkimpy/default.nix
index 6b639f8cc8c3e..541c3bef56e92 100644
--- a/pkgs/development/python-modules/dkimpy/default.nix
+++ b/pkgs/development/python-modules/dkimpy/default.nix
@@ -3,12 +3,12 @@
 
 buildPythonPackage rec {
   pname = "dkimpy";
-  version = "1.1.5";
+  version = "1.1.6";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mmZ/hmS3Lrn4qhJQsHV8w5gqto9wxIrzkxe1jPYvLXU=";
+    hash = "sha256-DOctlh9EPo+fBWlLNUVC3uU04I4rjFtgxi1drKfB2g8=";
 };
 
   nativeCheckInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/docplex/default.nix b/pkgs/development/python-modules/docplex/default.nix
index 2f5c485cf631d..29395e91a5f1d 100644
--- a/pkgs/development/python-modules/docplex/default.nix
+++ b/pkgs/development/python-modules/docplex/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "docplex";
-  version = "2.25.236";
+  version = "2.27.239";
   format = "setuptools";
 
   # No source available from official repo
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JWkUtMAROk4cePMuogx9dtyO/ihv6JAnDnXPrVD+UQ8=";
+    hash = "sha256-Ug5+jDBBbamqd0JebzHvjLZoTRRPYWQiJl6g8BK0aMQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/docutils/default.nix b/pkgs/development/python-modules/docutils/default.nix
index 136f679fcf6e2..161e5361c1c14 100644
--- a/pkgs/development/python-modules/docutils/default.nix
+++ b/pkgs/development/python-modules/docutils/default.nix
@@ -1,24 +1,36 @@
 { stdenv
 , lib
-, fetchPypi
+, fetchgit
 , buildPythonPackage
+, flit-core
+, pillow
 , python
 , pythonOlder
 }:
 
-buildPythonPackage rec {
+let self = buildPythonPackage rec {
   pname = "docutils";
-  version = "0.20.1";
+  version = "0.21.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-8IpOJ2w6FYOobc4+NKuj/gTQK7ot1R7RYQYkToqSPjs=";
+  src = fetchgit {
+    url = "git://repo.or.cz/docutils.git";
+    rev = "docutils-${version}";
+    hash = "sha256-ahnj6iKjyUCDxhgxJdwEb8huFIGpbuuLQBHDzKj6O9E=";
   };
 
+  build-system = [ flit-core ];
+
+  # infinite recursion via sphinx and pillow
+  doCheck = false;
+  passthru.tests.pytest = self.overridePythonAttrs { doCheck = true; };
+
+  nativeCheckInputs = [
+    pillow
+  ];
+
   # Only Darwin needs LANG, but we could set it in general.
   # It's done here conditionally to prevent mass-rebuilds.
   checkPhase = lib.optionalString stdenv.isDarwin ''LANG="en_US.UTF-8" LC_ALL="en_US.UTF-8" '' + ''
@@ -38,4 +50,5 @@ buildPythonPackage rec {
     license = with licenses; [ publicDomain bsd2 psfl gpl3Plus ];
     maintainers = with maintainers; [ AndersonTorres ];
   };
-}
+};
+in self
diff --git a/pkgs/development/python-modules/dogtail/default.nix b/pkgs/development/python-modules/dogtail/default.nix
index d0b7e983a0994..5186d95670584 100644
--- a/pkgs/development/python-modules/dogtail/default.nix
+++ b/pkgs/development/python-modules/dogtail/default.nix
@@ -11,7 +11,7 @@
 , fetchurl
 , dbus
 , xvfb-run
-, wrapGAppsHook
+, wrapGAppsHook3
 # , fetchPypi
 }:
 
@@ -36,7 +36,7 @@ buildPythonPackage {
     ./nix-support.patch
   ];
 
-  nativeBuildInputs = [ gobject-introspection dbus xvfb-run wrapGAppsHook ]; # for setup hooks
+  nativeBuildInputs = [ gobject-introspection dbus xvfb-run wrapGAppsHook3 ]; # for setup hooks
   propagatedBuildInputs = [ at-spi2-core gtk3 pygobject3 pyatspi pycairo ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/domeneshop/default.nix b/pkgs/development/python-modules/domeneshop/default.nix
index b266412219b42..ab01424c09405 100644
--- a/pkgs/development/python-modules/domeneshop/default.nix
+++ b/pkgs/development/python-modules/domeneshop/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, setuptools
 , urllib3
 , pyopenssl
 , cryptography
@@ -12,7 +13,7 @@
 buildPythonPackage rec {
   pname = "domeneshop";
   version = "0.4.3";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.4";
 
@@ -21,7 +22,11 @@ buildPythonPackage rec {
     hash = "sha256-kL0X1mEsmVWqnq5NgsMBxeAu48zjmi3muhZYryTCOMo=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  dependencies = [
     certifi
     urllib3
   ];
diff --git a/pkgs/development/python-modules/duckdb-engine/default.nix b/pkgs/development/python-modules/duckdb-engine/default.nix
index 955334bdf283d..be851c7e16fa9 100644
--- a/pkgs/development/python-modules/duckdb-engine/default.nix
+++ b/pkgs/development/python-modules/duckdb-engine/default.nix
@@ -6,7 +6,9 @@
 , duckdb
 , hypothesis
 , ipython-sql
+, pandas
 , poetry-core
+, pytest-remotedata
 , snapshottest
 , sqlalchemy
 , typing-extensions
@@ -14,20 +16,18 @@
 
 buildPythonPackage rec {
   pname = "duckdb-engine";
-  version = "0.11.2";
+  version = "0.12.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     repo = "duckdb_engine";
     owner = "Mause";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yW1gaZ0B6JNX98KzAxf146goniNmWnkMUmJRrScot1w=";
+    hash = "sha256-cm0vbz0VZ2Ws6FDWJO16q4KZW2obs0CBNrfY9jmR+6A=";
   };
 
-  patches = [ ./remote_data.patch ];
-
   nativeBuildInputs = [
     poetry-core
   ];
@@ -42,24 +42,27 @@ buildPythonPackage rec {
   '';
 
   disabledTests = [
-    # this test tries to download the httpfs extension
-    "test_preload_extension"
-    "test_motherduck"
     # test should be skipped based on sqlalchemy version but isn't and fails
     "test_commit"
-    # rowcount no longer generates an attribute error.
-    "test_rowcount"
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
+  ];
+
+  checkInputs = [
     hypothesis
     ipython-sql
-    # TODO(cpcloud): include pandas here when it supports sqlalchemy 2.0
+    pandas
+    pytest-remotedata
     snapshottest
     typing-extensions
   ];
 
+  pytestFlagsArray = [
+    "-m" "'not remote_data'"
+  ];
+
   pythonImportsCheck = [
     "duckdb_engine"
   ];
diff --git a/pkgs/development/python-modules/duckdb-engine/remote_data.patch b/pkgs/development/python-modules/duckdb-engine/remote_data.patch
deleted file mode 100644
index 1c887acf6caea..0000000000000
--- a/pkgs/development/python-modules/duckdb-engine/remote_data.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/duckdb_engine/tests/test_basic.py b/duckdb_engine/tests/test_basic.py
-index 302636f..ed20f12 100644
---- a/duckdb_engine/tests/test_basic.py
-+++ b/duckdb_engine/tests/test_basic.py
-@@ -183,7 +183,6 @@ def test_get_views(engine: Engine) -> None:
- 
- 
- @mark.skipif(os.uname().machine == "aarch64", reason="not supported on aarch64")
--@mark.remote_data
- def test_preload_extension() -> None:
-     duckdb.default_connection.execute("INSTALL httpfs")
-     engine = create_engine(
-diff --git a/duckdb_engine/tests/test_integration.py b/duckdb_engine/tests/test_integration.py
-index 349c976..bf3dbaa 100644
---- a/duckdb_engine/tests/test_integration.py
-+++ b/duckdb_engine/tests/test_integration.py
-@@ -24,7 +24,6 @@ def test_integration(engine: Engine) -> None:
-         conn.execute(text("select * from test_df"))
- 
- 
--@mark.remote_data
- @mark.skipif(
-     "dev" in duckdb.__version__, reason="md extension not available for dev builds"  # type: ignore[attr-defined]
- )
diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index 83fd0bbb6908e..34f20998ef3d5 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     # 2. default to extension autoload & autoinstall disabled
     substituteInPlace setup.py \
       --replace-fail "ParallelCompile()" 'ParallelCompile("NIX_BUILD_CORES")' \
-      --replace-fail "define_macros.extend([('DUCKDB_EXTENSION_AUTOLOAD_DEFAULT', '1'), ('DUCKDB_EXTENSION_AUTOINSTALL_DEFAULT', '1')])" ""
+      --replace-fail "define_macros.extend([('DUCKDB_EXTENSION_AUTOLOAD_DEFAULT', '1'), ('DUCKDB_EXTENSION_AUTOINSTALL_DEFAULT', '1')])" "pass"
   '';
 
   env = {
@@ -34,8 +34,6 @@ buildPythonPackage rec {
     OVERRIDE_GIT_DESCRIBE="v${version}-0-g${rev}";
   };
 
-  dontPretendSetuptoolsSCMVersion = true;
-
   nativeBuildInputs = [
     pybind11
     setuptools-scm
diff --git a/pkgs/development/python-modules/dulwich/default.nix b/pkgs/development/python-modules/dulwich/default.nix
index 49789421af346..65a4eb19d88d9 100644
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@@ -76,6 +76,8 @@ buildPythonPackage rec {
     "test_cyrillic"
     # OSError: [Errno 84] Invalid or incomplete multibyte or wide character: b'/build/tmpfseetobk/test/\xc0'
     "test_commit_no_encode_decode"
+    # https://github.com/jelmer/dulwich/issues/1279
+    "test_init_connector"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/dwdwfsapi/default.nix b/pkgs/development/python-modules/dwdwfsapi/default.nix
index 58b62032e33bc..824d23cbe23ea 100644
--- a/pkgs/development/python-modules/dwdwfsapi/default.nix
+++ b/pkgs/development/python-modules/dwdwfsapi/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, hatchling
 , requests
 , ciso8601
 , pythonOlder
@@ -8,17 +9,21 @@
 
 buildPythonPackage rec {
   pname = "dwdwfsapi";
-  version = "1.0.7";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7le1F+581JwrBX/C1aaqsDaSpIt0yNsNKiGnJtHUg5s=";
+    hash = "sha256-7dIVD+4MiYtsjAM5j67MlbiUN2Q5DpK6bUU0ZuHN2rk=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
     requests
     ciso8601
   ];
diff --git a/pkgs/development/python-modules/ecdsa/default.nix b/pkgs/development/python-modules/ecdsa/default.nix
index 2ce07e5b6b2b8..3380d0f096167 100644
--- a/pkgs/development/python-modules/ecdsa/default.nix
+++ b/pkgs/development/python-modules/ecdsa/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "ecdsa";
-  version = "0.18.0";
+  version = "0.19.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GQNIBBVZ4hsiodZc7khSgsoRpvgdUD/duE1QF+ntHkk=";
+    hash = "sha256-YOqtEZllmQDdCvUh7UYreTu9+GdDKzlI6HQWrkyva/g=";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/elastic-transport/default.nix b/pkgs/development/python-modules/elastic-transport/default.nix
index ac2acebc6f7f1..c4f6b0435e84e 100644
--- a/pkgs/development/python-modules/elastic-transport/default.nix
+++ b/pkgs/development/python-modules/elastic-transport/default.nix
@@ -4,19 +4,24 @@
 , certifi
 , fetchFromGitHub
 , mock
+, opentelemetry-api
+, opentelemetry-sdk
+, orjson
 , pytest-asyncio
 , pytest-httpserver
 , pytestCheckHook
 , pythonOlder
 , requests
+, respx
+, setuptools
 , trustme
 , urllib3
 }:
 
 buildPythonPackage rec {
   pname = "elastic-transport";
-  version = "8.12.0";
-  format = "setuptools";
+  version = "8.13.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -24,7 +29,7 @@ buildPythonPackage rec {
     owner = "elastic";
     repo = "elastic-transport-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZLzaCiopdkhpqjzZzv/NT1+f5bHZYuqQvSgM5jeMaqg=";
+    hash = "sha256-KmZCaAbzbfqbPwFuF43ckwgVhZVbPvwjF7uqPKHml9Q=";
   };
 
   postPatch = ''
@@ -32,6 +37,10 @@ buildPythonPackage rec {
       --replace " --cov-report=term-missing --cov=elastic_transport" ""
   '';
 
+  build-system = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     urllib3
     certifi
@@ -40,10 +49,14 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     aiohttp
     mock
+    opentelemetry-api
+    opentelemetry-sdk
+    orjson
     pytest-asyncio
     pytest-httpserver
     pytestCheckHook
     requests
+    respx
     trustme
   ];
 
diff --git a/pkgs/development/python-modules/elasticsearch/default.nix b/pkgs/development/python-modules/elasticsearch/default.nix
index a89cb3f0a4c5e..12aac19267e8c 100644
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch";
-  version = "8.12.1";
+  version = "8.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-AMmXcg+9Dyr+VBfIGTz2XRFoF6AlDeBSHjDD6B8AuKw=";
+    sha256 = "sha256-5Ovrsi0J8O+DnCa2qpjhnM1ja8t38IwStWKwLKzV50Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/elasticsearch8/default.nix b/pkgs/development/python-modules/elasticsearch8/default.nix
index c83de92d03bf4..c1fa2c91372cc 100644
--- a/pkgs/development/python-modules/elasticsearch8/default.nix
+++ b/pkgs/development/python-modules/elasticsearch8/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch8";
-  version = "8.12.1";
+  version = "8.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RuL1zYmEZEaaXb2LEW+BUmo7TcdGHH/5fjgesxXtbls=";
+    hash = "sha256-NWg+/dr8jXCCLeXBAXY1yL6/2CB0xCO5tswY4y/5erw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/execnet/default.nix b/pkgs/development/python-modules/execnet/default.nix
index eb184c180d5b9..76f9b9b4df651 100644
--- a/pkgs/development/python-modules/execnet/default.nix
+++ b/pkgs/development/python-modules/execnet/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "execnet";
-  version = "2.0.2";
+  version = "2.1.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zFm8RCN0L9ca0icSLrDdRNtR77PcQJW0WsmgjHcAlq8=";
+    hash = "sha256-UYm1LGEhwk/q4ogWarQbMlScfiNIZSc2VAuebn1OcuM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
index ec667330a62bc..c0944e473fe7a 100644
--- a/pkgs/development/python-modules/faker/default.nix
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "faker";
-  version = "24.0.0";
+  version = "24.11.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "Faker";
     inherit version;
-    hash = "sha256-6m94TEBzDeD3cGfknnjN1ZDvsAvsPTP1d0kiYiBsF/w=";
+    hash = "sha256-NLlHWBwrztNAw5s1+J2/rE81aTLP/4/ok73oVJA/Dm4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 67193638dd5a6..92850c336bba7 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -38,7 +38,7 @@
 
 buildPythonPackage rec {
   pname = "fastapi";
-  version = "0.110.0";
+  version = "0.110.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     owner = "tiangolo";
     repo = "fastapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-OXWJ1PKJSJGzYNT8HHXvxMxjUtI4K6edpI+Z5B3TvhI=";
+    hash = "sha256-qUh5exkXVRcKIO0t4KIOZhhpsftj3BrWaL2asf8RqUI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ffmpy/default.nix b/pkgs/development/python-modules/ffmpy/default.nix
index 8e00a4678ebff..974e2bcd8fdac 100644
--- a/pkgs/development/python-modules/ffmpy/default.nix
+++ b/pkgs/development/python-modules/ffmpy/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   postPatch = ''
     # default to store ffmpeg
     substituteInPlace ffmpy.py \
-      --replace 'executable="ffmpeg",' 'executable="${ffmpeg-headless}/bin/ffmpeg",'
+      --replace-fail 'executable="ffmpeg",' 'executable="${ffmpeg-headless}/bin/ffmpeg",'
 
     #  The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail.
     for fname in tests/*.py; do
diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index b32335bb24754..5b739bcc8fda4 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "3.13.1";
+  version = "3.13.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Uh9fVsUPhCb14DrTsoG0kKh+8VvGxSbxaCkPDHFI1E4=";
+    hash = "sha256-0T9GZhi/3nK9LBglXiafclQsbnDnusg6AjLWscxcjPQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flake8-bugbear/default.nix b/pkgs/development/python-modules/flake8-bugbear/default.nix
index 75af6d9b9757d..5a6305744dbd8 100644
--- a/pkgs/development/python-modules/flake8-bugbear/default.nix
+++ b/pkgs/development/python-modules/flake8-bugbear/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "flake8-bugbear";
-  version = "24.4.21";
+  version = "24.4.26";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-6jKVKVJuNpdKLzl2dTkr1cvArGWCWvuhyjww05r9W/c=";
+    hash = "sha256-jJ4/l2nzjqJDCe1pFrdkMvB5WJ+GJarOHgGZSzCS6nc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask/default.nix b/pkgs/development/python-modules/flask/default.nix
index 8c60066b1975d..77d26dc24b824 100644
--- a/pkgs/development/python-modules/flask/default.nix
+++ b/pkgs/development/python-modules/flask/default.nix
@@ -31,12 +31,12 @@
 
 buildPythonPackage rec {
   pname = "flask";
-  version = "3.0.2";
+  version = "3.0.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-giwD9LeZIEJQp+6Ese3cQGZTlTM5c9+53uv+Ql/vy30=";
+    hash = "sha256-zrJ7CvOCPqJzeSik2Z0SWgYXW4USxEXL2anOIA73aEI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flexmock/default.nix b/pkgs/development/python-modules/flexmock/default.nix
index 45b2981ba9596..7ec46f29da6f5 100644
--- a/pkgs/development/python-modules/flexmock/default.nix
+++ b/pkgs/development/python-modules/flexmock/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "flexmock";
-  version = "0.12.0";
+  version = "0.12.1";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YdBvPRRCuBW3qoWh9HvoONBW9fXRTO/teuv7A0c9FKs=";
+    hash = "sha256-ILaQr6T/jG8xVI2JbW1BzKH8kFCkz2KLll6kNOxUjuM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fontbakery/default.nix b/pkgs/development/python-modules/fontbakery/default.nix
index 3076e6a4c469c..7ac5f86b1ee2a 100644
--- a/pkgs/development/python-modules/fontbakery/default.nix
+++ b/pkgs/development/python-modules/fontbakery/default.nix
@@ -47,11 +47,11 @@
 
 buildPythonPackage rec {
   pname = "fontbakery";
-  version = "0.11.2";
+  version = "0.12.2";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-61EXlf+d5kJeUF41OEnGNLaOcSvFWUDFgarVvHQZYmw=";
+    hash = "sha256-sHkTxu8TdPXbUZvpJH46SF8U4JNIzfFb5HJEXCqomOI=";
   };
 
   pyproject = true;
diff --git a/pkgs/development/python-modules/fontmake/default.nix b/pkgs/development/python-modules/fontmake/default.nix
index 7911750bbeeb5..d46083361e80a 100644
--- a/pkgs/development/python-modules/fontmake/default.nix
+++ b/pkgs/development/python-modules/fontmake/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "fontmake";
-  version = "3.8.1";
+  version = "3.9.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-m0cRLm9Jbqlsf9NwR7Lma2NZYUjy5IDJYOorVbdLDuw=";
+    hash = "sha256-KrfT0fvE1fhaM2RH4LqRUda7yMHg2T59UdGi3SSZP7s=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/frozendict/default.nix b/pkgs/development/python-modules/frozendict/default.nix
index e1ded2da5f9b5..5405e570ed8dc 100644
--- a/pkgs/development/python-modules/frozendict/default.nix
+++ b/pkgs/development/python-modules/frozendict/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 , pythonAtLeast
 , pythonOlder
@@ -9,7 +10,7 @@
 buildPythonPackage rec {
   pname = "frozendict";
   version = "2.4.2";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -32,6 +33,10 @@ buildPythonPackage rec {
     fi
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/gamble/default.nix b/pkgs/development/python-modules/gamble/default.nix
index 6cdfc4410b34e..c4bb320271023 100644
--- a/pkgs/development/python-modules/gamble/default.nix
+++ b/pkgs/development/python-modules/gamble/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "gamble";
-  version = "0.11";
+  version = "0.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zsEBqhKidgO1e0lpKhw+LY75I2Df+IefNLaSkBBFKFU=";
+    hash = "sha256-P0w1Q1Kus742Yu/MpqheEbp1+Pt21f163JWZfKJj3SA=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/gekko/default.nix b/pkgs/development/python-modules/gekko/default.nix
index 24fd7423b8c39..d62c1f3dbfd1b 100644
--- a/pkgs/development/python-modules/gekko/default.nix
+++ b/pkgs/development/python-modules/gekko/default.nix
@@ -33,6 +33,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/BYU-PRISM/GEKKO";
     changelog = "https://github.com/BYU-PRISM/GEKKO/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ ayes-web ];
+    maintainers = with maintainers; [ BatteredBunny ];
   };
 }
diff --git a/pkgs/development/python-modules/geopandas/default.nix b/pkgs/development/python-modules/geopandas/default.nix
index 522e0f6e59e33..f786d3b252938 100644
--- a/pkgs/development/python-modules/geopandas/default.nix
+++ b/pkgs/development/python-modules/geopandas/default.nix
@@ -2,20 +2,22 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, setuptools
+
 , fiona
 , packaging
 , pandas
 , pyproj
-, pytestCheckHook
-, pythonOlder
 , rtree
 , shapely
 }:
 
 buildPythonPackage rec {
   pname = "geopandas";
-  version = "0.14.3";
-  format = "setuptools";
+  version = "0.14.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
@@ -23,9 +25,13 @@ buildPythonPackage rec {
     owner = "geopandas";
     repo = "geopandas";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qAINoqnCVfpg2mQhnu0qT/5EjUB+9a3//H8vJJnyj6A=";
+    hash = "sha256-FBhPcae8bnNnsfr14I1p22VhoOf9USF9DAcrAqx+zso=";
   };
 
+  build-system = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     fiona
     packaging
diff --git a/pkgs/development/python-modules/geventhttpclient/default.nix b/pkgs/development/python-modules/geventhttpclient/default.nix
index 1943888df752b..d61e390135c3d 100644
--- a/pkgs/development/python-modules/geventhttpclient/default.nix
+++ b/pkgs/development/python-modules/geventhttpclient/default.nix
@@ -3,10 +3,12 @@
 , buildPythonPackage
 , certifi
 , dpkt
-, fetchPypi
+, fetchFromGitHub
 , gevent
+, llhttp
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , six
 , stdenv
 , urllib3
@@ -14,27 +16,34 @@
 
 buildPythonPackage rec {
   pname = "geventhttpclient";
-  version = "2.0.12";
-  format = "setuptools";
+  version = "2.3.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-6+oI55wap9A7Q5NrNHwPhzVub7HGhFc1oR8jyUnGVfc=";
+  src = fetchFromGitHub {
+    owner = "geventhttpclient";
+    repo = "geventhttpclient";
+    rev = "refs/tags/${version}";
+    # TODO: unvendor llhttp
+    fetchSubmodules = true;
+    hash = "sha256-uOGnwPbvTam14SFTUT0UrwxHfP4a5cn3a7EhLoGBUrA=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     brotli
     certifi
     gevent
-    six
+    urllib3
   ];
 
   nativeCheckInputs = [
     dpkt
     pytestCheckHook
-    urllib3
   ];
 
   # lots of: [Errno 48] Address already in use: ('127.0.0.1', 54323)
@@ -42,15 +51,12 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
-  disabledTests = [
-    # socket.gaierror: [Errno -3] Temporary failure in name resolution
-    "test_client_simple"
-    "test_client_without_leading_slas"
-    "test_request_with_headers"
-    "test_response_context_manager"
-    "test_client_ssl"
-    "test_ssl_fail_invalid_certificate"
-    "test_multi_queries_greenlet_safe"
+  preCheck = ''
+    rm -rf geventhttpclient
+  '';
+
+  pytestFlagsArray = [
+    "-m 'not network'"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/glyphsets/default.nix b/pkgs/development/python-modules/glyphsets/default.nix
index f59e7f09607d7..5decc00464a32 100644
--- a/pkgs/development/python-modules/glyphsets/default.nix
+++ b/pkgs/development/python-modules/glyphsets/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "glyphsets";
-  version = "0.6.14";
+  version = "0.6.19";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lMRgchadgKyfFLw6ZF1sJAKBAK75zmw77L34MW9p7TI=";
+    hash = "sha256-vO9gzMCXPlkkM9MtRhlulAnQi6uZMtJU1NqcP8w6tCo=";
   };
 
   dependencies = [
diff --git a/pkgs/development/python-modules/google-auth/default.nix b/pkgs/development/python-modules/google-auth/default.nix
index efe5dcd33541d..b8ff0805b01e8 100644
--- a/pkgs/development/python-modules/google-auth/default.nix
+++ b/pkgs/development/python-modules/google-auth/default.nix
@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "google-auth";
-  version = "2.28.1";
+  version = "2.29.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NPwwRsJXztzxYi/Esx/Cvnkj2bTUSXPUgRJezFDYOIU=";
+    hash = "sha256-Zy3/My0HMidVD/x0V4aKxCGNbFALFV/mzBfSsTYCw2A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-iam/default.nix b/pkgs/development/python-modules/google-cloud-iam/default.nix
index 93c85687dd4cc..c5b192169bef4 100644
--- a/pkgs/development/python-modules/google-cloud-iam/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam";
-  version = "2.14.3";
+  version = "2.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yC6ZP4qSGcW6H84TnDSu1vAZ3V+bRc6VbVQwWD0q8m4=";
+    hash = "sha256-6TgaGCPlFi9owoBI/xowe6Og5Tja9getfUHP47dWpvA=";
   };
 
   propagatedBuildInputs = [
@@ -34,6 +34,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTestPaths =[
+    # unmaintained, reference wrong import path for google.cloud.iam.v1
+    "tests/unit/gapic/iam_admin_v1/test_iam.py"
+  ];
+
   pythonImportsCheck = [
     "google.cloud.iam_credentials"
     "google.cloud.iam_credentials_v1"
diff --git a/pkgs/development/python-modules/google-cloud-kms/default.nix b/pkgs/development/python-modules/google-cloud-kms/default.nix
index 45fd8082d3d05..2dec1cea50a31 100644
--- a/pkgs/development/python-modules/google-cloud-kms/default.nix
+++ b/pkgs/development/python-modules/google-cloud-kms/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-kms";
-  version = "2.21.3";
+  version = "2.21.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XofVp7fY9bXJ8PZI81KniGlRqLTHJwPrnOe6gHb8JTM=";
+    hash = "sha256-AQW8FKOYt/05GUO766/VkY8+NAaCepiXObLcOInMEhg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/govee-local-api/default.nix b/pkgs/development/python-modules/govee-local-api/default.nix
index 03501fa0cbcf3..6cf2fa9b29c20 100644
--- a/pkgs/development/python-modules/govee-local-api/default.nix
+++ b/pkgs/development/python-modules/govee-local-api/default.nix
@@ -1,10 +1,11 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, poetry-core
-, poetry-dynamic-versioning
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  poetry-dynamic-versioning,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -21,21 +22,17 @@ buildPythonPackage rec {
     hash = "sha256-J4SG4n6LIZ/G6pEXAzliV7uTWzqsH7rtFe3Y7BJ2dWE=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
     poetry-dynamic-versioning
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [
-    "govee_local_api"
-  ];
+  pythonImportsCheck = [ "govee_local_api" ];
 
   meta = with lib; {
-    description = "";
+    description = "Library to communicate with Govee local API";
     homepage = "https://github.com/Galorhallen/govee-local-api";
     changelog = "https://github.com/Galorhallen/govee-local-api/releases/tag/v${version}";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/gradio-pdf/default.nix b/pkgs/development/python-modules/gradio-pdf/default.nix
index caa3ddbaa6b80..4a5128455e6d5 100644
--- a/pkgs/development/python-modules/gradio-pdf/default.nix
+++ b/pkgs/development/python-modules/gradio-pdf/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     hatchling
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     gradio-client
   ];
 
diff --git a/pkgs/development/python-modules/gradio/client.nix b/pkgs/development/python-modules/gradio/client.nix
index 2c3abd4c0e785..96c293d399c55 100644
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -59,7 +59,7 @@ buildPythonPackage rec {
     pythonRelaxDepsHook
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     setuptools # needed for 'pkg_resources'
     fsspec
     httpx
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 69e57b821a69c..0d4838e372de6 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -62,7 +62,7 @@
 
 buildPythonPackage rec {
   pname = "gradio";
-  version = "4.22.0";
+  version = "4.27.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -71,7 +71,7 @@ buildPythonPackage rec {
   # and upstream has stopped tagging releases since 3.41.0
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nhrT509xB3+R+HF6TF5AQGnfufT6iNmzjxZgcVL7fBo=";
+    hash = "sha256-617zutFhS8NGO4+fcALH8aKbk+reGC65DNWKVVKiWEw=";
   };
 
   # fix packaging.ParserSyntaxError, which can't handle comments
@@ -99,7 +99,7 @@ buildPythonPackage rec {
     hatch-fancy-pypi-readme
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     setuptools # needed for 'pkg_resources'
     aiofiles
     altair
diff --git a/pkgs/development/python-modules/grpcio-channelz/default.nix b/pkgs/development/python-modules/grpcio-channelz/default.nix
index ba66ffe4e3440..d4af468320185 100644
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-channelz";
-  version = "1.62.1";
+  version = "1.62.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e+8XBt/tt4lNbgNGemBjrBCxUAR7aWXi+0gU1MKmQkU=";
+    hash = "sha256-bkrCxD12skXF9m2Y9SPbCHhrGGEoplXubyCjCn5o5Pk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 4fd21a8bf1597..033e8ae58ae4d 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.62.1";
+  version = "1.62.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NDHIq7qwBUkSxB31xy8D3fO3pnvoooe7PBijRW+W/3c=";
+    hash = "sha256-YuG/ywICWhzXNzKi0zZy0+nQ300hwSxR4LvK8JurdCo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index c5cdf76a5ef67..54022a0433cec 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.62.1";
+  version = "1.62.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yyaVEAqykAtRz9vbVv4SEA1JWA8QrgZ6LKsRfo/HRu0=";
+    hash = "sha256-dNGeGQnpQbGmvvf71fnvMwWZ9nb7BrsGB8hFDtVVnfI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 4aef9f5fbd0f4..6b5c5cdda99fe 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.62.1";
+  version = "1.62.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pJkeXuipereRKW079+hwCxRFY1zBgozJjflFyhgC1/I=";
+    hash = "sha256-X9XhWCtnjmuUHuX1gJNAvl4HJGkd9SmaroImZA+U4Y8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index e890280c676c5..582314bf10736 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -18,11 +18,11 @@
 buildPythonPackage rec {
   pname = "grpcio";
   format = "setuptools";
-  version = "1.62.1";
+  version = "1.62.2";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bEVeAI+obZ6anYW7dtpCd8DX2WaKO/pw2+hunzx1mUc=";
+    hash = "sha256-x3YYBx2Wt6i+LBBwGphTeCO5xluiVsC5Bn4FlM29lU0=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 7b557a605a5b7..8a6ee21ede7df 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "gst-python";
-  version = "1.22.9";
+  version = "1.24.2";
 
   format = "other";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-python/${pname}-${version}.tar.xz";
-    hash = "sha256-P51cb/79omhwN0S1kqazmDqmcjJzsSIOy8tiwqWAAAk=";
+    hash = "sha256-vZDzvIrxfc478mtmU377SVGGn/zmQD9ZhGG5heKy144=";
   };
 
   # Python 2.x is not supported.
diff --git a/pkgs/development/python-modules/h5py/default.nix b/pkgs/development/python-modules/h5py/default.nix
index 4afd562e033dc..bc23ce61c1765 100644
--- a/pkgs/development/python-modules/h5py/default.nix
+++ b/pkgs/development/python-modules/h5py/default.nix
@@ -2,7 +2,6 @@
 , fetchPypi
 , buildPythonPackage
 , pythonOlder
-, oldest-supported-numpy
 , setuptools
 , wheel
 , numpy
@@ -21,21 +20,21 @@ let
   mpi = hdf5.mpi;
   mpiSupport = hdf5.mpiSupport;
 in buildPythonPackage rec {
-  version = "3.10.0";
+  version = "3.11.0";
   pname = "h5py";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2TrcSM7rMzR+skpjT7eH78euRkTm6kunM9CZYFBFwEk=";
+    hash = "sha256-e36PeAcqLt7IfJg28l80ID/UkqRHVwmhi0F6M8+yH6k=";
   };
 
   # avoid strict pinning of numpy
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace "mpi4py ==" "mpi4py >="
+    substituteInPlace pyproject.toml \
+      --replace-fail "numpy >=2.0.0rc1" "numpy"
   '';
 
   HDF5_DIR = "${hdf5}";
@@ -51,7 +50,7 @@ in buildPythonPackage rec {
 
   nativeBuildInputs = [
     cython_0
-    oldest-supported-numpy
+    numpy
     pkgconfig
     setuptools
     wheel
diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 4d5d345d625dd..9f8ca78a96aee 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "hatchling";
-  version = "1.22.4";
+  version = "1.24.1";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ii3OyW1/uEg4LvWEjlrEP9rmQfNaCKP6tRFr1JXzQW4=";
+    hash = "sha256-UfhhiR6YxAROtFUWOnN+XSMo16p0iQsYLbLYD+4ipJc=";
   };
 
   # listed in backend/pyproject.toml
diff --git a/pkgs/development/python-modules/hdf5plugin/default.nix b/pkgs/development/python-modules/hdf5plugin/default.nix
index c2cfe5843c426..7d4019d28ce29 100644
--- a/pkgs/development/python-modules/hdf5plugin/default.nix
+++ b/pkgs/development/python-modules/hdf5plugin/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     hash = "sha256-MnqY1PyGzo31H696J9CekiA2rJrUYzUMDC3UJMZaFLA=";
   };
 
-  propagatedBuildInputs = [
+  dependencies = [
     h5py
   ];
 
diff --git a/pkgs/development/python-modules/httpcore/default.nix b/pkgs/development/python-modules/httpcore/default.nix
index 212db973e9e0a..df9ec754352ef 100644
--- a/pkgs/development/python-modules/httpcore/default.nix
+++ b/pkgs/development/python-modules/httpcore/default.nix
@@ -18,11 +18,12 @@
 # for passthru.tests
 , httpx
 , httpx-socks
+, respx
 }:
 
 buildPythonPackage rec {
   pname = "httpcore";
-  version = "1.0.4";
+  version = "1.0.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -31,7 +32,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = "httpcore";
     rev = "refs/tags/${version}";
-    hash = "sha256-DK5avYEtQcTFogpdEjw0NB4qkzDm5cZKPjAE8MC6Sng=";
+    hash = "sha256-05jYLrBiPRg1qQEz8mRvYJKHFsfneh7z9yHIXuYYa5o=";
   };
 
   nativeBuildInputs = [
@@ -74,7 +75,7 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   passthru.tests = {
-    inherit httpx httpx-socks;
+    inherit httpx httpx-socks respx;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/hypercorn/default.nix b/pkgs/development/python-modules/hypercorn/default.nix
index 57d56fa417cac..b7add0e1a9979 100644
--- a/pkgs/development/python-modules/hypercorn/default.nix
+++ b/pkgs/development/python-modules/hypercorn/default.nix
@@ -2,12 +2,11 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
-, typing-extensions
-, wsproto
-, toml
+, exceptiongroup
+, h11
 , h2
 , priority
-, mock
+, wsproto
 , poetry-core
 , pytest-asyncio
 , pytest-trio
@@ -16,33 +15,44 @@
 
 buildPythonPackage rec {
   pname = "hypercorn";
-  version = "0.14.3";
-  disabled = pythonOlder "3.7";
+  version = "0.16.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.11"; # missing taskgroup dependency
+
   src = fetchFromGitHub {
     owner = "pgjones";
     repo = "Hypercorn";
     rev = version;
-    hash = "sha256-ECREs8UwqTWUweUrwnUwpVotCII2v4Bz7ZCk3DSAd8I=";
+    hash = "sha256-pIUZCQmC3c6FiV0iMMwJGs9TMi6B/YM+vaSx//sAmKE=";
   };
 
   postPatch = ''
     sed -i "/^addopts/d" pyproject.toml
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
-  propagatedBuildInputs = [ wsproto toml h2 priority ]
-    ++ lib.optionals (pythonOlder "3.8") [ typing-extensions ];
+  dependencies = [
+    exceptiongroup
+    h11
+    h2
+    priority
+    wsproto
+  ];
 
   nativeCheckInputs = [
     pytest-asyncio
     pytest-trio
     pytestCheckHook
-  ] ++ lib.optionals (pythonOlder "3.8") [ mock ];
+  ];
+
+  disabledTests = [
+    # https://github.com/pgjones/hypercorn/issues/217
+    "test_startup_failure"
+  ];
 
   pythonImportsCheck = [ "hypercorn" ];
 
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 5cf3408c89b73..09de31843bba6 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "hypothesis";
-  version = "6.99.12";
+  version = "6.100.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "HypothesisWorks";
     repo = "hypothesis";
     rev = "hypothesis-python-${version}";
-    hash = "sha256-0nzjRDv4L3bxxnC0lBY5S7FP9CFhyzHzNchWXoX91Zg=";
+    hash = "sha256-3Mwa1nS6rvFBcU5QXLH4/wa38qCvDX9sRina1aJS1Rs=";
   };
 
   # I tried to package sphinx-selective-exclude, but it throws
diff --git a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
index 46a5eb3e36912..65ddf3d5c0714 100644
--- a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
+++ b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "ibm-cloud-sdk-core";
-  version = "3.19.2";
+  version = "3.20.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qodN9ALyAfzsrCAiPT3t02JJRCBqFCNVWlsQP+4d3do=";
+    hash = "sha256-CqbZcEP1ianvRRpx527KBjQTjvGBzlSmoKY1Pe5MXRA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index 77aeb4483dc3d..ec47eb6751120 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -7,15 +7,15 @@
 
 buildPythonPackage rec {
   pname = "idna";
-  version = "3.6";
-  format = "pyproject";
+  version = "3.7";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ns270IOwZ5iuHoaty/6KsUec+GTk7jD+TkagA9Ekkco=";
+    hash = "sha256-Ao/zqt8GCcH9J42OowiSmUEqeoub0AXdCLn4KFvLXPw=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     flit-core
   ];
 
@@ -25,6 +25,7 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/kjd/idna/";
+    changelog = "https://github.com/kjd/idna/releases/tag/v${version}";
     description = "Internationalized Domain Names in Applications (IDNA)";
     license = lib.licenses.bsd3;
   };
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index 995d625f56048..511424fb19834 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "7.0.2";
+  version = "7.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    hash = "sha256-GY9WjzIwh4yxtE+9eXX4eQbCIzbbouSn8FJ4woH715I=";
+    hash = "sha256-t4k4uSbujV8CD8R3LUhwRYBaVd260uzyHG1gk43H/NI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 79012fa9677a1..a8407239cc402 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "importlib-resources";
-  version = "6.1.3";
+  version = "6.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "importlib_resources";
     inherit version;
-    hash = "sha256-VvtFJRl7eFRKM1TqJ3k5UquT+TW7S/dGuEa7EBUCDys=";
+    hash = "sha256-lj63lkklKwFgwa/P5aHT/jrWbt0KixFL6s/7cMBnQiM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/inflect/default.nix b/pkgs/development/python-modules/inflect/default.nix
index d6317d00841ba..35760249f7420 100644
--- a/pkgs/development/python-modules/inflect/default.nix
+++ b/pkgs/development/python-modules/inflect/default.nix
@@ -2,25 +2,31 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
+, more-itertools
 , setuptools-scm
 , pydantic
 , pytestCheckHook
+, typeguard
 }:
 
 buildPythonPackage rec {
   pname = "inflect";
-  version = "7.0.0";
+  version = "7.2.0";
   disabled = isPy27;
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Y9qTJa0p2oHsI+BVtBIleVq3k7TstIO+XcH6Nj/UcX4=";
+    hash = "sha256-Mv6s+s/K4vIub8zeoQ8N3yamOPrENNDd2q+8oANPN4Q=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
 
-  propagatedBuildInputs = [ pydantic ];
+  propagatedBuildInputs = [
+    more-itertools
+    pydantic
+    typeguard
+  ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/instructor/default.nix b/pkgs/development/python-modules/instructor/default.nix
index 0370c356d9fcc..bb36e7a8abf21 100644
--- a/pkgs/development/python-modules/instructor/default.nix
+++ b/pkgs/development/python-modules/instructor/default.nix
@@ -1,24 +1,50 @@
-{ lib
-, python3
-, fetchPypi
-, buildPythonPackage
+{
+  lib,
+  aiohttp,
+  anthropic,
+  buildPythonPackage,
+  docstring-parser,
+  fetchFromGitHub,
+  openai,
+  poetry-core,
+  pydantic,
+  pytest-examples,
+  pytest-asyncio,
+  pytestCheckHook,
+  fastapi,
+  diskcache,
+  redis,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  rich,
+  tenacity,
+  typer,
 }:
 
 buildPythonPackage rec {
   pname = "instructor";
-  version = "0.6.8";
+  version = "1.2.3";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-4mHXPes1NdYu53XEN7gq626cKy9ju1M7U6n6akfbuVo=";
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "jxnl";
+    repo = "instructor";
+    rev = "refs/tags/${version}";
+    hash = "sha256-LmorlFKIG7iPAK4pDbQqjxjiwB1md3u52B4u5WlqqTk=";
   };
 
-  nativeBuildInputs = [
-    python3.pkgs.poetry-core
+  pythonRelaxDeps = [
+    "docstring-parser"
+    "pydantic"
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = [ poetry-core ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [
     aiohttp
     docstring-parser
     openai
@@ -28,8 +54,31 @@ buildPythonPackage rec {
     typer
   ];
 
+  nativeCheckInputs = [
+    anthropic
+    fastapi
+    redis
+    diskcache
+    pytest-asyncio
+    pytest-examples
+    pytestCheckHook
+  ];
+
   pythonImportsCheck = [ "instructor" ];
 
+  disabledTests = [
+    # Tests require OpenAI API key
+    "test_partial"
+    "successfully"
+  ];
+
+  disabledTestPaths = [
+    # Tests require OpenAI API key
+    "tests/test_distil.py"
+    "tests/test_new_client.py"
+    "tests/llm/"
+  ];
+
   meta = with lib; {
     description = "Structured outputs for llm";
     homepage = "https://github.com/jxnl/instructor";
diff --git a/pkgs/development/python-modules/ipympl/default.nix b/pkgs/development/python-modules/ipympl/default.nix
index f461659c6500b..054372377b6c1 100644
--- a/pkgs/development/python-modules/ipympl/default.nix
+++ b/pkgs/development/python-modules/ipympl/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "ipympl";
-  version = "0.9.3";
+  version = "0.9.4";
   format = "wheel";
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version format;
-    hash = "sha256-0RPNVYkbr+myfvmbbdERqHvra7KuVQxAQpInIQO+gBM=";
+    hash = "sha256-WwwIxvT26mVbpYI5NjRXwQ+5IVV/UDjBpG20RX1taw4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/itsdangerous/default.nix b/pkgs/development/python-modules/itsdangerous/default.nix
index cfc364a4a3997..edd1b149905ff 100644
--- a/pkgs/development/python-modules/itsdangerous/default.nix
+++ b/pkgs/development/python-modules/itsdangerous/default.nix
@@ -2,31 +2,32 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, flit-core
 , freezegun
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "itsdangerous";
-  version = "2.1.2";
-  format = "setuptools";
+  version = "2.2.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XbvGizF+XkLzJ/kCF2NUXcP8O/4i5t65aq8fw4h0FWo=";
+    hash = "sha256-4AUMC32h7qU/+vFJwM+7XG4uK2nEvvIsgfputz5fYXM=";
   };
 
+  build-system = [ flit-core ];
+
   nativeCheckInputs = [
     freezegun
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
-    "-W" "ignore::DeprecationWarning"
-  ];
-
   meta = with lib; {
+    changelog = "https://github.com/pallets/itsdangerous/blob/${version}/CHANGES.rst";
     description = "Safely pass data to untrusted environments and back";
     homepage = "https://itsdangerous.palletsprojects.com";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/jaraco-collections/default.nix b/pkgs/development/python-modules/jaraco-collections/default.nix
index bab89a3f7a60e..ecef3939c9c5c 100644
--- a/pkgs/development/python-modules/jaraco-collections/default.nix
+++ b/pkgs/development/python-modules/jaraco-collections/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "jaraco-collections";
-  version = "5.0.0";
+  version = "5.0.1";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "jaraco.collections";
     inherit version;
-    hash = "sha256-FoDo0J8pX2Jce6kmiAF1om/b5wkrTHbRmOMEdrIc/mg=";
+    hash = "sha256-gIYxsXS4Sk4qWSSQ1i9i38FdgEeg9xVyYJjcQ7gabPo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jaraco-functools/default.nix b/pkgs/development/python-modules/jaraco-functools/default.nix
index 28a7d64e11f96..d3b899281887d 100644
--- a/pkgs/development/python-modules/jaraco-functools/default.nix
+++ b/pkgs/development/python-modules/jaraco-functools/default.nix
@@ -2,21 +2,25 @@
 , buildPythonPackage
 , fetchPypi
 , more-itertools
+, setuptools
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "jaraco-functools";
-  version = "4.0.0";
-  format = "pyproject";
+  version = "4.0.1";
+  pyproject = true;
 
   src = fetchPypi {
-    pname = "jaraco.functools";
+    pname = "jaraco_functools";
     inherit version;
-    hash = "sha256-wnnLJMk9aU73Jw+XDUmcq004E/TggnP5U5hlGmNPCSU=";
+    hash = "sha256-0z+nZTdMBhG1L4s6eV+JAIaaqIyEdp1NF0bNaPsow+g=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     more-itertools
diff --git a/pkgs/development/python-modules/joblib/default.nix b/pkgs/development/python-modules/joblib/default.nix
index 298a2ce83adfb..e592c8089f724 100644
--- a/pkgs/development/python-modules/joblib/default.nix
+++ b/pkgs/development/python-modules/joblib/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
-, fetchpatch
 , pythonAtLeast
 , stdenv
 
@@ -22,24 +21,16 @@
 
 buildPythonPackage rec {
   pname = "joblib";
-  version = "1.3.2";
+  version = "1.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kvhl5iHhd4TnlVCAttBCSJ47jilJScxExurDBPWXcrE=";
+    hash = "sha256-HrDcCRkZzThEkN6JDLXf1ThBCm1LO1Tu8J+4xQtAmxw=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "suppress-deprecation-warnings-with-python312.patch";
-      url = "https://github.com/joblib/joblib/commit/05caf0772d605799e5d2337018fd32ac829b37aa.patch";
-      hash = "sha256-bfqxCLFkCnuWMIkIbcjh+nCTv38A8jxvyCHeJPxoZwg=";
-    })
-  ];
-
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/jpylyzer/default.nix b/pkgs/development/python-modules/jpylyzer/default.nix
index 64b6163825188..0fc6f7cc125ea 100644
--- a/pkgs/development/python-modules/jpylyzer/default.nix
+++ b/pkgs/development/python-modules/jpylyzer/default.nix
@@ -17,20 +17,20 @@ let
   testFiles = fetchFromGitHub {
     owner = "openpreserve";
     repo = "jpylyzer-test-files";
-    rev = "146cb0029b5ea9d8ef22dc6683cec8afae1cc63a";
-    hash = "sha256-uKUau7mYXqGs4dSnXGPnPsH9k81ZCK0aPj5F9HWBMZ8=";
+    rev = "0290e98bae9c5480c995954d3f14b4cf0a0395ff";
+    hash = "sha256-dr3hC6dGd3HNSE4nRj1xrfFSW9cepQ1mdVH8S3YQdtw=";
   };
 
 in buildPythonPackage rec {
   pname = "jpylyzer";
-  version = "2.2.0";
+  version = "2.2.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "openpreserve";
     repo = pname;
     rev = version;
-    hash = "sha256-SK6Z+JkFBD9V99reRZf+jM8Z2SiDNSG72gusp2FPfmI=";
+    hash = "sha256-P42qAks8suI/Xknwd8WAkymbGE7RApRa/a11J/V4LA0=";
   };
 
   propagatedBuildInputs = [ six ];
@@ -40,14 +40,9 @@ in buildPythonPackage rec {
   # don't depend on testFiles unless doFullCheck as it may not be extractable
   # on some filesystems due to weird filenames
   preCheck = lib.optionalString doFullCheck ''
-    sed -i '/^testFilesDir = /ctestFilesDir = "${testFiles}"' tests/unit/test_testfiles.py
+    sed -i '/^testFilesDir = /ctestFilesDir = "${testFiles}/files"' tests/unit/test_testfiles.py
   '';
 
-  disabledTests = [
-    # missing file, but newer test files breaks other tests
-    "test_groundtruth_complete"
-  ];
-
   disabledTestPaths = lib.optionals (!doFullCheck) [
     "tests/unit/test_testfiles.py"
   ];
diff --git a/pkgs/development/python-modules/jsonpickle/default.nix b/pkgs/development/python-modules/jsonpickle/default.nix
index 4e3fd813144b0..fbe0efd86bb3e 100644
--- a/pkgs/development/python-modules/jsonpickle/default.nix
+++ b/pkgs/development/python-modules/jsonpickle/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "jsonpickle";
-  version = "3.0.3";
+  version = "3.0.4";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VpH0RJUyeFirOpW5xECnm0HjVCG+Gm4JpHtsm5Qh/QY=";
+    hash = "sha256-obFMjWIhzY85TyqX5zXqHX7ckn+9E1sm8vhwBlfIxis=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/kazoo/default.nix b/pkgs/development/python-modules/kazoo/default.nix
index eedbd7da41f14..73f041f49f23d 100644
--- a/pkgs/development/python-modules/kazoo/default.nix
+++ b/pkgs/development/python-modules/kazoo/default.nix
@@ -4,7 +4,7 @@
 , six
 , eventlet
 , gevent
-, nose
+, pynose
 , mock
 , coverage
 , pkgs
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [ six ];
-  buildInputs = [ eventlet gevent nose mock coverage pkgs.openjdk8 ];
+  buildInputs = [ eventlet gevent pynose mock coverage pkgs.openjdk8 ];
 
   # not really needed
   preBuild = ''
diff --git a/pkgs/development/python-modules/keras/default.nix b/pkgs/development/python-modules/keras/default.nix
index c745792962236..55deee586c8da 100644
--- a/pkgs/development/python-modules/keras/default.nix
+++ b/pkgs/development/python-modules/keras/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "keras";
-  version = "3.0.5";
+  version = "3.2.1";
   format = "wheel";
 
   src = fetchPypi {
     inherit format pname version;
-    hash = "sha256-SgIvLpfqWj2xLtgJ/8t84e+NNP6urFIxXshVPe0tz5c=";
+    hash = "sha256-C+HomwQeaXvlYthCLsuVjuVIGs/AiZEyAJJsVh0ligM=";
     python = "py3";
     dist = "py3";
   };
diff --git a/pkgs/development/python-modules/keyrings-alt/default.nix b/pkgs/development/python-modules/keyrings-alt/default.nix
index f463b18950dd4..2ad45c6e717f6 100644
--- a/pkgs/development/python-modules/keyrings-alt/default.nix
+++ b/pkgs/development/python-modules/keyrings-alt/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , jaraco-classes
+, jaraco-context
 , keyring
 , pytestCheckHook
 , pythonOlder
@@ -10,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "keyrings-alt";
-  version = "5.0.0";
+  version = "5.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "keyrings.alt";
     inherit version;
-    hash = "sha256-nURstHu86pD/ouzD6AA6z0FXP8IBv0S0vxO9DhFISCg=";
+    hash = "sha256-zTcqHsRGobxakGJKUsiOg7kzAhjjkEemyaSK430RZ0U=";
   };
 
   nativeBuildInputs = [
@@ -27,6 +28,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     jaraco-classes
+    jaraco-context
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/kombu/default.nix b/pkgs/development/python-modules/kombu/default.nix
index a6867075d9b5e..c4aad1fab20fb 100644
--- a/pkgs/development/python-modules/kombu/default.nix
+++ b/pkgs/development/python-modules/kombu/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "kombu";
-  version = "5.3.5";
+  version = "5.3.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MORw8aa0nHDcb20Tw+TMTheKpsRpzra81VZFOF/IS5M=";
+    hash = "sha256-ARxM2aNVwUod6NNdJXMUodJFbVK3FAOIVhrKw88al78=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/langchain-community/default.nix b/pkgs/development/python-modules/langchain-community/default.nix
index 472022947fed5..af29f6068b045 100644
--- a/pkgs/development/python-modules/langchain-community/default.nix
+++ b/pkgs/development/python-modules/langchain-community/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "langchain-community";
-  version = "0.0.33";
+  version = "0.0.36";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "langchain_community";
     inherit version;
-    hash = "sha256-u1bbwe8RygnyWEaOETaHga3akhnhRAc+MM2mlJbTQrI=";
+    hash = "sha256-l76dAM8RnJYeA+0ibgTmcPUbXUL1sF/8NRhZj6bSDHQ=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index 72ce1715493f3..3c0b421564492 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "langchain-core";
-  version = "0.1.46";
+  version = "0.1.48";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "langchain_core";
     inherit version;
-    hash = "sha256-F8QWNJ9cepgI5w43JXSaOi31CI8ezKBFyIOHGqlfnJ4=";
+    hash = "sha256-8KmwqPIvIZ72/YTisdkqgBToRRTAobVTNw/UApaBPBY=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index 48c2c0db93a1b..ddcb01d7c4506 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -158,6 +158,8 @@ buildPythonPackage rec {
     # AssertionErrors
     "test_callback_handlers"
     "test_generic_fake_chat_model"
+    # Test is outdated
+    "test_serializable_mapping"
   ];
 
   pythonImportsCheck = [ "langchain" ];
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index d77c613384754..9bf32dc7a1582 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -1,12 +1,14 @@
 {
   lib,
   stdenv,
+  anthropic,
   attr,
   buildPythonPackage,
   fastapi,
   fetchFromGitHub,
   freezegun,
   httpx,
+  instructor,
   orjson,
   poetry-core,
   pydantic,
@@ -20,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.1.48";
+  version = "0.1.52";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +31,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-n24rlulncJHNyHFqszEbALGfnT7+tTGjLjwR7Fw1smI=";
+    hash = "sha256-kTl+H1odRYDZc1KEuopZV9PvOQBd4QioWMhb3pD6xKE=";
   };
 
   sourceRoot = "${src.name}/python";
@@ -48,9 +50,11 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    anthropic
     fastapi
     freezegun
     httpx
+    instructor
     pytest-asyncio
     pytestCheckHook
     uvicorn
@@ -81,6 +85,7 @@ buildPythonPackage rec {
     "tests/unit_tests/test_client.py"
     # Tests require a Langsmith API key
     "tests/evaluation/test_evaluation.py"
+    "tests/external/test_instructor_evals.py"
   ];
 
   pythonImportsCheck = [ "langsmith" ];
diff --git a/pkgs/development/python-modules/ledgerblue/default.nix b/pkgs/development/python-modules/ledgerblue/default.nix
index 9342f8d3b5da8..f78d9ad5e554d 100644
--- a/pkgs/development/python-modules/ledgerblue/default.nix
+++ b/pkgs/development/python-modules/ledgerblue/default.nix
@@ -12,24 +12,38 @@
 , pycrypto
 , pycryptodomex
 , pyelftools
+, python-gnupg
 , python-u2flib-host
 , pythonOlder
+, pythonRelaxDepsHook
+, setuptools
+, setuptools-scm
 , websocket-client
 }:
 
 buildPythonPackage rec {
   pname = "ledgerblue";
-  version = "0.1.48";
-  format = "setuptools";
+  version = "0.1.50";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LVRNcsTmJOR3zTBhbKV4V0zCQk0sk/Uf6kSmfbAhgfY=";
+    hash = "sha256-0SzUy0mPEbgeoOKEa9UtrjAQafrauKl1wvsONyosJNk=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+    setuptools-scm
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "protobuf"
+  ];
+
+  dependencies = [
     ecpy
     future
     hidapi
@@ -39,6 +53,7 @@ buildPythonPackage rec {
     pycrypto
     pycryptodomex
     pyelftools
+    python-gnupg
     python-u2flib-host
     websocket-client
   ]
diff --git a/pkgs/development/python-modules/lmfit/default.nix b/pkgs/development/python-modules/lmfit/default.nix
index d96eb4d4c9adc..30ccb1cb5c5d4 100644
--- a/pkgs/development/python-modules/lmfit/default.nix
+++ b/pkgs/development/python-modules/lmfit/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "lmfit";
-  version = "1.2.2";
+  version = "1.3.0";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BEoFKhGmHaBXYnRQTBfrfigDtBEo4lgh6WYyIH8jyIw=";
+    hash = "sha256-foI668BSN8qA0z0mDO27peJhkMzsn69ZXmgUOQneDJM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/maestral/default.nix b/pkgs/development/python-modules/maestral/default.nix
index 5e658bdea69f6..885911b181c8f 100644
--- a/pkgs/development/python-modules/maestral/default.nix
+++ b/pkgs/development/python-modules/maestral/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , makePythonPath
@@ -17,6 +18,7 @@
 , pyro5
 , requests
 , rich
+, rubicon-objc
 , setuptools
 , survey
 , typing-extensions
@@ -59,6 +61,8 @@ buildPythonPackage rec {
     typing-extensions
     watchdog
     xattr
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    rubicon-objc
   ];
 
   makeWrapperArgs = [
@@ -71,6 +75,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  # ModuleNotFoundError: No module named '_watchdog_fsevents'
+  doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64);
+
   preCheck = ''
     export HOME=$(mktemp -d)
   '';
@@ -90,6 +97,19 @@ buildPythonPackage rec {
     "test_locking_multiprocess"
     # OSError: [Errno 95] Operation not supported
     "test_move_preserves_xattrs"
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # maetral daemon does not start but worked in real environment
+    "test_catching_non_ignored_events"
+    "test_connection"
+    "test_event_handler"
+    "test_fs_ignore_tree_creation"
+    "test_lifecycle"
+    "test_notify_level"
+    "test_notify_snooze"
+    "test_receiving_events"
+    "test_remote_exceptions"
+    "test_start_already_running"
+    "test_stop"
   ];
 
   pythonImportsCheck = [
@@ -104,7 +124,6 @@ buildPythonPackage rec {
     homepage = "https://maestral.app";
     changelog = "https://github.com/samschott/maestral/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ peterhoeg sfrijters ];
-    platforms = platforms.unix;
+    maintainers = with maintainers; [ natsukium peterhoeg sfrijters ];
   };
 }
diff --git a/pkgs/development/python-modules/magic-wormhole/default.nix b/pkgs/development/python-modules/magic-wormhole/default.nix
index 353e2c0e053b0..7b89f29b76e21 100644
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@@ -33,12 +33,12 @@
 
 buildPythonPackage rec {
   pname = "magic-wormhole";
-  version = "0.13.0";
+  version = "0.14.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rDvWgoYnDn8UnAYUmo5Anl+jTX/rDoiESibSnu0tFRY=";
+    hash = "sha256-AG0jn4i/98N7wu/2CgBOJj+vklj3J5GS0Gugyc7WsIA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/magika/default.nix b/pkgs/development/python-modules/magika/default.nix
index 6e4099004317a..f2a7cbd85a117 100644
--- a/pkgs/development/python-modules/magika/default.nix
+++ b/pkgs/development/python-modules/magika/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "magika";
-  version = "0.5.0";
+  version = "0.5.1";
   pyproject = true;
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-r6C7iDCG/o3JEvweQGb4upr+LuHvmNtkwtduZGehCsc=";
+    hash = "sha256-Q9wRU6FjcyciWmJqFVDAo5Wh1F6jPsH11GubCAI4vuA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mako/default.nix b/pkgs/development/python-modules/mako/default.nix
index 0f512f8ec3a7d..a1629b4cf3668 100644
--- a/pkgs/development/python-modules/mako/default.nix
+++ b/pkgs/development/python-modules/mako/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "mako";
-  version = "1.3.2";
+  version = "1.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Mako";
     inherit version;
-    hash = "sha256-KgyK1/YnQnGzu3Rn3TfPnMbatLwZy2mk7xBmlALeaY4=";
+    hash = "sha256-4WwB2aucEfcpDu8c/vwJP7WkXuSj2gni/sLk0brlTnM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/manim/default.nix b/pkgs/development/python-modules/manim/default.nix
index b341a7ffee89a..09f2953c362e4 100644
--- a/pkgs/applications/video/manim/default.nix
+++ b/pkgs/development/python-modules/manim/default.nix
@@ -1,11 +1,43 @@
 { lib
+, buildPythonPackage
 , fetchFromGitHub
+, poetry-core
+, pytest-xdist
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
 
 , cairo
 , ffmpeg
 , texliveInfraOnly
 
-, python3
+, click
+, click-default-group
+, cloup
+, colour
+, grpcio
+, grpcio-tools
+, importlib-metadata
+, isosurfaces
+, jupyterlab
+, manimpango
+, mapbox-earcut
+, moderngl
+, moderngl-window
+, networkx
+, numpy
+, pillow
+, pycairo
+, pydub
+, pygments
+, rich
+, scipy
+, screeninfo
+, skia-pathops
+, srt
+, svgelements
+, tqdm
+, watchdog
 }:
 
 let
@@ -42,13 +74,11 @@ let
     babel-english gnu-freefont mathastext cbfonts-fd
   ]);
 
-  python = python3;
-
-in python.pkgs.buildPythonApplication rec {
+in buildPythonPackage rec {
   pname = "manim";
   pyproject = true;
   version = "0.18.1";
-  disabled = python3.pythonOlder "3.9";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner  = "ManimCommunity";
@@ -57,7 +87,7 @@ in python.pkgs.buildPythonApplication rec {
     hash = "sha256-o+Wl3NMK6yopcsRVFtZuUE9c1GABa5d8rbQNHDJ4OiQ=";
   };
 
-  nativeBuildInputs = with python.pkgs; [
+  nativeBuildInputs = [
     poetry-core
     pythonRelaxDepsHook
   ];
@@ -81,7 +111,7 @@ in python.pkgs.buildPythonApplication rec {
 
   buildInputs = [ cairo ];
 
-  propagatedBuildInputs = with python.pkgs; [
+  propagatedBuildInputs = [
     click
     click-default-group
     cloup
@@ -101,7 +131,6 @@ in python.pkgs.buildPythonApplication rec {
     pycairo
     pydub
     pygments
-    pysrt
     rich
     scipy
     screeninfo
@@ -122,10 +151,9 @@ in python.pkgs.buildPythonApplication rec {
   nativeCheckInputs = [
     ffmpeg
     manim-tinytex
-  ] ++ (with python.pkgs; [
     pytest-xdist
     pytestCheckHook
-  ]);
+  ];
 
   # about 55 of ~600 tests failing mostly due to demand for display
   disabledTests = import ./failing_tests.nix;
diff --git a/pkgs/applications/video/manim/failing_tests.nix b/pkgs/development/python-modules/manim/failing_tests.nix
index ac788c25be20c..ac788c25be20c 100644
--- a/pkgs/applications/video/manim/failing_tests.nix
+++ b/pkgs/development/python-modules/manim/failing_tests.nix
diff --git a/pkgs/applications/video/manim/pytest-report-header.patch b/pkgs/development/python-modules/manim/pytest-report-header.patch
index 7aa87d373e508..7aa87d373e508 100644
--- a/pkgs/applications/video/manim/pytest-report-header.patch
+++ b/pkgs/development/python-modules/manim/pytest-report-header.patch
diff --git a/pkgs/development/python-modules/markdown/default.nix b/pkgs/development/python-modules/markdown/default.nix
index f31af525f1e6e..70bff8d2c8548 100644
--- a/pkgs/development/python-modules/markdown/default.nix
+++ b/pkgs/development/python-modules/markdown/default.nix
@@ -10,28 +10,30 @@
 
 buildPythonPackage rec {
   pname = "markdown";
-  version = "3.5.2";
+  version = "3.6";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  pyproject = true;
-
   src = fetchFromGitHub {
     owner = "Python-Markdown";
     repo = "markdown";
     rev = "refs/tags/${version}";
-    hash = "sha256-YLOLDiS93zpjJWzkWXcutjZw9iB/FfbjxQXjau2B+JQ=";
+    hash = "sha256-jGo9/ZS2EhMDl/o1ref7Owqckuc7am578Ojmcz2aWIE=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.10") [
+  dependencies = lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ];
 
-  nativeCheckInputs = [ unittestCheckHook pyyaml ];
+  nativeCheckInputs = [
+    unittestCheckHook
+    pyyaml
+  ];
 
   pythonImportsCheck = [ "markdown" ];
 
diff --git a/pkgs/development/python-modules/mashumaro/default.nix b/pkgs/development/python-modules/mashumaro/default.nix
index 6cfa517cc386a..cf79f268ffb37 100644
--- a/pkgs/development/python-modules/mashumaro/default.nix
+++ b/pkgs/development/python-modules/mashumaro/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "mashumaro";
-  version = "3.12";
+  version = "3.13";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "Fatal1ty";
     repo = "mashumaro";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sSwj/8j+vPX7M8l2h4bPs8WnjzIN2WIpyd7/NcGaExg=";
+    hash = "sha256-ETK1rHKlByQkqibejiZmXF6c4eIiMazLa8XY2OH30q4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mat2/default.nix b/pkgs/development/python-modules/mat2/default.nix
index 1646d3ac72460..fe627c8b99d5f 100644
--- a/pkgs/development/python-modules/mat2/default.nix
+++ b/pkgs/development/python-modules/mat2/default.nix
@@ -9,7 +9,7 @@
 , exiftool
 , ffmpeg
 , mailcap
-, wrapGAppsHook
+, wrapGAppsHook3
 , gdk-pixbuf
 , gobject-introspection
 , librsvg
@@ -66,7 +66,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/matplotlib-inline/default.nix b/pkgs/development/python-modules/matplotlib-inline/default.nix
index 90cbd00dc4d14..e35111fd191ce 100644
--- a/pkgs/development/python-modules/matplotlib-inline/default.nix
+++ b/pkgs/development/python-modules/matplotlib-inline/default.nix
@@ -1,4 +1,8 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, setuptools
 , traitlets
 
 # tests
@@ -7,15 +11,23 @@
 
 buildPythonPackage rec {
   pname = "matplotlib-inline";
-  version = "0.1.6";
-  format = "setuptools";
+  version = "0.1.7";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-+Ifl8Qupjo0rFQ3c9HAsHl+LOiAAXrD3S/29Ng7m8wQ=";
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "ipython";
+    repo = "matplotlib-inline";
+    rev = "refs/tags/${version}";
+    hash = "sha256-y7T8BshNa8NVWzH8oLS4dTAyhG+YmkkYQJFAyMXsJFA=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     traitlets
   ];
 
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 788df3d9458eb..bf1e7a86323e3 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -12,7 +12,6 @@
 , pybind11
 , setuptools
 , setuptools-scm
-, wheel
 
 # native libraries
 , ffmpeg-headless
@@ -77,15 +76,15 @@ let
 in
 
 buildPythonPackage rec {
-  version = "3.8.3";
+  version = "3.8.4";
   pname = "matplotlib";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e0FiOemuOL5UsCirv5BIr/UFSpq6VBa+8L0X+RYs4WE=";
+    hash = "sha256-iqw5fV6ewViWDjHDgcX/xS3dUr2aR3F+KmlAOBZ9/+o=";
   };
 
   env.XDG_RUNTIME_DIR = "/tmp";
@@ -100,7 +99,10 @@ buildPythonPackage rec {
     let
       tcl_tk_cache = ''"${tk}/lib", "${tcl}/lib", "${lib.strings.substring 0 3 tk.version}"'';
     in
-    lib.optionalString enableTk ''
+    ''
+      substituteInPlace pyproject.toml \
+        --replace-fail '"numpy>=2.0.0rc1,<2.3",' ""
+    '' + lib.optionalString enableTk ''
       sed -i '/self.tcl_tk_cache = None/s|None|${tcl_tk_cache}|' setupext.py
     '' + lib.optionalString (stdenv.isLinux && interactive) ''
       # fix paths to libraries in dlopen calls (headless detection)
@@ -110,13 +112,7 @@ buildPythonPackage rec {
     '';
 
   nativeBuildInputs = [
-    certifi
-    numpy
     pkg-config
-    pybind11
-    setuptools
-    setuptools-scm
-    wheel
   ] ++ lib.optionals enableGtk3 [
     gobject-introspection
   ];
@@ -143,7 +139,15 @@ buildPythonPackage rec {
     "strictoverflow"
   ];
 
-  propagatedBuildInputs = [
+  build-system = [
+    certifi
+    numpy
+    pybind11
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
     # explicit
     contourpy
     cycler
diff --git a/pkgs/development/python-modules/maxminddb/default.nix b/pkgs/development/python-modules/maxminddb/default.nix
index 3f95408364db0..100191643be8d 100644
--- a/pkgs/development/python-modules/maxminddb/default.nix
+++ b/pkgs/development/python-modules/maxminddb/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "maxminddb";
-  version = "2.5.2";
+  version = "2.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-s8M+T8eCHubJ9Ag3EW4Wq2F1hj1KZO7gJMW+xoZpCoc=";
+    hash = "sha256-bF1ZH2JeA7CjTfDH/4FYBnY5e4M14T7OEwxuOeSjr7k=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/mecab-python3/default.nix b/pkgs/development/python-modules/mecab-python3/default.nix
index e347aa107d7c7..f661fad488467 100644
--- a/pkgs/development/python-modules/mecab-python3/default.nix
+++ b/pkgs/development/python-modules/mecab-python3/default.nix
@@ -9,14 +9,15 @@
 
 buildPythonPackage rec {
   pname = "mecab-python3";
-  version = "1.0.8";
+  version = "1.0.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-cJiLqyY2lkVvddPYkQx1rqR3qdCAVK1++FvlRw3T9ls=";
+    pname = "mecab_python3";
+    inherit version;
+    hash = "sha256-LYkfSgEZ+3Zvp5bijYgaVXk6DDVE5EbP9k3JRq1yJ8w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 01912c9060945..c92c0705aaaea 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "meson-python";
-  version = "0.15.0";
+  version = "0.16.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "meson_python";
-    hash = "sha256-/dtz7s1J6JwcQch5N82JwtC2WhxjuigjhoHUvZSE0m8=";
+    hash = "sha256-kGjBfjbInWx/9wn/+yqKmSXozQsCYpco5c6vLsUFy18=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/milksnake/default.nix b/pkgs/development/python-modules/milksnake/default.nix
index 72115444ffa2c..567305b194e81 100644
--- a/pkgs/development/python-modules/milksnake/default.nix
+++ b/pkgs/development/python-modules/milksnake/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, cffi }:
+{ lib, buildPythonPackage, fetchPypi, fetchpatch, cffi }:
 
 buildPythonPackage rec {
   pname = "milksnake";
@@ -11,6 +11,14 @@ buildPythonPackage rec {
     sha256 = "120nprd8lqis7x7zy72536gk2j68f7gxm8gffmx8k4ygifvl7kfz";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-regex-python-311.patch";
+      url = "https://github.com/getsentry/milksnake/commit/421cc1ffab4d76d01366240c087ffb30d63b744c.diff";
+      hash = "sha256-U/C4CCX8SEOzVXNpOf4hVy2V3Lh6fUrFkz5z+h191C8=";
+    })
+  ];
+
   propagatedBuildInputs = [
    cffi
   ];
diff --git a/pkgs/development/python-modules/mkdocstrings/default.nix b/pkgs/development/python-modules/mkdocstrings/default.nix
index a8dc02b4a980c..f82916c3a784d 100644
--- a/pkgs/development/python-modules/mkdocstrings/default.nix
+++ b/pkgs/development/python-modules/mkdocstrings/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocstrings";
-  version = "0.24.3";
+  version = "0.25.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "mkdocstrings";
     repo = "mkdocstrings";
     rev = "refs/tags/${version}";
-    hash = "sha256-L3QQ2ll2sDbQwrmw88iwTW6WS2SNsiMR2TvuV4P1uj4=";
+    hash = "sha256-VKjK58KK9x5RCc7VVy46zax42ySCv2NzqAat+XF+3a8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mocket/default.nix b/pkgs/development/python-modules/mocket/default.nix
index 2a44707bff1b3..116e85ce2c343 100644
--- a/pkgs/development/python-modules/mocket/default.nix
+++ b/pkgs/development/python-modules/mocket/default.nix
@@ -35,12 +35,12 @@
 
 buildPythonPackage rec {
   pname = "mocket";
-  version = "3.12.4";
+  version = "3.12.5";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-O+IRX59Z4D188XEmiSCT8H3sg1jhtaboHS3QINEnE0s=";
+    hash = "sha256-6yWo7SBlVldK+AxUBnQOXjQBxz9HbIC+Ch977xiZxek=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mpi4py/default.nix b/pkgs/development/python-modules/mpi4py/default.nix
index b5f4e403ab38d..9119db8a204bd 100644
--- a/pkgs/development/python-modules/mpi4py/default.nix
+++ b/pkgs/development/python-modules/mpi4py/default.nix
@@ -4,12 +4,12 @@
 
 buildPythonPackage rec {
   pname = "mpi4py";
-  version = "3.1.5";
+  version = "3.1.6";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pwbnbbklUTXC+10e9Uy097DkrZ4zy62n3idiYgXyoVM=";
+    hash = "sha256-yPpiXg+SsILvlVv7UvGfpmkdKSc9fXETXSlaoUPe5ss=";
   };
 
   passthru = {
diff --git a/pkgs/development/python-modules/mypy-protobuf/default.nix b/pkgs/development/python-modules/mypy-protobuf/default.nix
index 0010e40800ec0..32560c7baeef1 100644
--- a/pkgs/development/python-modules/mypy-protobuf/default.nix
+++ b/pkgs/development/python-modules/mypy-protobuf/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "mypy-protobuf";
-  version = "3.5.0";
+  version = "3.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IfJw2gqXkqnax2sN9GPAJ+VhZkq2lzxZvk5NBk3+Z9w=";
+    hash = "sha256-AvJC6zQJ9miJ8rGjqlg1bsTZCc3Q+TEVYi6ecDZuyjw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/myst-parser/default.nix b/pkgs/development/python-modules/myst-parser/default.nix
index e485b768a7507..12ddb2ec769ec 100644
--- a/pkgs/development/python-modules/myst-parser/default.nix
+++ b/pkgs/development/python-modules/myst-parser/default.nix
@@ -4,6 +4,7 @@
 , fetchpatch
 , flit-core
 , pythonOlder
+, defusedxml
 , docutils
 , jinja2
 , markdown-it-py
@@ -16,6 +17,7 @@
 , pytest-regressions
 , sphinx-pytest
 , pytestCheckHook
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -40,7 +42,10 @@ buildPythonPackage rec {
     })
   ];
 
-  nativeBuildInputs = [ flit-core ];
+  nativeBuildInputs = [
+    flit-core
+    pythonRelaxDepsHook
+  ];
 
   propagatedBuildInputs = [
     docutils
@@ -54,6 +59,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     beautifulsoup4
+    defusedxml
     pytest-param-files
     pytest-regressions
     sphinx-pytest
@@ -64,6 +70,10 @@ buildPythonPackage rec {
     "myst_parser"
   ];
 
+  pythonRelaxDeps = [
+    "docutils"
+  ];
+
   disabledTests = [
     # AssertionError due to different files
     "test_basic"
@@ -72,6 +82,9 @@ buildPythonPackage rec {
     "test_fieldlist_extension"
     # docutils 0.19 expectation mismatches
     "test_docutils_roles"
+    # sphinx 7.0 expectation mismatches
+    "test_heading_slug_func"
+    "test_references_singlehtml"
     # sphinx 6.0 expectation mismatches
     "test_sphinx_directives"
     # sphinx 5.3 expectation mismatches
diff --git a/pkgs/development/python-modules/netcdf4/default.nix b/pkgs/development/python-modules/netcdf4/default.nix
index 39994519db17b..72b03ef5d7f65 100644
--- a/pkgs/development/python-modules/netcdf4/default.nix
+++ b/pkgs/development/python-modules/netcdf4/default.nix
@@ -7,6 +7,7 @@
 , oldest-supported-numpy
 , setuptools
 , wheel
+, certifi
 , numpy
 , zlib
 , netcdf
@@ -19,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "netcdf4";
-  version = "1.6.2";
+  version = "1.6.5";
   format = "pyproject";
 
   disabled = isPyPy;
@@ -27,7 +28,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "netCDF4";
     inherit version;
-    hash = "sha256-A4KwL/aiiEGfb/7IXexA9FH0G4dVVHFUxXXd2fD0rlM=";
+    hash = "sha256-gkiB0KrP3lvZgtat7dhXQlnIVVN4HnuD4M6CuJC/oO8=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +39,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    certifi
     cftime
     numpy
     zlib
diff --git a/pkgs/development/python-modules/networkx/default.nix b/pkgs/development/python-modules/networkx/default.nix
index 0c4993cdd6943..40a6cdcf4b2ed 100644
--- a/pkgs/development/python-modules/networkx/default.nix
+++ b/pkgs/development/python-modules/networkx/default.nix
@@ -24,14 +24,14 @@
 buildPythonPackage rec {
   pname = "networkx";
   # upgrade may break sage, please test the sage build or ping @timokau on upgrade
-  version = "3.2.1";
+  version = "3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nxu1zzQJvzJOCnIsIL20wg7jm/HDDOiuSZyFArC14MY=";
+    hash = "sha256-DBJ9iy9IZfWa6cuKr81gtccPMkHr1m997618SrkBJsk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/nilearn/default.nix b/pkgs/development/python-modules/nilearn/default.nix
index ce7cdee635b3e..c4088ca7e42d9 100644
--- a/pkgs/development/python-modules/nilearn/default.nix
+++ b/pkgs/development/python-modules/nilearn/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "nilearn";
-  version = "0.10.3";
+  version = "0.10.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d4GTMTFMTKXBXAdjT2n4Vfr9+a3QUbGILjpgCtUnV9g=";
+    hash = "sha256-lFC9Vqd22ZezJPRd0Yv5bom9jYAWCXT8x1kzP7rqNcI=";
   };
 
   nativeBuildInputs = [ hatch-vcs ];
diff --git a/pkgs/development/python-modules/numba-scipy/default.nix b/pkgs/development/python-modules/numba-scipy/default.nix
index c4c37b7ad3333..22e3db22f3023 100644
--- a/pkgs/development/python-modules/numba-scipy/default.nix
+++ b/pkgs/development/python-modules/numba-scipy/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "numba-scipy";
-  version = "0.3.1";
+  version = "0.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cApTGH5GJZH/RbkRjKhL3injvixD5kvfaS49FjrPA2U=";
+    hash = "sha256-RDZF1mNcZnrcOzjQpjbZq8yXHnjeLAeAjYmvzXvFhEQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/numexpr/default.nix b/pkgs/development/python-modules/numexpr/default.nix
index 4de1e4a7de05a..ca8e329771fe2 100644
--- a/pkgs/development/python-modules/numexpr/default.nix
+++ b/pkgs/development/python-modules/numexpr/default.nix
@@ -2,30 +2,38 @@
 , buildPythonPackage
 , fetchPypi
 , numpy
-, packaging
-, python
-, pythonOlder
+, pytestCheckHook
+, setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "numexpr";
-  version = "2.9.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
+  version = "2.10.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8h0S9sQyzjSQieuVNCur9mKa67P93xh6RJLTqtqtqvA=";
+    hash = "sha256-yJ6TB1JjnfBAU5FgMm2PmahBWbvqQZQ6uOlgWR7arvA=";
   };
 
-  nativeBuildInputs = [
+  # patch for compatibility with numpy < 2.0
+  # see more details, https://numpy.org/devdocs/numpy_2_0_migration_guide.html#c-api-changes
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "numpy>=2.0.0rc1" "numpy"
+    sed -i "1i#define PyDataType_SET_ELSIZE(descr, elsize)" numexpr/interpreter.cpp
+    sed -i "1i#define PyDataType_ELSIZE(descr) ((descr)->elsize)" numexpr/interpreter.cpp
+  '';
+
+  build-system = [
+    setuptools
+    wheel
     numpy
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
-    packaging
   ];
 
   preBuild = ''
@@ -33,13 +41,25 @@ buildPythonPackage rec {
     ln -s ${numpy.cfg} site.cfg
   '';
 
-  checkPhase = ''
-    runtest="$(pwd)/numexpr/tests/test_numexpr.py"
-    pushd "$out"
-    ${python.interpreter} "$runtest"
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    pushd $out
+  '';
+
+  postCheck = ''
     popd
   '';
 
+  disabledTests = [
+    # fails on computers with more than 8 threads
+    # https://github.com/pydata/numexpr/issues/479
+    "test_numexpr_max_threads_empty_string"
+    "test_omp_num_threads_empty_string"
+  ];
+
   pythonImportsCheck = [
     "numexpr"
   ];
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 4299c6d4dc63e..c2d38cc31b248 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -88,6 +88,9 @@ in buildPythonPackage rec {
     # remove needless reference to full Python path stored in built wheel
     substituteInPlace numpy/meson.build \
       --replace 'py.full_path()' "'python'"
+
+    substituteInPlace pyproject.toml \
+      --replace-fail "meson-python>=0.15.0,<0.16.0" "meson-python"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/openrazer/daemon.nix b/pkgs/development/python-modules/openrazer/daemon.nix
index 317d36b305760..aa6055c19c70f 100644
--- a/pkgs/development/python-modules/openrazer/daemon.nix
+++ b/pkgs/development/python-modules/openrazer/daemon.nix
@@ -10,7 +10,7 @@
 , pyudev
 , setproctitle
 , setuptools
-, wrapGAppsHook
+, wrapGAppsHook3
 , notify2
 }:
 
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index ede3b10fc718c..bd1d06e5c266c 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -30,22 +30,22 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.9.15";
+  version = "3.10.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "ijl";
     repo = "orjson";
     rev = "refs/tags/${version}";
-    hash = "sha256-6fcj64d/uFCxaez+xxOdHd+NqILKOPqK+YlxYX7D0DI=";
+    hash = "sha256-vEJriLd7f+zlYcMIyhDTkq2kmNc5MaNLHo0qMLS5hro=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-/Aa3saUP4QjSBIS9T8Vd0yggiJn2SIk7dYMA5icb1yA=";
+    hash = "sha256-yQkpjedHwgsZiiZEzYV66aa9RepCFW0PBqtD29tfoMI=";
   };
 
   maturinBuildFlags = [ "--interpreter ${python.executable}" ];
diff --git a/pkgs/development/python-modules/paddle2onnx/default.nix b/pkgs/development/python-modules/paddle2onnx/default.nix
index e358c2ec49861..0ba25c3046c41 100644
--- a/pkgs/development/python-modules/paddle2onnx/default.nix
+++ b/pkgs/development/python-modules/paddle2onnx/default.nix
@@ -9,7 +9,7 @@
 }:
 let
   pname = "paddle2onnx";
-  version = "1.1.0";
+  version = "1.2.0";
   format = "wheel";
   pyShortVersion = "cp${builtins.replaceStrings ["."] [""] python.pythonVersion}";
   src = fetchPypi {
@@ -18,7 +18,7 @@ let
     python = pyShortVersion;
     abi = pyShortVersion;
     platform = "manylinux_2_12_x86_64.manylinux2010_x86_64";
-    hash = "sha256-HI/lIj9ezdCry5fYDi5Pia6hvOjN6/Slm9BMfLeq8AU=";
+    hash = "sha256-18eStagm7V4D87fiPoigAyXxVGoo//8UENutSqNfUBI=";
   };
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/panel/default.nix b/pkgs/development/python-modules/panel/default.nix
index 4a4b93035d735..b418757dbe889 100644
--- a/pkgs/development/python-modules/panel/default.nix
+++ b/pkgs/development/python-modules/panel/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "panel";
-  version = "1.3.8";
+  version = "1.4.1";
 
   format = "wheel";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   # tries to fetch even more artifacts
   src = fetchPypi {
     inherit pname version format;
-    hash = "sha256-Sb85MZhqDd8/e0vaPGXGoxHVJ3UkrNtOC/9py6a/V3U=";
+    hash = "sha256-x7ywbO2uY1r06bDXV/+X/7cs9f6jFawyDHeo8pLWZVE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/parsedmarc/default.nix b/pkgs/development/python-modules/parsedmarc/default.nix
index a5c59338fcdce..26d01dedf9767 100644
--- a/pkgs/development/python-modules/parsedmarc/default.nix
+++ b/pkgs/development/python-modules/parsedmarc/default.nix
@@ -40,14 +40,14 @@ let
 in
 buildPythonPackage rec {
   pname = "parsedmarc";
-  version = "8.8.0";
+  version = "8.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tK/cxOw50awcDAGRDTQ+Nxb9aJl2+zLZHuJq88xNmXM=";
+    hash = "sha256-OBxiaXB8NKNMviRI19rYYJxpnfnaEL3zSPmYB4urIug=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/parsel/default.nix b/pkgs/development/python-modules/parsel/default.nix
index ee817f70665a4..639f973e77541 100644
--- a/pkgs/development/python-modules/parsel/default.nix
+++ b/pkgs/development/python-modules/parsel/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "parsel";
-  version = "1.9.0";
+  version = "1.9.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-paa8sMX8dBVAujB1Y2/1y5aIUqeMwWroIlDl1Ib6fUg=";
+    hash = "sha256-FOANwHcxyQMNtiDBlfyuiEtbSEjp+cUjxhGfcIzPqaw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/parso/default.nix b/pkgs/development/python-modules/parso/default.nix
index 7d76ef5d80aa3..03b052a46dd76 100644
--- a/pkgs/development/python-modules/parso/default.nix
+++ b/pkgs/development/python-modules/parso/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "parso";
-  version = "0.8.3";
+  version = "0.8.4";
   format = "setuptools";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jAe+KQu1nwNYiRWSHinopQACrK8s3F+g4BFPkXCfr6A=";
+    hash = "sha256-6zp7WCQPuZCZo0VXHe7MD5VA6l9N0v4UwqmdaygauS0=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/path/default.nix b/pkgs/development/python-modules/path/default.nix
index e88a7efd60f5c..3629d8b11db56 100644
--- a/pkgs/development/python-modules/path/default.nix
+++ b/pkgs/development/python-modules/path/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "path";
-  version = "16.10.0";
+  version = "16.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sysit2/oEKje1tE2JozItmmK58R8KblKnqEmI/MFHkY=";
+    hash = "sha256-26qn79RgL9a6jYKJDceCPWnl3nQKboQtmRmw+q8rao4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pathlib-abc/default.nix b/pkgs/development/python-modules/pathlib-abc/default.nix
index 891b6d348561e..b048fc3748c1a 100644
--- a/pkgs/development/python-modules/pathlib-abc/default.nix
+++ b/pkgs/development/python-modules/pathlib-abc/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pathlib-abc";
-  version = "0.1.1";
+  version = "0.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pathlib_abc";
     inherit version;
-    hash = "sha256-CE573ZGbD3d0kUqeZM2GobOYYPgfeB3XJCWGMfKRWr4=";
+    hash = "sha256-ua9rOf1RMhSFZ47DgD0KEeAqIuhp6AUsrLbo9l3nuGI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pdm-backend/default.nix b/pkgs/development/python-modules/pdm-backend/default.nix
index 0e1cc04f920b3..8c199ffd8e8b5 100644
--- a/pkgs/development/python-modules/pdm-backend/default.nix
+++ b/pkgs/development/python-modules/pdm-backend/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pdm-backend";
-  version = "2.1.8";
+  version = "2.2.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pdm-project";
     repo = "pdm-backend";
     rev = "refs/tags/${version}";
-    hash = "sha256-d8i+FvxNFPM18W7NmOwh9bqZnMUenF7eCPdcCw4BT7s=";
+    hash = "sha256-WvRpZD486yGP9qqxZyiErfEuIyrULDbzKAoFwroV1KE=";
   };
 
   env.PDM_BUILD_SCM_VERSION = version;
diff --git a/pkgs/development/python-modules/pdoc/default.nix b/pkgs/development/python-modules/pdoc/default.nix
index d1356c9a9940c..c6ebbc72f5ce1 100644
--- a/pkgs/development/python-modules/pdoc/default.nix
+++ b/pkgs/development/python-modules/pdoc/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     jinja2
     pygments
     markupsafe
diff --git a/pkgs/development/python-modules/pg8000/default.nix b/pkgs/development/python-modules/pg8000/default.nix
index 3bd937c6d492f..05e5201375813 100644
--- a/pkgs/development/python-modules/pg8000/default.nix
+++ b/pkgs/development/python-modules/pg8000/default.nix
@@ -6,28 +6,28 @@
 , python-dateutil
 , pythonOlder
 , scramp
-, setuptools
+, hatchling
 , versioningit
 }:
 
 buildPythonPackage rec {
   pname = "pg8000";
-  version = "1.30.5";
-  format = "pyproject";
+  version = "1.31.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-By960AzXI2lcsun8AsHfuEx4FFXpe43m9MQoHuoIB4w=";
+    hash = "sha256-sREw1MYV3TBi6o/tgUMGSnl4t/5tRPFLciYdQ8jicIc=";
   };
 
-  nativeBuildInputs = [
-    setuptools
+  build-system = [
+    hatchling
     versioningit
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     passlib
     python-dateutil
     scramp
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index b2bb4cbfd01d6..85153b6fa9052 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.13.31";
+  version = "8.13.34";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J0IHHJ0K8JJ0yKWyom2aNqy/LqXLYpQ8ws6ttcDIdkE=";
+    hash = "sha256-fCZ2vge30PdEEeJ14GYDgKDsPuDTWfBw1xlCS9LF9i4=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index bfcd4c0589c29..ba0ce17b0c3a0 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "8.13.0";
+  version = "8.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-6HCFPHIQ6+SHt4Zu6CZ0R2Ah+jFnztGOCMhQfvR6FxY=";
+    hash = "sha256-3ORvbhO3eLu/NIE0Lwdf93QtUHUmyMf7LmdMBJpkYIg=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pikepdf/paths.patch b/pkgs/development/python-modules/pikepdf/paths.patch
index 1bd030c186c23..83cebed5cc234 100644
--- a/pkgs/development/python-modules/pikepdf/paths.patch
+++ b/pkgs/development/python-modules/pikepdf/paths.patch
@@ -12,10 +12,10 @@ index da40043f..4f566f01 100644
              check=True,
          )
 diff --git a/src/pikepdf/jbig2.py b/src/pikepdf/jbig2.py
-index f89b4f90..f187ebdf 100644
+index 901f3b6f..45551820 100644
 --- a/src/pikepdf/jbig2.py
 +++ b/src/pikepdf/jbig2.py
-@@ -63,7 +63,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
+@@ -72,7 +72,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
              output_path = Path(tmpdir) / "outfile"
  
              args = [
@@ -24,12 +24,12 @@ index f89b4f90..f187ebdf 100644
                  "--embedded",
                  "--format",
                  "png",
-@@ -90,7 +90,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
+@@ -101,7 +101,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
      def _version(self) -> Version:
          try:
              proc = self._run(
--                ['jbig2dec', '--version'], stdout=PIPE, check=True, encoding='ascii'
-+                ['@jbig2dec@', '--version'], stdout=PIPE, check=True, encoding='ascii'
-             )
-         except (CalledProcessError, FileNotFoundError) as e:
-             raise DependencyError("jbig2dec - not installed or not found") from e
+-                ['jbig2dec', '--version'],
++                ['@jbig2dec@', '--version'],
+                 stdout=PIPE,
+                 check=True,
+                 encoding='ascii',
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index f101d6b361ec1..a576b47bda19e 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -12,7 +12,7 @@
 
 import ./generic.nix (rec {
   pname = "pillow";
-  version = "10.2.0";
+  version = "10.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ import ./generic.nix (rec {
   src = fetchPypi {
     pname = "pillow";
     inherit version;
-    hash = "sha256-6H8LLHgVfhLXaGsn1jwHD9ZdmU6N2ubzKODc9KDNAH4=";
+    hash = "sha256-nSRV+/RMkUhAx5PomqgtDhdjoUJToAB0NxmuWUaBSy0=";
   };
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/pipdeptree/default.nix b/pkgs/development/python-modules/pipdeptree/default.nix
index f42041f1a56f0..8dad1316c1a7f 100644
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@@ -1,20 +1,21 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, diff-cover
-, graphviz
-, hatchling
-, hatch-vcs
-, pytest-mock
-, pytestCheckHook
-, pip
-, virtualenv
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  diff-cover,
+  graphviz,
+  hatchling,
+  hatch-vcs,
+  pytest-mock,
+  pytestCheckHook,
+  pip,
+  virtualenv,
 }:
 
 buildPythonPackage rec {
   pname = "pipdeptree";
-  version = "2.18.1";
+  version = "2.19.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +24,7 @@ buildPythonPackage rec {
     owner = "tox-dev";
     repo = "pipdeptree";
     rev = "refs/tags/${version}";
-    hash = "sha256-fzxshqh2QurpbilG0gC3NWnUntTRoxOHPpfpg6bPI98=";
+    hash = "sha256-kXRz78UHQtVyHFFnURSjOOXX8Me2I5tG2bX+u2yGyzY=";
   };
 
   build-system = [
@@ -31,14 +32,10 @@ buildPythonPackage rec {
     hatch-vcs
   ];
 
-  dependencies = [
-    pip
-  ];
+  dependencies = [ pip ];
 
   passthru.optional-dependencies = {
-    graphviz = [
-      graphviz
-    ];
+    graphviz = [ graphviz ];
   };
 
   nativeCheckInputs = [
@@ -48,9 +45,7 @@ buildPythonPackage rec {
     virtualenv
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
-  pythonImportsCheck = [
-    "pipdeptree"
-  ];
+  pythonImportsCheck = [ "pipdeptree" ];
 
   disabledTests = [
     # Don't run console tests
@@ -59,10 +54,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Command line utility to show dependency tree of packages";
-    mainProgram = "pipdeptree";
     homepage = "https://github.com/tox-dev/pipdeptree";
     changelog = "https://github.com/tox-dev/pipdeptree/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ charlesbaynham ];
+    mainProgram = "pipdeptree";
   };
 }
diff --git a/pkgs/development/python-modules/pixel-font-builder/default.nix b/pkgs/development/python-modules/pixel-font-builder/default.nix
index bd67a88905f7d..0ef77bd5521c9 100644
--- a/pkgs/development/python-modules/pixel-font-builder/default.nix
+++ b/pkgs/development/python-modules/pixel-font-builder/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "pixel-font-builder";
-  version = "0.0.15";
+  version = "0.0.19";
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     pname = "pixel_font_builder";
     inherit version;
-    hash = "sha256-2QnbnJk3onwxmjZ6aUgXFGsx6GtqJDV9Bgs3p5Czvns=";
+    hash = "sha256-f38DyM5hojHfv8k/W6kcHxbOjz43hHW6i4Scm6NbHiQ=";
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/plotly/default.nix b/pkgs/development/python-modules/plotly/default.nix
index 0bec07c3bad2c..a0e26e354ed9a 100644
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "5.20.0";
+  version = "5.21.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v5AcgF0iAyz6U0sv98WqawZZ4DfxnsHgzKf1hZGLXIk=";
+    hash = "sha256-aSQ/jBZdS+JsDfHG8LeyWOLf7v4DJ2NAStfn+318IHM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyasn1/default.nix b/pkgs/development/python-modules/pyasn1/default.nix
index d4fb73d509986..c9e542a6e1ba8 100644
--- a/pkgs/development/python-modules/pyasn1/default.nix
+++ b/pkgs/development/python-modules/pyasn1/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyasn1";
-  version = "0.5.1";
+  version = "0.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bTkaluWbIxMKXPp01v1/OI274mzI8e3zn93fCNnWZ2w=";
+    hash = "sha256-OjWrLEte+Y4X397IqwdARvvaduKBxacGzNgjKM/I9kw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pycparser/default.nix b/pkgs/development/python-modules/pycparser/default.nix
index fa0622df9ff91..89771e7df8f7a 100644
--- a/pkgs/development/python-modules/pycparser/default.nix
+++ b/pkgs/development/python-modules/pycparser/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "pycparser";
-  version = "2.21";
+  version = "2.22";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e644fdec12f7872f86c58ff790da456218b10f863970249516d60a5eaca77206";
+    sha256 = "sha256-SRyL6cBA9TkPW/RKWwd1K9B/Vu35kjgbBccBQ57sEPY=";
   };
 
   nativeCheckInputs = [ unittestCheckHook ];
diff --git a/pkgs/development/python-modules/pycups/default.nix b/pkgs/development/python-modules/pycups/default.nix
index 9b4a1a2d0ee7f..12adc1f669afc 100644
--- a/pkgs/development/python-modules/pycups/default.nix
+++ b/pkgs/development/python-modules/pycups/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "pycups";
-  version = "2.0.1";
+  version = "2.0.4";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-V0NM5fYlSOsSlJyoIX8Gb07rIaXWq4sTRx3ONQ44DJA=";
+    hash = "sha256-hD44XB2/aUmWyoTvAqfzDCg3YDVYj1++rNa64AXPfI0=";
   };
 
   buildInputs = [ cups ] ++ lib.optional stdenv.isDarwin libiconv;
diff --git a/pkgs/development/python-modules/pydrawise/default.nix b/pkgs/development/python-modules/pydrawise/default.nix
index 18752af1e057a..6d1f6aff06bf6 100644
--- a/pkgs/development/python-modules/pydrawise/default.nix
+++ b/pkgs/development/python-modules/pydrawise/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pydrawise";
-  version = "2024.4.0";
+  version = "2024.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "dknowles2";
     repo = "pydrawise";
     rev = "refs/tags/${version}";
-    hash = "sha256-krePSrMMrMgKDHQSjzH7hSNnRmwyRe0qTDXc0r0+CPU=";
+    hash = "sha256-rJul7UAhgB0a6+3buPlfjnhhy2QOo82gvmRtZB+vrko=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyelftools/default.nix b/pkgs/development/python-modules/pyelftools/default.nix
index 84cdda65f1f95..063215f5bc6e1 100644
--- a/pkgs/development/python-modules/pyelftools/default.nix
+++ b/pkgs/development/python-modules/pyelftools/default.nix
@@ -4,22 +4,27 @@
 , fetchFromGitHub
 , python
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pyelftools";
-  version = "0.30";
-  format = "setuptools";
+  version = "0.31";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "eliben";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-A9etnN7G24/Gu8YlV/YDpxZV+TG2eVXGx2ZjVnA9ZD4=";
+    repo = "pyelftools";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kX89fMXqrEvhMAAjqKHzHmrYizKBt1uCWMOJtFNNhy4=";
   };
 
+  build-system = [
+    setuptools
+  ];
+
   doCheck = stdenv.hostPlatform.system == "x86_64-linux" && stdenv.hostPlatform.isGnu;
 
   checkPhase = ''
@@ -35,10 +40,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python library for analyzing ELF files and DWARF debugging information";
-    mainProgram = "readelf.py";
     homepage = "https://github.com/eliben/pyelftools";
     changelog = "https://github.com/eliben/pyelftools/blob/v${version}/CHANGES";
     license = licenses.publicDomain;
     maintainers = with maintainers; [ igsha pamplemousse ];
+    mainProgram = "readelf.py";
   };
 }
diff --git a/pkgs/development/python-modules/pyerfa/default.nix b/pkgs/development/python-modules/pyerfa/default.nix
index 8561738f8428c..fd7348f3ca59a 100644
--- a/pkgs/development/python-modules/pyerfa/default.nix
+++ b/pkgs/development/python-modules/pyerfa/default.nix
@@ -2,9 +2,8 @@
 , buildPythonPackage
 , fetchPypi
 , jinja2
-, oldest-supported-numpy
+, setuptools
 , setuptools-scm
-, wheel
 , liberfa
 , packaging
 , numpy
@@ -14,23 +13,27 @@
 
 buildPythonPackage rec {
   pname = "pyerfa";
-  format = "pyproject";
-  version = "2.0.1.1";
+  version = "2.0.1.4";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-26x07409Ow8i7wrTu72zCyqeEFcLH6Wpi+NMe+Nsmms=";
+    hash = "sha256-rLimcTIy6jXAS8bkCsTkYd/MgX05XvKjyAUcGjMkndM=";
   };
 
-  nativeBuildInputs = [
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "numpy>=2.0.0rc1" "numpy"
+  '';
+
+  build-system = [
     jinja2
-    oldest-supported-numpy
     packaging
+    setuptools
     setuptools-scm
-    wheel
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
   ];
   buildInputs = [
diff --git a/pkgs/development/python-modules/pyfakefs/default.nix b/pkgs/development/python-modules/pyfakefs/default.nix
index c588607f5c126..6e31c1e2e2364 100644
--- a/pkgs/development/python-modules/pyfakefs/default.nix
+++ b/pkgs/development/python-modules/pyfakefs/default.nix
@@ -8,20 +8,21 @@
 , setuptools
 
 # tests
+, pandas
 , pytestCheckHook
 , undefined
 }:
 
 buildPythonPackage rec {
   pname = "pyfakefs";
-  version = "5.3.5";
+  version = "5.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fNxQCzWiFMt6YU4ZQFQ6zGZQ5pqUrHbjDzPJNzvZz5A=";
+    hash = "sha256-IMtR6GDC8/+DhZFirVE0u4sKHnqB3woYz8zEhi0Nncw=";
   };
 
   postPatch = ''
@@ -46,6 +47,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    pandas
     pytestCheckHook
     undefined
   ];
diff --git a/pkgs/development/python-modules/pygame-ce/default.nix b/pkgs/development/python-modules/pygame-ce/default.nix
new file mode 100644
index 0000000000000..a476ecd58b850
--- /dev/null
+++ b/pkgs/development/python-modules/pygame-ce/default.nix
@@ -0,0 +1,123 @@
+{ stdenv
+, lib
+, substituteAll
+, fetchFromGitHub
+, buildPythonPackage
+, pythonOlder
+, python
+, pkg-config
+, setuptools
+, cython
+
+, AppKit
+, fontconfig
+, freetype
+, libjpeg
+, libpng
+, libX11
+, portmidi
+, SDL2
+, SDL2_image
+, SDL2_mixer
+, SDL2_ttf
+}:
+
+buildPythonPackage rec {
+  pname = "pygame-ce";
+  version = "2.4.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "pygame-community";
+    repo = "pygame-ce";
+    rev = "refs/tags/${version}";
+    hash = "sha256-4Ky+QEUsQ0odcwEETk0yGECs7CcJQthhavboOnMDvF8=";
+    # Unicode file cause different checksums on HFS+ vs. other filesystems
+    postFetch = "rm -rf $out/docs/reST";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./fix-dependency-finding.patch;
+      buildinputs_include = builtins.toJSON (builtins.concatMap (dep: [
+        "${lib.getDev dep}/"
+        "${lib.getDev dep}/include"
+        "${lib.getDev dep}/include/SDL2"
+      ]) buildInputs);
+      buildinputs_lib = builtins.toJSON (builtins.concatMap (dep: [
+        "${lib.getLib dep}/"
+        "${lib.getLib dep}/lib"
+      ]) buildInputs);
+    })
+    # Skip tests that should be disabled without video driver
+    ./skip-surface-tests.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace buildconfig/config_{unix,darwin}.py \
+      --replace-fail 'from distutils' 'from setuptools._distutils'
+    substituteInPlace src_py/sysfont.py \
+      --replace-fail 'path="fc-list"' 'path="${fontconfig}/bin/fc-list"' \
+      --replace-fail /usr/X11/bin/fc-list ${fontconfig}/bin/fc-list
+  '' + lib.optionalString stdenv.isDarwin ''
+    # flaky
+    rm test/system_test.py
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    cython
+    setuptools
+  ];
+
+  buildInputs = [
+    freetype
+    libX11
+    libjpeg
+    libpng
+    portmidi
+    SDL2
+    SDL2_image
+    SDL2_mixer
+    SDL2_ttf
+  ] ++ lib.optionals stdenv.isDarwin [
+    AppKit
+  ];
+
+  preConfigure = ''
+    ${python.pythonOnBuildForHost.interpreter} buildconfig/config.py
+  '';
+
+  env = {
+    SDL_CONFIG = "${SDL2.dev}/bin/sdl2-config";
+  } // lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-function-pointer-types";
+  };
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    # No audio or video device in test environment
+    export SDL_VIDEODRIVER=dummy
+    export SDL_AUDIODRIVER=disk
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} -m pygame.tests -v --exclude opengl,timing --time_out 300
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [
+    "pygame"
+  ];
+
+  meta = with lib; {
+    description = "Pygame Community Edition (CE) - library for multimedia application built on SDL";
+    homepage = "https://pyga.me/";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ pbsds ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/python-modules/pygame-ce/fix-dependency-finding.patch b/pkgs/development/python-modules/pygame-ce/fix-dependency-finding.patch
new file mode 100644
index 0000000000000..5e39dff135752
--- /dev/null
+++ b/pkgs/development/python-modules/pygame-ce/fix-dependency-finding.patch
@@ -0,0 +1,41 @@
+diff --git a/buildconfig/config_darwin.py b/buildconfig/config_darwin.py
+index 9503ea70..d0d3ab6e 100644
+--- a/buildconfig/config_darwin.py
++++ b/buildconfig/config_darwin.py
+@@ -140,16 +140,8 @@ def main(auto_config=False):
+     ])
+ 
+     print('Hunting dependencies...')
+-    incdirs = ['/usr/local/include', '/opt/homebrew/include']
+-    incdirs.extend(['/usr/local/include/SDL2', '/opt/homebrew/include/SDL2', '/opt/local/include/SDL2'])
+-
+-    incdirs.extend([
+-       #'/usr/X11/include',
+-       '/opt/local/include',
+-       '/opt/local/include/freetype2/freetype']
+-    )
+-    #libdirs = ['/usr/local/lib', '/usr/X11/lib', '/opt/local/lib']
+-    libdirs = ['/usr/local/lib', '/opt/local/lib', '/opt/homebrew/lib']
++    incdirs = @buildinputs_include@
++    libdirs = @buildinputs_lib@
+ 
+     for d in DEPS:
+         if isinstance(d, (list, tuple)):
+diff --git a/buildconfig/config_unix.py b/buildconfig/config_unix.py
+index 3eba5b5c..53cc6233 100644
+--- a/buildconfig/config_unix.py
++++ b/buildconfig/config_unix.py
+@@ -240,11 +240,8 @@ def main(auto_config=False):
+     if not DEPS[0].found:
+         raise RuntimeError('Unable to run "sdl-config". Please make sure a development version of SDL is installed.')
+ 
+-    incdirs = []
+-    libdirs = []
+-    for extrabase in extrabases:
+-        incdirs += [extrabase + d for d in origincdirs]
+-        libdirs += [extrabase + d for d in origlibdirs]
++    incdirs = @buildinputs_include@
++    libdirs = @buildinputs_lib@
+ 
+     for arg in DEPS[0].cflags.split():
+         if arg[:2] == '-I':
diff --git a/pkgs/development/python-modules/pygame-ce/skip-surface-tests.patch b/pkgs/development/python-modules/pygame-ce/skip-surface-tests.patch
new file mode 100644
index 0000000000000..21d9c9060f3b8
--- /dev/null
+++ b/pkgs/development/python-modules/pygame-ce/skip-surface-tests.patch
@@ -0,0 +1,26 @@
+diff --git a/test/surface_test.py b/test/surface_test.py
+index 5ce78b6e..8b8f7ed5 100644
+--- a/test/surface_test.py
++++ b/test/surface_test.py
+@@ -1091,6 +1091,10 @@ class GeneralSurfaceTests(unittest.TestCase):
+         finally:
+             pygame.display.quit()
+ 
++    @unittest.skipIf(
++        os.environ.get("SDL_VIDEODRIVER") == "dummy",
++        'requires a non-"dummy" SDL_VIDEODRIVER',
++    )
+     def test_convert_init(self):
+         """Ensure initialization exceptions are raised
+         for surf.convert()."""
+@@ -1118,6 +1122,10 @@ class GeneralSurfaceTests(unittest.TestCase):
+         finally:
+             pygame.display.quit()
+ 
++    @unittest.skipIf(
++        os.environ.get("SDL_VIDEODRIVER") == "dummy",
++        'requires a non-"dummy" SDL_VIDEODRIVER',
++    )
+     def test_convert_alpha_init(self):
+         """Ensure initialization exceptions are raised
+         for surf.convert_alpha()."""
diff --git a/pkgs/development/python-modules/pygame/default.nix b/pkgs/development/python-modules/pygame/default.nix
index a219804f34b81..fca187c8cc58a 100644
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , substituteAll
+, fetchpatch
 , fetchFromGitHub
 , buildPythonPackage
 , pythonOlder
@@ -61,6 +62,13 @@ buildPythonPackage rec {
     })
     # Skip tests that should be disabled without video driver
     ./skip-surface-tests.patch
+
+    # removes distutils unbreaking py312, part of https://github.com/pygame/pygame/pull/4211
+    (fetchpatch {
+      name = "remove-distutils.patch";
+      url = "https://github.com/pygame/pygame/commit/6038e7d6583a7a25fcc6e15387cf6240e427e5a7.patch";
+      hash = "sha256-HxcYjjhsu/Y9HiK9xDvY4X5dgWPP4XFLxdYGXC6tdWM=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix
index cc2d41147bca7..f1dff5b24e31c 100644
--- a/pkgs/development/python-modules/pygobject/3.nix
+++ b/pkgs/development/python-modules/pygobject/3.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "3.46.0";
+  version = "3.48.2";
 
   outputs = [ "out" "dev" ];
 
@@ -27,7 +27,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "QmAIstrVSMmvHHsDtZ3wRA/eXDPzj7VAaxA6Q9ZTyvw=";
+    hash = "sha256-B5SutKm+MaCSrCBiG19U7CgPkYWUPTKLEFza5imK0ac=";
   };
 
   depsBuildBuild = [
@@ -50,6 +50,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     pycairo
+    gobject-introspection # e.g. try building: python3Packages.urwid python3Packages.pydbus
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/python-modules/pykalman/default.nix b/pkgs/development/python-modules/pykalman/default.nix
index 7073e9382d3de..401ff4fc6fe7a 100644
--- a/pkgs/development/python-modules/pykalman/default.nix
+++ b/pkgs/development/python-modules/pykalman/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pykalman";
-  version = "0.9.5";
+  version = "0.9.7";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gWr0dyDZJKTGAW+nS54sjCEWWgjZFpPDIqF0Ho4H+zg=";
+    hash = "sha256-E1d5IAOTxrNwIhmQ9zFnQEcvVBNG6SEdEWMOLC2PuKA=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pykdtree/default.nix b/pkgs/development/python-modules/pykdtree/default.nix
index b720f5b838b3a..84372802ecaf2 100644
--- a/pkgs/development/python-modules/pykdtree/default.nix
+++ b/pkgs/development/python-modules/pykdtree/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "pykdtree";
-  version = "1.3.11";
+  version = "1.3.12";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bBI8e65SE68iPFKai0FhwH64VKb+QDizaVK62iEx68s=";
+    hash = "sha256-zCCypnxkBWSFoxTSwrbbo1SvfuHI+42uG+byk2o3Q0E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pymc/default.nix b/pkgs/development/python-modules/pymc/default.nix
index e3f64840a0737..947aaa4241861 100644
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pymc";
-  version = "5.13.1";
+  version = "5.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "pymc-devs";
     repo = "pymc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SSAn7nbKhXGeEvASKQITUs3+ix3j37u9JTkNiG+1tZ0=";
+    hash = "sha256-ZVGMzkStKSPLgBoyzA8SOvsof7QRR7TLmLhh5NmD/F8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pymdown-extensions/default.nix b/pkgs/development/python-modules/pymdown-extensions/default.nix
index d760b9cd0dd47..733f124d36553 100644
--- a/pkgs/development/python-modules/pymdown-extensions/default.nix
+++ b/pkgs/development/python-modules/pymdown-extensions/default.nix
@@ -63,6 +63,11 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  disabledTests = [
+    # test artifact mismatch
+    "test_toc_tokens"
+  ];
+
   pythonImportsCheck = map (ext: "pymdownx.${ext}") extensions;
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/pymongo-inmemory/default.nix b/pkgs/development/python-modules/pymongo-inmemory/default.nix
index 604f0c1c3cd32..6447b0a7ffe94 100644
--- a/pkgs/development/python-modules/pymongo-inmemory/default.nix
+++ b/pkgs/development/python-modules/pymongo-inmemory/default.nix
@@ -25,13 +25,13 @@ buildPythonPackage rec {
   postPatch = ''
     # move cache location from nix store to home
     substituteInPlace pymongo_inmemory/context.py \
-      --replace \
+      --replace-fail \
         'CACHE_FOLDER = path.join(path.dirname(__file__), "..", ".cache")' \
         'CACHE_FOLDER = os.environ.get("XDG_CACHE_HOME", os.environ["HOME"] + "/.cache") + "/pymongo-inmemory"'
 
     # fix a broken assumption arising from the above fix
     substituteInPlace pymongo_inmemory/_utils.py \
-      --replace \
+      --replace-fail \
         'os.mkdir(current_path)' \
         'os.makedirs(current_path)'
   '';
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     poetry-core
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     pymongo
   ];
 
diff --git a/pkgs/development/python-modules/pymongo/default.nix b/pkgs/development/python-modules/pymongo/default.nix
index 3d17ea66f1e71..1ca7ca08ad501 100644
--- a/pkgs/development/python-modules/pymongo/default.nix
+++ b/pkgs/development/python-modules/pymongo/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pymongo";
-  version = "4.6.2";
+  version = "4.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-q30BrIMqFmPa1ZLMvZK7Dwd1vI+YoZI8Xhp9f+rUla8=";
+    hash = "sha256-QAB0CQuaYx8SC0LGGyIv10NJDBM6XS+ZwCCM78zMlk4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pymysql/default.nix b/pkgs/development/python-modules/pymysql/default.nix
index e7711f5902b94..1b5a00c27ac13 100644
--- a/pkgs/development/python-modules/pymysql/default.nix
+++ b/pkgs/development/python-modules/pymysql/default.nix
@@ -1,19 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , cryptography
 }:
 
 buildPythonPackage rec {
   pname = "pymysql";
-  version = "1.0.2";
+  version = "1.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "PyMySQL";
     inherit version;
-    sha256 = "816927a350f38d56072aeca5dfb10221fe1dc653745853d30a216637f5d7ad36";
+    hash = "sha256-TxOn34vzalHoHdnzYF/t5FpIeP4C+SNjSf2Co/BhL5Y=";
   };
 
+  build-system = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ cryptography ];
 
   # Wants to connect to MySQL
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 31e9e810c9edd..e59a9a4b43f72 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -9,18 +9,18 @@
 , pretend
 , sphinxHook
 , sphinx-rtd-theme
-, flaky
+, pytest-rerunfailures
 }:
 
 buildPythonPackage rec {
   pname = "pyopenssl";
-  version = "24.0.0";
+  version = "24.1.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "pyOpenSSL";
     inherit version;
-    hash = "sha256-aqMwOak//6RWPmVbYdETZNASZL6My0mQYQHgKjNFML8=";
+    hash = "sha256-yr7Uv6pd+fGhbA72Sgy2Uxi1zQd6ftp9aXATHKL0Gm8=";
   };
 
   outputs = [
@@ -46,8 +46,8 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    flaky
     pretend
+    pytest-rerunfailures
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/pyproject-metadata/default.nix b/pkgs/development/python-modules/pyproject-metadata/default.nix
index e5f5e157a52dd..f0bdb9379ec8e 100644
--- a/pkgs/development/python-modules/pyproject-metadata/default.nix
+++ b/pkgs/development/python-modules/pyproject-metadata/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, flit-core
 , packaging
 , pytestCheckHook
 , pythonOlder
@@ -11,22 +12,22 @@
 
 buildPythonPackage rec {
   pname = "pyproject-metadata";
-  version = "0.7.1";
+  version = "0.8.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi rec {
-    inherit pname version;
-    hash = "sha256-CpTxixCLmyHzomo9VB8FbDTtyxfchyoUShVhj+1672c=";
+  src = fetchPypi {
+    pname = "pyproject_metadata";
+    inherit version;
+    hash = "sha256-N21aAHZKwpRApUV5+I5mt9nLfmKdNcNaHHJIv+vJtFU=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
+  build-system = [
+    flit-core
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     packaging
   ];
 
diff --git a/pkgs/development/python-modules/pyqt-builder/default.nix b/pkgs/development/python-modules/pyqt-builder/default.nix
index 1bf96713a4fe5..5bd7cca6189e3 100644
--- a/pkgs/development/python-modules/pyqt-builder/default.nix
+++ b/pkgs/development/python-modules/pyqt-builder/default.nix
@@ -3,23 +3,25 @@
 , fetchPypi
 , packaging
 , setuptools
+, setuptools-scm
 , sip
 , wheel
 }:
 
 buildPythonPackage rec {
   pname = "pyqt-builder";
-  version = "1.15.4";
+  version = "1.16.0";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "PyQt-builder";
     inherit version;
-    hash = "sha256-OfjHXbF9nOF8trvz3xZQtc68HqTlvXOEPSHMlmErKuE=";
+    hash = "sha256-R7vSz6VDACAQj59AMB4WbL6pi27z5TlTNQvdTGsxqxg=";
   };
 
   nativeBuildInputs = [
     setuptools
+    setuptools-scm
     wheel
   ];
 
diff --git a/pkgs/development/python-modules/pyramid-beaker/default.nix b/pkgs/development/python-modules/pyramid-beaker/default.nix
index aad88af5f16a4..a49e01a378f10 100644
--- a/pkgs/development/python-modules/pyramid-beaker/default.nix
+++ b/pkgs/development/python-modules/pyramid-beaker/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pyramid-beaker";
-  version = "0.8";
+  version = "0.9";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "pyramid_beaker";
     inherit version;
-    sha256 = "0hflx3qkcdml1mwpq53sz46s7jickpfn0zy0ns2c7j445j66bp3p";
+    sha256 = "sha256-zMUT60z7W0Flfym25rKMor17O/n9qRMGoQKa7pLRz6U=";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pyrender/default.nix b/pkgs/development/python-modules/pyrender/default.nix
index eb1d5d17ee47b..41214174ae789 100644
--- a/pkgs/development/python-modules/pyrender/default.nix
+++ b/pkgs/development/python-modules/pyrender/default.nix
@@ -3,6 +3,7 @@
 , pythonOlder
 , fetchFromGitHub
 , fetchpatch
+, setuptools
 , freetype-py
 , imageio
 , networkx
@@ -19,7 +20,7 @@
 buildPythonPackage rec {
   pname = "pyrender";
   version = "0.1.45";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.5";
 
@@ -45,12 +46,16 @@ buildPythonPackage rec {
   # the commit does not apply as a patch when cherry picked, hence the substituteInPlace
   postPatch = ''
     substituteInPlace tests/unit/test_meshes.py \
-      --replace \
+      --replace-fail \
         "bm = trimesh.load('tests/data/WaterBottle.glb').dump()[0]" \
         'bm = trimesh.load("tests/data/WaterBottle.glb").geometry["WaterBottle"]'
   '';
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  dependencies = [
     freetype-py
     imageio
     networkx
diff --git a/pkgs/development/python-modules/pysimplegui/default.nix b/pkgs/development/python-modules/pysimplegui/default.nix
index 58deefb4f3d33..71234522f9fb0 100644
--- a/pkgs/development/python-modules/pysimplegui/default.nix
+++ b/pkgs/development/python-modules/pysimplegui/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pysimplegui";
-  version = "5.0.3";
+  version = "5.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PySimpleGUI";
     inherit version;
-    hash = "sha256-bnjPVGMVfma/tn8oCg6FLMI1W+9rtHMKNdarbNg61GM=";
+    hash = "sha256-pThG6BBWxy98REUae91yBZDKK8Q1Zc1PHpoW7nhdmAw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index 5b281130f309a..5d997cab00444 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -60,7 +60,6 @@ buildPythonPackage rec {
     jax
     jaxlib
     numba
-    numba-scipy
     pytest-mock
     pytestCheckHook
     tensorflow-probability
diff --git a/pkgs/development/python-modules/pytest-mock/default.nix b/pkgs/development/python-modules/pytest-mock/default.nix
index f956a62e1a5a0..966304cdc83d0 100644
--- a/pkgs/development/python-modules/pytest-mock/default.nix
+++ b/pkgs/development/python-modules/pytest-mock/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-mock";
-  version = "3.12.0";
+  version = "3.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MaQPA4wiytMih7tDkyBURR/1WD/wlLym9nXfL4vBpuk=";
+    hash = "sha256-JxklWh7+zq28BW1r8989HFAVUw+0DPNHwPmvrIhBC9A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-order/default.nix b/pkgs/development/python-modules/pytest-order/default.nix
index 389ce90eddceb..ebb7bbe09d438 100644
--- a/pkgs/development/python-modules/pytest-order/default.nix
+++ b/pkgs/development/python-modules/pytest-order/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-order";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lE+GttRBqnsdqA+AHGq2W4S766Ry0KehLrQ7omZQEBo=";
+    hash = "sha256-RFG9iCG6T6IQlFWi/MiCr2DvjlPgnSRNZ2dL4I9W6sM=";
   };
 
   buildInputs = [ pytest ];
@@ -27,10 +27,12 @@ buildPythonPackage rec {
     pytest-mock
   ];
 
-  meta = {
+  strictDeps = true;
+
+  meta = with lib; {
     description = "Pytest plugin that allows you to customize the order in which your tests are run";
     homepage = "https://github.com/pytest-dev/pytest-order";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.jacg ];
+    license = licenses.mit;
+    maintainers = with maintainers; [ jacg Luflosi ];
   };
 }
diff --git a/pkgs/development/python-modules/python-dbusmock/default.nix b/pkgs/development/python-modules/python-dbusmock/default.nix
index 2a676f72832e2..cec0275dfdbe4 100644
--- a/pkgs/development/python-modules/python-dbusmock/default.nix
+++ b/pkgs/development/python-modules/python-dbusmock/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , nose
 , dbus
+, gobject-introspection
 , dbus-python
 , pygobject3
 , bluez
@@ -40,6 +41,7 @@ in buildPythonPackage rec {
 
   nativeCheckInputs = [
     dbus
+    gobject-introspection
     pygobject3
     bluez
     pbap-client
diff --git a/pkgs/development/python-modules/python-jose/default.nix b/pkgs/development/python-modules/python-jose/default.nix
index 6e3f406fe5a30..9739e5bf7f65e 100644
--- a/pkgs/development/python-modules/python-jose/default.nix
+++ b/pkgs/development/python-modules/python-jose/default.nix
@@ -64,7 +64,12 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+
+  disabledTests = [
+    # https://github.com/mpdavis/python-jose/issues/348
+    "TestBackendEcdsaCompatibility"
+  ];
 
   meta = with lib; {
     changelog = "https://github.com/mpdavis/python-jose/releases/tag/${version}";
diff --git a/pkgs/development/python-modules/python-musicpd/default.nix b/pkgs/development/python-modules/python-musicpd/default.nix
index cc4ab6b722f0a..c105dcea14da7 100644
--- a/pkgs/development/python-modules/python-musicpd/default.nix
+++ b/pkgs/development/python-modules/python-musicpd/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "python-musicpd";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchPypi {
     inherit pname;
     inherit version;
-    sha256 = "sha256-5Br4rZO1c/pPmAZ/UecYjuVLttR8R+xeReKsc/xnaeI=";
+    sha256 = "sha256-/FdM0UolVqhJNpS60Q/nra1hSHKL/LiSMX7/Hcipwco=";
   };
 
   format = "setuptools";
diff --git a/pkgs/development/python-modules/pytikz-allefeld/default.nix b/pkgs/development/python-modules/pytikz-allefeld/default.nix
index fe59dc0a5208c..9dd0bdb2bbe6b 100644
--- a/pkgs/development/python-modules/pytikz-allefeld/default.nix
+++ b/pkgs/development/python-modules/pytikz-allefeld/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , buildPythonPackage
 , pythonOlder
+, setuptools
 , pymupdf
 , numpy
 , ipython
@@ -12,7 +13,7 @@
 buildPythonPackage rec {
   pname = "pytikz-allefeld"; # "pytikz" on pypi is a different module
   version = "unstable-2022-11-01";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.5";
 
@@ -23,7 +24,11 @@ buildPythonPackage rec {
     hash = "sha256-G59UUkpjttJKNBN0MB/A9CftO8tO3nv8qlTxt3/fKHk=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  dependencies = [
     pymupdf
     numpy
     ipython
diff --git a/pkgs/development/python-modules/pyunpack/default.nix b/pkgs/development/python-modules/pyunpack/default.nix
index ea7ad7d416a3a..631c9706f0df0 100644
--- a/pkgs/development/python-modules/pyunpack/default.nix
+++ b/pkgs/development/python-modules/pyunpack/default.nix
@@ -23,14 +23,14 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyunpack/__init__.py \
-      --replace \
+      --replace-fail \
        '_exepath("patool")' \
        '"${lib.getBin patool}/bin/.patool-wrapped"'
   '';
 
   nativeBuildInputs = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     easyprocess
     entrypoint2
   ];
diff --git a/pkgs/development/python-modules/pyvis/default.nix b/pkgs/development/python-modules/pyvis/default.nix
index a9fea2dc68303..cb39d67192c9f 100644
--- a/pkgs/development/python-modules/pyvis/default.nix
+++ b/pkgs/development/python-modules/pyvis/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , fetchpatch
 , buildPythonPackage
+, setuptools
 , networkx
 , jinja2
 , ipython
@@ -13,7 +14,7 @@
 buildPythonPackage rec {
   pname = "pyvis";
   version = "0.3.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "WestHealth";
@@ -22,7 +23,11 @@ buildPythonPackage rec {
     hash = "sha256-eo9Mk2c0hrBarCrzwmkXha3Qt4Bl1qR7Lhl9EkUx96E=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  dependencies = [
     jinja2
     networkx
     ipython
diff --git a/pkgs/development/python-modules/pywavelets/default.nix b/pkgs/development/python-modules/pywavelets/default.nix
index a4d8117fc3720..af598a1439caf 100644
--- a/pkgs/development/python-modules/pywavelets/default.nix
+++ b/pkgs/development/python-modules/pywavelets/default.nix
@@ -1,34 +1,44 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, isPy27
+, fetchFromGitHub
+, pythonOlder
+, meson-python
 , cython
-, nose
-, pytest
+, pytestCheckHook
 , numpy
 }:
 
 buildPythonPackage rec {
   pname = "pywavelets";
-  version = "1.4.1";
-  disabled = isPy27;
+  version = "1.6.0";
+  pyproject = true;
 
-  src = fetchPypi {
-    pname = "PyWavelets";
-    inherit version;
-    hash = "sha256-ZDevPd8IMRjCbY+Xq0OwckuVbJ+Vjp6niGWfaig0upM=";
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "PyWavelets";
+    repo = "pywt";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Dr6LWGVlYGDD21l1RQ7elScovcen5uuFdJJXe3deB5o=";
   };
 
-  nativeCheckInputs = [ nose pytest ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"numpy>=2.0.0rc1,<2.3",' ""
+  '';
+
+  build-system = [
+    meson-python
+    cython
+    numpy
+  ];
 
-  buildInputs = [ cython ];
+  dependencies = [ numpy ];
 
-  propagatedBuildInputs = [ numpy ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
-  # Somehow nosetests doesn't run the tests, so let's use pytest instead
-  doCheck = false; # tests use relative paths, which fail to resolve
-  checkPhase = ''
-    py.test pywt/tests
+  preCheck = ''
+    cd $out
   '';
 
   # ensure compiled modules are present
@@ -43,6 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Wavelet transform module";
     homepage = "https://github.com/PyWavelets/pywt";
+    changelog = "https://github.com/PyWavelets/pywt/releases/tag/v${version}";
     license = licenses.mit;
   };
 
diff --git a/pkgs/development/python-modules/pywbem/default.nix b/pkgs/development/python-modules/pywbem/default.nix
index bba152dd43671..c298c1e51209e 100644
--- a/pkgs/development/python-modules/pywbem/default.nix
+++ b/pkgs/development/python-modules/pywbem/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "pywbem";
-  version = "1.6.3";
+  version = "1.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eN8w3umMUIYgtZm4lR8yKoHGwKnXt4/+XgF7lBfNl7k=";
+    hash = "sha256-6jx5H4FtM93JToXQwq9ihiPfMw7nX4KwFFQzHkAgnP4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qdldl/default.nix b/pkgs/development/python-modules/qdldl/default.nix
index a5af403d4d7a6..10d05be786960 100644
--- a/pkgs/development/python-modules/qdldl/default.nix
+++ b/pkgs/development/python-modules/qdldl/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "qdldl";
-  version = "0.1.7.post1";
+  version = "0.1.7.post2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eY2IwW4CU2rmXHHwa2Tj+/MbdNfke8EP+YFnaGMrOmQ=";
+    hash = "sha256-SxU5pewQzHV6/XFW1960AGAHythtd0yfD9w+NEFVV9M=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/qrcode/default.nix b/pkgs/development/python-modules/qrcode/default.nix
index b5c3d2aec6b34..3d7ad90dbaaf5 100644
--- a/pkgs/development/python-modules/qrcode/default.nix
+++ b/pkgs/development/python-modules/qrcode/default.nix
@@ -51,6 +51,9 @@ buildPythonPackage rec {
 
   disabledTests = lib.optionals (pythonAtLeast "3.12") [
     "test_change"
+  ] ++ [
+    # Attempts to open a file which doesn't exist in sandbox
+    "test_piped"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/readme-renderer/default.nix b/pkgs/development/python-modules/readme-renderer/default.nix
index 13a8074a56907..bcc961bc18ffc 100644
--- a/pkgs/development/python-modules/readme-renderer/default.nix
+++ b/pkgs/development/python-modules/readme-renderer/default.nix
@@ -44,17 +44,8 @@ buildPythonPackage rec {
   ++ optional-dependencies.md;
 
   disabledTests = [
-    # https://github.com/pypa/readme_renderer/issues/221
-    "test_GFM_"
-    # https://github.com/pypa/readme_renderer/issues/274
-    "test_CommonMark_008.md"
+    "test_rst_fixtures"
     "test_rst_008.rst"
-    # Relies on old distutils behaviour removed by setuptools (TypeError: dist must be a Distribution instance)
-    "test_valid_rst"
-    "test_invalid_rst"
-    "test_malicious_rst"
-    "test_invalid_missing"
-    "test_invalid_empty"
   ];
 
   pythonImportsCheck = [
@@ -64,6 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for rendering readme descriptions";
     homepage = "https://github.com/pypa/readme_renderer";
+    changelog = "https://github.com/pypa/readme_renderer/releases/tag/${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index d987092e48f02..9e583447e1017 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "redis";
-  version = "5.0.1";
+  version = "5.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DatJXNV1MGnTvGUKDd6Kj57d4W/FaRtomlZu2lgQDQ8=";
+    hash = "sha256-SXO650RMD77WSga4dEb3k2HLfk7BU4wCLWlu16UBVYA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/referencing/default.nix b/pkgs/development/python-modules/referencing/default.nix
index 0113f23e47420..3e7063e42ecc6 100644
--- a/pkgs/development/python-modules/referencing/default.nix
+++ b/pkgs/development/python-modules/referencing/default.nix
@@ -1,39 +1,39 @@
-{ lib
-, attrs
-, buildPythonPackage
-, fetchFromGitHub
-, hatch-vcs
-, hatchling
-, jsonschema
-, pytest-subtests
-, pytestCheckHook
-, pythonOlder
-, rpds-py
+{
+  lib,
+  attrs,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
+  jsonschema,
+  pytest-subtests,
+  pytestCheckHook,
+  pythonOlder,
+  rpds-py,
 }:
 
-
 let
   self = buildPythonPackage rec {
     pname = "referencing";
-    version = "0.33.0";
-    format = "pyproject";
+    version = "0.34.0";
+    pyproject = true;
 
-    disabled = pythonOlder "3.7";
+    disabled = pythonOlder "3.8";
 
     src = fetchFromGitHub {
       owner = "python-jsonschema";
       repo = "referencing";
       rev = "refs/tags/v${version}";
       fetchSubmodules = true;
-      hash = "sha256-QP/F6UNiKHGNMhGphDJgEFZnpGU5izExcI/A9WJjA5Q=";
+      hash = "sha256-Vx+WVgt09I04Z/sIYsLLtPCwuo5wW0Z2o2OTH2V17UY=";
     };
 
-    nativeBuildInputs = [
+    build-system = [
       hatch-vcs
       hatchling
     ];
 
-    propagatedBuildInputs = [
+    dependencies = [
       attrs
       rpds-py
     ];
@@ -44,22 +44,20 @@ let
       pytestCheckHook
     ];
 
-    # avoid infinite recursion with jsonschema
+    # Avoid infinite recursion with jsonschema
     doCheck = false;
 
     passthru.tests.referencing = self.overridePythonAttrs { doCheck = true; };
 
-    pythonImportsCheck = [
-      "referencing"
-    ];
+    pythonImportsCheck = [ "referencing" ];
 
     meta = with lib; {
       description = "Cross-specification JSON referencing";
       homepage = "https://github.com/python-jsonschema/referencing";
-      changelog = "https://github.com/python-jsonschema/referencing/blob/${version}/CHANGELOG.rst";
+      changelog = "https://github.com/python-jsonschema/referencing/releases/tag/v${version}";
       license = licenses.mit;
       maintainers = with maintainers; [ fab ];
     };
   };
 in
-  self
+self
diff --git a/pkgs/development/python-modules/remi/default.nix b/pkgs/development/python-modules/remi/default.nix
index b1f28e269099e..64b6a70669743 100644
--- a/pkgs/development/python-modules/remi/default.nix
+++ b/pkgs/development/python-modules/remi/default.nix
@@ -2,6 +2,7 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 , matplotlib
 , python-snap7
@@ -11,7 +12,7 @@
 buildPythonPackage rec {
   pname = "remi";
   version = "2022.7.27";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rawpython";
@@ -23,23 +24,27 @@ buildPythonPackage rec {
   preCheck = ''
     # for some reason, REMI already deal with these using try blocks, but they fail
     substituteInPlace test/test_widget.py \
-      --replace \
+      --replace-fail \
         "from html_validator import " \
         "from .html_validator import "
     substituteInPlace test/test_examples_app.py \
-      --replace \
+      --replace-fail \
         "from mock_server_and_request import " \
         "from .mock_server_and_request import " \
-      --replace \
+      --replace-fail \
         "from html_validator import " \
         "from .html_validator import "
     # Halves number of warnings
     substituteInPlace test/test_*.py \
-      --replace \
+      --replace-quiet \
         "self.assertEquals(" \
         "self.assertEqual("
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
     python-snap7
diff --git a/pkgs/development/python-modules/reportlab/default.nix b/pkgs/development/python-modules/reportlab/default.nix
index ef0a575789e75..2024b2835a753 100644
--- a/pkgs/development/python-modules/reportlab/default.nix
+++ b/pkgs/development/python-modules/reportlab/default.nix
@@ -14,7 +14,7 @@ let
   ft = freetype.overrideAttrs (oldArgs: { dontDisableStatic = true; });
 in buildPythonPackage rec {
   pname = "reportlab";
-  version = "4.1.0";
+  version = "4.2.0";
   pyproject = true;
 
   # See https://bitbucket.org/pypy/compatibility/wiki/reportlab%20toolkit
@@ -22,7 +22,7 @@ in buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Opn69BJpEVnAaLP/AcFTB84v0s9rhgGZQ0h04AIECoQ=";
+    hash = "sha256-R0+yjWNDGl1H11yQ1YA5MFDffUkaCceHffMpGi6fbQo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/reproject/default.nix b/pkgs/development/python-modules/reproject/default.nix
index ff6e3070cf7e0..c5ee962365430 100644
--- a/pkgs/development/python-modules/reproject/default.nix
+++ b/pkgs/development/python-modules/reproject/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "reproject";
-  version = "0.13.0";
+  version = "0.13.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lL6MkKVSWmV6KPkG/9fjc2c2dFQ14i9fiJAr3VFfcuI=";
+    hash = "sha256-Y+Ne7ZUgCieWcC4zqfrqPzmr/kGUdFroGfIPKWACaPY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/requests-mock/default.nix b/pkgs/development/python-modules/requests-mock/default.nix
index 4e72ce67364ac..9273875ab688f 100644
--- a/pkgs/development/python-modules/requests-mock/default.nix
+++ b/pkgs/development/python-modules/requests-mock/default.nix
@@ -4,24 +4,31 @@
 , fixtures
 , purl
 , pytestCheckHook
-, python
 , requests
 , requests-futures
-, six
+, setuptools
+, setuptools-scm
 , testtools
 }:
 
 buildPythonPackage rec {
   pname = "requests-mock";
-  version = "1.11.0";
-  format = "setuptools";
+  version = "1.12.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7xC1crSJpfKOCbcIaXIIxKOyuJ74Cp8BWENA6jV+w8Q=";
+    hash = "sha256-6eEuMztSUVboKjyFLyIBa5FYIg0vR0VN6crop303FAE=";
   };
 
-  propagatedBuildInputs = [ requests six ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    requests
+  ];
 
   nativeCheckInputs = [
     fixtures
diff --git a/pkgs/development/python-modules/rpy2/default.nix b/pkgs/development/python-modules/rpy2/default.nix
index c10b23414b425..b323034847255 100644
--- a/pkgs/development/python-modules/rpy2/default.nix
+++ b/pkgs/development/python-modules/rpy2/default.nix
@@ -25,14 +25,14 @@
 }:
 
 buildPythonPackage rec {
-    version = "3.5.15";
+    version = "3.5.16";
     format = "setuptools";
     pname = "rpy2";
 
     disabled = isPyPy;
     src = fetchPypi {
       inherit version pname;
-      hash = "sha256-RE+uSoTcfyM7cOqrCqgTmO4BR8ThrjjdRSTXedbyWys=";
+      hash = "sha256-g34vdFg2WKXEwzl2GnP5Q08z75ztPjDGTadWIWXCgBs=";
     };
 
     patches = [
diff --git a/pkgs/development/python-modules/rq/default.nix b/pkgs/development/python-modules/rq/default.nix
index 45c8627be5df1..7eb455a6dc82c 100644
--- a/pkgs/development/python-modules/rq/default.nix
+++ b/pkgs/development/python-modules/rq/default.nix
@@ -57,15 +57,15 @@ buildPythonPackage rec {
     kill $REDIS_PID
   '';
 
-  pythonImportsCheck = [
-    "rq"
-  ];
-
   disabledTests = [
-    # AttributeError
+    # https://github.com/rq/rq/commit/fd261d5d8fc0fe604fa396ee6b9c9b7a7bb4142f
     "test_clean_large_registry"
   ];
 
+  pythonImportsCheck = [
+    "rq"
+  ];
+
   meta = with lib; {
     description = "Library for creating background jobs and processing them";
     homepage = "https://github.com/nvie/rq/";
diff --git a/pkgs/development/python-modules/rubicon-objc/default.nix b/pkgs/development/python-modules/rubicon-objc/default.nix
new file mode 100644
index 0000000000000..f12f08e0ad47f
--- /dev/null
+++ b/pkgs/development/python-modules/rubicon-objc/default.nix
@@ -0,0 +1,62 @@
+{ lib
+, buildPythonPackage
+, darwin
+, fetchFromGitHub
+, pythonOlder
+, setuptools
+, setuptools-scm
+, unittestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "rubicon-objc";
+  version = "0.4.8";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "beeware";
+    repo = "rubicon-objc";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-aFKzLeVYn5u8hTEgXCum3XpZxI7C/Wql41jkWkCF0HQ=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools==69.2.0" "setuptools" \
+      --replace-fail "setuptools_scm==8.0.4" "setuptools_scm"
+  '';
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  preCheck = ''
+    make -C tests/objc
+  '';
+
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
+
+  checkInputs = [
+    darwin.apple_sdk.frameworks.Foundation
+  ];
+
+  pythonImportsCheck = [
+    "rubicon.objc"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "A bridge interface between Python and Objective-C";
+    homepage = "https://github.com/beeware/rubicon-objc/";
+    changelog = "https://github.com/beeware/rubicon-objc/releases/tag/v${version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ natsukium ];
+    platforms = lib.platforms.darwin;
+  };
+}
diff --git a/pkgs/development/python-modules/s3transfer/default.nix b/pkgs/development/python-modules/s3transfer/default.nix
index 124b44f097cc5..52bf82fc502db 100644
--- a/pkgs/development/python-modules/s3transfer/default.nix
+++ b/pkgs/development/python-modules/s3transfer/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "s3transfer";
-  version = "0.10.0";
+  version = "0.10.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "boto";
     repo = "s3transfer";
     rev = "refs/tags/${version}";
-    hash = "sha256-21xycx1+84uY4gFr7N+ra98dpsEwxy9zeSl4QA66nUc=";
+    hash = "sha256-EHNkYviafnuU8AADp9oyaDuAnoPOdOVNSLCcoONnHPY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/safety/default.nix b/pkgs/development/python-modules/safety/default.nix
index 529ed4d8d4c27..1a5e1ab8f461e 100644
--- a/pkgs/development/python-modules/safety/default.nix
+++ b/pkgs/development/python-modules/safety/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "safety";
-  version = "3.0.1";
+  version = "3.1.0";
 
   disabled = pythonOlder "3.7";
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HyAA8DZS86C/xn+P0emLxXI8y3bhXLG91oVFw9gD3wE=";
+    hash = "sha256-cfR7guzhU+wvJA4nf3y/pw1douDRQxYsZ/Y7L3RZoao=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/scalene/default.nix b/pkgs/development/python-modules/scalene/default.nix
index 29a51e38b631b..18eebe07cc198 100644
--- a/pkgs/development/python-modules/scalene/default.nix
+++ b/pkgs/development/python-modules/scalene/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "scalene";
-  version = "1.5.38";
+  version = "1.5.39";
   pyproject = true;
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LR1evkn2m6FNBmJnUUJubesxIPeHG6RDgLFBHDuxe38=";
+    hash = "sha256-B4pDLP3+56toQZyvh6+6NimCKv0cpcO0ydcqV1tJZkg=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/schwifty/default.nix b/pkgs/development/python-modules/schwifty/default.nix
index 1a33c71f7ff5f..1498dd1bfdb1c 100644
--- a/pkgs/development/python-modules/schwifty/default.nix
+++ b/pkgs/development/python-modules/schwifty/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "schwifty";
-  version = "2024.1.1.post0";
+  version = "2024.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZFDu+stuKdsVc8bTuSZ4LZX8BuQhORjyEMosnrk1rX0=";
+    hash = "sha256-1EV2oi2LBcjw2U7nKqdVUVDlFCzR8RqX5tVIciw1trg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/scikit-bio/default.nix b/pkgs/development/python-modules/scikit-bio/default.nix
index c08f992f2293b..2f49063ae06cb 100644
--- a/pkgs/development/python-modules/scikit-bio/default.nix
+++ b/pkgs/development/python-modules/scikit-bio/default.nix
@@ -20,14 +20,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.5.9";
+  version = "0.6.0";
   format = "setuptools";
   pname = "scikit-bio";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-euBE3IvuIxkAJIrcOoZZB352FA1WrJ9CvQH7eYEBSRA=";
+    hash = "sha256-EBBafDwVrlkQJEkn8punqjUjSxnr5lE7hIRUc0OywQ8=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/scikit-build/default.nix b/pkgs/development/python-modules/scikit-build/default.nix
index acaf74e10953e..0d35ccf4a8ed5 100644
--- a/pkgs/development/python-modules/scikit-build/default.nix
+++ b/pkgs/development/python-modules/scikit-build/default.nix
@@ -92,6 +92,8 @@ buildPythonPackage rec {
     "test_dual_pep518" # pip exits with code 1
     "test_isolated_env_trigger_reconfigure" # Regex pattern 'exit skbuild saving cmake spec' does not match 'exit skbuild running make'.
     "test_hello_wheel" # [Errno 2] No such file or directory: '_skbuild/linux-x86_64-3.9/setuptools/bdist.linux-x86_64/wheel/helloModule.py'
+    "test_hello_cython_sdist" # [Errno 2] No such file or directory: 'dist/hello-cython-1.2.3.tar.gz'
+    "test_hello_pure_sdist" # [Errno 2] No such file or directory: 'dist/hello-pure-1.2.3.tar.gz'
     # sdist contents differ, contains additional setup.py
     "test_hello_sdist"
     "test_manifest_in_sdist"
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index bbcb44de2c02a..88927aa4f20be 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -2,7 +2,6 @@
 , lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 
 # build-system
 , cython
@@ -16,6 +15,7 @@
 , glibcLocales
 , llvmPackages
 , pytestCheckHook
+, pythonRelaxDepsHook
 , pytest-xdist
 , pillow
 , joblib
@@ -25,23 +25,21 @@
 
 buildPythonPackage rec {
   pname = "scikit-learn";
-  version = "1.4.1.post1";
+  version = "1.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-k9PUlv8ZZUcPmXfQXl7DN2+x5jsQ5P2l450jwtiWmjA=";
+    hash = "sha256-2qHEcdlbrQgMbkS0lGyTkKSEKtwwglcsIOT4iE456Vk=";
   };
 
-  patches = [
-    (fetchpatch { # included in >= 1.4.2
-      name = "test_standard_scaler_dtype.patch";
-      url = "https://github.com/jeremiedbb/scikit-learn/commit/87c32d35eeb8f6f7fec63dc3d97d9c416545f053.diff";
-      hash = "sha256-iOBOoWHuWChCTnZ5go7MobPcHRGMChROpCI7V/5ik1Y=";
-    })
-  ];
+  # Avoid build-system requirements causing failure
+  prePatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "numpy==2.0.0rc1" "numpy"
+  '';
 
   buildInputs = [
     pillow
@@ -52,6 +50,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     gfortran
+    pythonRelaxDepsHook
   ];
 
   build-system = [
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 46a2597ed1419..c7cfd09dc49d8 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "setuptools";
-  version = "69.2.0";
+  version = "69.5.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "setuptools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kll4zYFQn4g/8Fq0Y5vLvDXtotxYMbiNAgGa0sClFQk=";
+    hash = "sha256-X0ntFlDIhUjxtWzz0LxybQSuxhRpHlMeBYtOGwqDl4A=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/setuptools/setuptools-distutils-C++.patch b/pkgs/development/python-modules/setuptools/setuptools-distutils-C++.patch
index 399e1682357de..16dfd34c2def2 100644
--- a/pkgs/development/python-modules/setuptools/setuptools-distutils-C++.patch
+++ b/pkgs/development/python-modules/setuptools/setuptools-distutils-C++.patch
@@ -1,8 +1,8 @@
 diff --git a/setuptools/_distutils/cygwinccompiler.py b/setuptools/_distutils/cygwinccompiler.py
-index 47efa377..5cdbbe10 100644
+index 539f09d8f..a3d3020cb 100644
 --- a/setuptools/_distutils/cygwinccompiler.py
 +++ b/setuptools/_distutils/cygwinccompiler.py
-@@ -101,14 +101,19 @@ class CygwinCCompiler(UnixCCompiler):
+@@ -99,14 +99,19 @@ class CygwinCCompiler(UnixCCompiler):
          self.cxx = os.environ.get('CXX', 'g++')
  
          self.linker_dll = self.cc
@@ -12,17 +12,17 @@ index 47efa377..5cdbbe10 100644
          self.set_executables(
              compiler='%s -mcygwin -O -Wall' % self.cc,
              compiler_so='%s -mcygwin -mdll -O -Wall' % self.cc,
-             compiler_cxx='%s -mcygwin -O -Wall' % self.cxx,
 +            compiler_so_cxx='%s -mcygwin -mdll -O -Wall' % self.cxx,
+             compiler_cxx='%s -mcygwin -O -Wall' % self.cxx,
              linker_exe='%s -mcygwin' % self.cc,
-             linker_so=('{} -mcygwin {}'.format(self.linker_dll, shared_option)),
+             linker_so=(f'{self.linker_dll} -mcygwin {shared_option}'),
 +            linker_exe_cxx='%s -mcygwin' % self.cxx,
 +            linker_so_cxx=('%s -mcygwin %s' %
 +                (self.linker_dll_cxx, shared_option)),
          )
  
          # Include the appropriate MSVC runtime library if Python was built
-@@ -140,9 +145,12 @@ class CygwinCCompiler(UnixCCompiler):
+@@ -138,9 +143,12 @@ class CygwinCCompiler(UnixCCompiler):
                  raise CompileError(msg)
          else:  # for other files use the C-compiler
              try:
@@ -38,24 +38,24 @@ index 47efa377..5cdbbe10 100644
              except DistutilsExecError as msg:
                  raise CompileError(msg)
  
-@@ -278,9 +286,12 @@ class Mingw32CCompiler(CygwinCCompiler):
+@@ -276,9 +284,12 @@ class Mingw32CCompiler(CygwinCCompiler):
          self.set_executables(
              compiler='%s -O -Wall' % self.cc,
              compiler_so='%s -mdll -O -Wall' % self.cc,
 +            compiler_so_cxx='%s -mdll -O -Wall' % self.cxx,
              compiler_cxx='%s -O -Wall' % self.cxx,
              linker_exe='%s' % self.cc,
-             linker_so='{} {}'.format(self.linker_dll, shared_option),
+             linker_so=f'{self.linker_dll} {shared_option}',
 +            linker_exe_cxx='%s' % self.cxx,
 +            linker_so_cxx='%s %s' % (self.linker_dll_cxx, shared_option)
          )
  
      def runtime_library_dir_option(self, dir):
 diff --git a/setuptools/_distutils/sysconfig.py b/setuptools/_distutils/sysconfig.py
-index a40a7231..e5aad4f4 100644
+index 1a38e9fa7..034ed6566 100644
 --- a/setuptools/_distutils/sysconfig.py
 +++ b/setuptools/_distutils/sysconfig.py
-@@ -297,6 +297,7 @@ def customize_compiler(compiler):  # noqa: C901
+@@ -300,6 +300,7 @@ def customize_compiler(compiler):  # noqa: C901
              cflags,
              ccshared,
              ldshared,
@@ -63,7 +63,7 @@ index a40a7231..e5aad4f4 100644
              shlib_suffix,
              ar,
              ar_flags,
-@@ -306,11 +307,14 @@ def customize_compiler(compiler):  # noqa: C901
+@@ -309,11 +310,14 @@ def customize_compiler(compiler):  # noqa: C901
              'CFLAGS',
              'CCSHARED',
              'LDSHARED',
@@ -78,7 +78,7 @@ index a40a7231..e5aad4f4 100644
          if 'CC' in os.environ:
              newcc = os.environ['CC']
              if 'LDSHARED' not in os.environ and ldshared.startswith(cc):
-@@ -322,19 +326,27 @@ def customize_compiler(compiler):  # noqa: C901
+@@ -325,19 +329,27 @@ def customize_compiler(compiler):  # noqa: C901
              cxx = os.environ['CXX']
          if 'LDSHARED' in os.environ:
              ldshared = os.environ['LDSHARED']
@@ -107,7 +107,7 @@ index a40a7231..e5aad4f4 100644
          if 'AR' in os.environ:
              ar = os.environ['AR']
          if 'ARFLAGS' in os.environ:
-@@ -343,13 +355,17 @@ def customize_compiler(compiler):  # noqa: C901
+@@ -346,13 +358,17 @@ def customize_compiler(compiler):  # noqa: C901
              archiver = ar + ' ' + ar_flags
  
          cc_cmd = cc + ' ' + cflags
@@ -127,10 +127,10 @@ index a40a7231..e5aad4f4 100644
          )
  
 diff --git a/setuptools/_distutils/unixccompiler.py b/setuptools/_distutils/unixccompiler.py
-index 6ca2332a..5ac64128 100644
+index 0248bde87..9508e6cff 100644
 --- a/setuptools/_distutils/unixccompiler.py
 +++ b/setuptools/_distutils/unixccompiler.py
-@@ -115,9 +115,12 @@ class UnixCCompiler(CCompiler):
+@@ -118,9 +118,12 @@ class UnixCCompiler(CCompiler):
          'preprocessor': None,
          'compiler': ["cc"],
          'compiler_so': ["cc"],
@@ -144,7 +144,7 @@ index 6ca2332a..5ac64128 100644
          'archiver': ["ar", "-cr"],
          'ranlib': None,
      }
-@@ -181,8 +184,13 @@ class UnixCCompiler(CCompiler):
+@@ -184,8 +187,13 @@ class UnixCCompiler(CCompiler):
  
      def _compile(self, obj, src, ext, cc_args, extra_postargs, pp_opts):
          compiler_so = compiler_fixup(self.compiler_so, cc_args + extra_postargs)
@@ -159,7 +159,7 @@ index 6ca2332a..5ac64128 100644
          except DistutilsExecError as msg:
              raise CompileError(msg)
  
-@@ -250,7 +258,8 @@ class UnixCCompiler(CCompiler):
+@@ -253,7 +261,8 @@ class UnixCCompiler(CCompiler):
                  # building an executable or linker_so (with shared options)
                  # when building a shared library.
                  building_exe = target_desc == CCompiler.EXECUTABLE
diff --git a/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix b/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix
index 5e89670edef68..56da9cd5f4033 100644
--- a/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix
+++ b/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "sigstore-protobuf-specs";
-  version = "0.3.0";
+  version = "0.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "sigstore_protobuf_specs";
     inherit version;
-    hash = "sha256-MyKttzmSvKDz3G1MLDi6wpCGoR0mMamDrbJ5jljjKlQ=";
+    hash = "sha256-xAthl1uVeukG6ymlvHBA7AFbaLa0YAXMWAXmKUk+jew=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix b/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix
index 324f34f33524d..7b50a7ae6c197 100644
--- a/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix
+++ b/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix
@@ -17,7 +17,7 @@
 , skytemple-files
 , skytemple-icons
 , skytemple-ssb-emulator
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonPackage rec {
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   };
 
   buildInputs = [ gtk3 gtksourceview4 ];
-  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+  nativeBuildInputs = [ gobject-introspection wrapGAppsHook3 ];
   propagatedBuildInputs = [
     explorerscript
     ndspy
diff --git a/pkgs/development/python-modules/slicer/default.nix b/pkgs/development/python-modules/slicer/default.nix
index f678dfb2eaa20..f6900cb634927 100644
--- a/pkgs/development/python-modules/slicer/default.nix
+++ b/pkgs/development/python-modules/slicer/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "slicer";
-  version = "0.0.7";
+  version = "0.0.8";
   format = "setuptools";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9dX3tF+Y0VW5wLplVPqXcMaybVeTo+d6EDD7VpEOvuw=";
+    hash = "sha256-LnVTr3PwwMLTVfSvzD7Pl8byFW/PRZOVXD9Wz2xNbrc=";
   };
 
   prePatch = ''
diff --git a/pkgs/development/python-modules/snaptime/default.nix b/pkgs/development/python-modules/snaptime/default.nix
index 8555e3640d559..8f148eba4e68e 100644
--- a/pkgs/development/python-modules/snaptime/default.nix
+++ b/pkgs/development/python-modules/snaptime/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , python-dateutil
 , pytz
 }:
@@ -8,14 +9,18 @@
 buildPythonPackage rec {
   pname = "snaptime";
   version = "0.2.4";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-4/HriQQ9WNMHIauYy2UCPxpMJ0DjsZdwQpixY8ktUIs=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  dependencies = [
     python-dateutil
     pytz
   ];
diff --git a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
index d8857b971a31a..66824e6ccd0f9 100644
--- a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "snowflake-sqlalchemy";
-  version = "1.5.1";
+  version = "1.5.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TxODQC/8iTEZdL2BDe4iADrvSvDzEqD9tVd4MzrRq/c=";
+    hash = "sha256-eRkew/6/syvP/s1m8qfdVhvVcTRepLzL9BzB+1wGgv8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/spglib/default.nix b/pkgs/development/python-modules/spglib/default.nix
index 2939ab51989c7..5255fedd044bb 100644
--- a/pkgs/development/python-modules/spglib/default.nix
+++ b/pkgs/development/python-modules/spglib/default.nix
@@ -20,12 +20,12 @@
 
 buildPythonPackage rec {
   pname = "spglib";
-  version = "2.3.1";
+  version = "2.4.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-c24l7GfCIMsg+rcBfE/mOC7t7iIwdtV/QEc0KxvGjOM=";
+    hash = "sha256-bmP57mG3DxU6ItO1ULGD2lMfiQR1kX/OIDutRZeqwkM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinx-autoapi/default.nix b/pkgs/development/python-modules/sphinx-autoapi/default.nix
index ca80a717ba545..f10e8be83da6c 100644
--- a/pkgs/development/python-modules/sphinx-autoapi/default.nix
+++ b/pkgs/development/python-modules/sphinx-autoapi/default.nix
@@ -53,6 +53,8 @@ buildPythonPackage rec {
     # failing typing assertions
     "test_integration"
     "test_annotations"
+    # sphinx.errors.SphinxWarning: cannot cache unpickable configuration value: 'autoapi_prepare_jinja_env' (because it contains a function, class, or module object)
+    "test_custom_jinja_filters"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/sphinx-autobuild/default.nix b/pkgs/development/python-modules/sphinx-autobuild/default.nix
index d4ad4cedab8cf..50189474d4c15 100644
--- a/pkgs/development/python-modules/sphinx-autobuild/default.nix
+++ b/pkgs/development/python-modules/sphinx-autobuild/default.nix
@@ -1,21 +1,32 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+
+# build-system
 , flit-core
+
+# dependencies
 , colorama
 , sphinx
-, livereload
+, starlette
+, uvicorn
+, watchfiles
+, websockets
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "sphinx-autobuild";
-  version = "2024.2.4";
+  version = "2024.04.16";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "sphinx_autobuild";
-    inherit version;
-    hash = "sha256-y50hIaF21i1FRxYkhyr8X613Va1mJzir5ADs9KeVQwM=";
+  src = fetchFromGitHub {
+    owner = "sphinx-doc";
+    repo = "sphinx-autobuild";
+    rev = "refs/tags/${version}";
+    hash = "sha256-5HgRqt2ZTGcQ6X2sZN0gRfahmwlqpDbae5gOnGa02L0=";
   };
 
   build-system = [
@@ -25,11 +36,15 @@ buildPythonPackage rec {
   dependencies = [
     colorama
     sphinx
-    livereload
+    starlette
+    uvicorn
+    watchfiles
+    websockets
   ];
 
-  # No tests included.
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "sphinx_autobuild" ];
 
diff --git a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
index e5bba673e4ce1..45ef02367fbe0 100644
--- a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
+++ b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "sphinx-autodoc-typehints";
-  version = "2.0.0";
+  version = "2.1.0";
 in
 
 buildPythonPackage {
@@ -22,7 +22,7 @@ buildPythonPackage {
   src = fetchPypi {
     pname = "sphinx_autodoc_typehints";
     inherit version;
-    hash = "sha256-fyzawucP2Xh5Jrbp5UHNTe0eg40rRv2iobsKdexbfzo=";
+    hash = "sha256-Ub+Nx3xPunR+MvBzUAKpFQB0fQVTyuYWhjhI6PXkn+g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinx-pytest/default.nix b/pkgs/development/python-modules/sphinx-pytest/default.nix
index 7bc41418fe46a..e89183641e40a 100644
--- a/pkgs/development/python-modules/sphinx-pytest/default.nix
+++ b/pkgs/development/python-modules/sphinx-pytest/default.nix
@@ -4,6 +4,7 @@
 , flit-core
 , pytest
 , sphinx
+, defusedxml
 , pytestCheckHook
 }:
 
@@ -36,6 +37,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    defusedxml
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
index 1e8e0cd4b1e71..61e443333b3ea 100644
--- a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
+++ b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
@@ -40,6 +40,11 @@ buildPythonPackage rec {
     readthedocs-sphinx-ext
   ];
 
+  disabledTests = [
+    # docutils 0.21 compat
+    "test_basic"
+  ];
+
   pythonRelaxDeps = [
     "docutils"
     "sphinxcontrib-jquery"
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 43b7ebcd99ee9..c9f83af0aee68 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, pythonAtLeast
 , pythonOlder
 , fetchFromGitHub
 , isPyPy
@@ -28,6 +27,7 @@
 , sphinxcontrib-websupport
 
 # check phase
+, defusedxml
 , filelock
 , html5lib
 , pytestCheckHook
@@ -36,7 +36,7 @@
 
 buildPythonPackage rec {
   pname = "sphinx";
-  version = "7.2.6";
+  version = "7.3.7";
   format = "pyproject";
   disabled = pythonOlder "3.9";
 
@@ -51,7 +51,7 @@ buildPythonPackage rec {
       mv tests/roots/test-images/{testimäge,testimæge}.png
       sed -i 's/testimäge/testimæge/g' tests/{test_build*.py,roots/test-images/index.rst}
     '';
-    hash = "sha256-IjpRGeGpGfzrEvwIKtuu2l1S74w8W+AbqDOGnWwtRck=";
+    hash = "sha256-XGGRWEvd1SbQsK8W5yxDzBd5hlvXcDzr8t5Qa6skH/M=";
   };
 
   nativeBuildInputs = [
@@ -83,6 +83,7 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
+    defusedxml
     filelock
     html5lib
     pytestCheckHook
@@ -110,6 +111,8 @@ buildPythonPackage rec {
     "test_decorators"
     # requires cython_0, but fails miserably on 3.11
     "test_cython"
+    # Could not fetch remote image: http://localhost:7777/sphinx.png
+    "test_copy_images"
   ] ++ lib.optionals isPyPy [
     # PyPy has not __builtins__ which get asserted
     # https://doc.pypy.org/en/latest/cpython_differences.html#miscellaneous
@@ -122,9 +125,6 @@ buildPythonPackage rec {
     "test_isattributedescriptor"
     "test_methoddescriptor"
     "test_partialfunction"
-  ] ++ lib.optionals (pythonAtLeast "3.12") [
-    # https://github.com/sphinx-doc/sphinx/issues/12202 (Fixed in 7.3)
-    "test_enum_class"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix b/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix
index fef662c85daef..0ca9fad7b7319 100644
--- a/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , fetchpatch
 , flit-core
+, defusedxml
 , pytestCheckHook
 , sphinx
 }:
@@ -42,6 +43,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    defusedxml
     pytestCheckHook
     sphinx
   ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-tikz/default.nix b/pkgs/development/python-modules/sphinxcontrib-tikz/default.nix
index fb44f8ce343a5..a52ebdd83d6f5 100644
--- a/pkgs/development/python-modules/sphinxcontrib-tikz/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-tikz/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-tikz";
-  version = "0.4.18";
+  version = "0.4.19";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+IQV2uoKqAGQzq0te6z7vi+NnvQGZ0Sb7XjhdT05Tzo=";
+    hash = "sha256-gen+bH4NvEbxnxr5HStisB1BqyKIS4n1VoHyAK4mXUk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/spyder/default.nix b/pkgs/development/python-modules/spyder/default.nix
index fb28f0bf6207f..edefde907e2cc 100644
--- a/pkgs/development/python-modules/spyder/default.nix
+++ b/pkgs/development/python-modules/spyder/default.nix
@@ -15,6 +15,7 @@
 , nbconvert
 , numpy
 , numpydoc
+, pickleshare
 , psutil
 , pygments
 , pylint-venv
@@ -33,6 +34,7 @@
 , rope
 , rtree
 , scipy
+, setuptools
 , spyder-kernels
 , textdistance
 , three-merge
@@ -41,25 +43,26 @@
 
 buildPythonPackage rec {
   pname = "spyder";
-  version = "5.5.3";
-  format = "setuptools";
+  version = "5.5.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-i3OEKbiELfEmgff3EQfr6xGc74f1kMx1e+PbbXprkis=";
+    hash = "sha256-UiIyoFREfd3gV0uhSgZ8TVFQiP3yprrBZDOm3+8Dge0=";
   };
 
   patches = [
     ./dont-clear-pythonpath.patch
   ];
 
-  nativeBuildInputs = [
+  build-system = [
     pyqtwebengine.wrapQtAppsHook
+    setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     atomicwrites
     chardet
     cloudpickle
@@ -73,6 +76,7 @@ buildPythonPackage rec {
     nbconvert
     numpy
     numpydoc
+    pickleshare
     psutil
     pygments
     pylint-venv
diff --git a/pkgs/development/python-modules/sqlalchemy-utils/default.nix b/pkgs/development/python-modules/sqlalchemy-utils/default.nix
index 1ace2eab95900..8b0a1a374754b 100644
--- a/pkgs/development/python-modules/sqlalchemy-utils/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-utils/default.nix
@@ -38,23 +38,17 @@
 
 buildPythonPackage rec {
   pname = "sqlalchemy-utils";
-  version = "0.41.1";
+  version = "0.41.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "SQLAlchemy-Utils";
-    hash = "sha256-ohgb/wHuuER544Vx0sBxjrUgQvmv2MGU0NAod+hLfXQ=";
+    hash = "sha256-vFmcjDszGeU85sXDxHESC9Ml0AcftvOKEOkk49B7mZA=";
   };
 
   patches = [
     ./skip-database-tests.patch
-
-    (fetchpatch {
-      # sqlalchemy 2.0.22+ compat; https://github.com/kvesteri/sqlalchemy-utils/pull/725
-      url = "https://github.com/kvesteri/sqlalchemy-utils/commit/712aabaefc5c8ca3680751c705cf5a5984c74af1.patch";
-      hash = "sha256-xBdiUtFWjlUhBzHgGFbaKBt3at6NDo+mv9sd8WwiPOA=";
-    })
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlglot/default.nix b/pkgs/development/python-modules/sqlglot/default.nix
index 7eb9ee70eca91..c25a2c10bc59e 100644
--- a/pkgs/development/python-modules/sqlglot/default.nix
+++ b/pkgs/development/python-modules/sqlglot/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "sqlglot";
-  version = "21.1.1";
+  version = "23.12.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     repo = "sqlglot";
     owner = "tobymao";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xMKDkhotVBkLzn+f9RMGCPfWTF4Rz9a193nSJv5z+iA=";
+    hash = "sha256-VUG/l1iZ/8vAJwhktN/tx8U8KVLgaghUPArtxEyIA54=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlparse/default.nix b/pkgs/development/python-modules/sqlparse/default.nix
index c0afa5eeb7c1c..2e63191e033c5 100644
--- a/pkgs/development/python-modules/sqlparse/default.nix
+++ b/pkgs/development/python-modules/sqlparse/default.nix
@@ -1,10 +1,10 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, flit-core
+, hatchling
 , installShellFiles
 , pytestCheckHook
-, isPy3k
+, pythonOlder
 
 # for passthru.tests
 , django
@@ -15,18 +15,19 @@
 
 buildPythonPackage rec {
   pname = "sqlparse";
-  version = "0.4.4";
+  version = "0.5.0";
+  pyproject = true;
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1EYYPoS4NJ+jBh8P5/BsqUumW0JpRv/r5uPoKVMyQgw=";
+    hash = "sha256-cU0KSTLAWdFhifWO9UEewih6Q2DxfN0O3S0J1MUIfJM=";
   };
 
-  format = "pyproject";
+  build-system = [ hatchling ];
 
-  nativeBuildInputs = [ flit-core installShellFiles ];
+  nativeBuildInputs = [ installShellFiles ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -40,11 +41,12 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Non-validating SQL parser for Python";
-    mainProgram = "sqlformat";
     longDescription = ''
       Provides support for parsing, splitting and formatting SQL statements.
     '';
     homepage = "https://github.com/andialbrecht/sqlparse";
+    changelog = "https://github.com/andialbrecht/sqlparse/blob/${version}/CHANGELOG";
     license = licenses.bsd3;
+    mainProgram = "sqlformat";
   };
 }
diff --git a/pkgs/development/python-modules/stack-data/default.nix b/pkgs/development/python-modules/stack-data/default.nix
index d6cbacf3abd08..a3fe6964f755e 100644
--- a/pkgs/development/python-modules/stack-data/default.nix
+++ b/pkgs/development/python-modules/stack-data/default.nix
@@ -3,39 +3,33 @@
 , cython
 , executing
 , fetchFromGitHub
-, git
 , lib
 , littleutils
 , pure-eval
 , pygments
 , pytestCheckHook
 , setuptools-scm
-, toml
 , typeguard
+, setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "stack-data";
-  version = "0.2.0";
-  format = "setuptools";
+  version = "0.6.3";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alexmojaki";
     repo = "stack_data";
-    rev = "v${version}";
-    hash = "sha256-brXFrk1UU5hxCVeRvGK7wzRA0Hoj9fgqoxTIwInPrEc=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dmBhfCg60KX3gWp3k1CGRxW14z3BLlair0PjLW9HFYo=";
   };
 
-  nativeBuildInputs = [
-    git
+  build-system = [
+    setuptools
     setuptools-scm
-    toml
-  ];
-
-  propagatedBuildInputs = [
-    asttokens
-    executing
-    pure-eval
+    wheel
   ];
 
   nativeCheckInputs = [
@@ -46,9 +40,11 @@ buildPythonPackage rec {
     typeguard
   ];
 
-  # https://github.com/alexmojaki/stack_data/issues/50
-  # incompatible with typeguard>=3
-  doCheck = false;
+  dependencies = [
+    asttokens
+    executing
+    pure-eval
+  ];
 
   disabledTests = [
     # AssertionError
@@ -63,7 +59,9 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Extract data from stack frames and tracebacks";
     homepage = "https://github.com/alexmojaki/stack_data/";
+    changelog = "https://github.com/alexmojaki/stack_data/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ jluttine ];
+    mainProgram = "stack-data";
   };
 }
diff --git a/pkgs/development/python-modules/statsmodels/default.nix b/pkgs/development/python-modules/statsmodels/default.nix
index d92e618c99be3..e3f40a5cff31f 100644
--- a/pkgs/development/python-modules/statsmodels/default.nix
+++ b/pkgs/development/python-modules/statsmodels/default.nix
@@ -3,11 +3,9 @@
 , cython
 , fetchPypi
 , numpy
-, oldest-supported-numpy
 , packaging
 , pandas
 , patsy
-, pythonAtLeast
 , pythonOlder
 , scipy
 , setuptools
@@ -16,24 +14,27 @@
 
 buildPythonPackage rec {
   pname = "statsmodels";
-  version = "0.14.1";
+  version = "0.14.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ImDv3B74nznGcKC9gVGx0IQ1Z3gbyv7GzaBTTrR6lPY=";
+    hash = "sha256-iQVQFHrTqBzaJPC6GlxAIa3BYBCAvQDhka581v7s1q0=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "numpy>=2.0.0rc1,<3" "numpy"
+  '';
+
   build-system = [
     cython
-    oldest-supported-numpy
+    numpy
     scipy
     setuptools
     setuptools-scm
-  ] ++ lib.optionals (pythonAtLeast "3.12") [
-    numpy
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/strct/default.nix b/pkgs/development/python-modules/strct/default.nix
index 061e2a90c07c8..c5f9bc2f994b4 100644
--- a/pkgs/development/python-modules/strct/default.nix
+++ b/pkgs/development/python-modules/strct/default.nix
@@ -30,13 +30,13 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pytest.ini \
-      --replace  \
+      --replace-fail  \
         "--cov" \
         "#--cov"
 
     # configure correct version, which fails due to missing .git
     substituteInPlace versioneer.py strct/_version.py \
-      --replace '"0+unknown"' '"${version}"'
+      --replace-fail '"0+unknown"' '"${version}"'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index b23e68aa2c271..fe31361a65be7 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "8.9.0";
+  version = "9.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cffBvdoPPlaKop0nWRChSDQRWliuIesEebOyZ0WHXQ4=";
+    hash = "sha256-D94cu/Re4Nd71/vYVhiG37bawPNuWp5T/cpKc4biPsw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index 17aa79c34020d..88a803fa46fbd 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "sunpy";
-  version = "5.1.1";
+  version = "5.1.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-k2fsmvKjl/zVljiyAHII1O6vntJOPo3CWWwmsYlsLh8=";
+    hash = "sha256-1/oz2Ir1K7nR6B2TPZzSjbyiADyQyRlzE9KqTg7EwkA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tablib/default.nix b/pkgs/development/python-modules/tablib/default.nix
index 679f8df11559a..66388b285686b 100644
--- a/pkgs/development/python-modules/tablib/default.nix
+++ b/pkgs/development/python-modules/tablib/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "tablib";
-  version = "3.5.0";
+  version = "3.6.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9mYd/EXh1PUfqKYjn5yDSTgIWaW/qnMoBkXwRtbJbjM=";
+    hash = "sha256-BAaF/eEekjdnX0Pphe25S2MlCl6SNvidVhzm+xRluDk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tidalapi/default.nix b/pkgs/development/python-modules/tidalapi/default.nix
index 8c3c2429dc72e..edbe6ee398116 100644
--- a/pkgs/development/python-modules/tidalapi/default.nix
+++ b/pkgs/development/python-modules/tidalapi/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "tidalapi";
-  version = "0.7.5";
+  version = "0.7.6";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QzrIWQ7cWpPAu3+/zqAqX9eDWOF8F3Xj8Rt5D8I6h9M=";
+    hash = "sha256-X6U34T1sM4P+JFpOfcI7CmULcGZ4SCXwP2fFHKi1cWE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tifffile/default.nix b/pkgs/development/python-modules/tifffile/default.nix
index 30d99043f04c9..21931254d202e 100644
--- a/pkgs/development/python-modules/tifffile/default.nix
+++ b/pkgs/development/python-modules/tifffile/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "tifffile";
-  version = "2024.2.12";
+  version = "2024.4.18";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SSCj7I6OAD5nPTxlMYY8me7dVw0bi34UHAcu14/4Aw0=";
+    hash = "sha256-X/zXe513w6raEnhjGvXIrHiEOEUv2i6xubYNVVPpXII=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/total-connect-client/default.nix b/pkgs/development/python-modules/total-connect-client/default.nix
index f6f3baaefe252..e7b85cf199b60 100644
--- a/pkgs/development/python-modules/total-connect-client/default.nix
+++ b/pkgs/development/python-modules/total-connect-client/default.nix
@@ -9,8 +9,8 @@
 
 buildPythonPackage rec {
   pname = "total-connect-client";
-  version = "2023.12.1";
-  format = "pyproject";
+  version = "2024.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -18,14 +18,14 @@ buildPythonPackage rec {
     owner = "craigjmidwinter";
     repo = "total-connect-client";
     rev = "refs/tags/${version}";
-    hash = "sha256-iEQC02KuBWtk8yQwM/fU28ilbmCWeAjilvR6fHVexuI=";
+    hash = "sha256-LuPyhidbAzt/AU5WuXyxggGxjm9yArHsbn6iAaccMEc=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     zeep
   ];
 
diff --git a/pkgs/development/python-modules/traitlets/default.nix b/pkgs/development/python-modules/traitlets/default.nix
index 5394e7f4091ab..51336a0f9195a 100644
--- a/pkgs/development/python-modules/traitlets/default.nix
+++ b/pkgs/development/python-modules/traitlets/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "traitlets";
-  version = "5.14.1";
+  version = "5.14.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hYUQWzcaBLgxakPVzinAmFdcLkd4ULYrhIuWTxREUn4=";
+    hash = "sha256-jN2DwEDat9He6CJnjl9dEAtRT3tysBYVsm/FcYkW/fk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index abcc25faafdbe..bd3a9f8d762d2 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -10,19 +10,19 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.3.1";
+  version = "4.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SFD+nZVNb90+UVdWmZwnGEGF21zKhE7mfFPn2HluizE=";
+    hash = "sha256-FFDb0aro3YJe3dVsWn19GzXK1+/Cxj1TXhlWlXfCWRY=";
   };
 
   nativeBuildInputs = [ setuptools ];
 
-  propagatedBuildInputs = [ numpy ];
+  dependencies = [ numpy ];
 
   nativeCheckInputs = [ lxml pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/trio-asyncio/default.nix b/pkgs/development/python-modules/trio-asyncio/default.nix
index a74b3889facda..258bb61b66e85 100644
--- a/pkgs/development/python-modules/trio-asyncio/default.nix
+++ b/pkgs/development/python-modules/trio-asyncio/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , setuptools
 , greenlet
 , trio
@@ -14,27 +14,28 @@
 
 buildPythonPackage rec {
   pname = "trio-asyncio";
-  version = "0.14.0";
+  version = "0.14.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    pname = "trio_asyncio";
-    inherit version;
-    hash = "sha256-msSKQ8vhZxtBIh7HNq4M2qc0yKOErGNiCWLBXXse3WQ=";
+  src = fetchFromGitHub {
+    owner = "python-trio";
+    repo = "trio-asyncio";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-634fcYAn5J1WW71J/USAMkJaZI8JmKoQneQEhz2gYFc=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace '"pytest-runner"' ""
+      --replace-fail '"pytest-runner"' ""
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     greenlet
     trio
     outcome
@@ -43,18 +44,16 @@ buildPythonPackage rec {
     exceptiongroup
   ];
 
-  # RuntimeWarning: Can't run the Python asyncio tests because they're not installed. On a Debian/Ubuntu system, you might need to install the libpython3.11-testsuite package.
-  doCheck = false;
+  pytestFlagsArray = [
+    # RuntimeWarning: Can't run the Python asyncio tests because they're not installed
+    "-W" "ignore::RuntimeWarning"
+  ];
 
   nativeCheckInputs = [
     pytest-trio
     pytestCheckHook
   ];
 
-  disabledTestPaths = [
-    "tests/python" # tries to import internal API test.test_asyncio
-  ];
-
   pythonImportsCheck = [
     "trio_asyncio"
   ];
diff --git a/pkgs/development/python-modules/trio-websocket/default.nix b/pkgs/development/python-modules/trio-websocket/default.nix
index 98fdcfae0c160..8ffa3de60fc3c 100644
--- a/pkgs/development/python-modules/trio-websocket/default.nix
+++ b/pkgs/development/python-modules/trio-websocket/default.nix
@@ -2,6 +2,8 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+, setuptools
 , exceptiongroup
 , pytest-trio
 , pytestCheckHook
@@ -12,20 +14,25 @@
 
 buildPythonPackage rec {
   pname = "trio-websocket";
-  version = "0.10.2";
-  format = "setuptools";
+  version = "0.11.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "HyperionGray";
     repo = "trio-websocket";
     rev = version;
-    hash = "sha256-djoTxkIKY52l+WnxL1FwlqrU/zvsLVkPUAHn9BxJ45k=";
+    hash = "sha256-ddLbYkb1m9zRjv3Lb7YwUzj26gYbK4nYN6jN+FAuiOs=";
   };
 
-  propagatedBuildInputs = [
-    exceptiongroup
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     trio
     wsproto
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    exceptiongroup
   ];
 
   nativeCheckInputs = [
@@ -34,7 +41,16 @@ buildPythonPackage rec {
     trustme
   ];
 
-  disabledTests = lib.optionals stdenv.isDarwin [
+  disabledTests = [
+    # https://github.com/python-trio/trio-websocket/issues/187
+    "test_handshake_exception_before_accept"
+    "test_reject_handshake"
+    "test_reject_handshake_invalid_info_status"
+    "test_client_open_timeout"
+    "test_client_close_timeout"
+    "test_client_connect_networking_error"
+    "test_finalization_dropped_exception"
+  ] ++ lib.optionals stdenv.isDarwin [
     # Failed: DID NOT RAISE <class 'ValueError'>
     "test_finalization_dropped_exception"
     # Timing related
diff --git a/pkgs/development/python-modules/trio/default.nix b/pkgs/development/python-modules/trio/default.nix
index cc276fef5c525..84215b5122a64 100644
--- a/pkgs/development/python-modules/trio/default.nix
+++ b/pkgs/development/python-modules/trio/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pythonOlder
 , stdenv
 
@@ -37,26 +37,23 @@ let
 in
 buildPythonPackage rec {
   pname = "trio";
-  version = "0.24.0";
+  version = "0.25.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-/6CadKa/gbhPhhOQn7C+ruhHV0UBg6ei4LR7RVwMrF0=";
+  src = fetchFromGitHub {
+    owner = "python-trio";
+    repo = "trio";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-JQ493U4WINOG6ob4IzfNQt5Lgs3DmEM2BDwbae7Bvsw=";
   };
 
-  postPatch = ''
-    substituteInPlace src/trio/_tests/test_subprocess.py \
-      --replace "/bin/sleep" "${coreutils}/bin/sleep"
-  '';
-
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     attrs
     idna
     outcome
@@ -103,11 +100,8 @@ buildPythonPackage rec {
     "src/trio/_tests/tools/test_gen_exports.py"
   ];
 
-  pytestFlagsArray = [
-    "-W" "ignore::DeprecationWarning"
-  ];
-
   meta = {
+    changelog = "https://github.com/python-trio/trio/blob/v${version}/docs/source/history.rst";
     description = "An async/await-native I/O library for humans and snake people";
     homepage = "https://github.com/python-trio/trio";
     license = with lib.licenses; [ mit asl20 ];
diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 64829175c1989..61ef9858d2dd2 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -10,14 +10,14 @@
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2024.3.3";
+    version = "2024.4.10";
     pyproject = true;
 
     disabled = pythonOlder "3.7";
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-337f+cZ/+GtzNiiZgzCxgOgdElseCWU22DrA/XlnP9w=";
+      hash = "sha256-SfQLtqdGtyocuk+NVe6CUhac2g9wgC4/0k8Et/slpJI=";
     };
 
     postPatch = ''
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index 5e89da7f35049..8660e95508ff6 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "trytond";
-  version = "7.0.9";
+  version = "7.0.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DlPuIaGTpJu4FyLOTNAy2CAEJHoe7+8e34wacz8C7d8=";
+    hash = "sha256-N/O27qQBD18lncW0hCfJkUlmCuej8HtV2x/MnRUDGcc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/type-infer/default.nix b/pkgs/development/python-modules/type-infer/default.nix
index 55af22a1c94b5..1e10215031006 100644
--- a/pkgs/development/python-modules/type-infer/default.nix
+++ b/pkgs/development/python-modules/type-infer/default.nix
@@ -24,7 +24,7 @@ let
 in
 buildPythonPackage rec {
   pname = "type-infer";
-  version = "0.0.18";
+  version = "0.0.19";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "type_infer";
     inherit version;
-    hash = "sha256-nA5TlyHpCueFWqUggS7T/eKSLlffp0pIyGCouwXPZ28=";
+    hash = "sha256-7fWRM776lAyOncp6WZDLH9ouVBhVvV23105xvhw8V24=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/typer/default.nix b/pkgs/development/python-modules/typer/default.nix
index b072f3a6d8ca9..a1f0a9033e109 100644
--- a/pkgs/development/python-modules/typer/default.nix
+++ b/pkgs/development/python-modules/typer/default.nix
@@ -4,9 +4,8 @@
 , click
 , colorama
 , coverage
-, fetchpatch
 , fetchPypi
-, flit-core
+, pdm-backend
 , pytest-sugar
 , pytest-xdist
 , pytestCheckHook
@@ -18,27 +17,18 @@
 
 buildPythonPackage rec {
   pname = "typer";
-  version = "0.9.0";
+  version = "0.12.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UJIv15rqL0dRqOBAj/ENJmK9DIu/qEdVppnzutopeLI=";
+    hash = "sha256-SecxMUgdgEKI72JZjZehzu8wWJBapTahE0+QiRujVII=";
   };
 
-  patches = [
-    # https://github.com/tiangolo/typer/pull/651
-    (fetchpatch {
-      name = "unpin-flit-core-dependency.patch";
-      url = "https://github.com/tiangolo/typer/commit/78a0ee2eec9f54ad496420e177fdaad84984def1.patch";
-      hash = "sha256-VVUzFvF2KCXXkCfCU5xu9acT6OLr+PlQQPeVGONtU4A=";
-    })
-  ];
-
   nativeBuildInputs = [
-    flit-core
+    pdm-backend
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-pillow/default.nix b/pkgs/development/python-modules/types-pillow/default.nix
index adb92251b8f10..db173d39e74b5 100644
--- a/pkgs/development/python-modules/types-pillow/default.nix
+++ b/pkgs/development/python-modules/types-pillow/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "types-pillow";
-  version = "10.2.0.20240331";
+  version = "10.2.0.20240415";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "types-Pillow";
-    hash = "sha256-xgTjmutwcZ5GPTWRV6Iji/wOgb+cZYN1cD97mM/WB9o=";
+    hash = "sha256-3WBYAnY5vNxmuniyKMwl/a5CUkwhUMeMgE2kJ+fnbnA=";
   };
 
   # Modules doesn't have tests
diff --git a/pkgs/development/python-modules/types-protobuf/default.nix b/pkgs/development/python-modules/types-protobuf/default.nix
index c09cb206cf040..6482d4e30ba15 100644
--- a/pkgs/development/python-modules/types-protobuf/default.nix
+++ b/pkgs/development/python-modules/types-protobuf/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-protobuf";
-  version = "4.24.0.20240311";
+  version = "4.25.0.20240417";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yAQm+fubIa7lFGkelqsypc1pSoLirAeWSzUsPn4Bgrw=";
+    hash = "sha256-w07/F7mzoK22gwYi8PMCSE5MCJ9TOkbj8UdWgxNUQ1I=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-pyopenssl/default.nix b/pkgs/development/python-modules/types-pyopenssl/default.nix
index d7cf53e4ff68c..a00f14c89395e 100644
--- a/pkgs/development/python-modules/types-pyopenssl/default.nix
+++ b/pkgs/development/python-modules/types-pyopenssl/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "types-pyopenssl";
-  version = "24.0.0.20240311";
+  version = "24.0.0.20240417";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "types-pyOpenSSL";
     inherit version;
-    hash = "sha256-e8oAz8Tn75xdJmPGocBow1eY5ZZwWVQ59ilue6PVgIM=";
+    hash = "sha256-OOdfuCjScXvhc3cLuujCKBH97GjivD9YM5VBE+uEI30=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-python-dateutil/default.nix b/pkgs/development/python-modules/types-python-dateutil/default.nix
index 04f146e40e54d..0bee1e8ddca2c 100644
--- a/pkgs/development/python-modules/types-python-dateutil/default.nix
+++ b/pkgs/development/python-modules/types-python-dateutil/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-python-dateutil";
-  version = "2.8.19.20240106";
+  version = "2.9.0.20240316";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-H42yIcO5jmygLqg6WDcbIsN09Crlu98YbbnJp2WBRZ8=";
+    hash = "sha256-XS8uJAuGkF5AlE3Xh9ttqSY/Deq+8Qdt2u15c1HsAgI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-pytz/default.nix b/pkgs/development/python-modules/types-pytz/default.nix
index bf1b49ccc918f..8f86e7be43d87 100644
--- a/pkgs/development/python-modules/types-pytz/default.nix
+++ b/pkgs/development/python-modules/types-pytz/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-pytz";
-  version = "2024.1.0.20240203";
+  version = "2024.1.0.20240417";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yTdR7iDfxuBUoBSPj1InuaALeckKTTyfRkcRpzF5yJ4=";
+    hash = "sha256-aBDIofaPIf3w9PN0pDJIfHdkWgrAsx3kv0aQzyGtOYE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-pyyaml/default.nix b/pkgs/development/python-modules/types-pyyaml/default.nix
index c8735dbfe6de4..35f02941b6d5d 100644
--- a/pkgs/development/python-modules/types-pyyaml/default.nix
+++ b/pkgs/development/python-modules/types-pyyaml/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "types-pyyaml";
-  version = "6.0.12.12";
+  version = "6.0.12.20240311";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "types-PyYAML";
     inherit version;
-    hash = "sha256-M0Nz05L94P35WvXD8WYYhfoQxSFnsUWT64ViieGFUGI=";
+    hash = "sha256-qeDw+I3INXObDBylHukNBMoqiXpxr3nemuxfOMsKU0I=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/types-s3transfer/default.nix b/pkgs/development/python-modules/types-s3transfer/default.nix
index eb90a554174e9..30533010fbe04 100644
--- a/pkgs/development/python-modules/types-s3transfer/default.nix
+++ b/pkgs/development/python-modules/types-s3transfer/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "types-s3transfer";
-  version = "0.10.0";
+  version = "0.10.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_s3transfer";
     inherit version;
-    hash = "sha256-NeSZjCXff4mFrWne3I5IYOivO0O3YV6UDVPADUE73Gk=";
+    hash = "sha256-AhVMzkZSgoetdq0aAVOEDgSSI5oIh+iDNGbsz4S5jaA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-setuptools/default.nix b/pkgs/development/python-modules/types-setuptools/default.nix
index a2a0a9f125bde..557a065c68e9d 100644
--- a/pkgs/development/python-modules/types-setuptools/default.nix
+++ b/pkgs/development/python-modules/types-setuptools/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-setuptools";
-  version = "69.2.0.20240317";
+  version = "69.5.0.20240415";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tgfExIhC7z7kncDH/pwbrXVwCwceEBi7TX46xJLUcEg=";
+    hash = "sha256-6mSvCpamdPjEC6NMCcJU88cLw/IYxr/6HQkSvZFYSi8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-toml/default.nix b/pkgs/development/python-modules/types-toml/default.nix
index 140664989f3b2..db58fbc181b5c 100644
--- a/pkgs/development/python-modules/types-toml/default.nix
+++ b/pkgs/development/python-modules/types-toml/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-toml";
-  version = "0.10.8.7";
+  version = "0.10.8.20240310";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WLB4HGgeZx/wtcAxkwmRBon0q0DookMeIF1wyUu277E=";
+    hash = "sha256-PUFQEwKXJDamuLI5yFCyZollfiUoG0j/DsBjRbiDAzE=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index eb1c9c58d690f..b20fe1a051069 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "typing-extensions";
-  version = "4.10.0";
+  version = "4.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "typing_extensions";
     inherit version;
-    hash = "sha256-sKvXyJ6PuW+Y2xjYYQb/HZCraSAE63Rs9u2iaC+Rs8s=";
+    hash = "sha256-g/CFvVylnIApX8KoKrXaxnnL4CufM/fYOvaOJBvqUbA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/uqbar/default.nix b/pkgs/development/python-modules/uqbar/default.nix
index c7c6e8e2eea6a..83ccc7fe11fd8 100644
--- a/pkgs/development/python-modules/uqbar/default.nix
+++ b/pkgs/development/python-modules/uqbar/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "uqbar";
-  version = "0.7.3";
+  version = "0.7.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9KQmLCsIiHcdiAu4GeEu+wa3lGwEZOO+oHWuhFNosR0=";
+    hash = "sha256-q4p+ki5wA/gYGWnt2tzCiEakk4fBl9P96ONz2ZxlCCg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/uvicorn/default.nix b/pkgs/development/python-modules/uvicorn/default.nix
index 6201bb6157266..2694880594b0e 100644
--- a/pkgs/development/python-modules/uvicorn/default.nix
+++ b/pkgs/development/python-modules/uvicorn/default.nix
@@ -17,16 +17,16 @@
 
 buildPythonPackage rec {
   pname = "uvicorn";
-  version = "0.27.1";
+  version = "0.29.0";
   disabled = pythonOlder "3.8";
 
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "encode";
-    repo = pname;
+    repo = "uvicorn";
     rev = "refs/tags/${version}";
-    hash = "sha256-p0iPQE66RJfd811x6cnv7m3yvD/L9v7evBXlaIQSE0M=";
+    hash = "sha256-D0FdZxaDB+9N/7p73GF8qw0UwbXTQrKc1WOgy9UltxA=";
   };
 
   outputs = [
@@ -34,9 +34,9 @@ buildPythonPackage rec {
     "testsout"
   ];
 
-  nativeBuildInputs = [ hatchling ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     click
     h11
   ] ++ lib.optionals (pythonOlder "3.11") [
diff --git a/pkgs/development/python-modules/validators/default.nix b/pkgs/development/python-modules/validators/default.nix
index 8e29effda9a24..4a5e2f7df1cfe 100644
--- a/pkgs/development/python-modules/validators/default.nix
+++ b/pkgs/development/python-modules/validators/default.nix
@@ -1,15 +1,16 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pytestCheckHook
-, pythonOlder
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "validators";
-  version = "0.22.0";
-  format = "pyproject";
+  version = "0.28.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -17,26 +18,20 @@ buildPythonPackage rec {
     owner = "python-validators";
     repo = "validators";
     rev = "refs/tags/${version}";
-    hash = "sha256-Qu6Tu9uIluT1KBJYkFjDFt9AWN2Kez3uCYDQknXqYrU=";
+    hash = "sha256-r3SQvt96y8e9odWxz0GjVKH3+Pa0Lqs+tbhryeGaZUU=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [
-    "validators"
-  ];
+  pythonImportsCheck = [ "validators" ];
 
   meta = with lib; {
     description = "Python Data Validation for Humans";
     homepage = "https://github.com/python-validators/validators";
     changelog = "https://github.com/python-validators/validators/blob/${version}/CHANGES.md";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/versioningit/default.nix b/pkgs/development/python-modules/versioningit/default.nix
index a58f2d6133aa1..f5c6180b2344c 100644
--- a/pkgs/development/python-modules/versioningit/default.nix
+++ b/pkgs/development/python-modules/versioningit/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "versioningit";
-  version = "3.0.0";
+  version = "3.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TjzkemQk2FCunlXhsTSgIOn8vLiVM48QfytcUdNMnBs=";
+    hash = "sha256-eqxxPDGlPrNnprvC6LPejMK4bRDUXFEBr9ZRRGyxD9c=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/virt-firmware/default.nix b/pkgs/development/python-modules/virt-firmware/default.nix
index 8f2f0c0736098..d5da9d57c40f2 100644
--- a/pkgs/development/python-modules/virt-firmware/default.nix
+++ b/pkgs/development/python-modules/virt-firmware/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "virt-firmware";
-  version = "24.2";
+  version = "24.4";
 
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bvk3MIgPY6DJ+y0eKQHLffClNjPAEP7AJ15rFObiMig=";
+    hash = "sha256-rqhaKDOQEOj6bcRz3qZJ+a4yG1qTC9SUjuxMhZlnmwU=";
   };
 
   pythonImportsCheck = [ "virt.firmware.efi" ];
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index 44ca0ff4f4f35..d2b60338121bf 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.25.1";
+  version = "20.25.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4I4T7NynoL1TeY81bVgxQ0r6Wwe5Pwq98Hl7egb/4Zc=";
+    hash = "sha256-e7VUu9/qrMM0n6YU6lv/asMA/HwzXp+s86O8/HA/Rb4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/werkzeug/default.nix b/pkgs/development/python-modules/werkzeug/default.nix
index 51e380ece2a16..80ed4c53539a9 100644
--- a/pkgs/development/python-modules/werkzeug/default.nix
+++ b/pkgs/development/python-modules/werkzeug/default.nix
@@ -3,7 +3,6 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
-, fetchpatch2
 
 # build-system
 , flit-core
@@ -29,24 +28,16 @@
 
 buildPythonPackage rec {
   pname = "werkzeug";
-  version = "3.0.1";
+  version = "3.0.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UH6BHs6nKxikBJR63tSzOQ4duPgmtJTXZVDvRbs7Hcw=";
+    hash = "sha256-45tkWmrJKCJYjns5ppLngockzq4LDXAu+WcB+Q5wEo0=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "werkzeug-pytest8-compat.patch";
-      url = "https://github.com/pallets/werkzeug/commit/4e5bdca7f8227d10cae828f8064fb98190ace4aa.patch";
-      hash = "sha256-lVknzvC+HIM6TagpyIOhnb+7tx0UXuGw0tINjsujISI=";
-    })
-  ];
-
   nativeBuildInputs = [
     flit-core
   ];
diff --git a/pkgs/development/python-modules/wheezy-template/default.nix b/pkgs/development/python-modules/wheezy-template/default.nix
index 0baba9c564e50..53a0bf2867d09 100644
--- a/pkgs/development/python-modules/wheezy-template/default.nix
+++ b/pkgs/development/python-modules/wheezy-template/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "wheezy.template";
-  version = "3.1.0";
+  version = "3.2.2";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4RAHysczaNzhKZjjS2bEdgFrtGFHH/weTVboQALslg8=";
+    hash = "sha256-hknPXHGPPNjRAr0TYVosPaTntsjwQjOKZBCU+qFlIHw=";
   };
 
   pythonImportsCheck = [ "wheezy.template" ];
diff --git a/pkgs/development/python-modules/whenever/default.nix b/pkgs/development/python-modules/whenever/default.nix
index d36baeefcba30..cb72e8b0aa426 100644
--- a/pkgs/development/python-modules/whenever/default.nix
+++ b/pkgs/development/python-modules/whenever/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "whenever";
-  version = "0.5.1";
+  version = "0.5.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "ariebovenberg";
     repo = "whenever";
     rev = "refs/tags/${version}";
-    hash = "sha256-RH2614M91zYULNTQsr6JoKfxlnGyAJsCkB7oeiz7urs=";
+    hash = "sha256-bG8LV+r5MjA1JwBHWy9/Io4daldAlyEGYNLW+5ITuOw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/xdot/default.nix b/pkgs/development/python-modules/xdot/default.nix
index f0bfe71fcbb02..3cf0564c70a3f 100644
--- a/pkgs/development/python-modules/xdot/default.nix
+++ b/pkgs/development/python-modules/xdot/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , python
 , xvfb-run
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , pygobject3
 , graphviz
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   propagatedBuildInputs = [
     pygobject3
diff --git a/pkgs/development/python-modules/xmlsec/default.nix b/pkgs/development/python-modules/xmlsec/default.nix
index 94af405e8f640..28dfd80dcd9d3 100644
--- a/pkgs/development/python-modules/xmlsec/default.nix
+++ b/pkgs/development/python-modules/xmlsec/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "xmlsec";
-  version = "1.3.13";
+  version = "1.3.14";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kW9deOgEH2zZORq7plnajJSk/vcZbRJtQK8f9Bfyz4Y=";
+    hash = "sha256-k0+ATy+JW824bx6u4ja2YQE1YO5p7BCNKc3W5fKSotk=";
   };
 
   nativeBuildInputs = [ pkg-config pkgconfig setuptools-scm ];
diff --git a/pkgs/development/python-modules/ydiff/default.nix b/pkgs/development/python-modules/ydiff/default.nix
index 04f9be193aac1..ffa1f3cefad87 100644
--- a/pkgs/development/python-modules/ydiff/default.nix
+++ b/pkgs/development/python-modules/ydiff/default.nix
@@ -4,12 +4,12 @@
 
 buildPythonPackage rec {
   pname = "ydiff";
-  version = "1.2";
+  version = "1.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f5430577ecd30974d766ee9b8333e06dc76a947b4aae36d39612a0787865a121";
+    sha256 = "sha256-ii6EWI7zHT5SVwD6lksfmqth8MnEYoHgU0GlbgHc17g=";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/python-modules/zarr/default.nix b/pkgs/development/python-modules/zarr/default.nix
index fcb57b3731ddc..826a496445f67 100644
--- a/pkgs/development/python-modules/zarr/default.nix
+++ b/pkgs/development/python-modules/zarr/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "zarr";
-  version = "2.17.1";
+  version = "2.17.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Vks6oHISJUb+aaD6IXNvRmsg+tQXVDNLYmGfCIzkYmE=";
+    hash = "sha256-LLqmy040LUUVLUp6SyATwzf806jnvJglNWAYDeYFUs4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zephyr-python-api/default.nix b/pkgs/development/python-modules/zephyr-python-api/default.nix
index 8ff111b605faf..d4bd2642317c4 100644
--- a/pkgs/development/python-modules/zephyr-python-api/default.nix
+++ b/pkgs/development/python-modules/zephyr-python-api/default.nix
@@ -7,12 +7,13 @@
 
 buildPythonPackage rec {
   pname = "zephyr-python-api";
-  version = "0.0.4";
+  version = "0.0.5";
   format = "pyproject";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-GIXxpItbRH31PJ7dX48w92LrYY0axbZQoAFXrRGeLas=";
+    pname = "zephyr_python_api";
+    inherit version;
+    hash = "sha256-tzuLFM2Oav5rKH1GEZcP/Kfw4NXRTObMf1gcn862UBw=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/zipp/default.nix b/pkgs/development/python-modules/zipp/default.nix
index 6555d172ce2e1..9ddbd4b43313d 100644
--- a/pkgs/development/python-modules/zipp/default.nix
+++ b/pkgs/development/python-modules/zipp/default.nix
@@ -9,14 +9,14 @@
 
 let zipp = buildPythonPackage rec {
   pname = "zipp";
-  version = "3.17.0";
+  version = "3.18.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hOZKHCjPfpHtIHi7jMjCWcsZt2lCCWyNe4SUdpDKuvA=";
+    hash = "sha256-KITtIufYlh3hyaBRQutpokfxICkbwCBqAKdkLwm1txU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zlib-ng/default.nix b/pkgs/development/python-modules/zlib-ng/default.nix
index 7cb498bbb12f9..71f2c0b768ae6 100644
--- a/pkgs/development/python-modules/zlib-ng/default.nix
+++ b/pkgs/development/python-modules/zlib-ng/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "zlib-ng";
-  version = "0.4.1";
+  version = "0.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pycompression";
     repo = "python-zlib-ng";
     rev = "v${version}";
-    hash = "sha256-uK6Md8ZOVUNwXCjzM4zTVr3WBwzLdnvT9n8yBvf968k=";
+    hash = "sha256-M0R39vUX3JMDEDJfsRzg1ipxbWJ/kl0FzW6ZUMXvGDs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index e59941e805382..b9389603670d7 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.5.7";
-  source.sha256 = "sha256-Df4EofDsE828V59yTND3+hdDfbB7iaQfWZfiC/SoNA4=";
+  version = "2.5.9";
+  source.sha256 = "sha256-4rYTJb41m85U6w/tiEBO/mfl4fgAPTSiIYQeO3Za7AY=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 45de779fcdaf9..e6018b06fa992 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -24,7 +24,7 @@
 , libsodium, snappy, libossp_uuid, lxc, libpcap, xorg, gtk2, gtk3, buildRubyGem
 , cairo, expat, re2, rake, gobject-introspection, gdk-pixbuf, zeromq, czmq, graphicsmagick, libcxx
 , file, libvirt, glib, vips, taglib, libopus, linux-pam, libidn, protobuf, fribidi, harfbuzz
-, bison, flex, pango, python3, patchelf, binutils, freetds, wrapGAppsHook, atk
+, bison, flex, pango, python3, patchelf, binutils, freetds, wrapGAppsHook3, atk
 , bundler, libsass, dart-sass, libexif, libselinux, libsepol, shared-mime-info, libthai, libdatrie
 , CoreServices, DarwinTools, cctools, libtool, discount, exiv2, libepoxy, libxkbcommon, libmaxminddb, libyaml
 , cargo, rustc, rustPlatform
@@ -50,7 +50,7 @@ in
     dependencies = attrs.dependencies ++ [ "gobject-introspection" ];
     nativeBuildInputs = [ rake bundler pkg-config ]
       ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
-    propagatedBuildInputs = [ gobject-introspection wrapGAppsHook atk ];
+    propagatedBuildInputs = [ gobject-introspection wrapGAppsHook3 atk ];
   };
 
   bundler = attrs:
@@ -230,13 +230,13 @@ in
   gdk_pixbuf2 = attrs: {
     nativeBuildInputs = [ pkg-config bundler rake ]
       ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
-    propagatedBuildInputs = [ gobject-introspection wrapGAppsHook gdk-pixbuf ];
+    propagatedBuildInputs = [ gobject-introspection wrapGAppsHook3 gdk-pixbuf ];
   };
 
   gdk3 = attrs: {
     nativeBuildInputs = [ pkg-config bundler rake ]
       ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
-    propagatedBuildInputs = [ gobject-introspection wrapGAppsHook gdk-pixbuf cairo ];
+    propagatedBuildInputs = [ gobject-introspection wrapGAppsHook3 gdk-pixbuf cairo ];
   };
 
   gpgme = attrs: {
@@ -395,7 +395,7 @@ in
   gobject-introspection = attrs: {
     nativeBuildInputs = [ pkg-config pcre2 ]
       ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
-    propagatedBuildInputs = [ gobject-introspection wrapGAppsHook glib ];
+    propagatedBuildInputs = [ gobject-introspection wrapGAppsHook3 glib ];
   };
 
   gollum = attrs: {
@@ -633,7 +633,7 @@ in
     ] ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
     buildInputs = [ libdatrie libthai ]
       ++ lib.optionals stdenv.isLinux [ libselinux libsepol util-linux ];
-    propagatedBuildInputs = [ gobject-introspection wrapGAppsHook gtk2 ];
+    propagatedBuildInputs = [ gobject-introspection wrapGAppsHook3 gtk2 ];
   };
 
   patron = attrs: {
diff --git a/pkgs/development/tools/analysis/frama-c/default.nix b/pkgs/development/tools/analysis/frama-c/default.nix
index 37b44e1f80447..26cd487d9ebed 100644
--- a/pkgs/development/tools/analysis/frama-c/default.nix
+++ b/pkgs/development/tools/analysis/frama-c/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, fetchpatch, makeWrapper, writeText
 , graphviz, doxygen
 , ocamlPackages, ltl2ba, coq, why3
-, gdk-pixbuf, wrapGAppsHook
+, gdk-pixbuf, wrapGAppsHook3
 }:
 
 let
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ wrapGAppsHook ] ++ (with ocamlPackages; [ ocaml findlib dune_3 menhir ]);
+  nativeBuildInputs = [ wrapGAppsHook3 ] ++ (with ocamlPackages; [ ocaml findlib dune_3 menhir ]);
 
   buildInputs = with ocamlPackages; [
     dune-site dune-configurator
diff --git a/pkgs/development/tools/backblaze-b2/default.nix b/pkgs/development/tools/backblaze-b2/default.nix
index fadd6a2d4f76d..2021604637a19 100644
--- a/pkgs/development/tools/backblaze-b2/default.nix
+++ b/pkgs/development/tools/backblaze-b2/default.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "backblaze-b2";
-  version = "3.18.0";
+  version = "3.19.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Backblaze";
     repo = "B2_Command_Line_Tool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1UXByc3jjp8GN7+aI2GBohJ0DFxgp604QOsXp5GaL4Q=";
+    hash = "sha256-/P1cgAC+a2YCcvbsysYdD+fEwibo+GyE0XY4A0+gMh4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/bbin/default.nix b/pkgs/development/tools/bbin/default.nix
index 7edce1e48998b..42ef4285816cc 100644
--- a/pkgs/development/tools/bbin/default.nix
+++ b/pkgs/development/tools/bbin/default.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "bbin";
-  version = "0.2.1";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "babashka";
     repo = "bbin";
     rev = "v${version}";
-    sha256 = "sha256-mF8+Fm1vwLUw5l2PqV+vFFlr6y2JpKBwc+J3PdKQ6Fo=";
+    sha256 = "sha256-tWk5HzDKff+wwqRjLYbjfio3aQC6Xz5vsMf/NLm+Scc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/cambalache/default.nix b/pkgs/development/tools/cambalache/default.nix
index 757ab10583a77..66ee1edbd1d5e 100644
--- a/pkgs/development/tools/cambalache/default.nix
+++ b/pkgs/development/tools/cambalache/default.nix
@@ -8,11 +8,11 @@
 , gobject-introspection
 , desktop-file-utils
 , shared-mime-info
-, wrapGAppsHook
+, wrapGAppsHook4
 , glib
 , gtk3
 , gtk4
-, gtksourceview4
+, gtksourceview5
 , libadwaita
 , libhandy
 , webkitgtk_4_1
@@ -22,7 +22,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cambalache";
-  version = "0.16.0";
+  version = "0.90.2";
 
   format = "other";
 
@@ -30,9 +30,9 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "jpu";
-    repo = pname;
+    repo = "cambalache";
     rev = version;
-    sha256 = "sha256-Ha94Ca5a7EUBYuSJvMrLc5895Q2/01/tbKpwlHLmTDc=";
+    hash = "sha256-m3rearoCFQUzdZMXY2xyKf4dgdq7G4QlUbetrIqW83U=";
   };
 
   nativeBuildInputs = [
@@ -42,7 +42,7 @@ python3.pkgs.buildPythonApplication rec {
     gobject-introspection # for setup hook
     desktop-file-utils # for update-desktop-database
     shared-mime-info # for update-mime-database
-    wrapGAppsHook
+    wrapGAppsHook4
   ];
 
   pythonPath = with python3.pkgs; [
@@ -54,7 +54,7 @@ python3.pkgs.buildPythonApplication rec {
     glib
     gtk3
     gtk4
-    gtksourceview4
+    gtksourceview5
     webkitgtk_4_1
     webkitgtk_6_0
     # For extra widgets support.
@@ -70,8 +70,8 @@ python3.pkgs.buildPythonApplication rec {
     # those programs are used at runtime not build time
     # https://gitlab.gnome.org/jpu/cambalache/-/blob/0.12.1/meson.build#L79-80
     substituteInPlace ./meson.build \
-      --replace "find_program('broadwayd', required: true)" "" \
-      --replace "find_program('gtk4-broadwayd', required: true)" ""
+      --replace-fail "find_program('broadwayd', required: true)" "" \
+      --replace-fail "find_program('gtk4-broadwayd', required: true)" ""
   '';
 
   preFixup = ''
diff --git a/pkgs/development/tools/click/default.nix b/pkgs/development/tools/click/default.nix
index f8d73eec2580f..da05368a2ce4b 100644
--- a/pkgs/development/tools/click/default.nix
+++ b/pkgs/development/tools/click/default.nix
@@ -13,7 +13,7 @@
 , getopt
 , setuptools
 , pygobject3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication {
@@ -57,7 +57,7 @@ buildPythonApplication {
     gobject-introspection
     vala
     getopt
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   # Tests were omitted for time constraint reasons
diff --git a/pkgs/development/tools/continuous-integration/drone/default.nix b/pkgs/development/tools/continuous-integration/drone/default.nix
index 1c85e501e6b0b..e6f6b8bf4c45c 100644
--- a/pkgs/development/tools/continuous-integration/drone/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "drone.io${lib.optionalString (!enableUnfree) "-oss"}";
-  version = "2.22.0";
+  version = "2.23.0";
 
   src = fetchFromGitHub {
     owner = "harness";
     repo = "drone";
     rev = "v${version}";
-    sha256 = "sha256-haxxILbM3REdSK4h4LN+HhRvl3VK9Ozf2NfnLTL5T3A=";
+    sha256 = "sha256-HkyR2h7dgbEhqexJXyGebP3zkoTLlzuY+1O2pidAveQ=";
   };
 
   vendorHash = "sha256-n4KbKkqAnHDIsXs8A/FE+rCkSKQKr5fv7npJ/X6t0mk=";
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index 34aaf68bb0ff3..f219438d134dc 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -22,13 +22,13 @@ assert builtins.all (x: builtins.elem x [ "node20" ]) nodeRuntimes;
 
 buildDotnetModule rec {
   pname = "github-runner";
-  version = "2.315.0";
+  version = "2.316.0";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-kKfwLZYV4uEkHt82YWNtDehbspgnH8heckVU5aA/YiY=";
+    hash = "sha256-LoXVe4ZuVIFoqz+N8WK950Wm8zssCoKVj6HSkPvDFYU=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git-revision
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 04d9db9de714a..999a2ce7719b3 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl, bash }:
 
 let
-  version = "16.10.0";
+  version = "16.11.0";
 in
 buildGoModule rec {
   inherit version;
@@ -17,13 +17,13 @@ buildGoModule rec {
   # For patchShebangs
   buildInputs = [ bash ];
 
-  vendorHash = "sha256-ng3ea60qK98nKGmwlSN2hPiE4BF64cgxEYPSeAoeOh0=";
+  vendorHash = "sha256-98ixme01PHbuyCJatWErbzTeuKYSbXsLbZxNGSd+zjY=";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "sha256-TN8T/iib7G1NjyHZzZw686KZ3RCwpA1xRli3/0fnLBI=";
+    sha256 = "sha256-cPY+JAvyRb4+ytx5nwx1BaH/tZ5BW4kgWIEvD6a3aec=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/database/sqlitebrowser/default.nix b/pkgs/development/tools/database/sqlitebrowser/default.nix
index a622d3481ce2e..b13255f57a725 100644
--- a/pkgs/development/tools/database/sqlitebrowser/default.nix
+++ b/pkgs/development/tools/database/sqlitebrowser/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, mkDerivation, fetchFromGitHub, cmake
-, qtbase, qttools, sqlcipher, wrapGAppsHook, qtmacextras
+, qtbase, qttools, sqlcipher, wrapGAppsHook3, qtmacextras
 }:
 
 mkDerivation rec {
@@ -19,7 +19,7 @@ mkDerivation rec {
   # We *really* should get that cleaned up.
   buildInputs = [ qtbase sqlcipher ] ++ lib.optionals stdenv.isDarwin [ qtmacextras ];
 
-  nativeBuildInputs = [ cmake qttools wrapGAppsHook ];
+  nativeBuildInputs = [ cmake qttools wrapGAppsHook3 ];
 
   cmakeFlags = [
     "-Dsqlcipher=1"
diff --git a/pkgs/development/tools/documentation/gtk-doc/default.nix b/pkgs/development/tools/documentation/gtk-doc/default.nix
index 18d53e51da439..b21bdfc500daa 100644
--- a/pkgs/development/tools/documentation/gtk-doc/default.nix
+++ b/pkgs/development/tools/documentation/gtk-doc/default.nix
@@ -14,7 +14,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gtk-doc";
-  version = "1.33.2";
+  version = "1.34.0";
 
   outputDevdoc = "out";
 
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "GNOME";
     repo = pname;
     rev = version;
-    sha256 = "A6OXpazrJ05SUIO1ZPVN0xHTXOSov8UnPvUolZAv/Iw=";
+    hash = "sha256-Jt6d5wbhAoSQ2sWyYWW68Y81duc3+QOJK/5JR/lCmnQ=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index fb2fcdd6cb1f2..f9e493e6b7cbd 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -3,7 +3,7 @@
 , libXScrnSaver
 , makeWrapper
 , fetchurl
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , gtk3
 , unzip
@@ -112,7 +112,7 @@ let
     nativeBuildInputs = [
       unzip
       makeWrapper
-      wrapGAppsHook
+      wrapGAppsHook3
     ];
 
     dontUnpack = true;
diff --git a/pkgs/development/tools/electron/wrapper.nix b/pkgs/development/tools/electron/wrapper.nix
index 5ecb0387b6a88..c912c059e2558 100644
--- a/pkgs/development/tools/electron/wrapper.nix
+++ b/pkgs/development/tools/electron/wrapper.nix
@@ -1,6 +1,6 @@
 { stdenv
 , electron-unwrapped
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeWrapper
 , gsettings-desktop-schemas
 , glib
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   pname = "electron";
   inherit (electron-unwrapped) version;
 
-  nativeBuildInputs = [ wrapGAppsHook makeWrapper ];
+  nativeBuildInputs = [ wrapGAppsHook3 makeWrapper ];
   buildInputs = [
     # needed for GSETTINGS_SCHEMAS_PATH
     gsettings-desktop-schemas glib gtk3 gtk4
diff --git a/pkgs/development/tools/glade/default.nix b/pkgs/development/tools/glade/default.nix
index 97e1cea9c6cd4..84885d912129f 100644
--- a/pkgs/development/tools/glade/default.nix
+++ b/pkgs/development/tools/glade/default.nix
@@ -12,7 +12,7 @@
 , enableWebkit2gtk ? stdenv.isLinux
 , webkitgtk_4_1
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , itstool
 , libxml2
 , docbook-xsl-nons
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     itstool
-    wrapGAppsHook
+    wrapGAppsHook3
     docbook-xsl-nons
     docbook_xml_dtd_42
     libxslt
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Glade";
+    homepage = "https://gitlab.gnome.org/GNOME/glade";
     description = "User interface designer for GTK applications";
     maintainers = teams.gnome.members;
     license = licenses.lgpl2;
diff --git a/pkgs/development/tools/glamoroustoolkit/default.nix b/pkgs/development/tools/glamoroustoolkit/default.nix
index 3a32bfdaddaa2..fed9323566de4 100644
--- a/pkgs/development/tools/glamoroustoolkit/default.nix
+++ b/pkgs/development/tools/glamoroustoolkit/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchzip
-, wrapGAppsHook
+, wrapGAppsHook3
 , cairo
 , dbus
 , fontconfig
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-GQeYR232zoHLIt1AzznD7rp6u4zMiAdj1+0OfXfT6AQ=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   sourceRoot = ".";
 
diff --git a/pkgs/development/tools/gnome-desktop-testing/default.nix b/pkgs/development/tools/gnome-desktop-testing/default.nix
index 51f6eae6f3413..1ff42a6f6241b 100644
--- a/pkgs/development/tools/gnome-desktop-testing/default.nix
+++ b/pkgs/development/tools/gnome-desktop-testing/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "GNOME test runner for installed tests";
-    homepage = "https://wiki.gnome.org/Initiatives/GnomeGoals/InstalledTests";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-desktop-testing";
     license = licenses.lgpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.jtojnar ];
diff --git a/pkgs/development/tools/gotestsum/default.nix b/pkgs/development/tools/gotestsum/default.nix
index f28f3f12970c7..5ab4caa621f9a 100644
--- a/pkgs/development/tools/gotestsum/default.nix
+++ b/pkgs/development/tools/gotestsum/default.nix
@@ -3,14 +3,17 @@
   fetchFromGitHub,
   buildGoModule,
 }:
-buildGoModule rec {
+let
+  version = "1.11.0";
+in
+buildGoModule {
   pname = "gotestsum";
-  version = "1.10.1";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "gotestyourself";
     repo = "gotestsum";
-    rev = "refs/tags/v${version}";
+    rev = "v${version}";
     hash = "sha256-Sq0ejnX7AJoPf3deBge8PMOq1NlMbw+Ljn145C5MQ+s=";
   };
 
@@ -26,13 +29,13 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/gotestyourself/gotestsum";
     changelog = "https://github.com/gotestyourself/gotestsum/releases/tag/v${version}";
     description = "A human friendly `go test` runner";
     mainProgram = "gotestsum";
-    platforms = platforms.linux ++ platforms.darwin;
-    license = licenses.asl20;
-    maintainers = with maintainers; [ isabelroses ];
+    platforms = with lib.platforms; linux ++ darwin;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ isabelroses ];
   };
 }
diff --git a/pkgs/development/tools/misc/astyle/default.nix b/pkgs/development/tools/misc/astyle/default.nix
index 6620207ae752a..f7c7a1f09cdb0 100644
--- a/pkgs/development/tools/misc/astyle/default.nix
+++ b/pkgs/development/tools/misc/astyle/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "astyle";
-  version = "3.4.13";
+  version = "3.4.14";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-eKYQq9OelOD5E+nuXNoehbtizWM1U97LngDT2SAQGc4=";
+    hash = "sha256-YGqD85FGczGF9nYwWdKSQzxA85Prb1IELhY/jfThaj4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/tools/misc/awf/default.nix b/pkgs/development/tools/misc/awf/default.nix
index b73f1dc04502f..79d630d5688b5 100644
--- a/pkgs/development/tools/misc/awf/default.nix
+++ b/pkgs/development/tools/misc/awf/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, gtk2, gtk3, pkg-config
-, wrapGAppsHook }:
+, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "awf";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0jl2kxwpvf2n8974zzyp69mqhsbjnjcqm39y0jvijvjb1iy8iman";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook3 ];
 
   buildInputs = [ gtk2 gtk3 ];
 
diff --git a/pkgs/development/tools/misc/d-spy/default.nix b/pkgs/development/tools/misc/d-spy/default.nix
index e48a51f4870fe..c2812c2e1209d 100644
--- a/pkgs/development/tools/misc/d-spy/default.nix
+++ b/pkgs/development/tools/misc/d-spy/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "d-spy";
-  version = "1.8.0";
+  version = "1.10.0";
 
   outputs = [ "out" "lib" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/d-spy/${lib.versions.majorMinor version}/d-spy-${version}.tar.xz";
-    sha256 = "+J15XQaG2C2h3OsjYUj3zlTVynjwuY4PEzayY6WvzqE=";
+    hash = "sha256-VVgSucZUBVHaWZ7oFHiArTkVuTyH4XV7bRz9kKDgXlM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/misc/gpuvis/default.nix b/pkgs/development/tools/misc/gpuvis/default.nix
index d553f29db06e4..ad2d36e250214 100644
--- a/pkgs/development/tools/misc/gpuvis/default.nix
+++ b/pkgs/development/tools/misc/gpuvis/default.nix
@@ -7,7 +7,7 @@
 , pkg-config
 , SDL2
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
       --replace "libgtk-3.so" "${lib.getLib gtk3}/lib/libgtk-3.so"
   '';
 
-  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook3 ];
 
   buildInputs = [ SDL2 gtk3 freetype ];
 
diff --git a/pkgs/development/tools/misc/lttng-tools/default.nix b/pkgs/development/tools/misc/lttng-tools/default.nix
index 127ab2c4b6714..b9ea426641106 100644
--- a/pkgs/development/tools/misc/lttng-tools/default.nix
+++ b/pkgs/development/tools/misc/lttng-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lttng-tools";
-  version = "2.13.12";
+  version = "2.13.13";
 
   src = fetchurl {
     url = "https://lttng.org/files/lttng-tools/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-4S/lZjyvKtOne2BThRc9Tik33SFm2uecdPBkS/I5mK0=";
+    sha256 = "sha256-/19PALCB2sZgkq/o5yt8eQZwkxzxwe4N6qf4D7xTiD4=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/tools/misc/lttng-ust/default.nix b/pkgs/development/tools/misc/lttng-ust/default.nix
index b1fb9c83e8d0e..7a0a918db74d7 100644
--- a/pkgs/development/tools/misc/lttng-ust/default.nix
+++ b/pkgs/development/tools/misc/lttng-ust/default.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "2.13.7";
-  sha256 = "sha256-X7TxfDB8jBt5xoVh6JvpVi0H50Jb9A5yjE1mdVNCpes=";
+  version = "2.13.8";
+  sha256 = "sha256-1O+Y2rmjetT1JMyv39UK9PJmA5tSjdWvq8545JAk2Tc=";
 }
diff --git a/pkgs/development/tools/misc/msitools/default.nix b/pkgs/development/tools/misc/msitools/default.nix
index 66571e887e418..0d4d5c2c43311 100644
--- a/pkgs/development/tools/misc/msitools/default.nix
+++ b/pkgs/development/tools/misc/msitools/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Set of programs to inspect and build Windows Installer (.MSI) files";
-    homepage = "https://wiki.gnome.org/msitools";
+    homepage = "https://gitlab.gnome.org/GNOME/msitools";
     license = with licenses; [
       # Library
       lgpl21Plus
diff --git a/pkgs/development/tools/misc/stlink/default.nix b/pkgs/development/tools/misc/stlink/default.nix
index 2255fbfd8dcbf..16785e4d4b891 100644
--- a/pkgs/development/tools/misc/stlink/default.nix
+++ b/pkgs/development/tools/misc/stlink/default.nix
@@ -5,7 +5,7 @@
 , libusb1
 , gtk3
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , withGUI ? false
 }:
 
@@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
     cmake
   ] ++ lib.optionals withGUI [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/tools/misc/texlab/default.nix b/pkgs/development/tools/misc/texlab/default.nix
index 0f15b8627ba5c..5505273d8566e 100644
--- a/pkgs/development/tools/misc/texlab/default.nix
+++ b/pkgs/development/tools/misc/texlab/default.nix
@@ -15,16 +15,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "texlab";
-  version = "5.15.0";
+  version = "5.16.0";
 
   src = fetchFromGitHub {
     owner = "latex-lsp";
     repo = "texlab";
     rev = "refs/tags/v${version}";
-    hash = "sha256-V2+2fiQsU55Ig6GoxDJB0RCTh8nhuiGIYM3NeR4pU+k=";
+    hash = "sha256-hdco5A6qUUs/kTXdaZKo9WhMq9FcbJyDwUauK4IElIA=";
   };
 
-  cargoHash = "sha256-MPhG+YZ52fvv3+cKNebIkWwvruUsaRnOqPI1fs3osNI=";
+  cargoHash = "sha256-MlV6+D6fpuIkLGd2lcFmfIXPtJSr5wV9njlqFoANs8o=";
 
   outputs = [ "out" ] ++ lib.optional (!isCross) "man";
 
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
   # generate the man page
   postInstall = lib.optionalString (!isCross) ''
     # TexLab builds man page separately in CI:
-    # https://github.com/latex-lsp/texlab/blob/v5.15.0/.github/workflows/publish.yml#L117-L121
+    # https://github.com/latex-lsp/texlab/blob/v5.16.0/.github/workflows/publish.yml#L117-L121
     help2man --no-info "$out/bin/texlab" > texlab.1
     installManPage texlab.1
   '';
diff --git a/pkgs/development/tools/nemiver/default.nix b/pkgs/development/tools/nemiver/default.nix
index af02246582120..c63761f23a0b9 100644
--- a/pkgs/development/tools/nemiver/default.nix
+++ b/pkgs/development/tools/nemiver/default.nix
@@ -17,7 +17,7 @@
 , gtksourceview
 , gsettings-desktop-schemas
 , gtksourceviewmm
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     intltool
     itstool
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -54,15 +54,15 @@ stdenv.mkDerivation rec {
   patches = [
     # build fixes
     (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/nemiver/commit/e0e42221ceb77d88be64fac1c09792dc5c9e2f43.patch";
+      url = "https://gitlab.gnome.org/Archive/nemiver/-/commit/e0e42221ceb77d88be64fac1c09792dc5c9e2f43.patch";
       sha256 = "1g0ixll6yqfj6ysf50p0c7nmh3lgmb6ds15703q7ibnw7dyidvj8";
     })
     (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/nemiver/commit/7005393a8c4d914eac9705e7f47818d0f4de3578.patch";
+      url = "https://gitlab.gnome.org/Archive/nemiver/-/commit/7005393a8c4d914eac9705e7f47818d0f4de3578.patch";
       sha256 = "1mxb1sdqdj7dm204gja8cdygx8579bjriqqbb7cna9rj0m9c8pjg";
     })
     (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/nemiver/commit/262cf9657f9c2727a816972b348692adcc666008.patch";
+      url = "https://gitlab.gnome.org/Archive/nemiver/-/commit/262cf9657f9c2727a816972b348692adcc666008.patch";
       sha256 = "03jv6z54b8nzvplplapk4aj206zl1gvnv6iz0mad19g6yvfbw7a7";
     })
   ];
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Nemiver";
+    homepage = "https://gitlab.gnome.org/Archive/nemiver";
     description = "Easy to use standalone C/C++ debugger";
     mainProgram = "nemiver";
     license = licenses.gpl2;
diff --git a/pkgs/development/tools/nwjs/default.nix b/pkgs/development/tools/nwjs/default.nix
index 7ada7365ebb55..fd03766560ff8 100644
--- a/pkgs/development/tools/nwjs/default.nix
+++ b/pkgs/development/tools/nwjs/default.nix
@@ -31,7 +31,7 @@
 , stdenv
 , systemd
 , udev
-, wrapGAppsHook
+, wrapGAppsHook3
 , xorg
 }:
 
@@ -105,7 +105,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    (wrapGAppsHook.override { inherit makeWrapper; })
+    (wrapGAppsHook3.override { inherit makeWrapper; })
   ];
 
   buildInputs = [ nwEnv ];
diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 97554e53de206..14f5e32b505cc 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchgit
 , fetchFromGitHub
+, nix-update-script
 , runCommand
 , which
 , rustPlatform
@@ -26,8 +27,8 @@ let
   # 2) nix-build -A tree-sitter.updater.update-all-grammars
   # 3) Set GITHUB_TOKEN env variable to avoid api rate limit (Use a Personal Access Token from https://github.com/settings/tokens It does not need any permissions)
   # 4) run the ./result script that is output by that (it updates ./grammars)
-  version = "0.22.2";
-  hash = "sha256-RhM3SgsCb8eLs56cm8/Yo1ptNnFrR21FriHAlMdvdrU=";
+  version = "0.22.5";
+  hash = "sha256-f8bdpiPNo5M8aefTmrQ2MQVg7lS0Yq7j312K1slortA=";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
@@ -62,6 +63,7 @@ let
         };
       grammars' = import ./grammars { inherit lib; } // extraGrammars;
       grammars = grammars' //
+        { tree-sitter-latex = grammars'.tree-sitter-latex // { generate = true; }; } //
         { tree-sitter-ocaml = grammars'.tree-sitter-ocaml // { location = "grammars/ocaml"; }; } //
         { tree-sitter-ocaml-interface = grammars'.tree-sitter-ocaml // { location = "grammars/interface"; }; } //
         { tree-sitter-org-nvim = grammars'.tree-sitter-org-nvim // { language = "org"; }; } //
@@ -110,7 +112,7 @@ rustPlatform.buildRustPackage {
   pname = "tree-sitter";
   inherit src version;
 
-  cargoHash = "sha256-QWqg84naOIPhkHj2yLchZVb2gvjL9+AEK2rRK7K8uQY=";
+  cargoHash = "sha256-Fk6V/kPKc/GL/q6QsaCUrq+ZG0R+N5FLOpIm77Y+n2A=";
 
   buildInputs =
     lib.optionals stdenv.isDarwin [ Security CoreServices ];
@@ -158,6 +160,8 @@ rustPlatform.buildRustPackage {
     };
     inherit grammars buildGrammar builtGrammars withPlugins allGrammars;
 
+    updateScript = nix-update-script { };
+
     tests = {
       # make sure all grammars build
       builtGrammars = lib.recurseIntoAttrs builtGrammars;
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
index 190dda2ee3e9b..b17e5ca895277 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/thehamsta/tree-sitter-commonlisp",
-  "rev": "cf10fc38bc24faf0549d59217ff37c789973dfdc",
-  "date": "2023-11-19T14:17:12+01:00",
-  "path": "/nix/store/91kc23ng7axqzd4xjiwrgij1mpriq459-tree-sitter-commonlisp",
-  "sha256": "1nq5cvf557w3vwr7rjzdgqcpcs3ikp1x5cs00f8z5n9hgdk1lvry",
-  "hash": "sha256-Pm8aZnsw2fKRA0Cz0sOdcWh2GX7ty3wy34OfUtxmBds=",
+  "rev": "25856774aaab983c573bb2f9cc1ebbc97941f7b9",
+  "date": "2024-04-06T22:22:41+02:00",
+  "path": "/nix/store/mlji0h6k2x17jni9q3y571dmk5k4xi85-tree-sitter-commonlisp",
+  "sha256": "12fh2sinasnfp6rfq5d9qq24nfg55bclc5rp8mnw3a2ccyc5icis",
+  "hash": "sha256-OrJYmGdMqMFtRTcXRtkq5TlLBMapFeyyuc5qZaMW0Ik=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
index 4ba7b97a57d8d..53a829c4a941f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-cpp",
-  "rev": "e0c1678a78731e78655b7d953efb4daecf58be46",
-  "date": "2024-02-18T08:20:42-05:00",
-  "path": "/nix/store/dw86n9mqgfn9ymlbr7s7h05dvf8q867i-tree-sitter-cpp",
-  "sha256": "0fjxjm3gjqvcjqgjyq6lg6sgyy0ly69dinq33rmy56806da45lq9",
-  "hash": "sha256-CdNCVDMAmeJrHgPb2JLxFHj/tHnUYC8flmxj+UaVXTo=",
+  "rev": "72fd00128f1c38319670cbf4bcedbba0dc849d96",
+  "date": "2024-04-14T21:38:58-04:00",
+  "path": "/nix/store/sy0ln7q947bv9k313q4z6kkibl2zgdi1-tree-sitter-cpp",
+  "sha256": "0qaa48gq4n3300apwx1mdcwqnfg59q8bdj88c3ssd45pr1n47s88",
+  "hash": "sha256-COlDbMi3kKb1YAjJthBO5TmLOWs1dH4VAGNYgh8iSmE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
index 376d5f83bf469..54bbe3214f4b5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/thehamsta/tree-sitter-cuda",
-  "rev": "221179d4287a2c24c08e4c67ff383ef67dc32156",
-  "date": "2024-02-20T23:55:20+01:00",
-  "path": "/nix/store/x8sqw6njbai4x9jlx6zn0mamvfjpcxy9-tree-sitter-cuda",
-  "sha256": "0n4c79iq5izdjrb50f5af02jkzfn6mp3kvr0iajfhxlj3x64ykbv",
-  "hash": "sha256-e01PTB+SduikiiDvOW411v0pBXCqOFBWlu3HgmM6jFg=",
+  "rev": "4ec5afdf98041d137c25b555958a1f825c7c1272",
+  "date": "2024-04-02T22:40:43+02:00",
+  "path": "/nix/store/2n6dkgdvhfd34qa48b5824qbw1pc7899-tree-sitter-cuda",
+  "sha256": "1n840xzsx56w3hys263f216ih901jh456yxdmm0i274ijwngn38h",
+  "hash": "sha256-EA37LJeRHBFBra17UwiUASQYTRBuGKE9HNyUrn8HBNk=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
index 0cf8d54a9f4c4..f492de75ad545 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/usernobody14/tree-sitter-dart",
-  "rev": "1a31399a08aefc93bc4cdbfadc0cb619136f86c1",
-  "date": "2024-02-10T18:16:57-07:00",
-  "path": "/nix/store/4pdnic3kb0856ajy2xfbxdn84lflvbw1-tree-sitter-dart",
-  "sha256": "0nx4hvvx239prxckddbcgadvk894lxl4ycmxxg7m30j2sp6a6049",
-  "hash": "sha256-iQCjzNVCglHP670yT2inJKG5m3pstTZZzzcN0feGpFs=",
+  "rev": "6da46473ab8accb13da48113f4634e729a71d335",
+  "date": "2024-04-07T18:27:24-06:00",
+  "path": "/nix/store/v04h2p45ngm7llrckpkkbnvj9m5763vm-tree-sitter-dart",
+  "sha256": "1jxz4s0j8pmjxl7cz7s9blzqhr1w5jannxihidqrd6dqxawc6gh1",
+  "hash": "sha256-AT7DuOq4mZZxizB2a5UsPGSIP11Jn88O7bJeJIEmv8s=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
index 70e129ea41bd2..405fd174824e8 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/elixir-lang/tree-sitter-elixir",
-  "rev": "11426c5fd20eef360d5ecaf10729191f6bc5d715",
-  "date": "2023-12-04T13:06:21+07:00",
-  "path": "/nix/store/l3868ga8dvvq06k7px3k9i3kpynfjmis-tree-sitter-elixir",
-  "sha256": "1fqsvqdjscmjj7vaq3mgs6j49m3412g5i9jrm1r61n1d8yrg3mzy",
-  "hash": "sha256-/tfxskct2GByqFmmWJ4IZNREpNGvDqz2kbIyLRveGrs=",
+  "rev": "de690fa8a028f122af46d9d2685679fe5f2d7d60",
+  "date": "2024-04-08T19:02:42+02:00",
+  "path": "/nix/store/q46fy2kd4gvab4bpfv3zacg4qgkfc6dz-tree-sitter-elixir",
+  "sha256": "03fg2qj0i3n1dx8abkngg4nxqwpz86m5nr7q70hp5jw5bxccxxkf",
+  "hash": "sha256-bvbOWF+Fy3IhOPhkW6pB/3LcLXnPzqVQb8GOCCQWzw0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
index a1047117557c1..f1e8bc7ccaf1c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/ram02z/tree-sitter-fish",
-  "rev": "f9176908c9eb2e11eb684d79e1d00f3b29bd65c9",
-  "date": "2023-02-12T14:42:20+00:00",
-  "path": "/nix/store/hg229jskwvgmfgi9awznvp9cj5riacay-tree-sitter-fish",
-  "sha256": "1yxvibmmpkwswwrg1mzvcnfj6y0rpccrwyg27k4wpr2630ma9xcw",
-  "hash": "sha256-nPWkKhhG5MvJPOJ5nhm7GXgjnWX71/Ay55rPW+uKu/s=",
+  "rev": "a78aef9abc395c600c38a037ac779afc7e3cc9e0",
+  "date": "2024-04-02T18:45:18+01:00",
+  "path": "/nix/store/v0bvl4iadrl1fzr617s72rlk2d214ak9-tree-sitter-fish",
+  "sha256": "0nmdwxw8wbqc9nm1p30s91p6mh8qp7w5wnw7lpz6fy6hq5k3gfqg",
+  "hash": "sha256-D7s3ZsHQeGf+pYdbXvi5GMFqbkgajBuqTQwvjnjnrVo=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
index 0cf5f37e53666..eb12bf0a26a19 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/thehamsta/tree-sitter-glsl",
-  "rev": "284bed0e2f1d9f700756b96512baf33483642ff0",
-  "date": "2024-02-15T22:49:15+01:00",
-  "path": "/nix/store/vqnsavpda33cbzvfwk28cqz24m5lwrl7-tree-sitter-glsl",
-  "sha256": "1vcllf58mk1c1fiwh2amcjkgmq5m9dyhawvm744fx9phf0qlqb57",
-  "hash": "sha256-pyxMMXDwpu4IOXVzBX1LteD6pmRVCcijCyzMioqjlO0=",
+  "rev": "e7817c982e0e921c5ee89a1e0283121bb5cc5e01",
+  "date": "2024-04-14T19:48:45+02:00",
+  "path": "/nix/store/fs5zdqn1lilbd6f0g6kgjjl35dli61fv-tree-sitter-glsl",
+  "sha256": "1gxg9d3i7iyzxv0sijllbl57dl7ai7z48f1639xd8ljhwl7yyim6",
+  "hash": "sha256-pkbvD+VQUtR6GiY4RP6J6tB2Cl2UyqjB7t/HE0dLr78=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
index a41c8bc056c47..f0bb17721691c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-haskell",
-  "rev": "6b5ec205c9d4f23eb36a163f1edc4f2db8c98e4a",
-  "date": "2024-02-26T15:02:24+01:00",
-  "path": "/nix/store/ia666bffpywmack992f64jid4321fvdq-tree-sitter-haskell",
-  "sha256": "1d3klbflb1xl234s6pw874j1d5r82bkx5jdi7il1irfvhgdkjljc",
-  "hash": "sha256-TFI524Pb5RhoPLHJ0ucSKJcWJDmIX6PJELSHRd2ic7Q=",
+  "rev": "95a4f0023741b3bee0cc500f3dab9c5bab2dc2be",
+  "date": "2024-03-24T15:47:21+01:00",
+  "path": "/nix/store/ay1m5h51pp7p84hh5mlmxir8fsr68bs5-tree-sitter-haskell",
+  "sha256": "0kwbknxk8f6824bijqqkmlfg04074v31ava8qsf97bqsgs6039vf",
+  "hash": "sha256-bqcBjH4ar5OcxkhtFcYmBxDwHK0TYxkXEcg4NLudi08=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
index 7b03a81327734..67e30dd121eaf 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-javascript",
-  "rev": "de1e682289a417354df5b4437a3e4f92e0722a0f",
-  "date": "2024-03-10T11:12:05-04:00",
-  "path": "/nix/store/8p9li6jcc247jzpy0x3cr4iskfyhqwmi-tree-sitter-javascript",
-  "sha256": "1mvvc6cv46zyhxhdjycmj7746hbss7lxcxks61bzrh229nlrh6hy",
-  "hash": "sha256-HhqYqU1CwPxXMHp21unRekFDzpGVedlgh/4bsplhe9c=",
+  "rev": "ac10a11e0c8db512f70e6b798260d2516d22454c",
+  "date": "2024-04-07T02:36:56-04:00",
+  "path": "/nix/store/b5fahwmcx0riy3bfaarlggncfgfkhx38-tree-sitter-javascript",
+  "sha256": "1f0k7mk785ijppw1swcrilr5bl2nddi7hifml431y4lsqm7y6kmg",
+  "hash": "sha256-r07jT8WaEh8GodVFeGJrVtBVMo2ZcR34vTIWdGY9E7g=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
index 00991afc31368..3a43b67184e24 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-json",
-  "rev": "3b129203f4b72d532f58e72c5310c0a7db3b8e6d",
-  "date": "2024-02-23T13:05:26-08:00",
-  "path": "/nix/store/03dv24dlqkds0k1vjchzq6n8v6wys3ix-tree-sitter-json",
-  "sha256": "0rnfhmhr76fjlc6zzbxzrxrxa1xxpkg1jgq7vdw4630l1cg2nlbm",
-  "hash": "sha256-dVErHgsUDEN42wc/Gd68vQfVc8+/r/8No9KZk2GFzmY=",
+  "rev": "80e623c2165887f9829357acfa9c0a0bab34a3cd",
+  "date": "2024-04-07T15:21:58-04:00",
+  "path": "/nix/store/9cixfhx0x72pvn0ak349cbbzvhzlvhll-tree-sitter-json",
+  "sha256": "0mjphf34k5d0h28wwafwljk486h5mzx30dqdxz23lcmvnh0s79y1",
+  "hash": "sha256-waejAbS7MjrE7w03MPqvBRpEpqTcKc6RgKCVSYaDV1Y=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
index b94837ef46d06..d55e2ca470eea 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-julia",
-  "rev": "e84f10db8eeb8b9807786bfc658808edaa1b4fa2",
-  "date": "2024-02-14T19:03:11-05:00",
-  "path": "/nix/store/wv5r1xw2f3bfk4rqg660m6pqkwfdin68-tree-sitter-julia",
-  "sha256": "1fqirr8yjwmjy5dnfxk0djafq0hnl18mf28i7zg2gsfvy9a27d4f",
-  "hash": "sha256-jrQjVPLb6SfePxEJV1GgFgLslGxgdmdb8bJy6VHOEbs=",
+  "rev": "0a80d33aca49dd257625ab25ef3a506e2b99a554",
+  "date": "2024-04-14T10:47:45-07:00",
+  "path": "/nix/store/zi4q89960k33nkic7wm19fiq05bhx2bq-tree-sitter-julia",
+  "sha256": "057hg3v4rzzq19swb2mv2zlxp8zd746zxklxc0vw1i1fkr2x34yi",
+  "hash": "sha256-0ZPRRZ4uxMA3YJ3O/g057aPb6Re7isV1Cvj/TPZ48BQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
index e1b2ed4e16228..8e480f72a4063 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/IndianBoy42/tree-sitter-just",
-  "rev": "442538ab5ae0913b05e0269a988b4d452dfa5361",
-  "date": "2024-03-19T12:21:46-05:00",
-  "path": "/nix/store/ibqsrr59gr2ww1z5f9vr4q2fdvz9gmmy-tree-sitter-just",
-  "sha256": "1zcc7qsapcq8rs0myknx8bd8svcb18gwgpcqzh5jw1cf1c45yryr",
-  "hash": "sha256-2WdfCAuOBS4L/Jjdxx8Ki22N2kLdTl+BzgizqzQ+jP0=",
+  "rev": "6c2f018ab1d90946c0ce029bb2f7d57f56895dff",
+  "date": "2024-03-22T16:21:21-05:00",
+  "path": "/nix/store/8p22m5p2clrcc563v2z6pmhnhh03yyvg-tree-sitter-just",
+  "sha256": "0752hfkkqk92g0s68b01wf5d5q2y7aw87wsj8kz2vxkbj0i38x8j",
+  "hash": "sha256-EnU0IpBr9i3+RFLzg7g6XuDSiuMBLGQ0eCJNPKeDohw=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json
index 1ae0d28cde670..9e6eb0167e0b9 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/latex-lsp/tree-sitter-latex",
-  "rev": "8c75e93cd08ccb7ce1ccab22c1fbd6360e3bcea6",
-  "date": "2022-10-26T10:55:26+02:00",
-  "path": "/nix/store/zhx1vnr3xdrb0ry6kfjsfrzs6c3nf8i9-tree-sitter-latex",
-  "sha256": "0lc42x604f04x3kkp88vyqa5dx90wqyisiwl7nn861lyxl6phjnf",
-  "hash": "sha256-zkp4De2eBoOsPZRHHT3mIPVWFPYboTvn6AQ4AkwXhFE=",
+  "rev": "a834712c5e04029a451a262456bf6290b8ef6f37",
+  "date": "2024-04-01T14:31:04+02:00",
+  "path": "/nix/store/kn3vkfnysm170wc1dbjmb5y69hdlmyb4-tree-sitter-latex",
+  "sha256": "18dyda7299imb6i2jnjpr7z2jdrjn804c3958nkkpxzzfhbq39h7",
+  "hash": "sha256-B6aBF3T/9zunRSUNRgCyMjcp/slXWimiWTWmJI5qvqE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json
index 68a671d810daa..6f9a1b44406d9 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-markdown.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/MDeiml/tree-sitter-markdown",
-  "rev": "b2f01981a76e3251f5b660378136c248ed106b81",
-  "date": "2024-03-13T23:51:05+02:00",
-  "path": "/nix/store/z986603ky7a41d48i0rxkd23y5k1bxc7-tree-sitter-markdown",
-  "sha256": "183ig6p39wzlmb8vz5hyjr4787s03b8gsw5p210qxkl3xs46s37a",
-  "hash": "sha256-6gxtiO6Dzo5BELdw/dAaQB90SJYelr/RqvTzNK55caA=",
+  "rev": "62516e8c78380e3b51d5b55727995d2c511436d8",
+  "date": "2024-03-22T11:52:05+02:00",
+  "path": "/nix/store/4hi3bz1ny9dz3yq7mr6d74gsfmcnh9rw-tree-sitter-markdown",
+  "sha256": "08wl8y8xgrr10m1p6xpmv0jbmnif30wgd2q5m28ghh1v37q2ixfp",
+  "hash": "sha256-1/Uo8Bk7QPiQqAWL9jgYLtq6JNj1dnNDBSHn15FHlCM=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
index 9e3a8be40c227..91c713dae026e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/cstrahan/tree-sitter-nix",
-  "rev": "763168fa916a333a459434f1424b5d30645f015d",
-  "date": "2023-12-26T15:36:50+13:00",
-  "path": "/nix/store/wvnrjnrb3dgc5pg5n8nkwxm43478nk2k-tree-sitter-nix",
-  "sha256": "0nn3ij8k6wkbf3kcvkyyp0vhfjcksi31wyyfwmsbx66maf2xgaii",
-  "hash": "sha256-MarXhVPVmL505c57HkbUk0kHN7jez83mcGtyM5GMw1o=",
+  "rev": "b3cda619248e7dd0f216088bd152f59ce0bbe488",
+  "date": "2024-04-03T09:38:13+02:00",
+  "path": "/nix/store/5rz41r1yycp0w3s947cjs3m9d9v1082r-tree-sitter-nix",
+  "sha256": "1xh75z11d1b514qm997br8vmxalir2ah1pk7v3k1ppm28043ggr1",
+  "hash": "sha256-Ib83CECi3hvm2GfeAJXIkapeN8rrpFQxCWWFFsIvB/Y=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json
index 93f8737bb7d9d..968e703cc3528 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/nvim-neorg/tree-sitter-norg-meta",
-  "rev": "a479d1ca05848d0b51dd25bc9f71a17e0108b240",
-  "date": "2023-05-28T19:01:42+02:00",
-  "path": "/nix/store/7yp5rzpmdvyhhl38brhz0vl3gd9qv03y-tree-sitter-norg-meta",
-  "sha256": "1vvl39m41wgsq7xkfi523zx6nza03dkzgk6izc39igmwx5hsdl7f",
-  "hash": "sha256-7tCmYem8vpgG+9HM92cbQH1r+h+iRDf7wfrxQGoadO8=",
+  "rev": "6f0510cc516a3af3396a682fbd6655486c2c9d2d",
+  "date": "2024-04-13T19:12:46+02:00",
+  "path": "/nix/store/val14j7fz39yyqzp3xh2r7cbvfd1am4m-tree-sitter-norg-meta",
+  "sha256": "1vz74wc5yy5fykl9c3b16k6fsvskxp93acsy81p337jzg709v97j",
+  "hash": "sha256-8qSdwHlfnjFuQF4zNdLtU2/tzDRhDZbo9K54Xxgn5+8=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
index 2fa6470e2a358..f9be1d8935888 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/nvim-neorg/tree-sitter-norg",
-  "rev": "014073fe8016d1ac440c51d22c77e3765d8f6855",
-  "date": "2023-10-02T20:20:59+02:00",
-  "path": "/nix/store/xi96cyvgn1443wf54ykc90y80fqdmgzv-tree-sitter-norg",
-  "sha256": "05zrcglnpvyqx0gczzkx05qc95y5n3slbhjig7dqjyxvphyzf0nk",
-  "hash": "sha256-0wL3Pby7e4nbeVHCRfWwxZfEcAF9/s8e6Njva+lj+Rc=",
+  "rev": "ceb44e4cdb58fbeea52301835bdd461817ddb57e",
+  "date": "2024-04-14T13:26:39+02:00",
+  "path": "/nix/store/gmzacfd1sbdbgvc26bnv3cpyl5l3csq9-tree-sitter-norg",
+  "sha256": "1jzk1wxqah5ajgpxmmbhrjk43hhk9vpg1f7v9wnj1xgp7zv4w6mv",
+  "hash": "sha256-uxpO9j/39SAtT/u48O5OE8JBpsxw1drvk6pAhTsP88s=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
index 7bb3fd3c6f1ae..8a5f286af0c66 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/nushell/tree-sitter-nu",
-  "rev": "c5b7816043992b1cdc1462a889bc74dc08576fa6",
-  "date": "2024-03-09T11:27:22-06:00",
-  "path": "/nix/store/gcmmkjxfhf4y1qc3fvbaww5pfcdbjlhv-tree-sitter-nu",
-  "sha256": "0g9b7d6306z96x90w9v687nyws5jrh5jy2cm8yxhaz3xgq9v3s1z",
-  "hash": "sha256-P+ixE359fAW7R5UJLwvMsmju7UFmJw5SN+kbMEw7Kz0=",
+  "rev": "b090676f0205f52debb93745b9ad788385583276",
+  "date": "2024-04-14T14:09:50-05:00",
+  "path": "/nix/store/f8pjwwdy175mayqncxicn47lj7gw4vks-tree-sitter-nu",
+  "sha256": "10rmw80xzhpqhjhysfx13pkqzfm4a31wvvmq57wvrcrrrlqb982k",
+  "hash": "sha256-U6C0MM05s7z5KbjuzcNQpLqP5x2hO+2hhPjC3wHiNYM=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
index 95e3bed434e43..d769f351e21df 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-ocaml",
-  "rev": "dabe60a96553fbbda0a58b6ccda12b7d44047cb5",
-  "date": "2024-03-17T14:43:34+01:00",
-  "path": "/nix/store/sv3zz52xfyda4iwjwxfkyadg0bj1d2kj-tree-sitter-ocaml",
-  "sha256": "0pkw9bclbndcakaywdwj0ffvak78h68fjlbckdainfz99xgvg732",
-  "hash": "sha256-Ypy3X0/pOxtVm2xR6ZCB6Ey1nQOSN+7VVKzZRdlKfF4=",
+  "rev": "f7e63111ed1bc1908eacafe6af1ee8d01bfcf7ae",
+  "date": "2024-03-23T14:49:30+01:00",
+  "path": "/nix/store/p4awlsbz7b3xlbr9l785l7vi1rnxgxlr-tree-sitter-ocaml",
+  "sha256": "04vscg6lkhdnzs15r1yqwwmc2lj73x4h3nf4mfpkwq6g870i04wj",
+  "hash": "sha256-khMQwUHPYD6vq8TZAUkfR1LBKufYh1yC/rbBSc1jehM=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
index 025f5005b9ddd..385e00ceb5522 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/ganezdragon/tree-sitter-perl",
-  "rev": "a882a928d4930716896039d1c10e91b6d7444c48",
-  "date": "2024-03-03T23:09:15+05:30",
-  "path": "/nix/store/6v3jxaiad68k4rak3ihqn1vxqah1pi85-tree-sitter-perl",
-  "sha256": "0ss26x37ldj4v6pwbijrz0hbnvj8xrm8cj3y1n1f2xanzvcalz15",
-  "hash": "sha256-JXyq2P5WdeGCDX5IhmruSG67IPhZxsWv2UQ2ekY3Qms=",
+  "rev": "93bd92a6af01113140f1a0b4c1845d22adae7ab6",
+  "date": "2024-03-29T09:45:26+05:30",
+  "path": "/nix/store/v4fhidwmxfihmkkq32a2xj75zs9fs9cd-tree-sitter-perl",
+  "sha256": "1ldbqjiyc4apls5gfc96lw6l4y53k5adk8knf1pp3ar2x2dl8v6y",
+  "hash": "sha256-3mxEm+giq3FvcHai2VSZo3hCDacmMfeKplcR5qPEq9E=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
index 257b3e4053464..059ce3aed9a64 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-python",
-  "rev": "b8a4c64121ba66b460cb878e934e3157ecbfb124",
-  "date": "2024-03-12T19:59:41-04:00",
-  "path": "/nix/store/qyvpyxlyxxmc1rwqvy14j9z1pjnpxbw9-tree-sitter-python",
-  "sha256": "12bgdbhkxl7lrca4257wnjks1m4z3mv5mzw5cfbyr91ypv59cfk5",
-  "hash": "sha256-ZTqWyr4+pOyXY4X/WnYdn9Sgp7T8FEEUy/TQPuFqb4k=",
+  "rev": "a22761025cdac6c314b7e3aa48fb44fa9e594d6a",
+  "date": "2024-04-05T08:52:41-04:00",
+  "path": "/nix/store/4zxxl74gpdm4y3dcaxxy831c5zay31bw-tree-sitter-python",
+  "sha256": "1kr3rj4wszpb1bz7xjn8v5cmkp6817d1iyficpdafglv7rx89a1g",
+  "hash": "sha256-L6iEej6bPqfaZdH5GNoJyNxZWdnIyn7+Cut+zYnMI88=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-query.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-query.json
index 80676906d8dd1..b5ce91ba4c02a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-query.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-query.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/nvim-treesitter/tree-sitter-query",
-  "rev": "176a380df78800167565118bb0dadfc961abbd43",
-  "date": "2024-03-07T12:57:53+02:00",
-  "path": "/nix/store/wa9dwqw4z7gcsnizch00sssjfl35arpf-tree-sitter-query",
-  "sha256": "0w0f3zymch27s923j4wkxjn2rfgf2qrhsrcrxf56nxmsgbbkdlvg",
-  "hash": "sha256-b9M213q6dmuK65llDTMW7rksrOyTEzlE0kdAVv0fDnA=",
+  "rev": "2e31ca2771f6042b0e4e0c41a6290014a9e1face",
+  "date": "2024-03-26T11:42:51+02:00",
+  "path": "/nix/store/d80f3x65zd87i9zpi7z2rh28a5f03n1k-tree-sitter-query",
+  "sha256": "0g8234yicidpjqc1rc7dvpx5ja49g938w451796nnn02chxa204i",
+  "hash": "sha256-kQChOmQCWGtNOqEQjkZ6iShZ+t3tsBwYlrdFFj0ZAj0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rust.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rust.json
index 20b895d5d97a0..3861a460d1825 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rust.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rust.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-rust",
-  "rev": "3a56481f8d13b6874a28752502a58520b9139dc7",
-  "date": "2024-03-10T12:55:02-04:00",
-  "path": "/nix/store/91xc2kv7dql3waccf2ih7k55bjw03n4z-tree-sitter-rust",
-  "sha256": "12806974pngxqv1brj4r15yqzp2fdvid926n7941nylgmdw9f4z9",
-  "hash": "sha256-6ROXeKuPehtIOtaI1OJuTtyPfQmZyLzCxv3ZS04yAIk=",
+  "rev": "b77c0d8ac28a7c143224e6ed9b4f9e4bd044ff5b",
+  "date": "2024-04-08T18:09:37-04:00",
+  "path": "/nix/store/mzkmi2d933cn0imzhvfvm43rwzgv624n-tree-sitter-rust",
+  "sha256": "1i1and7lkrcpxkkm3y8p8v1d6wpb6z3b3vrxk9dlw84mwa03y97d",
+  "hash": "sha256-7SQ/gOKVIE5bmj3vscY363LTwkYX+VHn7JflSU+zKsQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
index bdb762ed83cc5..7e08f324213e0 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/6cdh/tree-sitter-scheme",
-  "rev": "184e7596ee0cbaef79230cae1b4ee5bb4fbad314",
-  "date": "2024-03-15T19:06:15+08:00",
-  "path": "/nix/store/wdhalppgf16xgcrm3llj0al5dimya5pc-tree-sitter-scheme",
-  "sha256": "0sqccw5az31di8jhb88v3afryiz7a4136g9a9xq8qni4znifw7y3",
-  "hash": "sha256-wx/uov0kWoxwTyo9MwJR50efnRoboQUlii2MrwpnDGs=",
+  "rev": "8f9dff3d038f09934db5ea113cebc59c74447743",
+  "date": "2024-04-12T09:33:55+08:00",
+  "path": "/nix/store/myg0q8bjsdzgq712skhxk1vf2gqqr7b0-tree-sitter-scheme",
+  "sha256": "1n9f9zala2mv7bllwjb2nsh2xsr56zjh7j09vxzd77jnb10rjh20",
+  "hash": "sha256-QECZQVhWntN+3wnIA+U3JesuoLZiSU7pOrsKRdVPLtk=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
index f777d50e6d5ec..bc24e7aa108bd 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/JoranHonig/tree-sitter-solidity",
-  "rev": "b239a95f94cfcc6e7b3e961bc73a28d55e214f02",
-  "date": "2024-03-12T10:13:22+00:00",
-  "path": "/nix/store/8bi3z4l3g890xgb7karzpqfinrcadk26-tree-sitter-solidity",
-  "sha256": "0kb8d6j81pv5bas7nfvq5wv12paicrv833d7iin5z0zy4y2fvqkg",
-  "hash": "sha256-b+LthCf+g19sjKeNgXZmUV0RNi94O3u0WmXfgKRpaE0=",
+  "rev": "c3da7d989747679305ec1c84b68082f01089d49f",
+  "date": "2024-04-13T15:44:09+02:00",
+  "path": "/nix/store/a9spnmq129v18p2mwh52ksnq8aj5ag0s-tree-sitter-solidity",
+  "sha256": "0ha57nxqina9jl2i1b0r38m971wk0lhxrivgb88yii0r07zdmp84",
+  "hash": "sha256-BN3a/gEZxOgRWm/H3CEFk4eTKhoZrBAFlUnZiLs9RUE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
index 256888ebf3fea..9173e9300fb94 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/vrischmann/tree-sitter-templ",
-  "rev": "592faa3186ef857c92e4bd1c31d73c07a4a334db",
-  "date": "2024-02-06T21:43:24+01:00",
-  "path": "/nix/store/nqchnmjz07500x1s9fqrvkzrzvzjls5d-tree-sitter-templ",
-  "sha256": "1i26q3ci8w14c8z5lsibpbza0xwn7cp6hl46c52c98wvr0zpwzax",
-  "hash": "sha256-XX1+P8ibo8REYYZQaC47lneg/roralo+YiRwFNnARsQ=",
+  "rev": "1f9dae9c273136551684cb41461d00e565150e23",
+  "date": "2024-04-14T01:39:30+02:00",
+  "path": "/nix/store/swrbx6wrw3k022j2g7vq625zvjbmaxnr-tree-sitter-templ",
+  "sha256": "0w9kr1awc9f30mvidz4aysqs5wk3v93yam6ybb2d2jmmnv9kx5zj",
+  "hash": "sha256-8pc+07a1StHEWt5U5UfaY/KisfaK/BZ3BcMlxlXIM3E=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
index e42a0ec6fc17d..eda4e2a9669c2 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/tlaplus-community/tree-sitter-tlaplus",
-  "rev": "3896a5be761f04ffb22a841b2a0672f7a8a43ef9",
-  "date": "2024-03-11T11:12:33-04:00",
-  "path": "/nix/store/7dq157m7v3mq9iscmjbywm3sy1p9hgyh-tree-sitter-tlaplus",
-  "sha256": "0bjyf470anxialbmphn19r7pdnni181r45zyyfrl9db2fsgz3q0h",
-  "hash": "sha256-EODxn3ZitUSz8/4XkgMK0dp2T07BwlsXVbFbBQ5xXi4=",
+  "rev": "3c8ce503563ea04ba1cc07c468ed064b1974c3ba",
+  "date": "2024-04-12T21:02:56-04:00",
+  "path": "/nix/store/p9q0v9h09nf49ji1fnl3s87xsda7skmj-tree-sitter-tlaplus",
+  "sha256": "0vh0kdab362n1cm1nl1klqixshdzjnx5cxynadrmz021x2dx3xl7",
+  "hash": "sha256-h/bRm+hBgF9zU9Z3VrqVv0HdI6YzUBsqC1aYsVSbAG4=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
index 4333285d9e515..1a10518cbfd3f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/uben0/tree-sitter-typst",
-  "rev": "77e23188c3a4287f6ff37f545722ac872a260ee8",
-  "date": "2023-12-30T18:08:13+01:00",
-  "path": "/nix/store/0zb749g1r03b3wnzfb3p98y33vyd8ybn-tree-sitter-typst",
-  "sha256": "02k5y63wh1gsfpfczrc86gkjr9ip4zqn21wbf6mxmm6qhmr5vkvz",
-  "hash": "sha256-f89dcoXY1NqrcYsHYfEnN6Ys5zOI5c/cdfoFyIfxZQo=",
+  "rev": "13863ddcbaa7b68ee6221cea2e3143415e64aea4",
+  "date": "2024-04-09T11:57:57+02:00",
+  "path": "/nix/store/y02g3bdn5nwqiykfki4fhsxmkp7y9kjm-tree-sitter-typst",
+  "sha256": "198rn8wdcqq51nz6hj1zxk7mplplr2z8vc36z6h1zpjjq925794z",
+  "hash": "sha256-n6RTRMJS3h+g+Wawjb7I9NJbz+w/SGi+DQVj1jiyGaU=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
index 83c5a7ad66576..bb79674690e37 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/winglang/wing",
-  "rev": "a43b5524b0adbb553d874a6ea8d08a2d791f56c5",
-  "date": "2024-03-21T08:10:44+00:00",
-  "path": "/nix/store/v4qvjygfjjx04c5jn0p96hx5zd3skvsx-wing",
-  "sha256": "1wqj0ilb9mqbghsby5ls0qm7jf5vi2zsihnwjnksj9lnrng368xh",
-  "hash": "sha256-sCMzns2WJqmnldzCqL+Iuzh5KgaaFr80fAvXtGgEEvM=",
+  "rev": "f0b6b11709eb2ed56e5ef76a9b6fcc98615683b8",
+  "date": "2024-04-15T06:16:09+00:00",
+  "path": "/nix/store/iz1a2mwxdx9zqgdds0rfy8apq9l36xpb-wing",
+  "sha256": "105q2w5a3mx8pd0k0jhr6p3fprd85jr7fz3ndkj48yb2m8x2r1is",
+  "hash": "sha256-OoYsOqpieUTkbHZ8d7IsqOXrxjUZSjBBu6jXoQoXuIA=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/pip-audit/default.nix b/pkgs/development/tools/pip-audit/default.nix
index 6adcf5529e56d..9deb33c757f40 100644
--- a/pkgs/development/tools/pip-audit/default.nix
+++ b/pkgs/development/tools/pip-audit/default.nix
@@ -1,43 +1,43 @@
-{ lib
-, fetchFromGitHub
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "pip-audit";
-  version = "2.7.2";
+  version = "2.7.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "trailofbits";
-    repo = pname;
+    repo = "pip-audit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IlIPLuHGmnmt6FgX+Psw+f6XpkuhP+BZ+e4k4DV8e/U=";
+    hash = "sha256-MRFfF5OygUCIdUnPvxhYk4IcLSWGgmlw2qgzPoZDniw=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    flit-core
-  ];
+  build-system = with python3.pkgs; [ flit-core ];
 
-  propagatedBuildInputs = with python3.pkgs; [
-    cachecontrol
-    cyclonedx-python-lib
-    html5lib
-    packaging
-    pip-api
-    pip-requirements-parser
-    rich
-    toml
-  ] ++ cachecontrol.optional-dependencies.filecache;
+  dependencies =
+    with python3.pkgs;
+    [
+      cachecontrol
+      cyclonedx-python-lib
+      html5lib
+      packaging
+      pip-api
+      pip-requirements-parser
+      rich
+      toml
+    ]
+    ++ cachecontrol.optional-dependencies.filecache;
 
   nativeCheckInputs = with python3.pkgs; [
     pretend
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "pip_audit"
-  ];
+  pythonImportsCheck = [ "pip_audit" ];
 
   preCheck = ''
     export HOME=$(mktemp -d);
@@ -60,10 +60,10 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Tool for scanning Python environments for known vulnerabilities";
-    mainProgram = "pip-audit";
     homepage = "https://github.com/trailofbits/pip-audit";
     changelog = "https://github.com/pypa/pip-audit/releases/tag/v${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "pip-audit";
   };
 }
diff --git a/pkgs/development/tools/profiling/sysprof/default.nix b/pkgs/development/tools/profiling/sysprof/default.nix
index 96747b52a076b..7359fbb136fb1 100644
--- a/pkgs/development/tools/profiling/sysprof/default.nix
+++ b/pkgs/development/tools/profiling/sysprof/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sysprof";
-  version = "45.1";
+  version = "46.0";
 
   outputs = [ "out" "lib" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Mju51YVhPWDEOUYDMUUAEfK5Cz1ScmJb2FjaTBnfLPk=";
+    hash = "sha256-c6p+deurPk4JRqBacj335u5CSeO56ITbo1UAq6Kh0XY=";
   };
 
   nativeBuildInputs = [
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "System-wide profiler for Linux";
-    homepage = "https://wiki.gnome.org/Apps/Sysprof";
+    homepage = "https://gitlab.gnome.org/GNOME/sysprof";
     longDescription = ''
       Sysprof is a sampling CPU profiler for Linux that uses the perf_event_open
       system call to profile the entire system, not just a single
diff --git a/pkgs/development/tools/rust/cargo-c/default.nix b/pkgs/development/tools/rust/cargo-c/default.nix
index 3356eee034bc5..b370f1299277e 100644
--- a/pkgs/development/tools/rust/cargo-c/default.nix
+++ b/pkgs/development/tools/rust/cargo-c/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-c";
-  version = "0.9.29";
+  version = "0.9.31";
 
   src = fetchCrate {
     inherit pname;
     # this version may need to be updated along with package version
-    version = "${version}+cargo-0.76.0";
-    hash = "sha256-Uy5Bm8WwN3jQO2btnV/ayxTlIJAe5q2FUvhxCCrn9U8=";
+    version = "${version}+cargo-0.78.0";
+    hash = "sha256-RqwUV3e02GykYH/pWHjoent+gix+CD+t3yAQxqUmo54=";
   };
 
-  cargoHash = "sha256-fkekUCZReiexdtiQcWx+Hqz4XDDbRGa4fGheBCNZ3Qw=";
+  cargoHash = "sha256-SfKDlcN+PW1twJu3YbmMsQOtFh6JHncAhdrVg+tweAE=";
 
   nativeBuildInputs = [ pkg-config (lib.getDev curl) ];
   buildInputs = [ openssl curl ] ++ lib.optionals stdenv.isDarwin [
@@ -55,6 +55,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/lu-zero/cargo-c";
     changelog = "https://github.com/lu-zero/cargo-c/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ cpu ];
   };
 }
diff --git a/pkgs/development/tools/rust/cargo-nextest/default.nix b/pkgs/development/tools/rust/cargo-nextest/default.nix
index 8972fef8825a8..de0af79902080 100644
--- a/pkgs/development/tools/rust/cargo-nextest/default.nix
+++ b/pkgs/development/tools/rust/cargo-nextest/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.68";
+  version = "0.9.70";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-LC+0s38ufmMrhNaKSn13jka/M7PG1+gJnqZCXJ7ef6I=";
+    hash = "sha256-YTeKcdUszI/0RCAq6Gcakl3hfUSUo3CfVCMod/IPYhw=";
   };
 
-  cargoHash = "sha256-E/bsVbSdFr1LMrIewsh15Vuk4Dt5UwETLCIhE7TT3kA=";
+  cargoHash = "sha256-FH9ODkK84bPPYyHP4kKcHKWpJ3FV1NC8S/NQFvV63Gw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/development/tools/rust/cargo-whatfeatures/default.nix b/pkgs/development/tools/rust/cargo-whatfeatures/default.nix
index fdae63bd50b4f..e040971df8300 100644
--- a/pkgs/development/tools/rust/cargo-whatfeatures/default.nix
+++ b/pkgs/development/tools/rust/cargo-whatfeatures/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-whatfeatures";
-  version = "0.9.10";
+  version = "0.9.11";
 
   src = fetchFromGitHub {
     owner = "museun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-80VbQyOg6jvX98QRcCVN/wwhAm4bO/UfHEIv4gP8IlA=";
+    sha256 = "sha256-lCS0EDSNnCii98OBZlPwwq7LBociN7zo8FZJvxt9X4w=";
   };
 
-  cargoHash = "sha256-mp9KUJuwSwRuxQAEilYwNZwqe3ipN4JzsaO5Pi3V9xg=";
+  cargoHash = "sha256-SNhulId9naSBO7UxiiX7q0RIVJngflAO2UfpxvKDIF4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/scenebuilder/default.nix b/pkgs/development/tools/scenebuilder/default.nix
index 6e0b80497f4bd..14d6c87259048 100644
--- a/pkgs/development/tools/scenebuilder/default.nix
+++ b/pkgs/development/tools/scenebuilder/default.nix
@@ -6,7 +6,7 @@
 , copyDesktopItems
 , glib
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -53,7 +53,7 @@ maven'.buildMavenPackage rec {
     copyDesktopItems
     glib
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dontWrapGApps = true; # prevent double wrapping
diff --git a/pkgs/development/tools/vala-lint/default.nix b/pkgs/development/tools/vala-lint/default.nix
index b3f4987146b8d..bb063fdfe32e9 100644
--- a/pkgs/development/tools/vala-lint/default.nix
+++ b/pkgs/development/tools/vala-lint/default.nix
@@ -9,7 +9,7 @@
 , pkg-config
 , vala
 , gettext
-, wrapGAppsHook
+, wrapGAppsHook3
 , unstableGitUpdater
 }:
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/development/web/cog/default.nix b/pkgs/development/web/cog/default.nix
index c350149f32e23..0a9be7e5682b4 100644
--- a/pkgs/development/web/cog/default.nix
+++ b/pkgs/development/web/cog/default.nix
@@ -10,7 +10,7 @@
 , glib-networking
 , webkitgtk
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , gnome
 , gdk-pixbuf
 }:
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     pkg-config
     wayland
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   depsBuildsBuild = [
diff --git a/pkgs/development/web/cypress/default.nix b/pkgs/development/web/cypress/default.nix
index dedd94230b8c8..8ce3c5aef739a 100644
--- a/pkgs/development/web/cypress/default.nix
+++ b/pkgs/development/web/cypress/default.nix
@@ -10,7 +10,7 @@
 , stdenv
 , udev
 , unzip
-, wrapGAppsHook
+, wrapGAppsHook3
 , xorg
 }:
 
@@ -40,7 +40,7 @@ in stdenv.mkDerivation rec {
   # don't remove runtime deps
   dontPatchELF = true;
 
-  nativeBuildInputs = [ autoPatchelfHook wrapGAppsHook unzip ];
+  nativeBuildInputs = [ autoPatchelfHook wrapGAppsHook3 unzip ];
 
   buildInputs = with xorg; [
     libXScrnSaver
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 78a69303a3cbc..489a38efcf12f 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGo122Module rec {
   pname = "flyctl";
-  version = "0.2.40";
+  version = "0.2.46";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-HIJ2EAfNKVlECXHgw2qx5OlWv5davaBrtrSQVsdrKKY=";
+    hash = "sha256-x7ICqPm3c2bpNb18vNxZVlkxtgCL2GqLMv8TxI7cUfg=";
   };
 
-  vendorHash = "sha256-uA9Sfovz42+JT+AEY7t4dwWpIUgqX8qdGto7LU7qLtY=";
+  vendorHash = "sha256-tLlWPKMRPFyMDZGkdjb/hF/7/OPpducGXyGlXExBG64=";
 
   subPackages = [ "." ];
 
@@ -52,12 +52,12 @@ buildGo122Module rec {
     version = "v${flyctl.version}";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Command line tools for fly.io services";
     downloadPage = "https://github.com/superfly/flyctl";
     homepage = "https://fly.io/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ adtya jsierles techknowlogick ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ adtya jsierles techknowlogick ];
     mainProgram = "flyctl";
   };
 }
diff --git a/pkgs/development/web/insomnia/default.nix b/pkgs/development/web/insomnia/default.nix
index 422c6b7378897..0d9b0e422b507 100644
--- a/pkgs/development/web/insomnia/default.nix
+++ b/pkgs/development/web/insomnia/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, makeWrapper, fetchurl, dpkg, alsa-lib, atk, cairo, cups, dbus, expat
 , fontconfig, freetype, gdk-pixbuf, glib, pango, mesa, nspr, nss, gtk3
-, at-spi2-atk, gsettings-desktop-schemas, gobject-introspection, wrapGAppsHook
+, at-spi2-atk, gsettings-desktop-schemas, gobject-introspection, wrapGAppsHook3
 , libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
 , libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb, libxshmfence, nghttp2
 , libudev0-shim, glibc, curl, openssl, autoPatchelfHook }:
@@ -28,7 +28,7 @@ in stdenv.mkDerivation rec {
     dpkg
     makeWrapper
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/development/web/nodejs/node-npm-build-npm-package-logic.patch b/pkgs/development/web/nodejs/node-npm-build-npm-package-logic.patch
index a9ac6b0589efc..a24ab07a3d804 100644
--- a/pkgs/development/web/nodejs/node-npm-build-npm-package-logic.patch
+++ b/pkgs/development/web/nodejs/node-npm-build-npm-package-logic.patch
@@ -49,7 +49,7 @@ index 1fa8b1f96..a026bb50d 100644
 +      if (process.env['NIX_NODEJS_BUILDNPMPACKAGE']) {
 +        const spawn = require('@npmcli/promise-spawn')
 +
-+        const npmWithNixFlags = (args, cmd) => spawn('bash', ['-c', 'npm ' + args + ` $npm${cmd}Flags "$\{npm${cmd}FlagsArray[@]}" $npmFlags "$\{npmFlagsArray[@]}"`], { cwd: dir, env: { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') } }, { message: `\`npm ${args}\` failed` })
++        const npmWithNixFlags = (args, cmd) => spawn('bash', ['-c', 'npm ' + args + ` $npm${cmd}Flags "$\{npm${cmd}FlagsArray[@]}" $npmFlags "$\{npmFlagsArray[@]}" || [ -n "$forceGitDeps" ]`], { cwd: dir, env: { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') } }, { message: `\`npm ${args}\` failed` })
 +        const patchShebangs = () => spawn('bash', ['-c', 'source $stdenv/setup; patchShebangs node_modules'], { cwd: dir })
 +
 +        // the DirFetcher will do its own preparation to run the prepare scripts
@@ -57,7 +57,7 @@ index 1fa8b1f96..a026bb50d 100644
 +        //
 +        // We ignore this.npmConfig to maintain an environment that's as close
 +        // to the rest of the build as possible.
-+        return spawn('bash', ['-c', '$prefetchNpmDeps --fixup-lockfile package-lock.json'], { cwd: dir })
++        return spawn('bash', ['-c', '$prefetchNpmDeps --fixup-lockfile package-lock.json || [ -n "$forceGitDeps" ]'], { cwd: dir })
 +        .then(() => npmWithNixFlags('ci --ignore-scripts', 'Install'))
 +        .then(patchShebangs)
 +        .then(() => npmWithNixFlags('rebuild', 'Rebuild'))
diff --git a/pkgs/development/web/postman/linux.nix b/pkgs/development/web/postman/linux.nix
index 763337fd25384..64f5deb1b48ff 100644
--- a/pkgs/development/web/postman/linux.nix
+++ b/pkgs/development/web/postman/linux.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchurl
 , makeDesktopItem
-, wrapGAppsHook
+, wrapGAppsHook3
 , atk
 , at-spi2-atk
 , at-spi2-core
@@ -126,7 +126,7 @@ stdenv.mkDerivation rec {
     xorg.libxshmfence
   ];
 
-  nativeBuildInputs = [ wrapGAppsHook copyDesktopItems ];
+  nativeBuildInputs = [ wrapGAppsHook3 copyDesktopItems ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/web/publii/default.nix b/pkgs/development/web/publii/default.nix
index e09e21f174a71..9792f2686454e 100644
--- a/pkgs/development/web/publii/default.nix
+++ b/pkgs/development/web/publii/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , autoPatchelfHook
 , makeShellWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , alsa-lib
 , at-spi2-atk
 , at-spi2-core
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoPatchelfHook
     makeShellWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/games/abuse/default.nix b/pkgs/games/abuse/default.nix
index 0a77c842bd82b..cd3587a244e0b 100644
--- a/pkgs/games/abuse/default.nix
+++ b/pkgs/games/abuse/default.nix
@@ -4,14 +4,14 @@
 , SDL2, SDL2_mixer, freepats
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname   = "abuse";
   version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "Xenoveritas";
-    repo = pname;
-    rev = "v${version}";
+    repo = "abuse";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-eneu0HxEoM//Ju2XMHnDMZ/igeVMPSLg7IaxR2cnJrk=";
   };
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   };
 
   preConfigure = ''
-    cp --reflink=auto -r ${data}/data/sfx ${data}/data/music data/
+    cp --reflink=auto -r ${finalAttrs.data}/data/sfx ${finalAttrs.data}/data/music data/
   '';
 
   desktopItems = [ (makeDesktopItem {
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     substituteAll "${./abuse.sh}" $out/bin/abuse
     chmod +x $out/bin/abuse
 
-    install -Dm644 ${data}/doc/abuse.png $out/share/pixmaps/abuse.png
+    install -Dm644 ${finalAttrs.data}/doc/abuse.png $out/share/pixmaps/abuse.png
   '';
 
   env.NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2}/include/SDL2";
@@ -49,16 +49,16 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ copyDesktopItems cmake ];
   buildInputs       = [ SDL2 SDL2_mixer freepats ];
 
-  meta = with lib; {
+  meta = {
     description = "Side-scroller action game that pits you against ruthless alien killers";
     homepage    = "http://abuse.zoy.org/";
-    license     = with licenses; [ unfree ];
+    license     = lib.licenses.unfree;
     # Most of abuse is free (public domain, GPL2+, WTFPL), however the creator
     # of its sfx and music only gave Debian permission to redistribute the
     # files. Our friends from Debian thought about it some more:
     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648272
-    maintainers = with maintainers; [ iblech ];
-    platforms   = platforms.unix;
+    maintainers = with lib.maintainers; [ iblech ];
+    platforms   = lib.platforms.unix;
     broken      = stdenv.isDarwin;
   };
-}
+})
diff --git a/pkgs/games/doom-ports/slade/default.nix b/pkgs/games/doom-ports/slade/default.nix
index 9ab3d1f458d5d..bae685ccac47f 100644
--- a/pkgs/games/doom-ports/slade/default.nix
+++ b/pkgs/games/doom-ports/slade/default.nix
@@ -15,7 +15,7 @@
 , glew
 , lua
 , mpg123
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     pkg-config
     which
     zip
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/games/freeciv/default.nix b/pkgs/games/freeciv/default.nix
index 6f653c46df864..d1a50ea89cc19 100644
--- a/pkgs/games/freeciv/default.nix
+++ b/pkgs/games/freeciv/default.nix
@@ -2,7 +2,7 @@
 , zlib, bzip2, curl, xz, gettext, libiconv, icu
 , SDL2, SDL2_mixer, SDL2_image, SDL2_ttf, SDL2_gfx, freetype, fluidsynth
 , sdl2Client ? false
-, gtkClient ? true, gtk3, wrapGAppsHook
+, gtkClient ? true, gtk3, wrapGAppsHook3
 , qtClient ? false, qt5
 , server ? true, readline
 , enableSqlite ? true, sqlite
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ]
     ++ lib.optionals qtClient [ qt5.wrapQtAppsHook ]
-    ++ lib.optionals gtkClient [ wrapGAppsHook ];
+    ++ lib.optionals gtkClient [ wrapGAppsHook3 ];
 
   buildInputs = [ lua5_3 zlib bzip2 curl xz gettext libiconv icu ]
     ++ [ SDL2 SDL2_mixer SDL2_image SDL2_ttf SDL2_gfx freetype fluidsynth ]
diff --git a/pkgs/games/gamehub/default.nix b/pkgs/games/gamehub/default.nix
index 87796d58c732b..3bfbe71c3c0e8 100644
--- a/pkgs/games/gamehub/default.nix
+++ b/pkgs/games/gamehub/default.nix
@@ -16,7 +16,7 @@
 , webkitgtk
 , libmanette
 , libXtst
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/games/gnonograms/default.nix b/pkgs/games/gnonograms/default.nix
index 69d45e32fe26c..57f38d61bbb5a 100644
--- a/pkgs/games/gnonograms/default.nix
+++ b/pkgs/games/gnonograms/default.nix
@@ -9,7 +9,7 @@
 , appstream
 , python3
 , shared-mime-info
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , pantheon
 , libgee
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     appstream
     python3
     shared-mime-info
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/games/grapejuice/default.nix b/pkgs/games/grapejuice/default.nix
index c8d1956eb9a54..9c2c8a594388b 100644
--- a/pkgs/games/grapejuice/default.nix
+++ b/pkgs/games/grapejuice/default.nix
@@ -4,7 +4,7 @@
 , pciutils
 , python3Packages
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib
 , cairo
 , desktop-file-utils
@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec  {
     gobject-introspection
     desktop-file-utils
     glib
-    wrapGAppsHook
+    wrapGAppsHook3
     python3Packages.pip
   ];
 
diff --git a/pkgs/games/gscrabble/default.nix b/pkgs/games/gscrabble/default.nix
index 28e2a58b0d008..453cbfedba949 100644
--- a/pkgs/games/gscrabble/default.nix
+++ b/pkgs/games/gscrabble/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonApplication, fetchFromGitHub
-, gtk3, wrapGAppsHook, gst_all_1, gobject-introspection
+, gtk3, wrapGAppsHook3, gst_all_1, gobject-introspection
 , python3Packages, gnome }:
 
 buildPythonApplication {
@@ -15,7 +15,7 @@ buildPythonApplication {
 
   doCheck = false;
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
 
   buildInputs = with gst_all_1; [
     gst-plugins-base gst-plugins-good gst-plugins-ugly gst-plugins-bad
diff --git a/pkgs/games/gshogi/default.nix b/pkgs/games/gshogi/default.nix
index 350ab86aa22b3..a4e9b903dc1cd 100644
--- a/pkgs/games/gshogi/default.nix
+++ b/pkgs/games/gshogi/default.nix
@@ -3,7 +3,7 @@
 , gobject-introspection
 , gtk3
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -23,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
     gtk3
   ];
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
 
   propagatedBuildInputs = with python3.pkgs; [
     pygobject3
diff --git a/pkgs/games/gweled/default.nix b/pkgs/games/gweled/default.nix
index 484543ad86592..b27da3b2f7c4e 100644
--- a/pkgs/games/gweled/default.nix
+++ b/pkgs/games/gweled/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchbzr, gettext
-, gtk2, wrapGAppsHook, autoreconfHook, pkg-config
+, gtk2, wrapGAppsHook3, autoreconfHook, pkg-config
 , libmikmod, librsvg, libcanberra-gtk2, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     substituteInPlace configure.ac --replace "AM_GNU_GETTEXT_VERSION([0.19.8])" "AM_GNU_GETTEXT_VERSION([${gettext.version}])"
   '';
 
-  nativeBuildInputs = [ wrapGAppsHook gettext autoreconfHook pkg-config ];
+  nativeBuildInputs = [ wrapGAppsHook3 gettext autoreconfHook pkg-config ];
 
   buildInputs = [ gtk2 libmikmod librsvg hicolor-icon-theme libcanberra-gtk2 ];
 
diff --git a/pkgs/games/hmcl/default.nix b/pkgs/games/hmcl/default.nix
index 95a40f0a8d809..2dd9c7b7884e5 100644
--- a/pkgs/games/hmcl/default.nix
+++ b/pkgs/games/hmcl/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , makeBinaryWrapper
 , makeDesktopItem
-, wrapGAppsHook
+, wrapGAppsHook3
 , copyDesktopItems
 , imagemagick
 , jre
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     makeBinaryWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     copyDesktopItems
     imagemagick
   ];
diff --git a/pkgs/games/jfsw/default.nix b/pkgs/games/jfsw/default.nix
index 9b631551b5790..ed82964e4d0eb 100644
--- a/pkgs/games/jfsw/default.nix
+++ b/pkgs/games/jfsw/default.nix
@@ -5,7 +5,7 @@
 , SDL2
 , perl
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 }:
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     SDL2
     perl
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/games/jumpnbump/default.nix b/pkgs/games/jumpnbump/default.nix
index 193d4dc0b585f..b2f6a646c65f3 100644
--- a/pkgs/games/jumpnbump/default.nix
+++ b/pkgs/games/jumpnbump/default.nix
@@ -4,7 +4,7 @@
 , SDL2, SDL2_mixer, SDL2_net
 , gtk3, gobject-introspection
 , python3Packages
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let data = fetchzip {
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  nativeBuildInputs = [ python3Packages.wrapPython wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ python3Packages.wrapPython wrapGAppsHook3 gobject-introspection ];
   buildInputs = [ SDL2 SDL2_mixer SDL2_net gtk3 ];
 
   postInstall = ''
diff --git a/pkgs/games/liberation-circuit/default.nix b/pkgs/games/liberation-circuit/default.nix
index 5df48282f26d4..cfae4282a04a3 100644
--- a/pkgs/games/liberation-circuit/default.nix
+++ b/pkgs/games/liberation-circuit/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchurl, pkg-config, allegro5, libGL, wrapGAppsHook }:
+{ stdenv, lib, fetchFromGitHub, fetchurl, pkg-config, allegro5, libGL, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "liberation-circuit";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-zIwjh4CBSmKz7pF7GM5af+VslWho5jHOLsulbW4C8TY=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = [ allegro5 libGL ];
 
   dontWrapGApps = true;
diff --git a/pkgs/games/linthesia/default.nix b/pkgs/games/linthesia/default.nix
index 1200afa4f2f71..e918906af4f38 100644
--- a/pkgs/games/linthesia/default.nix
+++ b/pkgs/games/linthesia/default.nix
@@ -14,7 +14,7 @@
 , python3
 , sqlite
 , stdenv
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     patchShebangs meson_post_install.py
   '';
 
-  nativeBuildInputs = [ meson ninja pkg-config python3 wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja pkg-config python3 wrapGAppsHook3 ];
   buildInputs = [
     libGL
     libGLU
diff --git a/pkgs/games/maptool/default.nix b/pkgs/games/maptool/default.nix
index 1e95e376825c6..775879a957ad3 100644
--- a/pkgs/games/maptool/default.nix
+++ b/pkgs/games/maptool/default.nix
@@ -8,7 +8,7 @@
 , makeDesktopItem
 , openjfx
 , stdenvNoCC
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 let
   pname = "maptool";
@@ -82,7 +82,7 @@ stdenvNoCC.mkDerivation {
   nativeBuildInputs = [
     copyDesktopItems
     libarchive
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   desktopItems = [
diff --git a/pkgs/games/minecraft/default.nix b/pkgs/games/minecraft/default.nix
index c9ce3bfb17f16..eb05e085f1496 100644
--- a/pkgs/games/minecraft/default.nix
+++ b/pkgs/games/minecraft/default.nix
@@ -4,7 +4,7 @@
 , copyDesktopItems
 , makeDesktopItem
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , jre # old or modded versions of the game may require Java 8 (https://aur.archlinux.org/packages/minecraft-launcher/#pinned-674960)
 , xorg
@@ -100,7 +100,7 @@ stdenv.mkDerivation rec {
     sha256 = "0w8z21ml79kblv20wh5lz037g130pxkgs8ll9s3bi94zn2pbrhim";
   };
 
-  nativeBuildInputs = [ makeWrapper wrapGAppsHook copyDesktopItems gobject-introspection ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook3 copyDesktopItems gobject-introspection ];
 
   sourceRoot = ".";
 
diff --git a/pkgs/games/openxcom/default.nix b/pkgs/games/openxcom/default.nix
index 3ae8e23605daf..25b3bd8116b82 100644
--- a/pkgs/games/openxcom/default.nix
+++ b/pkgs/games/openxcom/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation {
   pname = "openxcom";
-  version = "1.0.0.2023.08.12";
+  version = "1.0.0.2024.02.28";
 
   src = fetchFromGitHub {
     owner = "OpenXcom";
     repo = "OpenXcom";
-    rev = "bd632cc8569a57fdc3b68ce53f6ea850422ec5ac";
-    hash = "sha256-ouYZ4rAEluqeP+ZUrbEZwCpXCw0cZLWsf1GbIE3jaTc=";
+    rev = "e2c5a1b45c33957ce7e206207c5fb752c1e79ae1";
+    hash = "sha256-2G2dSvoDdacdYsXS51h3aGLCCjbHwcvD4CNnQIH/J6A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/games/principia/default.nix b/pkgs/games/principia/default.nix
index e97fc509c5b0a..0cf659e448e0e 100644
--- a/pkgs/games/principia/default.nix
+++ b/pkgs/games/principia/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 
 , curl
 , freetype
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/games/runescape-launcher/default.nix b/pkgs/games/runescape-launcher/default.nix
index 062a194c83dcc..6bed4908f471f 100644
--- a/pkgs/games/runescape-launcher/default.nix
+++ b/pkgs/games/runescape-launcher/default.nix
@@ -18,7 +18,7 @@
 , openssl_1_1
 , pango
 , SDL2
-, wrapGAppsHook
+, wrapGAppsHook3
 , xdg-utils
 , xorg
 , xorg_sys_opengl
@@ -40,7 +40,7 @@ let
     nativeBuildInputs = [
       autoPatchelfHook
       dpkg
-      wrapGAppsHook
+      wrapGAppsHook3
     ];
 
     buildInputs = [
diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index e5be3c4ae71ed..304c0f9b27c78 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, desktop-file-utils
 , gtk3, libX11, cmake, imagemagick
-, pkg-config, perl, wrapGAppsHook, nixosTests, writeScript
+, pkg-config, perl, wrapGAppsHook3, nixosTests, writeScript
 , isMobile ? false
 }:
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     imagemagick
     perl
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString isMobile "-DSTYLUS_BASED";
diff --git a/pkgs/games/space-station-14-launcher/space-station-14-launcher.nix b/pkgs/games/space-station-14-launcher/space-station-14-launcher.nix
index d6eedb6e9f698..c2071552e4cc2 100644
--- a/pkgs/games/space-station-14-launcher/space-station-14-launcher.nix
+++ b/pkgs/games/space-station-14-launcher/space-station-14-launcher.nix
@@ -2,7 +2,7 @@
 , buildDotnetModule
 , dotnetCorePackages
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , iconConvTools
 , copyDesktopItems
 , makeDesktopItem
@@ -73,7 +73,7 @@ buildDotnetModule rec {
     "-nologo"
   ];
 
-  nativeBuildInputs = [ wrapGAppsHook iconConvTools copyDesktopItems ];
+  nativeBuildInputs = [ wrapGAppsHook3 iconConvTools copyDesktopItems ];
 
   runtimeDeps = [
     # Required by the game.
diff --git a/pkgs/games/steam/runtime.nix b/pkgs/games/steam/runtime.nix
index 8e0492b69af8f..563a09d369073 100644
--- a/pkgs/games/steam/runtime.nix
+++ b/pkgs/games/steam/runtime.nix
@@ -4,16 +4,16 @@
 , writeShellScript, curl, nix-update
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
 
   pname = "steam-runtime";
   # from https://repo.steampowered.com/steamrt-images-scout/snapshots/latest-steam-client-general-availability/VERSION.txt
   version = "0.20231127.68515";
 
   src = fetchurl {
-    url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${version}/steam-runtime.tar.xz";
-    sha256 = "sha256-invUOdJGNhrswsj9Vj/bSAkEigWtBQ554sBAyvPf0mk=";
-    name = "scout-runtime-${version}.tar.gz";
+    url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${finalAttrs.version}/steam-runtime.tar.xz";
+    hash = "sha256-invUOdJGNhrswsj9Vj/bSAkEigWtBQ554sBAyvPf0mk=";
+    name = "scout-runtime-${finalAttrs.version}.tar.gz";
   };
 
   buildCommand = ''
@@ -28,10 +28,10 @@ stdenv.mkDerivation rec {
     '';
   };
 
-  meta = with lib; {
+  meta = {
     description = "The official runtime used by Steam";
     homepage = "https://github.com/ValveSoftware/steam-runtime";
-    license = licenses.unfreeRedistributable; # Includes NVIDIA CG toolkit
-    maintainers = with maintainers; [ hrdinka abbradar ];
+    license = lib.licenses.unfreeRedistributable; # Includes NVIDIA CG toolkit
+    maintainers = with lib.maintainers; [ hrdinka abbradar ];
   };
-}
+})
diff --git a/pkgs/games/vassal/default.nix b/pkgs/games/vassal/default.nix
index 31996a30c1fe6..e2c1d4037b3f9 100644
--- a/pkgs/games/vassal/default.nix
+++ b/pkgs/games/vassal/default.nix
@@ -4,7 +4,7 @@
 , glib
 , jre
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   installPhase = ''
diff --git a/pkgs/kde/misc/ktextaddons/default.nix b/pkgs/kde/misc/ktextaddons/default.nix
index 086608f2b6624..ae37770e99274 100644
--- a/pkgs/kde/misc/ktextaddons/default.nix
+++ b/pkgs/kde/misc/ktextaddons/default.nix
@@ -8,11 +8,11 @@
 }:
 mkKdeDerivation rec {
   pname = "ktextaddons";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchurl {
     url = "mirror://kde/stable/ktextaddons/ktextaddons-${version}.tar.xz";
-    hash = "sha256-ilLbir+oqdaNLSkfsPi+IGWf14mZh7Tcr98kaNsJF9w=";
+    hash = "sha256-ZLgGAuhLJekWRiCvP2NB+oZbhegmq49eAgYa4koneyA=";
   };
 
   extraBuildInputs = [qtspeech qttools kxmlgui];
diff --git a/pkgs/kde/plasma/kde-gtk-config/default.nix b/pkgs/kde/plasma/kde-gtk-config/default.nix
index 0101a56e93c68..3126e2f8d9c0b 100644
--- a/pkgs/kde/plasma/kde-gtk-config/default.nix
+++ b/pkgs/kde/plasma/kde-gtk-config/default.nix
@@ -1,7 +1,7 @@
 {
   mkKdeDerivation,
   pkg-config,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   sass,
   qtsvg,
   gsettings-desktop-schemas,
@@ -16,7 +16,7 @@ mkKdeDerivation {
     NIX_CFLAGS_COMPILE+=" -DGSETTINGS_SCHEMAS_PATH=\"$GSETTINGS_SCHEMAS_PATH\""
   '';
 
-  extraNativeBuildInputs = [pkg-config wrapGAppsHook sass];
+  extraNativeBuildInputs = [pkg-config wrapGAppsHook3 sass];
   extraBuildInputs = [qtsvg];
   dontWrapGApps = true; # There is nothing to wrap
 
diff --git a/pkgs/misc/drivers/sc-controller/default.nix b/pkgs/misc/drivers/sc-controller/default.nix
index 48783b492387d..1a7fce27013c2 100644
--- a/pkgs/misc/drivers/sc-controller/default.nix
+++ b/pkgs/misc/drivers/sc-controller/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonApplication, fetchFromGitHub, wrapGAppsHook
+{ lib, buildPythonApplication, fetchFromGitHub, wrapGAppsHook3
 , pytestCheckHook
 , gtk3, gobject-introspection, libappindicator-gtk3, librsvg
 , evdev, pygobject3, pylibacl, bluez, vdf
@@ -17,7 +17,7 @@ buildPythonApplication rec {
     sha256 = "sha256-vK/5S+GyqVfKTqn5PaPmOV/tXE9PIW57gqYxvhGaJSg=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
 
   buildInputs = [ gtk3 libappindicator-gtk3 librsvg ];
 
diff --git a/pkgs/misc/plasma-hud/default.nix b/pkgs/misc/plasma-hud/default.nix
index b0adf0e1efc69..e70162b79af74 100644
--- a/pkgs/misc/plasma-hud/default.nix
+++ b/pkgs/misc/plasma-hud/default.nix
@@ -1,4 +1,4 @@
-{ wrapGAppsHook
+{ wrapGAppsHook3
 , lib
 , python3Packages
 , fetchFromGitHub
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = (with python3Packages; [
diff --git a/pkgs/misc/screensavers/light-locker/default.nix b/pkgs/misc/screensavers/light-locker/default.nix
index 33db5825bc020..734f3f515d03d 100644
--- a/pkgs/misc/screensavers/light-locker/default.nix
+++ b/pkgs/misc/screensavers/light-locker/default.nix
@@ -14,7 +14,7 @@
 , libXext
 , systemd
 , pantheon
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/misc/screensavers/xlockmore/default.nix b/pkgs/misc/screensavers/xlockmore/default.nix
index 79b4adae6eb2b..3ecf07d29a3f5 100644
--- a/pkgs/misc/screensavers/xlockmore/default.nix
+++ b/pkgs/misc/screensavers/xlockmore/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xlockmore";
-  version = "5.76";
+  version = "5.77";
 
   src = fetchurl {
     url = "http://sillycycle.com/xlock/xlockmore-${version}.tar.xz";
-    sha256 = "sha256-gnn7crvjflmW05+J8EIg0pbK11IGlXz/EbCqc7gFvfM=";
+    sha256 = "sha256-UrfEE+c3hPxYFcc78SOPWiBd7rt4F6jBnnq/Pvb8LDY=";
     curlOpts = "--user-agent 'Mozilla/5.0'";
   };
 
diff --git a/pkgs/misc/sndio/default.nix b/pkgs/misc/sndio/default.nix
index a65c0cd7b0f50..2da49d1f45bca 100644
--- a/pkgs/misc/sndio/default.nix
+++ b/pkgs/misc/sndio/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, alsa-lib, fixDarwinDylibNames }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sndio";
   version = "1.9.0";
 
   src = fetchurl {
-    url = "https://www.sndio.org/sndio-${version}.tar.gz";
-    sha256 = "sha256-8wgm/JwH42nTkk1fzt9qClPA30rh9atQ/pzygFQPaZo=";
+    url = "https://www.sndio.org/sndio-${finalAttrs.version}.tar.gz";
+    hash = "sha256-8wgm/JwH42nTkk1fzt9qClPA30rh9atQ/pzygFQPaZo=";
   };
 
   nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
@@ -19,11 +19,11 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.sndio.org";
     description = "Small audio and MIDI framework part of the OpenBSD project";
-    license = licenses.isc;
-    maintainers = with maintainers; [ Madouura ];
-    platforms = platforms.all;
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ Madouura ];
+    platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/misc/solfege/default.nix b/pkgs/misc/solfege/default.nix
index 63606078abada..09964fd58bccf 100644
--- a/pkgs/misc/solfege/default.nix
+++ b/pkgs/misc/solfege/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, gettext, pkg-config, texinfo, wrapGAppsHook
+{ lib, fetchurl, gettext, pkg-config, texinfo, wrapGAppsHook3
 , buildPythonApplication, pycairo, pygobject3
 , gdk-pixbuf, gobject-introspection, gtk3, librsvg
 , alsa-utils, timidity, mpg123, vorbis-tools, csound, lilypond
@@ -36,7 +36,7 @@ buildPythonApplication rec {
     txt2man
 
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/cpupower-gui/default.nix b/pkgs/os-specific/linux/cpupower-gui/default.nix
index 02a781d1f0cf0..754f8e1396152 100644
--- a/pkgs/os-specific/linux/cpupower-gui/default.nix
+++ b/pkgs/os-specific/linux/cpupower-gui/default.nix
@@ -19,7 +19,7 @@
 , pygobject3
 , pyxdg
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication rec {
@@ -55,7 +55,7 @@ buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
 
     # Python packages
     dbus-python
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index dfa974e3e683c..610f9d31353e2 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -8,7 +8,6 @@
 , fetchurl
 , fetchpatch
 , glibmm
-, kernel
 , libavc1394
 , libconfig
 , libiec61883
@@ -22,7 +21,6 @@
 }:
 
 let
-  inherit (python3.pkgs) pyqt5 dbus-python;
   python = python3.withPackages (pkgs: with pkgs; [ pyqt5 dbus-python ]);
 in
 mkDerivation rec {
@@ -61,7 +59,7 @@ mkDerivation rec {
     pkg-config
     which
     python
-    pyqt5
+    python3.pkgs.pyqt5
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
index af455e7ef61fa..57b4207e383d0 100644
--- a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
@@ -8,7 +8,7 @@
 , openssl
 , udev
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     rustc
     pkg-config
     rustPlatform.cargoSetupHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/guvcview/default.nix b/pkgs/os-specific/linux/guvcview/default.nix
index e082038730111..d274c375fb42c 100644
--- a/pkgs/os-specific/linux/guvcview/default.nix
+++ b/pkgs/os-specific/linux/guvcview/default.nix
@@ -21,7 +21,7 @@
 # can be turned off if used as a library
 , useGtk ? true
 , gtk3 ? null
-, wrapGAppsHook ? null
+, wrapGAppsHook3 ? null
 }:
 
 assert pulseaudioSupport -> libpulseaudio != null;
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     intltool
     pkg-config
   ]
-    ++ lib.optionals (useGtk) [ wrapGAppsHook ]
+    ++ lib.optionals (useGtk) [ wrapGAppsHook3 ]
     ++ lib.optionals (useQt) [ wrapQtAppsHook ]
   ;
 
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 031dbfa700bc8..67914b0c4e276 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  configureFlags = [
+    "--color" "auto"
+  ];
+
   makeFlags = [
     "PREFIX=$(out)"
     "SBINDIR=$(out)/sbin"
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index e94b74fb00d73..8d87ee3598ec6 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -7,13 +7,15 @@ let
   # kernel config in the xanmod version commit
   ltsVariant = {
     version = "6.6.28";
-    hash = "sha256-0ld4pZIddfkGytxzqgC7AGD3gc2H9mhZbhpbFLD3G+s=";
+    suffix = "xanmod2";
+    hash = "sha256-U5L7i/g808GuUZhLjHE+v0VOQVdTPe+Tnx/rLQoGxx4=";
     variant = "lts";
   };
 
   mainVariant = {
     version = "6.8.7";
-    hash = "sha256-S9UooZhMtvfyL2BVUfMBxvPLkZvXm37duWSjcpk5dvY=";
+    suffix = "xanmod2";
+    hash = "sha256-/RhtRASEedYI4Zf9pUiiyDD3SgOL46cutTXo68gjBg8=";
     variant = "main";
   };
 
@@ -45,6 +47,9 @@ let
       HZ = freeform "250";
       HZ_250 = yes;
       HZ_1000 = no;
+
+      # Disable writeback throttling by default
+      BLK_WBT_MQ = lib.mkOverride 60 no;
     };
 
     extraMeta = {
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 59aa5bbc0e5d0..478b5fa8ac2cc 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libcap-ng";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchurl {
     url = "https://people.redhat.com/sgrubb/libcap-ng/libcap-ng-${version}.tar.gz";
-    sha256 = "sha256-aFgdOzjnVTy29t33gTsfyZ5ShW8hQh97R3zlq9JgWoo=";
+    hash = "sha256-O6UpTRy9+pivqs+8ALavntK4PoohgXGF39hEzIx6xv8=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 3680cd43efb77..95e4183a2fb6b 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -5,7 +5,6 @@
 , autoreconfHook
 , withDebugSymbols ? false
 , withCli ? true, libedit
-, withPython ? false, python3
 , withXtables ? true, iptables
 , nixosTests
 }:
@@ -29,25 +28,12 @@ stdenv.mkDerivation rec {
     libmnl libnftnl libpcap
     gmp jansson
   ] ++ lib.optional withCli libedit
-    ++ lib.optional withXtables iptables
-    ++ lib.optionals withPython [
-      python3
-      python3.pkgs.setuptools
-    ];
-
-  patches = [ ./fix-py-libnftables.patch ];
-
-  postPatch = ''
-    substituteInPlace "py/src/nftables.py" \
-      --subst-var-by "out" "$out"
-  '';
+    ++ lib.optional withXtables iptables;
 
   configureFlags = [
     "--with-json"
     (lib.withFeatureAs withCli "cli" "editline")
   ] ++ lib.optional (!withDebugSymbols) "--disable-debug"
-    ++ lib.optional (!withPython) "--disable-python"
-    ++ lib.optional withPython "--enable-python"
     ++ lib.optional withXtables "--with-xtables";
 
   passthru.tests = {
diff --git a/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch b/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch
deleted file mode 100644
index 3ab1e5363019a..0000000000000
--- a/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/py/src/nftables.py b/py/src/nftables.py
-index f1e43ade..9adcd1be 100644
---- a/py/src/nftables.py
-+++ b/py/src/nftables.py
-@@ -69,7 +69,7 @@ class Nftables:
- 
-     validator = None
- 
--    def __init__(self, sofile="libnftables.so.1"):
-+    def __init__(self, sofile="@out@/lib/libnftables.so.1"):
-         """Instantiate a new Nftables class object.
- 
-         Accepts a shared object file to open, by default standard search path
diff --git a/pkgs/os-specific/linux/nftables/python.nix b/pkgs/os-specific/linux/nftables/python.nix
new file mode 100644
index 0000000000000..5c5770ebed4a5
--- /dev/null
+++ b/pkgs/os-specific/linux/nftables/python.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, setuptools
+, nftables
+}:
+
+buildPythonPackage {
+  pname = "nftables";
+  inherit (nftables) version src;
+  pyproject = true;
+
+  postPatch = ''
+    substituteInPlace "py/src/nftables.py" \
+      --replace-fail "libnftables.so.1" "${nftables}/lib/libnftables.so.1"
+  '';
+
+  setSourceRoot = "sourceRoot=$(echo */py)";
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "nftables" ];
+
+  meta = {
+    inherit (nftables.meta) description homepage license platforms maintainers;
+  };
+}
diff --git a/pkgs/os-specific/linux/nvidia-x11/settings.nix b/pkgs/os-specific/linux/nvidia-x11/settings.nix
index b11dc06c85ebf..2d9dfd81829eb 100644
--- a/pkgs/os-specific/linux/nvidia-x11/settings.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/settings.nix
@@ -16,7 +16,7 @@ nvidia_x11: sha256:
 , libXxf86vm
 , libvdpau
 , librsvg
-, wrapGAppsHook
+, wrapGAppsHook3
 , addOpenGLRunpath
 , withGtk2 ? false
 , withGtk3 ? true
@@ -96,7 +96,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config m4 addOpenGLRunpath ];
 
   buildInputs = [ jansson libXv libXrandr libXext libXxf86vm libvdpau nvidia_x11 gtk2 dbus ]
-    ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook ];
+    ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook3 ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 2b0c327fbc2e6..e5f8fec5acb14 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, fetchurl, fetchpatch
+{ lib, stdenv, buildPackages, fetchurl
 , flex, cracklib, db4, gettext, audit, libxcrypt
 , nixosTests
 , autoreconfHook269, pkg-config-unwrapped
@@ -6,31 +6,15 @@
 
 stdenv.mkDerivation rec {
   pname = "linux-pam";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchurl {
     url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    hash = "sha256-//SjTlu+534ujxmS8nYx4jKby/igVj3etcM4m04xaa0=";
+    hash = "sha256-+JI8dAFZBS1xnb/CovgZQtaN00/K9hxwagLJuA/u744=";
   };
 
   patches = [
     ./suid-wrapper-path.patch
-
-    # Backport fix for missing include breaking musl builds.
-    (fetchpatch {
-      name = "pam_namespace-stdint.h.patch";
-      url = "https://github.com/linux-pam/linux-pam/commit/cc9d40b7cdbd3e15ccaa324a0dda1680ef9dea13.patch";
-      hash = "sha256-tCnH2yPO4dBbJOZA0fP2gm1EavHRMEJyfzB5Vy7YjAA=";
-    })
-
-    # Resotre handling of empty passwords:
-    #   https://github.com/linux-pam/linux-pam/pull/784
-    # TODO: drop upstreamed patch on 1.6.1 update.
-    (fetchpatch {
-      name = "revert-unconditional-helper.patch";
-      url = "https://github.com/linux-pam/linux-pam/commit/8d0c575336ad301cd14e16ad2fdec6fe621764b8.patch";
-      hash = "sha256-z9KfMxxqXQVnmNaixaVjLnQqaGsH8MBHhHbiP/8fvhE=";
-    })
   ];
 
   # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
diff --git a/pkgs/os-specific/linux/piper/default.nix b/pkgs/os-specific/linux/piper/default.nix
index b1508dcb6a3ed..dcdc7a363e30e 100644
--- a/pkgs/os-specific/linux/piper/default.nix
+++ b/pkgs/os-specific/linux/piper/default.nix
@@ -1,5 +1,5 @@
 { lib, meson, ninja, pkg-config, gettext, fetchFromGitHub, python3
-, wrapGAppsHook, gtk3, glib, desktop-file-utils, appstream-glib, gnome
+, wrapGAppsHook3, gtk3, glib, desktop-file-utils, appstream-glib, gnome
 , gobject-introspection, librsvg }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "0jsvfy0ihdcgnqljfgs41lys1nlz18qvsa0a8ndx3pyr41f8w8wf";
   };
 
-  nativeBuildInputs = [ meson ninja gettext pkg-config wrapGAppsHook desktop-file-utils appstream-glib gobject-introspection ];
+  nativeBuildInputs = [ meson ninja gettext pkg-config wrapGAppsHook3 desktop-file-utils appstream-glib gobject-introspection ];
   buildInputs = [
     gtk3 glib gnome.adwaita-icon-theme python3 librsvg
   ];
diff --git a/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index 11f26e5013a82..f7145bc02ebe7 100644
--- a/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -11,6 +11,7 @@
 , polkit
 , dbus
 , gobject-introspection
+, wrapGAppsNoGuiHook
 , gettext
 , gtk-doc
 , docbook-xsl-nons
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
     libxml2 # for xmllint for stripping GResources
     libxslt # for xsltproc for building docs
     gobject-introspection
+    wrapGAppsNoGuiHook
     # checkInput but cheked for during the configuring
     (python3.pythonOnBuildForHost.withPackages (ps: with ps; [
       pygobject3
@@ -95,6 +97,9 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # Only need to wrap the Python tool (powerprofilectl)
+  dontWrapGApps = true;
+
   PKG_CONFIG_POLKIT_GOBJECT_1_POLICYDIR = "${placeholder "out"}/share/polkit-1/actions";
 
   postPatch = ''
@@ -106,6 +111,10 @@ stdenv.mkDerivation rec {
       src/powerprofilesctl
   '';
 
+  postFixup = ''
+    wrapGApp "$out/bin/powerprofilesctl"
+  '';
+
   passthru = {
     tests = {
       nixos = nixosTests.power-profiles-daemon;
diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix
index 600655c447f7d..8847a83d53d77 100644
--- a/pkgs/os-specific/linux/tiscamera/default.nix
+++ b/pkgs/os-specific/linux/tiscamera/default.nix
@@ -18,7 +18,7 @@
 , glib
 , gobject-introspection
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook3
   # needs pkg_resources
 , withDoc ? false
 , sphinx
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ] ++ lib.optionals withDoc [
     sphinx
@@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
   # gstreamer tests requires, besides gst-plugins-bad, plugins installed by this expression.
   checkPhase = "ctest --force-new-ctest-process -E gstreamer";
 
-  # wrapGAppsHook: make sure we add ourselves to the introspection
+  # wrapGAppsHook3: make sure we add ourselves to the introspection
   # and gstreamer paths.
   GI_TYPELIB_PATH = "${placeholder "out"}/lib/girepository-1.0";
   GST_PLUGIN_SYSTEM_PATH_1_0 = "${placeholder "out"}/lib/gstreamer-1.0";
diff --git a/pkgs/os-specific/linux/tuna/default.nix b/pkgs/os-specific/linux/tuna/default.nix
index b57169369ca72..3b527c8b534fe 100644
--- a/pkgs/os-specific/linux/tuna/default.nix
+++ b/pkgs/os-specific/linux/tuna/default.nix
@@ -9,7 +9,7 @@
 , gtk3
 , python-linux-procfs
 , python-ethtool
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication rec {
@@ -37,7 +37,7 @@ buildPythonApplication rec {
     glib.dev
     gobject-introspection
     gtk3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [ pygobject3 python-linux-procfs python-ethtool ];
diff --git a/pkgs/os-specific/linux/waydroid/default.nix b/pkgs/os-specific/linux/waydroid/default.nix
index ae42c206280da..5e29b911ca548 100644
--- a/pkgs/os-specific/linux/waydroid/default.nix
+++ b/pkgs/os-specific/linux/waydroid/default.nix
@@ -12,7 +12,7 @@
 , iproute2
 , iptables
 , util-linux
-, wrapGAppsHook
+, wrapGAppsHook3
 , wl-clipboard
 , runtimeShell
 }:
@@ -39,7 +39,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/zenmonitor/default.nix b/pkgs/os-specific/linux/zenmonitor/default.nix
index e8fce959c8dc9..8101f47c6a241 100644
--- a/pkgs/os-specific/linux/zenmonitor/default.nix
+++ b/pkgs/os-specific/linux/zenmonitor/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, gtk3, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "zenmonitor";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ gtk3 ];
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
diff --git a/pkgs/servers/gonic/default.nix b/pkgs/servers/gonic/default.nix
index f3c83a164bce6..d405e82be9b85 100644
--- a/pkgs/servers/gonic/default.nix
+++ b/pkgs/servers/gonic/default.nix
@@ -55,7 +55,6 @@ buildGoModule rec {
     description = "Music streaming server / subsonic server API implementation";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ autrimpo ];
-    platforms = lib.platforms.linux;
     mainProgram = "gonic";
   };
 }
diff --git a/pkgs/servers/gpsd/default.nix b/pkgs/servers/gpsd/default.nix
index 224ce41d185ee..ac4d0c066783f 100644
--- a/pkgs/servers/gpsd/default.nix
+++ b/pkgs/servers/gpsd/default.nix
@@ -25,7 +25,7 @@
 , pango
 , gdk-pixbuf
 , atk
-, wrapGAppsHook
+, wrapGAppsHook3
 
 , gpsdUser ? "gpsd", gpsdGroup ? "dialout"
 }:
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     scons
   ] ++ lib.optionals guiSupport [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 0f90061ad61f0..52bf366e74fff 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -446,17 +446,9 @@ let
         };
       });
 
-      versioningit = super.versioningit.overridePythonAttrs (oldAttrs: rec {
-        version = "2.2.0";
-        src = fetchPypi {
-          inherit (oldAttrs) pname;
-          inherit version;
-          hash = "sha256-6xjnunJoqIC/HM/pLlNOlqs04Dl/KNy8s/wNpPaltr0=";
-        };
-        pytestFlagsArray = [
-          "-W" "ignore::DeprecationWarning"
-        ];
-      });
+      versioningit = super.versioningit.overridePythonAttrs {
+        doCheck = false;
+      };
 
       voluptuous = super.voluptuous.overridePythonAttrs (oldAttrs: rec {
         version = "0.13.1";
diff --git a/pkgs/servers/hqplayerd/rygel.nix b/pkgs/servers/hqplayerd/rygel.nix
index 5dfeda22137e2..313f0bb51ae04 100644
--- a/pkgs/servers/hqplayerd/rygel.nix
+++ b/pkgs/servers/hqplayerd/rygel.nix
@@ -7,7 +7,7 @@
 , gettext
 , libxml2
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , python3
 , glib
 , gssdp
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     gettext
     libxml2
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
     python3
   ];
 
diff --git a/pkgs/servers/http/jetty/12.x.nix b/pkgs/servers/http/jetty/12.x.nix
index c3ad743310dab..19aaa867c5dfe 100644
--- a/pkgs/servers/http/jetty/12.x.nix
+++ b/pkgs/servers/http/jetty/12.x.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "12.0.7";
-  hash = "sha256-n85MgRRWCaa7+KvGH1QyiQ03TFoAw7N2jPCJbmuGZNg=";
+  version = "12.0.8";
+  hash = "sha256-lmlt2bjomXl7UWu3FDUBSLGv0oyXV/8kPhRCtfSUW7w=";
 }
diff --git a/pkgs/servers/misc/gobgpd/default.nix b/pkgs/servers/misc/gobgpd/default.nix
index cd0f6bbd4ac43..14021f5a39c67 100644
--- a/pkgs/servers/misc/gobgpd/default.nix
+++ b/pkgs/servers/misc/gobgpd/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gobgpd";
-  version = "3.25.0";
+  version = "3.26.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cb4FYsYMkrna/1IjPlEglAmeQ/vfbUiaTb5OjrWiYR4=";
+    hash = "sha256-bFxKFAw02M8RmMCFFT3nu3urmvh7Wzi0rryuTi8Hw9k=";
   };
 
-  vendorHash = "sha256-fB/PjOO3+/RVQ5DGAHx4O8wAb9p+RdDC9+xkTCefP8A=";
+  vendorHash = "sha256-wrgRQwisOHAhvRbvGXMW5VWkQuEifCwCo3usuxLie4A=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index e32ef9bc1df64..331d1d3c71ac4 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -5,7 +5,7 @@
 , sbc, bluez5, udev, openssl, fftwFloat
 , soxr, speexdsp, systemd, webrtc-audio-processing_1
 , gst_all_1
-, check, libintl, meson, ninja, m4, wrapGAppsHook
+, check, libintl, meson, ninja, m4, wrapGAppsHook3
 , fetchpatch2
 
 , x11Support ? false
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config meson ninja makeWrapper perlPackages.perl perlPackages.XMLParser m4 ]
     ++ lib.optionals stdenv.isLinux [ glib ]
     # gstreamer plugin discovery requires wrapping
-    ++ lib.optional (bluetoothSupport && advancedBluetoothCodecs) wrapGAppsHook;
+    ++ lib.optional (bluetoothSupport && advancedBluetoothCodecs) wrapGAppsHook3;
 
   propagatedBuildInputs =
     lib.optionals stdenv.isLinux [ libcap ];
diff --git a/pkgs/servers/rpiplay/default.nix b/pkgs/servers/rpiplay/default.nix
index cc9369f9ea29d..ae22b838bda2a 100644
--- a/pkgs/servers/rpiplay/default.nix
+++ b/pkgs/servers/rpiplay/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, pkg-config, fetchFromGitHub, fetchpatch, cmake, wrapGAppsHook, avahi, avahi-compat, openssl, gst_all_1, libplist }:
+{ lib, stdenv, pkg-config, fetchFromGitHub, fetchpatch, cmake, wrapGAppsHook3, avahi, avahi-compat, openssl, gst_all_1, libplist }:
 
 stdenv.mkDerivation rec {
   pname = "rpiplay";
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     openssl
     libplist
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/servers/search/meilisearch/default.nix b/pkgs/servers/search/meilisearch/default.nix
index 8e816c0c13600..1846775194f06 100644
--- a/pkgs/servers/search/meilisearch/default.nix
+++ b/pkgs/servers/search/meilisearch/default.nix
@@ -6,7 +6,6 @@
 , SystemConfiguration
 , nixosTests
 , nix-update-script
-, libclang
 }:
 
 let version = "1.7.6";
@@ -40,12 +39,14 @@ rustPlatform.buildRustPackage {
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;
 
+  nativeBuildInputs = [
+    rustPlatform.bindgenHook
+  ];
+
   buildInputs = lib.optionals stdenv.isDarwin [
     Security SystemConfiguration
   ];
 
-  env.LIBCLANG_PATH = "${libclang.lib}/lib";
-
   passthru = {
     updateScript = nix-update-script { };
     tests = {
diff --git a/pkgs/servers/search/typesense/default.nix b/pkgs/servers/search/typesense/default.nix
index 30e09db055f2f..7a4256d81278b 100644
--- a/pkgs/servers/search/typesense/default.nix
+++ b/pkgs/servers/search/typesense/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     inherit hash;
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = lib.optionals stdenv.isLinux [
     autoPatchelfHook
   ];
 
@@ -59,7 +59,7 @@ stdenv.mkDerivation {
     #     This is where I stopped trying for now.
     # XXX: retry once typesense has officially released their bazel based build.
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with maintainers; [ oddlama ];
   };
 }
diff --git a/pkgs/servers/search/typesense/sources.json b/pkgs/servers/search/typesense/sources.json
index 0f7f43b7015af..854c0cfc4f9d9 100644
--- a/pkgs/servers/search/typesense/sources.json
+++ b/pkgs/servers/search/typesense/sources.json
@@ -12,6 +12,10 @@
     "x86_64-darwin": {
       "arch": "darwin-amd64",
       "hash": "sha256-FkWie6DgIhgojrn48rt9/GT0Lmu7jt74q2rzw1MI2Ws="
+    },
+    "aarch64-darwin": {
+      "arch": "darwin-arm64",
+      "hash": "sha256-ejw8B+DmCQs6cUSiLueY9tSdWnrFSFvLMS36U4+v8N4="
     }
   }
 }
diff --git a/pkgs/servers/search/typesense/update.sh b/pkgs/servers/search/typesense/update.sh
index c6d733181cd39..3dec74232f46b 100755
--- a/pkgs/servers/search/typesense/update.sh
+++ b/pkgs/servers/search/typesense/update.sh
@@ -15,6 +15,7 @@ fi
 
 declare -A platforms=(
     [aarch64-linux]="linux-arm64"
+    [aarch64-darwin]="darwin-arm64"
     [x86_64-darwin]="darwin-amd64"
     [x86_64-linux]="linux-amd64"
 )
diff --git a/pkgs/servers/sql/postgresql/12.nix b/pkgs/servers/sql/postgresql/12.nix
index 9e0388be04513..d29fc7683048f 100644
--- a/pkgs/servers/sql/postgresql/12.nix
+++ b/pkgs/servers/sql/postgresql/12.nix
@@ -1,10 +1,4 @@
 import ./generic.nix {
   version = "12.18";
   hash = "sha256-T5kZcl2UHOmGjgf+HtHTqGdIWZtIM4ZUdYOSi3TDkYo=";
-  muslPatches = {
-    icu-collations-hack = {
-      url = "https://git.alpinelinux.org/aports/plain/testing/postgresql12/icu-collations-hack.patch?id=d5227c91adda59d4e7f55f13468f0314e8869174";
-      hash = "sha256-wuwjvGHArkRNwFo40g3p43W32OrJohretlt6iSRlJKg=";
-    };
-  };
 }
diff --git a/pkgs/servers/sql/postgresql/13.nix b/pkgs/servers/sql/postgresql/13.nix
index a4870812acdb7..c81e15bc7f685 100644
--- a/pkgs/servers/sql/postgresql/13.nix
+++ b/pkgs/servers/sql/postgresql/13.nix
@@ -2,10 +2,6 @@ import ./generic.nix {
   version = "13.14";
   hash = "sha256-uN8HhVGJiWC9UA3F04oXfpkFN234H+fytmChQH+mpe0=";
   muslPatches = {
-    icu-collations-hack = {
-      url = "https://git.alpinelinux.org/aports/plain/main/postgresql14/icu-collations-hack.patch?id=56999e6d0265ceff5c5239f85fdd33e146f06cb7";
-      hash = "sha256-wuwjvGHArkRNwFo40g3p43W32OrJohretlt6iSRlJKg=";
-    };
     disable-test-collate-icu-utf8 = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql13/disable-test-collate.icu.utf8.patch?id=69faa146ec9fff3b981511068f17f9e629d4688b";
       hash = "sha256-jS/qxezaiaKhkWeMCXwpz1SDJwUWn9tzN0uKaZ3Ph2Y=";
diff --git a/pkgs/servers/sql/postgresql/14.nix b/pkgs/servers/sql/postgresql/14.nix
index 2de876cf4ad6c..c96ddd3ddc808 100644
--- a/pkgs/servers/sql/postgresql/14.nix
+++ b/pkgs/servers/sql/postgresql/14.nix
@@ -2,10 +2,6 @@ import ./generic.nix {
   version = "14.11";
   hash = "sha256-pnC9fc4i3K1Cl7JhE2s7HUoJpvVBcZViqhTKY78paKg=";
   muslPatches = {
-    icu-collations-hack = {
-      url = "https://git.alpinelinux.org/aports/plain/main/postgresql14/icu-collations-hack.patch?id=56999e6d0265ceff5c5239f85fdd33e146f06cb7";
-      hash = "sha256-wuwjvGHArkRNwFo40g3p43W32OrJohretlt6iSRlJKg=";
-    };
     disable-test-collate-icu-utf8 = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql14/disable-test-collate.icu.utf8.patch?id=56999e6d0265ceff5c5239f85fdd33e146f06cb7";
       hash = "sha256-jXe23AxnFjEl+TZQm4R7rStk2Leo08ctxMNmu1xr5zM=";
diff --git a/pkgs/servers/sql/postgresql/15.nix b/pkgs/servers/sql/postgresql/15.nix
index f633dc9750850..00dfc0cbbc19d 100644
--- a/pkgs/servers/sql/postgresql/15.nix
+++ b/pkgs/servers/sql/postgresql/15.nix
@@ -1,10 +1,4 @@
 import ./generic.nix {
   version = "15.6";
   hash = "sha256-hFUUbtnGnJOlfelUrq0DAsr60DXCskIXXWqh4X68svs=";
-  muslPatches = {
-    icu-collations-hack = {
-      url = "https://git.alpinelinux.org/aports/plain/main/postgresql15/icu-collations-hack.patch?id=f424e934e6d076c4ae065ce45e734aa283eecb9c";
-      hash = "sha256-HgtmhF4OJYU9macGJbTB9PjQi/yW7c3Akm3U0niWs8I=";
-    };
-  };
 }
diff --git a/pkgs/servers/sql/postgresql/16.nix b/pkgs/servers/sql/postgresql/16.nix
index 6a6420643b31a..cdc37b7c62f5f 100644
--- a/pkgs/servers/sql/postgresql/16.nix
+++ b/pkgs/servers/sql/postgresql/16.nix
@@ -1,10 +1,4 @@
 import ./generic.nix {
   version = "16.2";
   hash = "sha256-RG6IKU28LJCFq0twYaZG+mBLS+wDUh1epnHC5a2bKVI=";
-  muslPatches = {
-    icu-collations-hack = {
-      url = "https://git.alpinelinux.org/aports/plain/main/postgresql16/icu-collations-hack.patch?id=08a24be262339fd093e641860680944c3590238e";
-      hash = "sha256-+urQdVIlADLdDPeT68XYv5rljhbK8M/7mPZn/cF+FT0=";
-    };
-  };
 }
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index d11a2d06b2d26..ff9f4f4150a22 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -15,7 +15,6 @@ let
       in
       self.lib.nameValuePair attrName (import path {
         inherit jitSupport self;
-        thisAttr = attrName;
       })
     ) versions;
 
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 302350edeb5e0..705407a932560 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -16,10 +16,10 @@ let
       , self, newScope, buildEnv
 
       # source specification
-      , version, hash, muslPatches
+      , version, hash, muslPatches ? {}
 
       # for tests
-      , testers, nixosTests, thisAttr
+      , testers, nixosTests
 
       # JIT
       , jitSupport
@@ -45,7 +45,8 @@ let
 
     stdenv' = if jitSupport then llvmPackages.stdenv else stdenv;
   in stdenv'.mkDerivation (finalAttrs: {
-    inherit pname version;
+    inherit version;
+    pname = pname + lib.optionalString jitSupport "-jit";
 
     src = fetchurl {
       url = "mirror://postgresql/source/v${version}/${pname}-${version}.tar.bz2";
@@ -80,16 +81,15 @@ let
     ]
       ++ lib.optionals jitSupport [ llvmPackages.llvm.dev nukeReferences patchelf ];
 
-    enableParallelBuilding = !stdenv'.isDarwin;
+    enableParallelBuilding = true;
 
     separateDebugInfo = true;
 
     buildFlags = [ "world" ];
 
-    env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
-
-    # Otherwise it retains a reference to compiler and fails; see #44767.  TODO: better.
-    preConfigure = "CC=${stdenv'.cc.targetPrefix}cc";
+    # Makes cross-compiling work when xml2-config can't be executed on the host.
+    # Fixed upstream in https://github.com/postgres/postgres/commit/0bc8cebdb889368abdf224aeac8bc197fe4c9ae6
+    env.NIX_CFLAGS_COMPILE = lib.optionalString (olderThan "13") "-I${libxml2.dev}/include/libxml2";
 
     configureFlags = [
       "--with-openssl"
@@ -109,12 +109,11 @@ let
       ++ lib.optionals stdenv'.isLinux [ "--with-pam" ];
 
     patches = [
-      (if atLeast "16" then ./patches/disable-normalize_exec_path.patch
-       else ./patches/disable-resolve_symlinks.patch)
+      (if atLeast "16" then ./patches/relative-to-symlinks-16+.patch else ./patches/relative-to-symlinks.patch)
       ./patches/less-is-more.patch
-      ./patches/hardcode-pgxs-path.patch
+      ./patches/paths-for-split-outputs.patch
       ./patches/specify_pkglibdir_at_runtime.patch
-      ./patches/findstring.patch
+      ./patches/paths-with-postgresql-suffix.patch
 
       (substituteAll {
         src = ./patches/locale-binary-path.patch;
@@ -125,16 +124,14 @@ let
       # Using fetchurl instead of fetchpatch on purpose: https://github.com/NixOS/nixpkgs/issues/240141
       map fetchurl (lib.attrValues muslPatches)
     ) ++ lib.optionals stdenv'.isLinux  [
-      (if atLeast "13" then ./patches/socketdir-in-run-13.patch else ./patches/socketdir-in-run.patch)
+      (if atLeast "13" then ./patches/socketdir-in-run-13+.patch else ./patches/socketdir-in-run.patch)
     ];
 
     installTargets = [ "install-world" ];
 
-    LC_ALL = "C";
-
     postPatch = ''
       # Hardcode the path to pgxs so pg_config returns the path in $out
-      substituteInPlace "src/common/config_info.c" --replace HARDCODED_PGXS_PATH "$out/lib"
+      substituteInPlace "src/common/config_info.c" --subst-var out
     '' + lib.optionalString jitSupport ''
         # Force lookup of jit stuff in $out instead of $lib
         substituteInPlace src/backend/jit/jit.c --replace pkglib_path \"$out/lib\"
@@ -201,6 +198,7 @@ let
     # autodetection doesn't seem to able to find this, but it's there.
     checkTarget = "check";
 
+    # TODO: Remove after the next set of minor releases on May 9th 2024
     preCheck =
       # On musl, comment skip the following tests, because they break due to
       #     ! ERROR:  could not load library "/build/postgresql-11.5/tmp_install/nix/store/...-postgresql-11.5-lib/lib/libpqwalreceiver.so": Error loading shared library libpq.so.5: No such file or directory (needed by /build/postgresql-11.5/tmp_install/nix/store/...-postgresql-11.5-lib/lib/libpqwalreceiver.so)
@@ -246,10 +244,18 @@ let
                      this.pkgs;
 
       tests = {
-        postgresql = nixosTests.postgresql-wal-receiver.${thisAttr};
+        postgresql-wal-receiver = import ../../../../nixos/tests/postgresql-wal-receiver.nix {
+          inherit (stdenv) system;
+          pkgs = self;
+          package = this;
+        };
         pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       } // lib.optionalAttrs jitSupport {
-        postgresql-jit = nixosTests.postgresql-jit.${thisAttr};
+        postgresql-jit = import ../../../../nixos/tests/postgresql-jit.nix {
+          inherit (stdenv) system;
+          pkgs = self;
+          package = this;
+        };
       };
     };
 
@@ -272,7 +278,9 @@ let
       # resulting LLVM IR isn't platform-independent this doesn't give you much.
       # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
       # a query, postgres would coredump with `Illegal instruction`.
-      broken = jitSupport && (stdenv.hostPlatform != stdenv.buildPlatform);
+      broken = (jitSupport && stdenv.hostPlatform != stdenv.buildPlatform)
+        # Allmost all tests fail FATAL errors for v12 and v13
+        || (jitSupport && stdenv.hostPlatform.isMusl && olderThan "14");
     };
   });
 
diff --git a/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch b/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch
deleted file mode 100644
index fadeea90ac4b6..0000000000000
--- a/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- a/src/common/exec.c	2014-09-04 20:19:12.236057588 +0200
-+++ b/src/common/exec.c	2014-09-04 20:19:50.550251633 +0200
-@@ -218,6 +218,9 @@
- static int
- resolve_symlinks(char *path)
- {
-+	// On NixOS we *want* stuff relative to symlinks.
-+	return 0;
-+
- #ifdef HAVE_READLINK
- 	struct stat buf;
- 	char		orig_wd[MAXPGPATH],
diff --git a/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch b/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch
deleted file mode 100644
index 6cd449769baac..0000000000000
--- a/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -Naur postgresql-9.6.1-orig/src/common/config_info.c postgresql-9.6.1/src/common/config_info.c
---- postgresql-9.6.1-orig/src/common/config_info.c	2016-11-22 21:39:29.231929261 +0100
-+++ postgresql-9.6.1/src/common/config_info.c	2016-11-22 23:36:53.685163543 +0100
-@@ -118,7 +118,10 @@
- 	i++;
-
- 	configdata[i].name = pstrdup("PGXS");
-+	strlcpy(path, "HARDCODED_PGXS_PATH", sizeof(path));
-+/* commented out to be able to point to nix $out path
- 	get_pkglib_path(my_exec_path, path);
-+*/
- 	strlcat(path, "/pgxs/src/makefiles/pgxs.mk", sizeof(path));
- 	cleanup_path(path);
- 	configdata[i].setting = pstrdup(path);
diff --git a/pkgs/servers/sql/postgresql/patches/less-is-more.patch b/pkgs/servers/sql/postgresql/patches/less-is-more.patch
index f14af9dc22073..a72d1a28f9cea 100644
--- a/pkgs/servers/sql/postgresql/patches/less-is-more.patch
+++ b/pkgs/servers/sql/postgresql/patches/less-is-more.patch
@@ -1,6 +1,5 @@
-diff -Naur postgresql-9.6.1-orig/src/include/fe_utils/print.h postgresql-9.6.1/src/include/fe_utils/print.h
---- postgresql-9.6.1-orig/src/include/fe_utils/print.h	2016-11-22 21:39:29.148932827 +0100
-+++ postgresql-9.6.1/src/include/fe_utils/print.h	2016-11-22 21:39:36.283626258 +0100
+--- a/src/include/fe_utils/print.h
++++ b/src/include/fe_utils/print.h
 @@ -18,7 +18,7 @@
  
  /* This is not a particularly great place for this ... */
diff --git a/pkgs/servers/sql/postgresql/patches/locale-binary-path.patch b/pkgs/servers/sql/postgresql/patches/locale-binary-path.patch
index 08e90bce750ca..8068683ab64bf 100644
--- a/pkgs/servers/sql/postgresql/patches/locale-binary-path.patch
+++ b/pkgs/servers/sql/postgresql/patches/locale-binary-path.patch
@@ -1,5 +1,3 @@
-diff --git a/src/backend/commands/collationcmds.c b/src/backend/commands/collationcmds.c
-index fcfc02d..d011394 100644
 --- a/src/backend/commands/collationcmds.c
 +++ b/src/backend/commands/collationcmds.c
 @@ -611,7 +611,7 @@ pg_import_system_collations(PG_FUNCTION_ARGS)
diff --git a/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch b/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch
new file mode 100644
index 0000000000000..2134f7e81a870
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/patches/paths-for-split-outputs.patch
@@ -0,0 +1,11 @@
+--- a/src/common/config_info.c
++++ b/src/common/config_info.c
+@@ -118,7 +118,7 @@
+ 	i++;
+
+ 	configdata[i].name = pstrdup("PGXS");
++	strlcpy(path, "@out@/lib", sizeof(path));
+-	get_pkglib_path(my_exec_path, path);
+ 	strlcat(path, "/pgxs/src/makefiles/pgxs.mk", sizeof(path));
+ 	cleanup_path(path);
+ 	configdata[i].setting = pstrdup(path);
diff --git a/pkgs/servers/sql/postgresql/patches/findstring.patch b/pkgs/servers/sql/postgresql/patches/paths-with-postgresql-suffix.patch
index 959bf6a6caa4c..04d2f556e0bff 100644
--- a/pkgs/servers/sql/postgresql/patches/findstring.patch
+++ b/pkgs/servers/sql/postgresql/patches/paths-with-postgresql-suffix.patch
@@ -1,19 +1,3 @@
-From: Matthew Bauer <mjbauer95@gmail.com>
-Date: Wed, 29 May 2019 22:51:52 -0400
-Subject: [PATCH] Add /postgresql suffix for Nix outputs
-
-Nix outputs put the `name' in each store path like
-/nix/store/...-<name>. This was confusing the Postgres make script
-because it thought its data directory already had postgresql in its
-directory. This lead to Postgres installing all of its fils in
-$out/share. To fix this, we just look for postgres or psql in the part
-after the / using make's notdir.
-
----
-From: Matthew Bauer <mjbauer95@gmail.com>
-Date: Wed, 29 May 2019 22:51:52 -0400
-Subject: [PATCH] Add /postgresql suffix for Nix outputs
-
 Nix outputs put the `name' in each store path like
 /nix/store/...-<name>. This was confusing the Postgres make script
 because it thought its data directory already had postgresql in its
@@ -22,8 +6,6 @@ $out/share. To fix this, we just look for postgres or psql in the part
 after the / using make's notdir.
 
 ---
-diff --git a/src/Makefile.global.in b/src/Makefile.global.in
-index b9d86acaa9..bce05464c3 100644
 --- a/src/Makefile.global.in
 +++ b/src/Makefile.global.in
 @@ -102,15 +102,15 @@ datarootdir := @datarootdir@
diff --git a/pkgs/servers/sql/postgresql/patches/disable-normalize_exec_path.patch b/pkgs/servers/sql/postgresql/patches/relative-to-symlinks-16+.patch
index 349fd4203348a..996072ebd2fbd 100644
--- a/pkgs/servers/sql/postgresql/patches/disable-normalize_exec_path.patch
+++ b/pkgs/servers/sql/postgresql/patches/relative-to-symlinks-16+.patch
@@ -1,10 +1,11 @@
+On NixOS we *want* stuff relative to symlinks.
+---
 --- a/src/common/exec.c
 +++ b/src/common/exec.c
-@@ -238,6 +238,9 @@
+@@ -238,6 +238,8 @@
  static int
  normalize_exec_path(char *path)
  {
-+	// On NixOS we *want* stuff relative to symlinks.
 +	return 0;
 +
  	/*
diff --git a/pkgs/servers/sql/postgresql/patches/relative-to-symlinks.patch b/pkgs/servers/sql/postgresql/patches/relative-to-symlinks.patch
new file mode 100644
index 0000000000000..c9b199baf960c
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/patches/relative-to-symlinks.patch
@@ -0,0 +1,13 @@
+On NixOS we *want* stuff relative to symlinks.
+---
+--- a/src/common/exec.c
++++ b/src/common/exec.c
+@@ -218,6 +218,8 @@
+ static int
+ resolve_symlinks(char *path)
+ {
++	return 0;
++
+ #ifdef HAVE_READLINK
+ 	struct stat buf;
+ 	char		orig_wd[MAXPGPATH],
diff --git a/pkgs/servers/sql/postgresql/patches/socketdir-in-run-13.patch b/pkgs/servers/sql/postgresql/patches/socketdir-in-run-13+.patch
index 72c778b0758ef..fd808b6098249 100644
--- a/pkgs/servers/sql/postgresql/patches/socketdir-in-run-13.patch
+++ b/pkgs/servers/sql/postgresql/patches/socketdir-in-run-13+.patch
@@ -1,7 +1,5 @@
-diff --git i/src/include/pg_config_manual.h w/src/include/pg_config_manual.h
-index 8f3ec6bde1..4fc01e4a0a 100644
---- i/src/include/pg_config_manual.h
-+++ w/src/include/pg_config_manual.h
+--- a/src/include/pg_config_manual.h
++++ b/src/include/pg_config_manual.h
 @@ -201,7 +201,7 @@
   * support them yet.
   */
diff --git a/pkgs/servers/sql/postgresql/patches/socketdir-in-run.patch b/pkgs/servers/sql/postgresql/patches/socketdir-in-run.patch
index 969f80ff8fc7f..4932ef69ee360 100644
--- a/pkgs/servers/sql/postgresql/patches/socketdir-in-run.patch
+++ b/pkgs/servers/sql/postgresql/patches/socketdir-in-run.patch
@@ -1,5 +1,3 @@
-diff --git a/src/include/pg_config_manual.h b/src/include/pg_config_manual.h
-index 743401cb96..be5c5f61d2 100644
 --- a/src/include/pg_config_manual.h
 +++ b/src/include/pg_config_manual.h
 @@ -179,7 +179,7 @@
diff --git a/pkgs/servers/sql/postgresql/patches/specify_pkglibdir_at_runtime.patch b/pkgs/servers/sql/postgresql/patches/specify_pkglibdir_at_runtime.patch
index fe95d2ee99f06..b94fc9efcbff8 100644
--- a/pkgs/servers/sql/postgresql/patches/specify_pkglibdir_at_runtime.patch
+++ b/pkgs/servers/sql/postgresql/patches/specify_pkglibdir_at_runtime.patch
@@ -1,6 +1,5 @@
-diff -ur postgresql-9.5.3-orig/src/port/path.c postgresql-9.5.3/src/port/path.c
---- postgresql-9.5.3-orig/src/port/path.c	2016-05-09 22:50:23.000000000 +0200
-+++ postgresql-9.5.3/src/port/path.c	2016-08-29 22:44:10.507377613 +0200
+--- a/src/port/path.c
++++ b/src/port/path.c
 @@ -714,7 +714,11 @@
  void
  get_lib_path(const char *my_exec_path, char *ret_path)
diff --git a/pkgs/servers/uxplay/default.nix b/pkgs/servers/uxplay/default.nix
index 01b0361e29e8d..34c0a59e84adf 100644
--- a/pkgs/servers/uxplay/default.nix
+++ b/pkgs/servers/uxplay/default.nix
@@ -5,7 +5,7 @@
 , openssl
 , libplist
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , avahi
 , avahi-compat
 , gst_all_1
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
     libplist
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/servers/vouch-proxy/default.nix b/pkgs/servers/vouch-proxy/default.nix
index cfb22c85dbec5..7fdd1ad6fd265 100644
--- a/pkgs/servers/vouch-proxy/default.nix
+++ b/pkgs/servers/vouch-proxy/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "vouch-proxy";
-  version = "0.39.0";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "vouch";
     repo = "vouch-proxy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-q4tylXW219jzWrdzOQxewRh1advYEouEKiNJvvnIp9U=";
+    hash = "sha256-/B7MMRkI5DhDBWa53mgFUME1CR3FSxxQ8UWjlN19EmQ=";
   };
 
-  vendorHash = "sha256-IUjIGht/oQiWKHfbW7nJaybKpKs179mOkpLIwAb8/hk=";
+  vendorHash = "sha256-1k9YFdackF10iJWJ22XlaENlOfRkZMs+IedDWnd/h8E=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index a76a05fd05174..bf6c041205e43 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -66,18 +66,18 @@ self: with self; {
   })) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  editres = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt, wrapWithXFileSearchPathHook, testers }: stdenv.mkDerivation (finalAttrs: {
+  editres = callPackage ({ stdenv, pkg-config, fetchurl, libxkbfile, libX11, libXaw, libXmu, xorgproto, libXt, wrapWithXFileSearchPathHook, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "editres";
-    version = "1.0.8";
+    version = "1.0.9";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/editres-1.0.8.tar.xz";
-      sha256 = "1ydn32x9qh2zkn90w6nfv33gcq75z67w93bakkykadl8n7zmvkw3";
+      url = "mirror://xorg/individual/app/editres-1.0.9.tar.xz";
+      sha256 = "1imk7mgdc3q9lf058xisajij374x8r31ynvqmwbs9khfdxx3zz6d";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
     nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
-    buildInputs = [ libX11 libXaw libXmu xorgproto libXt ];
+    buildInputs = [ libxkbfile libX11 libXaw libXmu xorgproto libXt ];
     passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     meta = {
       pkgConfigModules = [ ];
@@ -88,11 +88,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   encodings = callPackage ({ stdenv, pkg-config, fetchurl, mkfontscale, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "encodings";
-    version = "1.0.7";
+    version = "1.1.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/font/encodings-1.0.7.tar.xz";
-      sha256 = "193hxaygxy2msmf8cyps8jdi0kxga84hj47qv7diqlhn7gsajf9s";
+      url = "mirror://xorg/individual/font/encodings-1.1.0.tar.xz";
+      sha256 = "0xg99nmpvik6vaz4h03xay7rx0r3bf5a8azkjlpa3ksn2xi3rwcz";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -938,11 +938,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   gccmakedep = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "gccmakedep";
-    version = "1.0.3";
+    version = "1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2";
-      sha256 = "1r1fpy5ni8chbgx7j5sz0008fpb6vbazpy1nifgdhgijyzqxqxdj";
+      url = "mirror://xorg/individual/util/gccmakedep-1.0.4.tar.xz";
+      sha256 = "1di5rxv930nhf5ls07fx04l0lqsakxycplmrx4kc6qzvd63zk22h";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -958,11 +958,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   iceauth = callPackage ({ stdenv, pkg-config, fetchurl, libICE, xorgproto, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "iceauth";
-    version = "1.0.9";
+    version = "1.0.10";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/iceauth-1.0.9.tar.xz";
-      sha256 = "01cc816fvdkkfcnqnyvgcshcip2jzjivwa8hzdvsz0snak5xzf9c";
+      url = "mirror://xorg/individual/app/iceauth-1.0.10.tar.xz";
+      sha256 = "0ad0kbr5bfdk9na3jmjpg26gd6hwv4lxja2nkdwxrybal9yzpvix";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -1118,11 +1118,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpthreadstubs, libxcb, xtrans, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libX11";
-    version = "1.8.7";
+    version = "1.8.9";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libX11-1.8.7.tar.xz";
-      sha256 = "1vlrgrdibp4lr84wgmsdy1ihzaai8bvvqc68npi1m19wir36gwh5";
+      url = "mirror://xorg/individual/lib/libX11-1.8.9.tar.xz";
+      sha256 = "0qijpp9l6hhwwx22hncrzjpmb5ffcakj6pxa5lzgjkhl3l8qz7bp";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -1198,11 +1198,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXaw = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto, libXmu, libXpm, libXt, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libXaw";
-    version = "1.0.15";
+    version = "1.0.16";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXaw-1.0.15.tar.xz";
-      sha256 = "0jkm2ards3nj08y7185k9jvjhhx78r46abrl3g3jrc4zvq7zfddb";
+      url = "mirror://xorg/individual/lib/libXaw-1.0.16.tar.xz";
+      sha256 = "13wwqfwaahm6dh35w0nkvw32x3li2s0glsks34ggh267ahmmf7bk";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -1278,11 +1278,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXdmcp = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libXdmcp";
-    version = "1.1.4";
+    version = "1.1.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXdmcp-1.1.4.tar.xz";
-      sha256 = "005dsry6nfqrv32i7gbqn7mxnb2m3pc8fz9lxj2b9w7q2z1mrkid";
+      url = "mirror://xorg/individual/lib/libXdmcp-1.1.5.tar.xz";
+      sha256 = "1312l8x3asib77wgf123w3nbabnky61mb6pnmmqapbf350l259fq";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -1438,11 +1438,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXmu = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto, libXt, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libXmu";
-    version = "1.1.4";
+    version = "1.2.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXmu-1.1.4.tar.xz";
-      sha256 = "0i42fng5gizablqziib25ipcwm5830jprl955ibq54rykjmy6391";
+      url = "mirror://xorg/individual/lib/libXmu-1.2.1.tar.xz";
+      sha256 = "1cp82iz7yki63iykvb3alwy4nwy01k2axi5rqpyfafca4j9pgcpw";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -1738,11 +1738,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libfontenc = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, zlib, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libfontenc";
-    version = "1.1.7";
+    version = "1.1.8";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libfontenc-1.1.7.tar.xz";
-      sha256 = "1hpy7kvppzy36fl8gbnzbv0cvglpdqk9jpdgvcfma1pfza8nkly0";
+      url = "mirror://xorg/individual/lib/libfontenc-1.1.8.tar.xz";
+      sha256 = "1ihlznj4m49jn1887cr86qqhrrlghvbfj7bbh230svi30pac60kv";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -1758,11 +1758,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libpciaccess = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libpciaccess";
-    version = "0.18";
+    version = "0.18.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libpciaccess-0.18.tar.xz";
-      sha256 = "1ab2qbksf15jrpzd6x9ncri64d2bnhlw7aajdws58lj9gljv0qal";
+      url = "mirror://xorg/individual/lib/libpciaccess-0.18.1.tar.xz";
+      sha256 = "0xpslrjnfrc1a7y8f8qwnd3wq24ndpj2q77ds12mbnwand239x2a";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -1798,11 +1798,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libxcb = callPackage ({ stdenv, pkg-config, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python3, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libxcb";
-    version = "1.16";
+    version = "1.17.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libxcb-1.16.tar.xz";
-      sha256 = "0w8xf6ff6axvla734lfb2291hrjrqqhn6mqabvdrdwgvl1m5cj23";
+      url = "mirror://xorg/individual/lib/libxcb-1.17.0.tar.xz";
+      sha256 = "0mbdkajqhg0j0zjc9a2z1qyv9mca797ihvifc9qyl3vijscvz7jr";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -1878,11 +1878,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   listres = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXmu, xorgproto, libXt, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "listres";
-    version = "1.0.5";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/listres-1.0.5.tar.xz";
-      sha256 = "17fwfjh0xrvg7jj4h32pa8ns4hq4r11z61kh2xsqvsyjwyxh0anf";
+      url = "mirror://xorg/individual/app/listres-1.0.6.tar.xz";
+      sha256 = "1jj3xqm4bkzzdikb189ga6q79267jklpf5byhzr599lvsvpm672d";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -1898,11 +1898,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   lndir = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "lndir";
-    version = "1.0.4";
+    version = "1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/util/lndir-1.0.4.tar.xz";
-      sha256 = "11syg5hx3f7m1d2p7zw717lryk819h6wk8h4vmapfdxvsflkfd1y";
+      url = "mirror://xorg/individual/util/lndir-1.0.5.tar.xz";
+      sha256 = "1nsd23kz6iqxfcis3432zq01i54n98b94m2gcsay1k3mamx5fr9v";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -1918,11 +1918,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   luit = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "luit";
-    version = "20230201";
+    version = "20240102";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "https://invisible-mirror.net/archives/luit/luit-20230201.tgz";
-      sha256 = "0vy5fqp26pnrdn0hmgnmar6m2y06syrz188jqh03vqkyphfqsapf";
+      url = "https://invisible-mirror.net/archives/luit/luit-20240102.tgz";
+      sha256 = "10n0xf8m3j6xhj5dgc0km40n9vy38hwnvjfq4pr0xiffrllflym0";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -2098,11 +2098,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   utilmacros = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "util-macros";
-    version = "1.20.0";
+    version = "1.20.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/util/util-macros-1.20.0.tar.xz";
-      sha256 = "1nrh8kmbix5pspva6y7h14fj97xdvxqc6fr3zysfswg9vdib51hb";
+      url = "mirror://xorg/individual/util/util-macros-1.20.1.tar.xz";
+      sha256 = "1xffkcqv96vpk5pckisanrvg4w7i9ciqhs6yv7sc12p7vii8yc0b";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -2238,11 +2238,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbproto = callPackage ({ stdenv, pkg-config, fetchurl, python3, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xcb-proto";
-    version = "1.16.0";
+    version = "1.17.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/proto/xcb-proto-1.16.0.tar.xz";
-      sha256 = "06aij66rs8g378wg8swd7b3g73wqrrbbwl8shhnsi29amm41hnm7";
+      url = "mirror://xorg/individual/proto/xcb-proto-1.17.0.tar.xz";
+      sha256 = "130lc8jx43s83496nc8jn47zixjcp4abgsz69pvrjiqg279aq6rc";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -2518,11 +2518,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xdm = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXau, libXaw, libXdmcp, libXext, libXft, libXinerama, libXmu, libXpm, xorgproto, libXrender, libXt, wrapWithXFileSearchPathHook, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xdm";
-    version = "1.1.14";
+    version = "1.1.16";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xdm-1.1.14.tar.xz";
-      sha256 = "0prx5h0xmv08yvm0axzh74a90cyc1s1dcv98jpjwjzkr6rbg56ry";
+      url = "mirror://xorg/individual/app/xdm-1.1.16.tar.xz";
+      sha256 = "1737hz8g3wpgdfj6y11q1xwma40wvgz85ckp6wv0hmz9h6c21wmw";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -2578,11 +2578,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xev = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto, libXrandr, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xev";
-    version = "1.2.5";
+    version = "1.2.6";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xev-1.2.5.tar.xz";
-      sha256 = "1hbfwcnbyz4w13fbhnghl0vdhf6w9f9pb7jgjwrhykkii51ilin9";
+      url = "mirror://xorg/individual/app/xev-1.2.6.tar.xz";
+      sha256 = "1mq7332kgisd9yq0w0rv11vhwhgpkmpg7pfdlyn776dc13hcbqb1";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -2878,11 +2878,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videochips = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xf86-video-chips";
-    version = "1.4.0";
+    version = "1.5.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-video-chips-1.4.0.tar.bz2";
-      sha256 = "1gqzy7q9v824m7hqkbbmncxg082zm0d4mafgc97c4skyiwgf9wq7";
+      url = "mirror://xorg/individual/driver/xf86-video-chips-1.5.0.tar.xz";
+      sha256 = "1cyljd3h2hjv42ldqimf4lllqhb8cma6p3n979kr8nn81rjdkhw4";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3158,11 +3158,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videonv = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xf86-video-nv";
-    version = "2.1.22";
+    version = "2.1.23";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-video-nv-2.1.22.tar.xz";
-      sha256 = "126j60dgnmiahjk5mxbnaav23hv7nvxvh49vhn6qg2f3nlnr6632";
+      url = "mirror://xorg/individual/driver/xf86-video-nv-2.1.23.tar.xz";
+      sha256 = "1jlap6xjn4pfwg9ab8fxm5mwf4dqfywp70bgc0071m7k66jbv3f6";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3298,11 +3298,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videosavage = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, libpciaccess, xorgserver, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xf86-video-savage";
-    version = "2.4.0";
+    version = "2.4.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-video-savage-2.4.0.tar.xz";
-      sha256 = "1z81nqwaqqy9sc7pywkw4q9mijpvjx9w8xxr7d13k2nhzlng0v5k";
+      url = "mirror://xorg/individual/driver/xf86-video-savage-2.4.1.tar.xz";
+      sha256 = "1bqhgldb6yahpgav7g7cyc4kl5pm3mgkq8w2qncj36311hb92hb7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3518,11 +3518,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videovboxvideo = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpciaccess, xorgserver, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xf86-video-vboxvideo";
-    version = "1.0.0";
+    version = "1.0.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-video-vboxvideo-1.0.0.tar.bz2";
-      sha256 = "195z1js3i51qgxvhfw4bxb4dw3jcrrx2ynpm2y3475dypjzs7dkz";
+      url = "mirror://xorg/individual/driver/xf86-video-vboxvideo-1.0.1.tar.xz";
+      sha256 = "12kzgf516mbdygpni0jzm3dv60vz6vf704f3hgc6pi9bgpy6bz4f";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3656,17 +3656,17 @@ self: with self; {
   })) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xfontsel = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt, wrapWithXFileSearchPathHook, testers }: stdenv.mkDerivation (finalAttrs: {
+  xfontsel = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt, gettext, wrapWithXFileSearchPathHook, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xfontsel";
-    version = "1.1.0";
+    version = "1.1.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xfontsel-1.1.0.tar.xz";
-      sha256 = "1d6ifx6sw97mmr00bhfakyx2f94w14yswxc68sw49zmvawrjq18p";
+      url = "mirror://xorg/individual/app/xfontsel-1.1.1.tar.xz";
+      sha256 = "1j827aiv7lsr2y7jgmv6pb5wmr2l3r3nd2pys0z2a0bpi9jqcjvs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
-    nativeBuildInputs = [ pkg-config wrapWithXFileSearchPathHook ];
+    nativeBuildInputs = [ pkg-config gettext wrapWithXFileSearchPathHook ];
     buildInputs = [ libX11 libXaw libXmu xorgproto libXt ];
     passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     meta = {
@@ -3938,11 +3938,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xload = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXaw, libXmu, xorgproto, libXt, gettext, wrapWithXFileSearchPathHook, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xload";
-    version = "1.1.4";
+    version = "1.2.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xload-1.1.4.tar.xz";
-      sha256 = "0c9h6w4bd1q3k4cy8v56sc3v9cg94cpg3xr057sf096v428vjil3";
+      url = "mirror://xorg/individual/app/xload-1.2.0.tar.xz";
+      sha256 = "104snn0rpnc91bmgj797cj6sgmkrp43n9mg20wbmr8p14kbfc3rc";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3998,11 +3998,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xlsfonts = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xlsfonts";
-    version = "1.0.7";
+    version = "1.0.8";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xlsfonts-1.0.7.tar.xz";
-      sha256 = "0r84wp4352hbfcaybqp2khipm40293byvrfyrlslrd37m52njwkv";
+      url = "mirror://xorg/individual/app/xlsfonts-1.0.8.tar.xz";
+      sha256 = "1kdnzyrm1wqwylghavn9lqi0h4lwf9ifkcv3zikbi176mjg90zw0";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -4038,11 +4038,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xmessage = callPackage ({ stdenv, pkg-config, fetchurl, libXaw, libXt, wrapWithXFileSearchPathHook, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xmessage";
-    version = "1.0.6";
+    version = "1.0.7";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xmessage-1.0.6.tar.xz";
-      sha256 = "04kahkk3kd6p1xlzf0jwfgnrb5z2r3y55q3p12b6n59py52wbsnj";
+      url = "mirror://xorg/individual/app/xmessage-1.0.7.tar.xz";
+      sha256 = "0mh3lclzh82l4wkwg1d9gflnm1irjydihg30gqfxcwmpl2vwqgvh";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -4118,11 +4118,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgdocs = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xorg-docs";
-    version = "1.7.2";
+    version = "1.7.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/doc/xorg-docs-1.7.2.tar.gz";
-      sha256 = "0xrncq9dkl6h03gfsj89zagi2vkhgvcgy8l6pjjva350d24027hc";
+      url = "mirror://xorg/individual/doc/xorg-docs-1.7.3.tar.xz";
+      sha256 = "1vyxpjcv8z5r5f5iza726ahzzwdapbbkxzv1b6w5izyrnppg58i8";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -4138,11 +4138,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgproto = callPackage ({ stdenv, pkg-config, fetchurl, libXt, python3, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xorgproto";
-    version = "2023.2";
+    version = "2024.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/proto/xorgproto-2023.2.tar.xz";
-      sha256 = "0b4c27aq25w1fccks49p020avf9jzh75kaq5qwnww51bp1yvq7xn";
+      url = "mirror://xorg/individual/proto/xorgproto-2024.1.tar.xz";
+      sha256 = "0nfbbi4j130m2gxzp20hp642xizbbl68jpbzahiq8nw183yja8ip";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -4178,11 +4178,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgsgmldoctools = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xorg-sgml-doctools";
-    version = "1.12";
+    version = "1.12.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/doc/xorg-sgml-doctools-1.12.tar.gz";
-      sha256 = "1nsb8kn6nipc09yv19wdpd94pav6hx7xby0psmmdvnm6wqlh6nlq";
+      url = "mirror://xorg/individual/doc/xorg-sgml-doctools-1.12.1.tar.xz";
+      sha256 = "0vvdnl1x82mr2phcq9z6dg94mas56zdmbm6lmkaqjkkbf3058p8a";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -4198,11 +4198,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xpr = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXmu, xorgproto, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xpr";
-    version = "1.1.0";
+    version = "1.2.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xpr-1.1.0.tar.xz";
-      sha256 = "1iaphm96kha6bzz34cj82r2lp5hrdpqwdca04iij4rinflab3fx0";
+      url = "mirror://xorg/individual/app/xpr-1.2.0.tar.xz";
+      sha256 = "1hyf6mc2l7lzkf21d5j4z6glg9y455hlsg8lv2lz028k6gw0554b";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -4278,11 +4278,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xrefresh = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xrefresh";
-    version = "1.0.7";
+    version = "1.1.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xrefresh-1.0.7.tar.xz";
-      sha256 = "07hvfw3rdv8mzqmm9ax5z8kw544insdd152f2z8868ply8sxdwd9";
+      url = "mirror://xorg/individual/app/xrefresh-1.1.0.tar.xz";
+      sha256 = "0pwb5c9g3xxs70gc35hahxq2ky8261pw9n04j01a6dffbqnmkv99";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -4338,11 +4338,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xsm = callPackage ({ stdenv, pkg-config, fetchurl, libICE, libSM, libX11, libXaw, xorgproto, libXt, wrapWithXFileSearchPathHook, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xsm";
-    version = "1.0.5";
+    version = "1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/app/xsm-1.0.5.tar.xz";
-      sha256 = "0bgvwvj99yqivy4dyxrfa0anwvh5d634gz0w43zy8cn17ymgsc4w";
+      url = "mirror://xorg/individual/app/xsm-1.0.6.tar.xz";
+      sha256 = "1kk398lbwyag8dljfmjfn4psdwmh66yhvab85xckf306qrscfk5p";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 6cc04f1490c64..246709dd1c1cd 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -557,7 +557,6 @@ self: super:
   xf86videoi128    = super.xf86videoi128.overrideAttrs    (attrs: { meta = attrs.meta // { broken = true; }; });
   xf86videonewport = super.xf86videonewport.overrideAttrs (attrs: { meta = attrs.meta // { broken = true; }; });
   xf86videos3virge = super.xf86videos3virge.overrideAttrs (attrs: { meta = attrs.meta // { broken = true; }; });
-  xf86videosavage  = super.xf86videosavage.overrideAttrs  (attrs: { meta = attrs.meta // { broken = true; }; });
   xf86videotga     = super.xf86videotga.overrideAttrs     (attrs: { meta = attrs.meta // { broken = true; }; });
   xf86videov4l     = super.xf86videov4l.overrideAttrs     (attrs: { meta = attrs.meta // { broken = true; }; });
   xf86videovoodoo  = super.xf86videovoodoo.overrideAttrs  (attrs: { meta = attrs.meta // { broken = true; }; });
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 53836294211ef..f58c526f7defe 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -1,4 +1,4 @@
-https://invisible-mirror.net/archives/luit/luit-20230201.tgz
+https://invisible-mirror.net/archives/luit/luit-20240102.tgz
 mirror://xorg/individual/xcb/libpthread-stubs-0.5.tar.xz
 mirror://xorg/individual/xcb/xcb-util-0.4.1.tar.xz
 mirror://xorg/individual/xcb/xcb-util-errors-1.0.1.tar.xz
@@ -8,11 +8,11 @@ mirror://xorg/individual/xcb/xcb-util-renderutil-0.3.10.tar.xz
 mirror://xorg/individual/xcb/xcb-util-wm-0.4.2.tar.xz
 mirror://xorg/individual/app/appres-1.0.6.tar.xz
 mirror://xorg/individual/app/bitmap-1.1.1.tar.xz
-mirror://xorg/individual/app/editres-1.0.8.tar.xz
+mirror://xorg/individual/app/editres-1.0.9.tar.xz
 mirror://xorg/individual/app/fonttosfnt-1.2.3.tar.xz
-mirror://xorg/individual/app/iceauth-1.0.9.tar.xz
+mirror://xorg/individual/app/iceauth-1.0.10.tar.xz
 mirror://xorg/individual/app/ico-1.0.6.tar.xz
-mirror://xorg/individual/app/listres-1.0.5.tar.xz
+mirror://xorg/individual/app/listres-1.0.6.tar.xz
 mirror://xorg/individual/app/mkfontscale-1.2.3.tar.xz
 mirror://xorg/individual/app/oclock-1.0.5.tar.xz
 mirror://xorg/individual/app/sessreg-1.1.3.tar.xz
@@ -30,13 +30,13 @@ mirror://xorg/individual/app/xcmsdb-1.0.6.tar.xz
 mirror://xorg/individual/app/xcompmgr-1.1.9.tar.xz
 mirror://xorg/individual/app/xconsole-1.0.8.tar.xz
 mirror://xorg/individual/app/xcursorgen-1.0.8.tar.xz
-mirror://xorg/individual/app/xdm-1.1.14.tar.xz
+mirror://xorg/individual/app/xdm-1.1.16.tar.xz
 mirror://xorg/individual/app/xdpyinfo-1.3.4.tar.xz
 mirror://xorg/individual/app/xdriinfo-1.0.7.tar.xz
-mirror://xorg/individual/app/xev-1.2.5.tar.xz
+mirror://xorg/individual/app/xev-1.2.6.tar.xz
 mirror://xorg/individual/app/xeyes-1.3.0.tar.xz
 mirror://xorg/individual/app/xfd-1.1.4.tar.xz
-mirror://xorg/individual/app/xfontsel-1.1.0.tar.xz
+mirror://xorg/individual/app/xfontsel-1.1.1.tar.xz
 mirror://xorg/individual/app/xfs-1.2.1.tar.xz
 mirror://xorg/individual/app/xfsinfo-1.0.7.tar.xz
 mirror://xorg/individual/app/xgamma-1.0.7.tar.xz
@@ -49,22 +49,22 @@ mirror://xorg/individual/app/xkbevd-1.1.5.tar.xz
 mirror://xorg/individual/app/xkbprint-1.0.6.tar.xz
 mirror://xorg/individual/app/xkbutils-1.0.6.tar.xz
 mirror://xorg/individual/app/xkill-1.0.6.tar.xz
-mirror://xorg/individual/app/xload-1.1.4.tar.xz
+mirror://xorg/individual/app/xload-1.2.0.tar.xz
 mirror://xorg/individual/app/xlsatoms-1.1.4.tar.xz
 mirror://xorg/individual/app/xlsclients-1.1.5.tar.xz
-mirror://xorg/individual/app/xlsfonts-1.0.7.tar.xz
+mirror://xorg/individual/app/xlsfonts-1.0.8.tar.xz
 mirror://xorg/individual/app/xmag-1.0.7.tar.xz
-mirror://xorg/individual/app/xmessage-1.0.6.tar.xz
+mirror://xorg/individual/app/xmessage-1.0.7.tar.xz
 mirror://xorg/individual/app/xmodmap-1.0.11.tar.xz
 mirror://xorg/individual/app/xmore-1.0.4.tar.xz
-mirror://xorg/individual/app/xpr-1.1.0.tar.xz
+mirror://xorg/individual/app/xpr-1.2.0.tar.xz
 mirror://xorg/individual/app/xprop-1.2.7.tar.xz
 mirror://xorg/individual/app/xrandr-1.5.2.tar.xz
 mirror://xorg/individual/app/xrdb-1.2.2.tar.xz
-mirror://xorg/individual/app/xrefresh-1.0.7.tar.xz
+mirror://xorg/individual/app/xrefresh-1.1.0.tar.xz
 mirror://xorg/individual/app/xset-1.2.5.tar.xz
 mirror://xorg/individual/app/xsetroot-1.1.3.tar.xz
-mirror://xorg/individual/app/xsm-1.0.5.tar.xz
+mirror://xorg/individual/app/xsm-1.0.6.tar.xz
 mirror://xorg/individual/app/xstdcmap-1.0.5.tar.xz
 mirror://xorg/individual/app/xtrap-1.0.3.tar.bz2
 mirror://xorg/individual/app/xvinfo-1.1.5.tar.xz
@@ -74,8 +74,8 @@ mirror://xorg/individual/app/xwud-1.0.6.tar.xz
 mirror://xorg/individual/data/xbitmaps-1.1.3.tar.xz
 mirror://xorg/individual/data/xcursor-themes-1.0.7.tar.xz
 mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.41.tar.xz
-mirror://xorg/individual/doc/xorg-docs-1.7.2.tar.gz
-mirror://xorg/individual/doc/xorg-sgml-doctools-1.12.tar.gz
+mirror://xorg/individual/doc/xorg-docs-1.7.3.tar.xz
+mirror://xorg/individual/doc/xorg-sgml-doctools-1.12.1.tar.xz
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2
 mirror://xorg/individual/driver/xf86-input-joystick-1.6.4.tar.xz
 mirror://xorg/individual/driver/xf86-input-keyboard-2.0.0.tar.xz
@@ -89,7 +89,7 @@ mirror://xorg/individual/driver/xf86-video-apm-1.3.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ark-0.7.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-ast-1.1.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-ati-22.0.0.tar.xz
-mirror://xorg/individual/driver/xf86-video-chips-1.4.0.tar.bz2
+mirror://xorg/individual/driver/xf86-video-chips-1.5.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-cirrus-1.6.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-dummy-0.4.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-fbdev-0.5.0.tar.bz2
@@ -103,14 +103,14 @@ mirror://xorg/individual/driver/xf86-video-mga-2.0.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-neomagic-1.3.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-newport-0.2.4.tar.bz2
 https://gitlab.freedesktop.org/xorg/driver/xf86-video-nouveau/-/archive/3ee7cbca8f9144a3bb5be7f71ce70558f548d268/xf86-video-nouveau-3ee7cbca8f9144a3bb5be7f71ce70558f548d268.tar.bz2
-mirror://xorg/individual/driver/xf86-video-nv-2.1.22.tar.xz
+mirror://xorg/individual/driver/xf86-video-nv-2.1.23.tar.xz
 mirror://xorg/individual/driver/xf86-video-omap-0.4.5.tar.bz2
 mirror://xorg/individual/driver/xf86-video-openchrome-0.6.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-qxl-0.1.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-r128-6.12.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-rendition-4.2.7.tar.bz2
 mirror://xorg/individual/driver/xf86-video-s3virge-1.11.1.tar.xz
-mirror://xorg/individual/driver/xf86-video-savage-2.4.0.tar.xz
+mirror://xorg/individual/driver/xf86-video-savage-2.4.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-siliconmotion-1.7.10.tar.xz
 mirror://xorg/individual/driver/xf86-video-sis-0.12.0.tar.gz
 mirror://xorg/individual/driver/xf86-video-sisusb-0.9.7.tar.bz2
@@ -121,13 +121,13 @@ mirror://xorg/individual/driver/xf86-video-tdfx-1.5.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-tga-1.2.2.tar.bz2
 mirror://xorg/individual/driver/xf86-video-trident-1.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-v4l-0.3.0.tar.bz2
-mirror://xorg/individual/driver/xf86-video-vboxvideo-1.0.0.tar.bz2
+mirror://xorg/individual/driver/xf86-video-vboxvideo-1.0.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-vesa-2.6.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-vmware-13.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-voodoo-1.2.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-xgi-1.6.1.tar.bz2
-mirror://xorg/individual/font/encodings-1.0.7.tar.xz
+mirror://xorg/individual/font/encodings-1.1.0.tar.xz
 mirror://xorg/individual/font/font-adobe-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-adobe-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-adobe-utopia-75dpi-1.0.5.tar.xz
@@ -167,21 +167,21 @@ mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 mirror://xorg/individual/lib/libAppleWM-1.4.1.tar.bz2
 mirror://xorg/individual/lib/libdmx-1.1.5.tar.xz
-mirror://xorg/individual/lib/libfontenc-1.1.7.tar.xz
+mirror://xorg/individual/lib/libfontenc-1.1.8.tar.xz
 mirror://xorg/individual/lib/libFS-1.0.9.tar.xz
 mirror://xorg/individual/lib/libICE-1.1.1.tar.xz
-mirror://xorg/individual/lib/libpciaccess-0.18.tar.xz
+mirror://xorg/individual/lib/libpciaccess-0.18.1.tar.xz
 mirror://xorg/individual/lib/libSM-1.2.4.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.8.7.tar.xz
+mirror://xorg/individual/lib/libX11-1.8.9.tar.xz
 mirror://xorg/individual/lib/libXau-1.0.11.tar.xz
-mirror://xorg/individual/lib/libXaw-1.0.15.tar.xz
-mirror://xorg/individual/lib/libxcb-1.16.tar.xz
+mirror://xorg/individual/lib/libXaw-1.0.16.tar.xz
+mirror://xorg/individual/lib/libxcb-1.17.0.tar.xz
 mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz
 mirror://xorg/individual/lib/libXcursor-1.2.2.tar.xz
 mirror://xorg/individual/lib/libxcvt-0.1.2.tar.xz
 mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz
-mirror://xorg/individual/lib/libXdmcp-1.1.4.tar.xz
+mirror://xorg/individual/lib/libXdmcp-1.1.5.tar.xz
 mirror://xorg/individual/lib/libXext-1.3.6.tar.xz
 mirror://xorg/individual/lib/libXfixes-6.0.1.tar.xz
 mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2
@@ -190,7 +190,7 @@ mirror://xorg/individual/lib/libXft-2.3.8.tar.xz
 mirror://xorg/individual/lib/libXi-1.8.1.tar.xz
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
-mirror://xorg/individual/lib/libXmu-1.1.4.tar.xz
+mirror://xorg/individual/lib/libXmu-1.2.1.tar.xz
 mirror://xorg/individual/lib/libXp-1.0.4.tar.xz
 mirror://xorg/individual/lib/libXpm-3.5.17.tar.xz
 mirror://xorg/individual/lib/libXpresent-1.0.1.tar.xz
@@ -209,13 +209,13 @@ mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.5.tar.xz
 mirror://xorg/individual/lib/xcb-util-cursor-0.1.5.tar.xz
 mirror://xorg/individual/lib/xtrans-1.5.0.tar.xz
-mirror://xorg/individual/proto/xcb-proto-1.16.0.tar.xz
-mirror://xorg/individual/proto/xorgproto-2023.2.tar.xz
+mirror://xorg/individual/proto/xcb-proto-1.17.0.tar.xz
+mirror://xorg/individual/proto/xorgproto-2024.1.tar.xz
 mirror://xorg/individual/util/bdftopcf-1.1.1.tar.xz
-mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
+mirror://xorg/individual/util/gccmakedep-1.0.4.tar.xz
 mirror://xorg/individual/util/imake-1.0.10.tar.xz
-mirror://xorg/individual/util/lndir-1.0.4.tar.xz
+mirror://xorg/individual/util/lndir-1.0.5.tar.xz
 mirror://xorg/individual/util/makedepend-1.0.9.tar.xz
-mirror://xorg/individual/util/util-macros-1.20.0.tar.xz
+mirror://xorg/individual/util/util-macros-1.20.1.tar.xz
 mirror://xorg/individual/util/xorg-cf-files-1.0.8.tar.xz
 mirror://xorg/individual/xserver/xorg-server-21.1.13.tar.xz
diff --git a/pkgs/servers/x11/xorg/update.py b/pkgs/servers/x11/xorg/update.py
new file mode 100755
index 0000000000000..6928837c76fa3
--- /dev/null
+++ b/pkgs/servers/x11/xorg/update.py
@@ -0,0 +1,116 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure --keep NIX_PATH -i python3 -p nix git "python3.withPackages (ps: [ ps. packaging ps.beautifulsoup4 ps.requests ])"
+
+# Usage: Run ./update.py from the directory containing tarballs.list. The script checks for the
+# latest versions of all packages, updates the expressions if any update is found, and commits
+# any changes.
+
+import subprocess
+
+import requests
+from bs4 import BeautifulSoup
+from packaging import version
+
+mirror = "mirror://xorg/"
+allversions = {}
+
+print("Downloading latest version info...")
+
+# xorg packages
+for component in [
+    "individual/app",
+    "individual/data",
+    "individual/data/xkeyboard-config",
+    "individual/doc",
+    "individual/driver",
+    "individual/font",
+    "individual/lib",
+    "individual/proto",
+    "individual/util",
+    "individual/xcb",
+    "individual/xserver",
+]:
+    url = "https://xorg.freedesktop.org/releases/{}/".format(component)
+    r = requests.get(url)
+    soup = BeautifulSoup(r.text, "html.parser")
+    for a in soup.table.find_all("a"):
+        href = a["href"]
+        if not href.endswith((".tar.bz2", ".tar.gz", ".tar.xz")):
+            continue
+
+        pname, rem = href.rsplit("-", 1)
+        ver, _, ext = rem.rsplit(".", 2)
+
+        if "rc" in ver:
+            continue
+
+        entry = allversions.setdefault(f"{mirror}{component}/{pname}", ([], {}))
+        entry[0].append(version.parse(ver))
+        entry[1][ver] = f"{mirror}{component}/{href}"
+
+# luit
+lurl = "https://invisible-mirror.net/archives/luit/"
+r = requests.get(lurl)
+soup = BeautifulSoup(r.text, "html.parser")
+for a in soup.find_all("a"):
+    href = a["href"]
+
+    if not href.endswith(".tgz"):
+        continue
+
+    pname, rem = href.rsplit("-", 1)
+    ver, _ = rem.rsplit(".", 1)
+
+    entry = allversions.setdefault(f"{lurl}{pname}", ([], {}))
+    entry[0].append(version.parse(ver))
+    entry[1][ver] = f"{lurl}{href}"
+
+print("Finding updated versions...")
+
+with open("./tarballs.list") as f:
+    lines_tarballs = f.readlines()
+
+updated_tarballs = []
+changes = {}
+changes_text = []
+for line in lines_tarballs:
+    line = line.rstrip("\n")
+
+    if any(line.startswith(frag) for frag in [mirror, lurl]):
+        pname, rem = line.rsplit("-", 1)
+        if line.startswith(mirror):
+            ver, _, _ = rem.rsplit(".", 2)
+        else:
+            ver, _ = rem.rsplit(".", 1)
+
+        if pname not in allversions:
+            print("# WARNING: no version found for {}".format(pname))
+            continue
+
+        highest = max(allversions[pname][0])
+        if highest > version.parse(ver):
+            line = allversions[pname][1][str(highest)]
+            text = f"{pname.split('/')[-1]}: {ver} -> {str(highest)}"
+            print(f"    Updating {text}")
+            changes[pname] = line
+            changes_text.append(text)
+
+    updated_tarballs.append(line)
+
+if len(changes) == 0:
+    print("No updates found")
+    exit()
+
+print("Updating tarballs.list...")
+
+with open("./tarballs.list", "w") as f:
+    f.writelines(f'{tarball}\n' for tarball in updated_tarballs)
+
+print("Generating updated expr (slow)...")
+
+subprocess.run(["./generate-expr-from-tarballs.pl", "tarballs.list"], check=True)
+
+print("Committing...")
+
+subprocess.run(["git", "add", "default.nix", "tarballs.list"], check=True)
+subprocess.run(["git", "commit", "-mxorg.*: update\n\n%s" % "\n".join(changes_text)], check=True)
diff --git a/pkgs/shells/zsh/spaceship-prompt/default.nix b/pkgs/shells/zsh/spaceship-prompt/default.nix
index 6a3bd0b3e5536..a9c6cb60df413 100644
--- a/pkgs/shells/zsh/spaceship-prompt/default.nix
+++ b/pkgs/shells/zsh/spaceship-prompt/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "spaceship-prompt";
-  version = "4.15.1";
+  version = "4.15.2";
 
   src = fetchFromGitHub {
     owner = "denysdovhan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5nlku/JUs1YnchOGvsle7rF96b3DteMuxZhSzoNvDGY=";
+    sha256 = "sha256-T5tilMwRc0vbj6Cq3xSf9Q77UfX2aQ+Y1RdkYtzD0k8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 1214d01013838..af68bf890ed29 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -413,25 +413,28 @@ else let
       requiredSystemFeatures = attrs.requiredSystemFeatures or [] ++ [ "gccarch-${stdenv.hostPlatform.gcc.arch}" ];
     } // optionalAttrs (stdenv.buildPlatform.isDarwin) (
       let
+        allDependencies = concatLists (concatLists dependencies);
+        allPropagatedDependencies = concatLists (concatLists propagatedDependencies);
+
         computedSandboxProfile =
           concatMap (input: input.__propagatedSandboxProfile or [])
             (stdenv.extraNativeBuildInputs
             ++ stdenv.extraBuildInputs
-            ++ concatLists dependencies);
+            ++ allDependencies);
 
         computedPropagatedSandboxProfile =
           concatMap (input: input.__propagatedSandboxProfile or [])
-            (concatLists propagatedDependencies);
+            allPropagatedDependencies;
 
         computedImpureHostDeps =
           unique (concatMap (input: input.__propagatedImpureHostDeps or [])
             (stdenv.extraNativeBuildInputs
             ++ stdenv.extraBuildInputs
-            ++ concatLists dependencies));
+            ++ allDependencies));
 
         computedPropagatedImpureHostDeps =
           unique (concatMap (input: input.__propagatedImpureHostDeps or [])
-            (concatLists propagatedDependencies));
+            allPropagatedDependencies);
     in {
       inherit __darwinAllowLocalNetworking;
       # TODO: remove `unique` once nix has a list canonicalization primitive
diff --git a/pkgs/tools/X11/arandr/default.nix b/pkgs/tools/X11/arandr/default.nix
index 2535f467771c6..996a5888e836f 100644
--- a/pkgs/tools/X11/arandr/default.nix
+++ b/pkgs/tools/X11/arandr/default.nix
@@ -4,7 +4,7 @@
 , gobject-introspection
 , gsettings-desktop-schemas
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , xrandr
 }:
 
@@ -28,7 +28,7 @@ buildPythonApplication rec {
   doCheck = false;
 
   buildInputs = [ docutils gsettings-desktop-schemas gtk3 ];
-  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+  nativeBuildInputs = [ gobject-introspection wrapGAppsHook3 ];
   propagatedBuildInputs = [ xrandr pygobject3 ];
 
   meta = with lib; {
diff --git a/pkgs/tools/X11/caffeine-ng/default.nix b/pkgs/tools/X11/caffeine-ng/default.nix
index 90292e8beda9d..480f4b6e36e9e 100644
--- a/pkgs/tools/X11/caffeine-ng/default.nix
+++ b/pkgs/tools/X11/caffeine-ng/default.nix
@@ -13,7 +13,7 @@
 , xautolock
 , xscreensaver
 , xfce
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -29,7 +29,7 @@ python3Packages.buildPythonApplication rec {
     sha256 = "sha256-uYzLRZ+6ZgIwhSuJWRBpLYHgonX7sFXgUZid0V26V0Q=";
   };
 
-  nativeBuildInputs = [ gobject-introspection meson ninja pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ gobject-introspection meson ninja pkg-config wrapGAppsHook3 ];
 
   buildInputs = [
     libayatana-appindicator
diff --git a/pkgs/tools/X11/obconf/default.nix b/pkgs/tools/X11/obconf/default.nix
index f4f9fd433fdea..02fe2663b0029 100644
--- a/pkgs/tools/X11/obconf/default.nix
+++ b/pkgs/tools/X11/obconf/default.nix
@@ -3,7 +3,7 @@
 , fetchgit
 , autoreconfHook
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , imlib2
 , libSM
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/X11/opentabletdriver/default.nix b/pkgs/tools/X11/opentabletdriver/default.nix
index 9f39fb7fb5c0a..702b4aa679302 100644
--- a/pkgs/tools/X11/opentabletdriver/default.nix
+++ b/pkgs/tools/X11/opentabletdriver/default.nix
@@ -11,7 +11,7 @@
 , copyDesktopItems
 , makeDesktopItem
 , nixosTests
-, wrapGAppsHook
+, wrapGAppsHook3
 , jq
 , coreutils
 }:
@@ -40,7 +40,7 @@ buildDotnetModule rec {
 
   nativeBuildInputs = [
     copyDesktopItems
-    wrapGAppsHook
+    wrapGAppsHook3
     # Dependency of generate-rules.sh
     jq
   ];
diff --git a/pkgs/tools/X11/wpgtk/default.nix b/pkgs/tools/X11/wpgtk/default.nix
index 371642cbfa7e3..bbc0e75d88112 100644
--- a/pkgs/tools/X11/wpgtk/default.nix
+++ b/pkgs/tools/X11/wpgtk/default.nix
@@ -1,5 +1,5 @@
 { lib, python3Packages, fetchFromGitHub, libxslt,
-  gobject-introspection, gtk3, wrapGAppsHook, gnome }:
+  gobject-introspection, gtk3, wrapGAppsHook3, gnome }:
 
 python3Packages.buildPythonApplication rec {
   pname = "wpgtk";
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gtk3
     gnome.adwaita-icon-theme
     libxslt
diff --git a/pkgs/tools/X11/xborders/default.nix b/pkgs/tools/X11/xborders/default.nix
index 379f976acf451..a9fa6318dffbf 100644
--- a/pkgs/tools/X11/xborders/default.nix
+++ b/pkgs/tools/X11/xborders/default.nix
@@ -4,7 +4,7 @@
 , libwnck
 , gtk3
 , libnotify
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , substituteAll
 }:
@@ -27,7 +27,7 @@ python3Packages.buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index e77273c6084c6..24b137eda052d 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -4,7 +4,7 @@
 , pkg-config
 , runCommand
 , writeText
-, wrapGAppsHook
+, wrapGAppsHook3
 , withNvenc ? false
 , atk
 , cairo
@@ -89,7 +89,7 @@ in buildPythonApplication rec {
   nativeBuildInputs = [
     gobject-introspection
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     pandoc
   ] ++ lib.optional withNvenc cudatoolkit;
 
diff --git a/pkgs/tools/archivers/xarchiver/default.nix b/pkgs/tools/archivers/xarchiver/default.nix
index b8ab9827cbd9a..c41a6010ef6f4 100644
--- a/pkgs/tools/archivers/xarchiver/default.nix
+++ b/pkgs/tools/archivers/xarchiver/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, gtk3, pkg-config, intltool, libxslt, makeWrapper,
-  coreutils, zip, unzip, p7zip, unar, gnutar, bzip2, gzip, lhasa, wrapGAppsHook }:
+  coreutils, zip, unzip, p7zip, unar, gnutar, bzip2, gzip, lhasa, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   version = "0.5.4.23";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-aNUpuePU6nmrralp+j8GgVPuxv9ayRVoKicPZkC4nTE=";
   };
 
-  nativeBuildInputs = [ intltool pkg-config makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ intltool pkg-config makeWrapper wrapGAppsHook3 ];
   buildInputs = [ gtk3 libxslt ];
 
   postFixup = ''
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index ef916f88e4fa8..a26e3de521e20 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2024.03.21";
+  version = "2024.04.30";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    hash = "sha256-tK7+09vCZXj79jEY3Zxz1cdt5UdfOVy4gjqewdAMiP4=";
+    hash = "sha256-Yw/EQZlGTYxouRL1Tf4TDSNWMleB7vKzWg4n6sw5d4Q=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index 1e552d64cfaa2..b761962b176e3 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, makeWrapper, alsa-lib, pkg-config, fetchFromGitHub, gtk3, gnome, gdk-pixbuf, librsvg, wrapGAppsHook }:
+{ lib, stdenv, makeWrapper, alsa-lib, pkg-config, fetchFromGitHub, gtk3, gnome, gdk-pixbuf, librsvg, wrapGAppsHook3 }:
 
 stdenv.mkDerivation {
   pname = "gvolicon";
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config makeWrapper ];
   buildInputs = [
     alsa-lib gtk3 gdk-pixbuf gnome.adwaita-icon-theme
-    librsvg wrapGAppsHook
+    librsvg wrapGAppsHook3
   ];
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/tools/audio/headset-charge-indicator/default.nix b/pkgs/tools/audio/headset-charge-indicator/default.nix
index 40005ea9a6e16..d365b4a5c6737 100644
--- a/pkgs/tools/audio/headset-charge-indicator/default.nix
+++ b/pkgs/tools/audio/headset-charge-indicator/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, headsetcontrol, wrapGAppsHook, python3, gtk3
+{ lib, stdenv, fetchFromGitHub, headsetcontrol, wrapGAppsHook3, python3, gtk3
 , gobject-introspection, libayatana-appindicator }:
 
 stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-eaAbqeFY+B3CcKJywC3vaRsWZNQENTbALc7L7uW0W6U=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
 
   buildInputs = [
     (python3.withPackages (ps: with ps; [ pygobject3 ]))
diff --git a/pkgs/tools/audio/mictray/default.nix b/pkgs/tools/audio/mictray/default.nix
index d93423e66b491..f53ae6c48d0e3 100644
--- a/pkgs/tools/audio/mictray/default.nix
+++ b/pkgs/tools/audio/mictray/default.nix
@@ -9,7 +9,7 @@
 , pulseaudio
 , stdenv
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/audio/mpdris2/default.nix b/pkgs/tools/audio/mpdris2/default.nix
index fd4b60f13e05d..bb050788f85ac 100644
--- a/pkgs/tools/audio/mpdris2/default.nix
+++ b/pkgs/tools/audio/mpdris2/default.nix
@@ -6,7 +6,7 @@
 , intltool
 , libnotify
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -29,7 +29,7 @@ python3.pkgs.buildPythonApplication rec {
     autoreconfHook
     gobject-introspection
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/audio/pasystray/default.nix b/pkgs/tools/audio/pasystray/default.nix
index 20708e82729dc..c89e1a208153a 100644
--- a/pkgs/tools/audio/pasystray/default.nix
+++ b/pkgs/tools/audio/pasystray/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchpatch, fetchFromGitHub, pkg-config, autoreconfHook, wrapGAppsHook
+{ lib, stdenv, fetchpatch, fetchFromGitHub, pkg-config, autoreconfHook, wrapGAppsHook3
 , gnome, avahi, gtk3, libayatana-appindicator, libnotify, libpulseaudio
 , gsettings-desktop-schemas
 }:
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     })
    ];
 
-  nativeBuildInputs = [ pkg-config autoreconfHook wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config autoreconfHook wrapGAppsHook3 ];
   buildInputs = [
     gnome.adwaita-icon-theme
     avahi gtk3 libayatana-appindicator libnotify libpulseaudio
diff --git a/pkgs/tools/audio/volctl/default.nix b/pkgs/tools/audio/volctl/default.nix
index 0d33c586ed375..3e1cdf56acace 100644
--- a/pkgs/tools/audio/volctl/default.nix
+++ b/pkgs/tools/audio/volctl/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3Packages, fetchFromGitHub, wrapGAppsHook, gobject-introspection, libpulseaudio, glib, gtk3, pango, xorg }:
+{ lib, python3Packages, fetchFromGitHub, wrapGAppsHook3, gobject-introspection, libpulseaudio, glib, gtk3, pango, xorg }:
 
 python3Packages.buildPythonApplication rec {
   pname = "volctl";
@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [ pango gtk3 ] ++ (with python3Packages; [
diff --git a/pkgs/tools/bluetooth/blueberry/default.nix b/pkgs/tools/bluetooth/blueberry/default.nix
index 63845045c06b6..91305ec880d97 100644
--- a/pkgs/tools/bluetooth/blueberry/default.nix
+++ b/pkgs/tools/bluetooth/blueberry/default.nix
@@ -9,7 +9,7 @@
 , pavucontrol
 , python3Packages
 , util-linux
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     gobject-introspection
     python3Packages.wrapPython
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/bluetooth/blueman/default.nix b/pkgs/tools/bluetooth/blueman/default.nix
index fb300a45fb547..0266198b1debf 100644
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@@ -1,6 +1,6 @@
 { config, stdenv, lib, fetchurl, intltool, pkg-config, python3Packages, bluez, gtk3
 , obex_data_server, xdg-utils, dnsmasq, dhcpcd, iproute2
-, gnome, librsvg, wrapGAppsHook, gobject-introspection
+, gnome, librsvg, wrapGAppsHook3, gobject-introspection
 , networkmanager, withPulseAudio ? config.pulseaudio or stdenv.isLinux, libpulseaudio }:
 
 let
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     gobject-introspection intltool pkg-config pythonPackages.cython
-    pythonPackages.wrapPython wrapGAppsHook
+    pythonPackages.wrapPython wrapGAppsHook3
   ];
 
   buildInputs = [ bluez gtk3 pythonPackages.python librsvg
diff --git a/pkgs/tools/cd-dvd/brasero/default.nix b/pkgs/tools/cd-dvd/brasero/default.nix
index fb57e2d7decb4..5ee15304968b0 100644
--- a/pkgs/tools/cd-dvd/brasero/default.nix
+++ b/pkgs/tools/cd-dvd/brasero/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, pkg-config, gtk3, itstool, gst_all_1, libxml2, libnotify
 , libcanberra-gtk3, intltool, dvdauthor, libburn, libisofs
-, vcdimager, wrapGAppsHook, hicolor-icon-theme }:
+, vcdimager, wrapGAppsHook3, hicolor-icon-theme }:
 
 let
   major = "3.12";
@@ -16,7 +16,7 @@ in stdenv.mkDerivation rec {
     hash = "sha256-h3SerjOhQSB9GwC+IzttgEWYLtMkntS5ja4fOpdf6hU=";
   };
 
-  nativeBuildInputs = [ pkg-config itstool intltool wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config itstool intltool wrapGAppsHook3 ];
 
   buildInputs = [ gtk3 libxml2 libnotify libcanberra-gtk3 libburn libisofs
                   hicolor-icon-theme
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A Gnome CD/DVD Burner";
-    homepage = "https://wiki.gnome.org/Apps/Brasero";
+    homepage = "https://gitlab.gnome.org/GNOME/brasero";
     maintainers = [ maintainers.bdimcheff ];
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/tools/compression/flips/default.nix b/pkgs/tools/compression/flips/default.nix
index e061459ece269..81fe0170aeb30 100644
--- a/pkgs/tools/compression/flips/default.nix
+++ b/pkgs/tools/compression/flips/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, gtk3, libdivsufsort, pkg-config, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, gtk3, libdivsufsort, pkg-config, wrapGAppsHook3 }:
 
 stdenv.mkDerivation {
   pname = "flips";
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     hash = "sha256-uuHgpt7aWqiMTUILm5tAEGGeZrls3g/DdylYQgsfpTw=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = [ gtk3 libdivsufsort ];
   patches = [ ./use-system-libdivsufsort.patch ];
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
diff --git a/pkgs/tools/games/minecraft/mcaselector/default.nix b/pkgs/tools/games/minecraft/mcaselector/default.nix
index cbd0ce7036a1a..4d8127b36265a 100644
--- a/pkgs/tools/games/minecraft/mcaselector/default.nix
+++ b/pkgs/tools/games/minecraft/mcaselector/default.nix
@@ -2,7 +2,7 @@
 , stdenvNoCC
 , fetchurl
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , jre
 }:
 
@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   dontUnpack = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ jre makeWrapper wrapGAppsHook ];
+  nativeBuildInputs = [ jre makeWrapper wrapGAppsHook3 ];
 
   dontWrapGApps = true;
 
diff --git a/pkgs/tools/games/mymcplus/default.nix b/pkgs/tools/games/mymcplus/default.nix
index c94ef8768c07e..7a3c49fac7506 100644
--- a/pkgs/tools/games/mymcplus/default.nix
+++ b/pkgs/tools/games/mymcplus/default.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchFromSourcehut
 , pythonPackages
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 pythonPackages.buildPythonApplication rec {
@@ -16,7 +16,7 @@ pythonPackages.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = with pythonPackages; [
diff --git a/pkgs/tools/games/opentracker/default.nix b/pkgs/tools/games/opentracker/default.nix
index 5bab19fa2ad97..d1c988876c5fb 100644
--- a/pkgs/tools/games/opentracker/default.nix
+++ b/pkgs/tools/games/opentracker/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   buildDotnetModule,
   fetchFromGitHub,
-  wrapGAppsHook,
+  wrapGAppsHook3,
   dotnetCorePackages,
   fontconfig,
   gtk3,
@@ -39,7 +39,7 @@ buildDotnetModule rec {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/games/scarab/default.nix b/pkgs/tools/games/scarab/default.nix
index c71502b7f5062..11ec9e7cdd027 100644
--- a/pkgs/tools/games/scarab/default.nix
+++ b/pkgs/tools/games/scarab/default.nix
@@ -10,7 +10,7 @@
 , gtk3
 , copyDesktopItems
 , icoutils
-, wrapGAppsHook
+, wrapGAppsHook3
 , makeDesktopItem
 }:
 
@@ -46,7 +46,7 @@ buildDotnetModule rec {
   nativeBuildInputs = [
     copyDesktopItems
     icoutils
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   postFixup = ''
diff --git a/pkgs/tools/games/ukmm/default.nix b/pkgs/tools/games/ukmm/default.nix
index aa5469472d85a..f76613ed4a571 100644
--- a/pkgs/tools/games/ukmm/default.nix
+++ b/pkgs/tools/games/ukmm/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , libglvnd
 , nix-update-script
 }:
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   preFixup = ''
diff --git a/pkgs/tools/graphics/agi/default.nix b/pkgs/tools/graphics/agi/default.nix
index 501522b27ea3c..27b5c7ca59fa1 100644
--- a/pkgs/tools/graphics/agi/default.nix
+++ b/pkgs/tools/graphics/agi/default.nix
@@ -5,7 +5,7 @@
 , makeWrapper
 , makeDesktopItem
 , copyDesktopItems
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , gdk-pixbuf
 , jre
@@ -22,7 +22,7 @@ stdenvNoCC.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gdk-pixbuf
     gobject-introspection
     autoPatchelfHook
diff --git a/pkgs/tools/graphics/escrotum/default.nix b/pkgs/tools/graphics/escrotum/default.nix
index c2e5a7ec9a719..6cbd793daf2ed 100644
--- a/pkgs/tools/graphics/escrotum/default.nix
+++ b/pkgs/tools/graphics/escrotum/default.nix
@@ -3,7 +3,7 @@
 , gtk3
 , pango
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 with python3Packages; buildPythonApplication {
@@ -24,7 +24,7 @@ with python3Packages; buildPythonApplication {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [ pygobject3 xcffib pycairo numpy ];
diff --git a/pkgs/tools/graphics/gromit-mpx/default.nix b/pkgs/tools/graphics/gromit-mpx/default.nix
index 7fdbe3b13f64b..433c11d95628d 100644
--- a/pkgs/tools/graphics/gromit-mpx/default.nix
+++ b/pkgs/tools/graphics/gromit-mpx/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config
 , gtk, glib, pcre, libappindicator, libpthreadstubs, xorg
 , libxkbcommon, libepoxy, at-spi2-core, dbus, libdbusmenu
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-olDQGw0qDWwXpqRopVoEPDXLRpFiiBo+/jiVeL7R6QA=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 ];
   buildInputs = [
     gtk glib pcre libappindicator libpthreadstubs
     xorg.libXdmcp libxkbcommon libepoxy at-spi2-core
diff --git a/pkgs/tools/graphics/icoutils/default.nix b/pkgs/tools/graphics/icoutils/default.nix
index b450537b5a428..0e22fe72c5941 100644
--- a/pkgs/tools/graphics/icoutils/default.nix
+++ b/pkgs/tools/graphics/icoutils/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libpng, perl, perlPackages, makeWrapper }:
+{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, libpng, perl, perlPackages, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "icoutils";
@@ -9,7 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "1q66cksms4l62y0wizb8vfavhmf7kyfgcfkynil3n99s0hny1aqp";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  patches = [
+    # Fixes a linker failure with newer versions of ld64 due to not supporting nested archives.
+    (fetchpatch {
+      url = "https://git.savannah.nongnu.org/cgit/icoutils.git/patch/?id=aa3572119bfe34484025f37dbbc4d5070f735908";
+      hash = "sha256-4YCI+SYT2bCBNegkpN5jcfi6gOeec65TmCABr98HHB4=";
+    })
+  ];
+
+  nativeBuildInputs = [ autoreconfHook makeWrapper ];
   buildInputs = [ libpng perl ];
   propagatedBuildInputs = [ perlPackages.LWP ];
 
@@ -17,7 +25,7 @@ stdenv.mkDerivation rec {
   # upgrades to a newer SDK.
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-DTARGET_OS_IPHONE=0";
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs extresso/extresso
     patchShebangs extresso/extresso.in
     patchShebangs extresso/genresscript
diff --git a/pkgs/tools/graphics/pdftag/default.nix b/pkgs/tools/graphics/pdftag/default.nix
index 90b8dde05f37c..d5efffd9f11ac 100644
--- a/pkgs/tools/graphics/pdftag/default.nix
+++ b/pkgs/tools/graphics/pdftag/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, meson, vala, ninja
-, gtk3, poppler, wrapGAppsHook }:
+, gtk3, poppler, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "pdftag";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1paj8hs27akzsivn01a30fl3zx5gfn1h89wxg2m72fd806hk0hql";
   };
 
-  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook vala ];
+  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook3 vala ];
   buildInputs = [ gtk3 poppler ];
 
   meta = with lib; {
diff --git a/pkgs/tools/graphics/wdisplays/default.nix b/pkgs/tools/graphics/wdisplays/default.nix
index 9c7093b58f85e..74998fe0fb79f 100644
--- a/pkgs/tools/graphics/wdisplays/default.nix
+++ b/pkgs/tools/graphics/wdisplays/default.nix
@@ -1,10 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, gtk3, libepoxy, wayland, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, gtk3, libepoxy, wayland, wrapGAppsHook3 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wdisplays";
   version = "1.1.1";
 
-  nativeBuildInputs = [ meson ninja pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja pkg-config wrapGAppsHook3 ];
 
   buildInputs = [ gtk3 libepoxy wayland ];
 
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index e44f46a19a16b..c3429069d2037 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -10,7 +10,7 @@
 , qtbase
 , qtx11extras
 , wrapQtAppsHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , xmlto
 , docbook_xsl
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
     docbook_xsl
   ] ++ lib.optionals enableVideo [
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
     qtbase
   ];
diff --git a/pkgs/tools/inputmethods/emote/default.nix b/pkgs/tools/inputmethods/emote/default.nix
index 6c2e4962a9965..10e66f1d33b3c 100644
--- a/pkgs/tools/inputmethods/emote/default.nix
+++ b/pkgs/tools/inputmethods/emote/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, python3Packages, wrapGAppsHook, gobject-introspection, keybinder3, xdotool }:
+{ lib, fetchFromGitHub, python3Packages, wrapGAppsHook3, gobject-introspection, keybinder3, xdotool }:
 
 python3Packages.buildPythonApplication rec {
   pname = "emote";
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication rec {
   '';
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix
index 0107e87558809..e7a5f4b1e16db 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix
@@ -2,7 +2,7 @@
 , fetchurl
 , gettext
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , anthy
 , ibus
 , glib
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     gettext
     gobject-introspection
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   configureFlags = [
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-bamboo/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-bamboo/default.nix
index 95ad99ca8fd57..286539174a95a 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-bamboo/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-bamboo/default.nix
@@ -4,7 +4,7 @@
 , gettext
 , xorg
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , go
 }:
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     gettext
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     go
   ];
 
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-cangjie/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-cangjie/default.nix
index 0e5233ad8b6f7..7c59754d2e626 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-cangjie/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-cangjie/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , gettext
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , ibus
 , glib
 , gobject-introspection
@@ -50,7 +50,7 @@ stdenv.mkDerivation {
     gettext
     gobject-introspection
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   # Upstream builds Python packages as a part of a non-python
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
index 9c338f71698eb..13895e3c72fc8 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
@@ -4,7 +4,7 @@
 , appstream-glib
 , gettext
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , ibus
 , libhangul
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ibus-hangul";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchurl {
-    url = "https://github.com/choehwanjin/ibus-hangul/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1q6g2pnrn5gqn9jqnm3975v9hh60hc5gn9x3zbrdjgy0n3wpxwm9";
+    url = "https://github.com/libhangul/ibus-hangul/releases/download/${version}/${pname}-${version}.tar.xz";
+    sha256 = "sha256-parIgobNGJYCKYYOPhp3iXinrqpIStms+kgoS4f9w7s=";
   };
 
   patches = [
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     appstream-glib
     gettext
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     isIbusEngine = true;
     description = "Ibus Hangul engine";
     mainProgram = "ibus-setup-hangul";
-    homepage = "https://github.com/choehwanjin/ibus-hangul";
+    homepage = "https://github.com/libhangul/ibus-hangul";
     license = licenses.gpl2;
     maintainers = with maintainers; [ ericsagnes ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
index b00ca264bc15e..b7052092bc6ba 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
@@ -4,7 +4,7 @@
 , autoreconfHook
 , gettext
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , sqlite
 , libpinyin
 , db
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
     gettext
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   configureFlags = [
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
index f2b2b3b305112..73f6022183287 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
@@ -8,7 +8,7 @@
 , m17n_db
 , gettext
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
     gettext
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
index 7b277e76ecb50..fedcbdc4c96e2 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub
 , autoreconfHook, docbook2x, pkg-config
 , gtk3, dconf, gobject-introspection
-, ibus, python3, wrapGAppsHook }:
+, ibus, python3, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "ibus-table";
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     docbook2x
     pkg-config
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   postUnpack = ''
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
index 4be1726095cab..8bfb1552775ee 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, python3, ibus, pkg-config, gtk3, m17n_lib
-, wrapGAppsHook, gobject-introspection
+, wrapGAppsHook3, gobject-introspection
 }:
 
 let
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-CZqtjiBTvnTvTf1AUd0IWINSQo4iOaJkBFT2YFsqTvI=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook3 gobject-introspection ];
   buildInputs = [ python ibus gtk3 m17n_lib ];
 
   preFixup = ''
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-uniemoji/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-uniemoji/default.nix
index 4c202939e7222..9ec45c65ee680 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-uniemoji/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-uniemoji/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
 , fetchFromGitHub
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , python3
 , ibus
 }:
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
 
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index 5de2fc67d0203..2acd97cbab7c8 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -7,7 +7,7 @@
 , makeWrapper
 , pkg-config
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , dbus
 , systemd
 , dconf ? null
@@ -125,7 +125,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3BuildEnv
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     dbus-launch
     gobject-introspection
   ];
diff --git a/pkgs/tools/inputmethods/input-remapper/default.nix b/pkgs/tools/inputmethods/input-remapper/default.nix
index 04f8c7f74c151..eb1c9dedd38df 100644
--- a/pkgs/tools/inputmethods/input-remapper/default.nix
+++ b/pkgs/tools/inputmethods/input-remapper/default.nix
@@ -1,6 +1,6 @@
 { lib
 , pkgconfig
-, wrapGAppsHook
+, wrapGAppsHook3
 , gettext
 , gtk3
 , glib
@@ -88,7 +88,7 @@ in
       python tests/test.py --start-dir unit
   '';
 
-  # Nixpkgs 15.9.4.3. When using wrapGAppsHook with special derivers you can end up with double wrapped binaries.
+  # Nixpkgs 15.9.4.3. When using wrapGAppsHook3 with special derivers you can end up with double wrapped binaries.
   dontWrapGApps = true;
   preFixup = ''
     makeWrapperArgs+=(
@@ -98,7 +98,7 @@ in
   '';
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gettext # needed to build translations
     gtk3
     glib
diff --git a/pkgs/tools/llm/shell_gpt/default.nix b/pkgs/tools/llm/shell_gpt/default.nix
deleted file mode 100644
index 4db72ae505864..0000000000000
--- a/pkgs/tools/llm/shell_gpt/default.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ lib
-, python3
-, fetchPypi
-, nix-update-script
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "shell_gpt";
-  version = "1.4.3";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-zSgWSC60ypOQ1IENcxObBezAfHosQWBD9ft06yh5iV4=";
-  };
-
-  nativeBuildInputs = with python3.pkgs; [
-    python3.pkgs.pythonRelaxDepsHook
-    python3
-    pip
-  ];
-
-  propagatedBuildInputs = with python3.pkgs; [
-    markdown-it-py
-    rich
-    distro
-    typer
-    requests
-    hatchling
-    openai
-    instructor
-  ];
-
-  pythonRelaxDeps = [ "requests" "rich" "distro" "typer" ];
-
-  passthru.updateScript = nix-update-script { };
-
-  doCheck = false;
-
-  meta = with lib; {
-    mainProgram = "sgpt";
-    homepage = "https://github.com/TheR1D/shell_gpt";
-    description = "Access ChatGPT from your terminal";
-    platforms = platforms.unix;
-    license = licenses.mit;
-    maintainers = with maintainers; [ mglolenstine ];
-  };
-}
diff --git a/pkgs/tools/misc/alarm-clock-applet/default.nix b/pkgs/tools/misc/alarm-clock-applet/default.nix
index 525d65dd7e08a..85feb80700e6e 100644
--- a/pkgs/tools/misc/alarm-clock-applet/default.nix
+++ b/pkgs/tools/misc/alarm-clock-applet/default.nix
@@ -4,7 +4,7 @@
 , fetchpatch
 , cmake
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gst_all_1
 , libnotify
 , libayatana-appindicator
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/misc/archi/default.nix b/pkgs/tools/misc/archi/default.nix
index 23c5372e5eef6..b7d9f6b92293d 100644
--- a/pkgs/tools/misc/archi/default.nix
+++ b/pkgs/tools/misc/archi/default.nix
@@ -5,7 +5,7 @@
 , jdk
 , libsecret
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , _7zz
 , nixosTests
 }:
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     _7zz
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
diff --git a/pkgs/tools/misc/birdfont/default.nix b/pkgs/tools/misc/birdfont/default.nix
index aa8e9ac6a9e86..731eeb0513358 100644
--- a/pkgs/tools/misc/birdfont/default.nix
+++ b/pkgs/tools/misc/birdfont/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, python3, xmlbird,
 cairo, gdk-pixbuf, libgee, glib, gtk3, webkitgtk, libnotify, sqlite, vala,
-gobject-introspection, gsettings-desktop-schemas, wrapGAppsHook, autoPatchelfHook }:
+gobject-introspection, gsettings-desktop-schemas, wrapGAppsHook3, autoPatchelfHook }:
 
 stdenv.mkDerivation rec {
   pname = "birdfont";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-NNw7203BtHhNyyQezb3/EP98cTsu7ABDFBnM5Ms2ePY=";
   };
 
-  nativeBuildInputs = [ python3 pkg-config vala gobject-introspection wrapGAppsHook autoPatchelfHook ];
+  nativeBuildInputs = [ python3 pkg-config vala gobject-introspection wrapGAppsHook3 autoPatchelfHook ];
   buildInputs = [ xmlbird libgee cairo gdk-pixbuf glib gtk3 webkitgtk libnotify sqlite gsettings-desktop-schemas ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/clipster/default.nix b/pkgs/tools/misc/clipster/default.nix
index cad2c45063746..5c9c2cd1054ca 100644
--- a/pkgs/tools/misc/clipster/default.nix
+++ b/pkgs/tools/misc/clipster/default.nix
@@ -1,5 +1,5 @@
 {fetchFromGitHub , lib, stdenv, python3, gtk3, libwnck,
- gobject-introspection, wrapGAppsHook }:
+ gobject-introspection, wrapGAppsHook3 }:
 
 stdenv.mkDerivation  rec {
   pname = "clipster";
@@ -15,7 +15,7 @@ stdenv.mkDerivation  rec {
   pythonEnv = python3.withPackages(ps: with ps; [ pygobject3 ]);
 
   nativeBuildInputs = [ gobject-introspection ];
-  buildInputs =  [ pythonEnv gtk3 libwnck wrapGAppsHook ];
+  buildInputs =  [ pythonEnv gtk3 libwnck wrapGAppsHook3 ];
 
   installPhase = ''
     sed -i 's/python/python3/g' clipster
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 6d97581af26f6..c5ca89f54841d 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -282,13 +282,7 @@ python.pkgs.buildPythonApplication rec {
     "test_libmix_differences"
   ];
 
-  disabledTestPaths = [
-    # fails due to https://github.com/NixOS/nixpkgs/issues/256896
-    # should be removed once that issue is resolved in coreboot or diffoscope
-    "tests/comparators/test_cbfs.py"
-  ]
-  # Flaky tests on Darwin
-  ++ lib.optionals stdenv.isDarwin [
+  disabledTestPaths = lib.optionals stdenv.isDarwin [
     "tests/comparators/test_git.py"
     "tests/comparators/test_java.py"
     "tests/comparators/test_uimage.py"
diff --git a/pkgs/tools/misc/fsearch/default.nix b/pkgs/tools/misc/fsearch/default.nix
index a9e3b6caa3526..933daaf3df51a 100644
--- a/pkgs/tools/misc/fsearch/default.nix
+++ b/pkgs/tools/misc/fsearch/default.nix
@@ -8,7 +8,7 @@
 , meson
 , ninja
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gettext
 , icu
 }:
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gettext
   ];
 
diff --git a/pkgs/tools/misc/gaphor/default.nix b/pkgs/tools/misc/gaphor/default.nix
index 48f9fa7a7bba9..a8afdef6a2bff 100644
--- a/pkgs/tools/misc/gaphor/default.nix
+++ b/pkgs/tools/misc/gaphor/default.nix
@@ -4,7 +4,7 @@
 , copyDesktopItems
 , gobject-introspection
 , poetry-core
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtksourceview4
 , pango
 , gaphas
@@ -34,7 +34,7 @@ buildPythonApplication rec {
     copyDesktopItems
     gobject-introspection
     poetry-core
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -59,7 +59,7 @@ buildPythonApplication rec {
     desktopName = "Gaphor";
   };
 
-  # Disable automatic wrapGAppsHook to prevent double wrapping
+  # Disable automatic wrapGAppsHook3 to prevent double wrapping
   dontWrapGApps = true;
 
   postInstall = ''
diff --git a/pkgs/tools/misc/gparted/default.nix b/pkgs/tools/misc/gparted/default.nix
index 7c068656385df..d12babfddfafd 100644
--- a/pkgs/tools/misc/gparted/default.nix
+++ b/pkgs/tools/misc/gparted/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, gettext, coreutils, gnused, gnome
 , gnugrep, parted, glib, libuuid, pkg-config, gtkmm3, libxml2
-, gpart, hdparm, procps, util-linux, polkit, wrapGAppsHook, substituteAll
+, gpart, hdparm, procps, util-linux, polkit, wrapGAppsHook3, substituteAll
 , mtools, dosfstools
 }:
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--disable-doc" ];
 
   buildInputs = [ parted glib libuuid gtkmm3 libxml2 polkit.bin gnome.adwaita-icon-theme  ];
-  nativeBuildInputs = [ gettext pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ gettext pkg-config wrapGAppsHook3 ];
 
   preConfigure = ''
     # For ITS rules
diff --git a/pkgs/tools/misc/gpick/default.nix b/pkgs/tools/misc/gpick/default.nix
index 0d421212a3d44..c21759b00fea2 100644
--- a/pkgs/tools/misc/gpick/default.nix
+++ b/pkgs/tools/misc/gpick/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , fetchFromGitHub
 , cmake
-, wrapGAppsHook
+, wrapGAppsHook3
 , boost
 , pkg-config
 , gtk3
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 ];
   buildInputs = [ boost gtk3 ragel lua ];
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/gsmartcontrol/default.nix b/pkgs/tools/misc/gsmartcontrol/default.nix
index a1c163f6784e8..2b5878f7a638e 100644
--- a/pkgs/tools/misc/gsmartcontrol/default.nix
+++ b/pkgs/tools/misc/gsmartcontrol/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, smartmontools, autoreconfHook, gettext, gtkmm3, pkg-config, wrapGAppsHook, pcre-cpp, gnome }:
+{ fetchurl, lib, stdenv, smartmontools, autoreconfHook, gettext, gtkmm3, pkg-config, wrapGAppsHook3, pcre-cpp, gnome }:
 
 stdenv.mkDerivation rec {
   pname = "gsmartcontrol";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     substituteInPlace data/org.gsmartcontrol.policy --replace "/usr/sbin" $out/bin
   '';
 
-  nativeBuildInputs = [ autoreconfHook gettext pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook gettext pkg-config wrapGAppsHook3 ];
   buildInputs = [ gtkmm3 pcre-cpp gnome.adwaita-icon-theme ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/misc/gtkterm/default.nix b/pkgs/tools/misc/gtkterm/default.nix
index 85636afb9d380..ebd7ec388764e 100644
--- a/pkgs/tools/misc/gtkterm/default.nix
+++ b/pkgs/tools/misc/gtkterm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, meson, ninja, pkg-config, gtk3, vte, libgudev, wrapGAppsHook, pcre2 }:
+{ stdenv, lib, fetchFromGitHub, meson, ninja, pkg-config, gtk3, vte, libgudev, wrapGAppsHook3, pcre2 }:
 
 stdenv.mkDerivation rec {
   pname = "gtkterm";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/misc/gwe/default.nix b/pkgs/tools/misc/gwe/default.nix
index d889230ed228d..5f2c29c644d97 100644
--- a/pkgs/tools/misc/gwe/default.nix
+++ b/pkgs/tools/misc/gwe/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config
 , meson
 , ninja
@@ -51,7 +51,7 @@ in stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     pkg-config
     meson
     ninja
diff --git a/pkgs/tools/misc/hakuneko/default.nix b/pkgs/tools/misc/hakuneko/default.nix
index 0359da603ccbb..fbc76aa1eb90b 100644
--- a/pkgs/tools/misc/hakuneko/default.nix
+++ b/pkgs/tools/misc/hakuneko/default.nix
@@ -6,7 +6,7 @@
 , udev
 , stdenv
 , lib
-, wrapGAppsHook
+, wrapGAppsHook3
 , alsa-lib
 , nss
 , nspr
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     autoPatchelfHook
     dpkg
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/misc/hashit/default.nix b/pkgs/tools/misc/hashit/default.nix
index a7bcde7ab5fca..ecd7aaf5cdcc4 100644
--- a/pkgs/tools/misc/hashit/default.nix
+++ b/pkgs/tools/misc/hashit/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, nix-update-script, meson, ninja, pkg-config, vala, pantheon, python3, libgee, gtk3, desktop-file-utils, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, nix-update-script, meson, ninja, pkg-config, vala, pantheon, python3, libgee, gtk3, desktop-file-utils, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "hashit";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     vala
     pkg-config
     python3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/misc/jugglinglab/default.nix b/pkgs/tools/misc/jugglinglab/default.nix
index 64b91a68d9480..ee2f4cbfc7e5e 100644
--- a/pkgs/tools/misc/jugglinglab/default.nix
+++ b/pkgs/tools/misc/jugglinglab/default.nix
@@ -3,7 +3,7 @@
 , maven
 , fetchFromGitHub
 , makeWrapper
-, wrapGAppsHook
+, wrapGAppsHook3
 , jre
 }:
 
@@ -38,7 +38,7 @@ maven.buildMavenPackage rec {
 
   nativeBuildInputs = [
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/tools/misc/mongodb-compass/default.nix b/pkgs/tools/misc/mongodb-compass/default.nix
index e0c1097d183f0..6df35c2ea734f 100644
--- a/pkgs/tools/misc/mongodb-compass/default.nix
+++ b/pkgs/tools/misc/mongodb-compass/default.nix
@@ -28,7 +28,7 @@ nss,
 pango,
 stdenv,
 systemd,
-wrapGAppsHook,
+wrapGAppsHook3,
 xorg,
 }:
 
@@ -95,7 +95,7 @@ in stdenv.mkDerivation {
 
   inherit src;
 
-  buildInputs = [ dpkg wrapGAppsHook gtk3 ];
+  buildInputs = [ dpkg wrapGAppsHook3 gtk3 ];
   dontUnpack = true;
 
   buildCommand = ''
diff --git a/pkgs/tools/misc/moserial/default.nix b/pkgs/tools/misc/moserial/default.nix
index 8ac7091e003c2..0a708681b4095 100644
--- a/pkgs/tools/misc/moserial/default.nix
+++ b/pkgs/tools/misc/moserial/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Clean, friendly gtk-based serial terminal for the gnome desktop";
-    homepage = "https://wiki.gnome.org/moserial";
+    homepage = "https://gitlab.gnome.org/GNOME/moserial";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ linsui ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/misc/mutagen-compose/default.nix b/pkgs/tools/misc/mutagen-compose/default.nix
index fe8f2b06505d6..33358017f24a0 100644
--- a/pkgs/tools/misc/mutagen-compose/default.nix
+++ b/pkgs/tools/misc/mutagen-compose/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mutagen-compose";
-  version = "0.17.5";
+  version = "0.17.6";
 
   src = fetchFromGitHub {
     owner = "mutagen-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-EkUaxk+zCm1ta1/vjClZHki/MghLvUkCeiW7hST7WEc=";
+    hash = "sha256-ZcfwpEfdoSMCGtw5Icj1hXbk5CRYS4LBtdaiX62E4I0=";
   };
 
-  vendorHash = "sha256-siLS53YVQfCwqyuvXXvHFtlpr3RQy2GP2/ZV+Tv/Lqc=";
+  vendorHash = "sha256-XyWi06siSHOKZca0w4WLIFGM63wnF//2rRP4aH5rFAo=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/nautilus-open-any-terminal/default.nix b/pkgs/tools/misc/nautilus-open-any-terminal/default.nix
index b200731ab8f24..45716202878ff 100644
--- a/pkgs/tools/misc/nautilus-open-any-terminal/default.nix
+++ b/pkgs/tools/misc/nautilus-open-any-terminal/default.nix
@@ -9,7 +9,7 @@
 , gsettings-desktop-schemas
 , gtk3
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonPackage rec {
@@ -30,7 +30,7 @@ python3.pkgs.buildPythonPackage rec {
     glib
     gobject-introspection
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     python3.pkgs.setuptools
   ];
 
diff --git a/pkgs/tools/misc/parcellite/default.nix b/pkgs/tools/misc/parcellite/default.nix
index d39115fcecc9a..3c53be706641b 100644
--- a/pkgs/tools/misc/parcellite/default.nix
+++ b/pkgs/tools/misc/parcellite/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook
 , gtk2, hicolor-icon-theme, intltool, pkg-config
-, which, wrapGAppsHook, xdotool, libappindicator-gtk2 }:
+, which, wrapGAppsHook3, xdotool, libappindicator-gtk2 }:
 
 stdenv.mkDerivation rec {
   pname = "parcellite";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "19q4x6x984s6gxk1wpzaxawgvly5vnihivrhmja2kcxhzqrnfhiy";
   };
 
-  nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook3 ];
   buildInputs = [ gtk2 hicolor-icon-theme libappindicator-gtk2 ];
   NIX_LDFLAGS = "-lgio-2.0";
 
diff --git a/pkgs/tools/misc/plotinus/default.nix b/pkgs/tools/misc/plotinus/default.nix
index 112010c80082f..10c86b10c3da7 100644
--- a/pkgs/tools/misc/plotinus/default.nix
+++ b/pkgs/tools/misc/plotinus/default.nix
@@ -7,7 +7,7 @@
 , cmake
 , ninja
 , vala
-, wrapGAppsHook }:
+, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "plotinus";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     vala
     cmake
     ninja
diff --git a/pkgs/tools/misc/pokemonsay/default.nix b/pkgs/tools/misc/pokemonsay/default.nix
index 7053e4ba80733..669fa6a494134 100644
--- a/pkgs/tools/misc/pokemonsay/default.nix
+++ b/pkgs/tools/misc/pokemonsay/default.nix
@@ -28,27 +28,27 @@ stdenvNoCC.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace pokemonsay.sh \
-      --replace \
+      --replace-fail \
         'INSTALL_PATH=''${HOME}/.bin/pokemonsay' \
         "" \
-      --replace \
+      --replace-fail \
         'POKEMON_PATH=''${INSTALL_PATH}/pokemons' \
         'POKEMON_PATH=${placeholder "out"}/share/pokemonsay' \
-      --replace \
+      --replace-fail \
         '$(find ' \
         '$(${findutils}/bin/find ' \
-      --replace \
+      --replace-fail \
         '$(basename ' \
         '$(${coreutils}/bin/basename ' \
-      --replace \
+      --replace-fail \
         'cowsay -f ' \
         '${cowsay}/bin/cowsay -f ' \
-      --replace \
+      --replace-fail \
         'cowthink -f ' \
         '${cowsay}/bin/cowthink -f '
 
     substituteInPlace pokemonthink.sh \
-      --replace \
+      --replace-fail \
         './pokemonsay.sh' \
         "${placeholder "out"}/bin/pokemonsay"
   '';
diff --git a/pkgs/tools/misc/popsicle/default.nix b/pkgs/tools/misc/popsicle/default.nix
index c5a9e5edc7389..2a62a0aa922dc 100644
--- a/pkgs/tools/misc/popsicle/default.nix
+++ b/pkgs/tools/misc/popsicle/default.nix
@@ -6,7 +6,7 @@
 , glib
 , pkg-config
 , rustc
-, wrapGAppsHook
+, wrapGAppsHook3
 , gdk-pixbuf
 , gtk3
 }:
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     rustPlatform.bindgenHook
     rustPlatform.cargoSetupHook
     rustc
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/misc/qflipper/default.nix b/pkgs/tools/misc/qflipper/default.nix
index 5c139d017c864..171c5d7b38775 100644
--- a/pkgs/tools/misc/qflipper/default.nix
+++ b/pkgs/tools/misc/qflipper/default.nix
@@ -6,7 +6,7 @@
 , libusb1
 , libGL
 , qmake
-, wrapGAppsHook
+, wrapGAppsHook3
 , wrapQtAppsHook
 , mkDerivation
 
@@ -45,7 +45,7 @@ mkDerivation {
     pkg-config
     qmake
     qttools
-    wrapGAppsHook
+    wrapGAppsHook3
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/tools/misc/remind/default.nix b/pkgs/tools/misc/remind/default.nix
index 00daec1e49132..31b7dad24003b 100644
--- a/pkgs/tools/misc/remind/default.nix
+++ b/pkgs/tools/misc/remind/default.nix
@@ -15,11 +15,11 @@ let
 in
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "04.03.04";
+  version = "04.03.07";
 
   src = fetchurl {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${version}.tar.gz";
-    sha256 = "sha256-XkF/silBwDlQt9T2wmUMPh7MiE9yB+vXrSQmEnBEpC8=";
+    sha256 = "sha256-s/jEsNXUBigNHPTCi3e4V2pGUNhK2s5/n+sU1ow7UU0=";
   };
 
   propagatedBuildInputs = tclLibraries;
diff --git a/pkgs/tools/misc/remote-exec/default.nix b/pkgs/tools/misc/remote-exec/default.nix
index 979f0f53bae0d..84b8026c0a073 100644
--- a/pkgs/tools/misc/remote-exec/default.nix
+++ b/pkgs/tools/misc/remote-exec/default.nix
@@ -34,10 +34,10 @@ buildPythonApplication rec {
   # remove legacy endpoints, we use --multi now
   postPatch = ''
     substituteInPlace setup.py \
-      --replace '"mremote' '#"mremote'
+      --replace-fail '"mremote' '#"mremote'
   '';
 
-  propagatedBuildInputs = [
+  dependencies = [
     click
     pydantic
     toml
diff --git a/pkgs/tools/misc/rmate-sh/default.nix b/pkgs/tools/misc/rmate-sh/default.nix
index bc93c6e437fe2..81189a1cd6c7c 100644
--- a/pkgs/tools/misc/rmate-sh/default.nix
+++ b/pkgs/tools/misc/rmate-sh/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     runHook preBuild
 
     substituteInPlace rmate \
-      --replace \
+      --replace-fail \
         'echo "hostname"' \
         'echo "${hostname}/bin/hostname"'
     patsh -f rmate -s ${builtins.storeDir}
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index 2c11cbf195bd2..08a0a0c5e1460 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -14,7 +14,7 @@
 , scons
 , sphinx
 , util-linux
-, wrapGAppsHook
+, wrapGAppsHook3
 , withGui ? false }:
 
 assert withGui -> !stdenv.isDarwin;
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     scons
   ] ++ lib.optionals withGui [
     makeWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
 
diff --git a/pkgs/tools/misc/scanmem/default.nix b/pkgs/tools/misc/scanmem/default.nix
index 817e713b229ff..15d8f1c02f1ec 100644
--- a/pkgs/tools/misc/scanmem/default.nix
+++ b/pkgs/tools/misc/scanmem/default.nix
@@ -4,7 +4,7 @@
 , autoreconfHook
 , gobject-introspection
 , intltool
-, wrapGAppsHook
+, wrapGAppsHook3
 , procps
 , python3
 , readline
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     sha256 = "17p8sh0rj8yqz36ria5bp48c8523zzw3y9g8sbm2jwq7sc27i7s9";
   };
 
-  nativeBuildInputs = [ autoreconfHook gobject-introspection intltool wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook gobject-introspection intltool wrapGAppsHook3 ];
   buildInputs = [ readline python3 ];
   configureFlags = ["--enable-gui"];
 
diff --git a/pkgs/tools/misc/scdl/default.nix b/pkgs/tools/misc/scdl/default.nix
index 5d30d7aec5051..2637c892e03ea 100644
--- a/pkgs/tools/misc/scdl/default.nix
+++ b/pkgs/tools/misc/scdl/default.nix
@@ -2,12 +2,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "scdl";
-  version = "2.7.5";
+  version = "2.7.7";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-YoQaIbOfwLtkSZJGZd9CL7TZGgqjfohJfrnQ3t5uLU0=";
+    sha256 = "sha256-/QQb8xbi0rv5dU3WFr/hm2BuM/iDZ2OhrGjuqsQMqdk=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/misc/staruml/default.nix b/pkgs/tools/misc/staruml/default.nix
index a6497a62f59b6..036f47965b8f8 100644
--- a/pkgs/tools/misc/staruml/default.nix
+++ b/pkgs/tools/misc/staruml/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl
-, dpkg, wrapGAppsHook
+, dpkg, wrapGAppsHook3
 , hicolor-icon-theme
 , gtk3, glib, systemd
 , xorg, nss, nspr
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
       sha256 = "sha256-ULdrAQCiQlTN+aRhETj+ASMKkKctFgC2AfvUHGc6stU=";
     };
 
-  nativeBuildInputs = [ wrapGAppsHook dpkg ];
+  nativeBuildInputs = [ wrapGAppsHook3 dpkg ];
   buildInputs = [ glib hicolor-icon-theme ];
 
   unpackPhase = ''
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/tools/misc/system-config-printer/default.nix
index cafc35790193c..8778327b0e876 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, udev, pkg-config, glib, xmlto, wrapGAppsHook
+{ lib, stdenv, fetchFromGitHub, udev, pkg-config, glib, xmlto, wrapGAppsHook3
 , docbook_xml_dtd_412, docbook_xsl
 , libxml2, desktop-file-utils, libusb1, cups, gdk-pixbuf, pango, atk, libnotify
 , gobject-introspection, libsecret, packagekit
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     pkg-config gettext libtool autoconf-archive
     xmlto libxml2 docbook_xml_dtd_412 docbook_xsl desktop-file-utils
     python3Packages.wrapPython
-    wrapGAppsHook autoreconfHook gobject-introspection
+    wrapGAppsHook3 autoreconfHook gobject-introspection
   ];
 
   pythonPath = with python3Packages; requiredPythonModules [ pycups pycurl dbus-python pygobject3 pycairo pysmbc ];
diff --git a/pkgs/tools/misc/trackma/default.nix b/pkgs/tools/misc/trackma/default.nix
index 86834e337d8c4..c57d5ac1d7572 100644
--- a/pkgs/tools/misc/trackma/default.nix
+++ b/pkgs/tools/misc/trackma/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , glib
 , gtk3
@@ -36,7 +36,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [ copyDesktopItems python3.pkgs.poetry-core ]
-    ++ lib.optionals withGTK [ wrapGAppsHook gobject-introspection ]
+    ++ lib.optionals withGTK [ wrapGAppsHook3 gobject-introspection ]
     ++ lib.optionals withQT [ qt5.wrapQtAppsHook ];
 
   buildInputs = lib.optionals withGTK [ glib gtk3 ];
diff --git a/pkgs/tools/misc/urn-timer/default.nix b/pkgs/tools/misc/urn-timer/default.nix
index df45524a8a060..0b75657fb121d 100644
--- a/pkgs/tools/misc/urn-timer/default.nix
+++ b/pkgs/tools/misc/urn-timer/default.nix
@@ -4,7 +4,7 @@
 , xxd
 , pkg-config
 , imagemagick
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , jansson
 , nixosTests
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     xxd
     pkg-config
     imagemagick
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/misc/usbimager/default.nix b/pkgs/tools/misc/usbimager/default.nix
index b845062c1783e..898b5f1a4c853 100644
--- a/pkgs/tools/misc/usbimager/default.nix
+++ b/pkgs/tools/misc/usbimager/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, pkg-config, wrapGAppsHook
+{ lib, stdenv, fetchFromGitLab, pkg-config, wrapGAppsHook3
 , withLibui ? true, gtk3
 , withUdisks ? stdenv.isLinux, udisks, glib
 , libX11 }:
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "${src.name}/src";
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
   buildInputs = lib.optionals withUdisks [ udisks glib ]
     ++ lib.optional (!withLibui) libX11
     ++ lib.optional withLibui gtk3;
diff --git a/pkgs/tools/misc/woeusb-ng/default.nix b/pkgs/tools/misc/woeusb-ng/default.nix
index 821eb73a4a896..1c3754bd95f3c 100644
--- a/pkgs/tools/misc/woeusb-ng/default.nix
+++ b/pkgs/tools/misc/woeusb-ng/default.nix
@@ -1,7 +1,7 @@
 { lib
 , python3Packages
 , fetchFromGitHub
-, wrapGAppsHook
+, wrapGAppsHook3
 , p7zip
 , parted
 , grub2
@@ -27,7 +27,7 @@ buildPythonApplication rec {
   '';
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/misc/wv/default.nix b/pkgs/tools/misc/wv/default.nix
index ed1b39b38df48..e1824c1d37090 100644
--- a/pkgs/tools/misc/wv/default.nix
+++ b/pkgs/tools/misc/wv/default.nix
@@ -1,16 +1,18 @@
-{ lib, stdenv, fetchurl, zlib, imagemagick, libpng, glib, pkg-config, libgsf
+{ lib, stdenv, fetchFromGitHub, zlib, imagemagick, libpng, glib, pkg-config, libgsf
 , libxml2, bzip2
 , autoreconfHook
 , buildPackages
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "wv";
   version = "1.2.9";
 
-  src = fetchurl {
-    url = "http://www.abisource.com/downloads/${pname}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "17f16lkdv1c3amaz2hagiicih59ynpp4786k1m2qa1sw68xhswsc";
+  src = fetchFromGitHub {
+    owner = "AbiWord";
+    repo = "wv";
+    rev = "wv-${builtins.replaceStrings ["."] ["-"] finalAttrs.version}";
+    hash = "sha256-xcC+/M1EzFqQFeF5Dw9qd8VIy7r8JdKMp2X/GHkFiPA=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
@@ -30,8 +32,9 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
+    homepage = "https://github.com/AbiWord/wv";
     description = "Converter from Microsoft Word formats to human-editable ones";
     platforms = lib.platforms.unix;
     license = lib.licenses.gpl2;
   };
-}
+})
diff --git a/pkgs/tools/misc/xdaliclock/default.nix b/pkgs/tools/misc/xdaliclock/default.nix
index 7201ffcbbe998..333da375d5801 100644
--- a/pkgs/tools/misc/xdaliclock/default.nix
+++ b/pkgs/tools/misc/xdaliclock/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 , pkg-config }:
 
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
   buildInputs = [
     gtk3
diff --git a/pkgs/tools/misc/xflux/gui.nix b/pkgs/tools/misc/xflux/gui.nix
index a9ec5d5d0eeb7..97ad6dbaaecd4 100644
--- a/pkgs/tools/misc/xflux/gui.nix
+++ b/pkgs/tools/misc/xflux/gui.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildPythonApplication, python3Packages, wrapGAppsHook
+{ lib, fetchFromGitHub, buildPythonApplication, python3Packages, wrapGAppsHook3
 , xflux, gtk3, gobject-introspection, pango, gdk-pixbuf, atk
 , pexpect, pygobject3, pyxdg, libappindicator-gtk3
 }:
@@ -24,7 +24,7 @@ buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    wrapGAppsHook gobject-introspection
+    wrapGAppsHook3 gobject-introspection
     pango gdk-pixbuf atk libappindicator-gtk3
   ];
 
diff --git a/pkgs/tools/misc/yad/default.nix b/pkgs/tools/misc/yad/default.nix
index 9bbb955f1a1bc..7b578d479758f 100644
--- a/pkgs/tools/misc/yad/default.nix
+++ b/pkgs/tools/misc/yad/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, intltool, autoreconfHook, wrapGAppsHook
+{ lib, stdenv, fetchFromGitHub, pkg-config, intltool, autoreconfHook, wrapGAppsHook3
 , gtk3, hicolor-icon-theme, netpbm }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gtk3 hicolor-icon-theme ];
 
-  nativeBuildInputs = [ autoreconfHook pkg-config intltool wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config intltool wrapGAppsHook3 ];
 
   postPatch = ''
     sed -i src/file.c -e '21i#include <glib/gprintf.h>'
diff --git a/pkgs/tools/networking/gobgp/default.nix b/pkgs/tools/networking/gobgp/default.nix
index 295791556f2a3..bd9049ee8cdc1 100644
--- a/pkgs/tools/networking/gobgp/default.nix
+++ b/pkgs/tools/networking/gobgp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gobgp";
-  version = "3.25.0";
+  version = "3.26.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${version}";
-    sha256 = "sha256-cb4FYsYMkrna/1IjPlEglAmeQ/vfbUiaTb5OjrWiYR4=";
+    sha256 = "sha256-bFxKFAw02M8RmMCFFT3nu3urmvh7Wzi0rryuTi8Hw9k=";
   };
 
-  vendorHash = "sha256-fB/PjOO3+/RVQ5DGAHx4O8wAb9p+RdDC9+xkTCefP8A=";
+  vendorHash = "sha256-wrgRQwisOHAhvRbvGXMW5VWkQuEifCwCo3usuxLie4A=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/tools/networking/gp-saml-gui/default.nix b/pkgs/tools/networking/gp-saml-gui/default.nix
index 348d47b667f66..d2c3bfc292103 100644
--- a/pkgs/tools/networking/gp-saml-gui/default.nix
+++ b/pkgs/tools/networking/gp-saml-gui/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , buildPythonPackage
 , webkitgtk
-, wrapGAppsHook
+, wrapGAppsHook3
 , glib-networking
 , gobject-introspection
 , openconnect
@@ -23,7 +23,7 @@ buildPythonPackage rec {
 
   buildInputs = lib.optional stdenv.isLinux glib-networking;
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection glib-networking ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection glib-networking ];
 
   propagatedBuildInputs = [
     requests
diff --git a/pkgs/tools/networking/gupnp-tools/default.nix b/pkgs/tools/networking/gupnp-tools/default.nix
index 20579a59b81e2..254201e28962e 100644
--- a/pkgs/tools/networking/gupnp-tools/default.nix
+++ b/pkgs/tools/networking/gupnp-tools/default.nix
@@ -12,7 +12,7 @@
 , gupnp-av
 , gtksourceview4
 , gnome
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     gettext
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/networking/haguichi/default.nix b/pkgs/tools/networking/haguichi/default.nix
index a921884dda064..ad1ad4a9a6d14 100644
--- a/pkgs/tools/networking/haguichi/default.nix
+++ b/pkgs/tools/networking/haguichi/default.nix
@@ -6,7 +6,7 @@
 , pkg-config
 , python3
 , vala
-, wrapGAppsHook
+, wrapGAppsHook3
 , desktop-file-utils
 , glib
 , gtk3
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     desktop-file-utils # for update-desktop-database
     glib # for glib-compile-resources
     gtk3 # for gtk-update-icon-cache
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index ae15785a21ff4..225c4b1c8cd9e 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -29,11 +29,11 @@ let
   sslPkg = sslPkgs.${sslLibrary};
 in stdenv.mkDerivation (finalAttrs: {
   pname = "haproxy";
-  version = "2.9.6";
+  version = "2.9.7";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-IIrfR8j6g8VJeANLpcARC3RjxHB48Rm9BSNCFxo7mgs=";
+    hash = "sha256-0aClbwCKjS8Ae8DDffaylSUg0fTd4zuNOAJxDlFYwTE=";
   };
 
   buildInputs = [ sslPkg zlib libxcrypt ]
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index 1fc7c0fd59f40..690cbfbbba5f5 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -28,7 +28,7 @@
 , libselinux
 , ldns
 , xmlto
-, docbook_xml_dtd_412
+, docbook_xml_dtd_45
 , docbook_xsl
 , findXMLCatalogs
 , dns-root-data
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libreswan";
-  version = "4.15";
+  version = "5.0";
 
   src = fetchurl {
     url = "https://download.libreswan.org/${pname}-${version}.tar.gz";
-    hash = "sha256-/mDX2zmMjuIlBV2zZeyWiiSuvLxcNQYRMfz/2tG+BK8=";
+    hash = "sha256-ELwK3JC56YGjDf77p9r/IAhB7LmRD51nHxN//BQUKGo=";
   };
 
   strictDeps = true;
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     flex
     pkg-config
     xmlto
-    docbook_xml_dtd_412
+    docbook_xml_dtd_45
     docbook_xsl
     findXMLCatalogs
   ];
@@ -73,51 +73,15 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional stdenv.isLinux libselinux;
 
   prePatch = ''
-    # Correct iproute2 and iptables path
-    sed -e 's|/sbin/ip|${iproute2}/bin/ip|g' \
-        -e 's|/sbin/\(ip6\?tables\)|${iptables}/bin/\1|' \
-        -e 's|/bin/bash|${runtimeShell}|g' \
-        -i initsystems/systemd/ipsec.service.in \
-           programs/barf/barf.in \
-           programs/verify.linux/verify.in
-    sed -e 's|\([[:blank:]]\)\(ip6\?tables\(-save\)\? -\)|\1${iptables}/bin/\2|' \
-        -i programs/verify.linux/verify.in
-
-    # Prevent the makefile from trying to
-    # reload the systemd daemon or create tmpfiles
-    sed -e 's|systemctl|true|g' \
-        -e 's|systemd-tmpfiles|true|g' \
-        -i initsystems/systemd/Makefile
-
-    # Fix systemd detection on NixOS
-    sed -e 's|\(-a ! -x /bin/journalctl\)|\1 -a ! -x /run/current-system/sw/bin/journalctl|g' \
-        -e 's|\(-o ! -x /bin/journalctl\)|\1 -o ! -x /run/current-system/sw/bin/journalctl|g' \
-        -i programs/barf/barf.in
-
-    # Fix the ipsec program from crushing the PATH
-    sed -e 's|\(PATH=".*"\):.*$|\1:$PATH|' -i programs/ipsec/ipsec.in
-
-    # Fix python script to use the correct python
-    sed -e 's/^\(\W*\)installstartcheck()/\1sscmd = "ss"\n\0/' \
-        -i programs/verify.linux/verify.in
-
     # Replace wget with curl to save a dependency
-    curlArgs='-s --remote-name-all --output-dir'
-    sed -e "s|wget -q -P|${curl}/bin/curl $curlArgs|g" \
-        -i programs/letsencrypt/letsencrypt.in
-
-    # Patch the Makefile:
-    # 1. correct the pam.d directory install path
-    # 2. do not create the /var/lib/ directory
-    sed -e 's|$(DESTDIR)/etc/pam.d|$(out)/etc/pam.d|' \
-        -e '/test ! -d $(NSSDIR)/,+3d' \
-        -i configs/Makefile
+    substituteInPlace programs/letsencrypt/letsencrypt.in \
+      --replace-fail 'wget -q -P' '${curl}/bin/curl -s --remote-name-all --output-dir'
   '';
 
   makeFlags = [
     "PREFIX=$(out)"
     "INITSYSTEM=systemd"
-    "UNITDIR=$(out)/etc/systemd/system/"
+    "SYSTEMUNITDIR=$(out)/etc/systemd/system/"
     "TMPFILESDIR=$(out)/lib/tmpfiles.d/"
     "LINUX_VARIANT=nixos"
     "DEFAULT_DNSSEC_ROOTKEY_FILE=${dns-root-data}/root.key"
@@ -125,13 +89,13 @@ stdenv.mkDerivation rec {
 
   # Hack to make install work
   installFlags = [
-    "FINALVARDIR=\${out}/var"
-    "FINALSYSCONFDIR=\${out}/etc"
+    "VARDIR=\${out}/var"
+    "SYSCONFDIR=\${out}/etc"
   ];
 
   postInstall = ''
-    # Install examples directory (needed for letsencrypt)
-    cp -r docs/examples $out/share/doc/libreswan/examples
+    # Install letsencrypt config files
+    install -m644 -Dt "$out/share/doc/libreswan/letsencrypt" docs/examples/*
   '';
 
   postFixup = ''
diff --git a/pkgs/tools/networking/networkmanager/applet/default.nix b/pkgs/tools/networking/networkmanager/applet/default.nix
index 908cb8757e36b..9b485dafa675a 100644
--- a/pkgs/tools/networking/networkmanager/applet/default.nix
+++ b/pkgs/tools/networking/networkmanager/applet/default.nix
@@ -14,7 +14,7 @@
 , gsettings-desktop-schemas
 , libgudev
 , jansson
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , python3
 , gtk3
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     ninja
     gettext
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
     python3
   ];
diff --git a/pkgs/tools/networking/ngrok/versions.json b/pkgs/tools/networking/ngrok/versions.json
index d62dfaa0f8a09..81791bcb7f83b 100644
--- a/pkgs/tools/networking/ngrok/versions.json
+++ b/pkgs/tools/networking/ngrok/versions.json
@@ -1,38 +1,38 @@
 {
   "linux-386": {
     "sys": "linux-386",
-    "url": "https://bin.equinox.io/a/NYbWaAdCby/ngrok-v3-3.7.0-linux-386",
-    "sha256": "3fbf2296a8ce35c7d050ed4c828ef4eacc8724852faaaaa8054822ee72426606",
-    "version": "3.7.0"
+    "url": "https://bin.equinox.io/a/4eyRd2Y9zhP/ngrok-v3-3.9.0-linux-386",
+    "sha256": "6b8b66e5608355dcf913e927a4641821867ecc177d8dce3d0153638748cf305b",
+    "version": "3.9.0"
   },
   "linux-amd64": {
     "sys": "linux-amd64",
-    "url": "https://bin.equinox.io/a/doBjqyzrcYM/ngrok-v3-3.7.0-linux-amd64",
-    "sha256": "d1f7149079bb3bce0a70619580818a0ec09ac20da25f64a268203c2a3a019a47",
-    "version": "3.7.0"
+    "url": "https://bin.equinox.io/a/2d3ZAS5cS1y/ngrok-v3-3.9.0-linux-amd64",
+    "sha256": "4b149cb7aa4aa97836b663aab205f2707c2b4309779d07cec593d66c1bd5eafa",
+    "version": "3.9.0"
   },
   "linux-arm": {
     "sys": "linux-arm",
-    "url": "https://bin.equinox.io/a/hgUUy2bUaz9/ngrok-v3-3.7.0-linux-arm",
-    "sha256": "5f2f0bf4ae42f5c8dcb945694bd1aedf963d631c39ba0cb9c0b9626eb396b2c4",
-    "version": "3.7.0"
+    "url": "https://bin.equinox.io/a/jwEoHhyU22A/ngrok-v3-3.9.0-linux-arm",
+    "sha256": "d4080caaf7d178c9c04ab26826d9dd190e2c94679aba6ac68afcc9066d1b4eb8",
+    "version": "3.9.0"
   },
   "linux-arm64": {
     "sys": "linux-arm64",
-    "url": "https://bin.equinox.io/a/9p821sdaKqh/ngrok-v3-3.7.0-linux-arm64",
-    "sha256": "f43af93d9d7a9af22a2a5423a0b7b964790b1d2dccfd532142a807282360c21a",
-    "version": "3.7.0"
+    "url": "https://bin.equinox.io/a/dCoWhZwgRB3/ngrok-v3-3.9.0-linux-arm64",
+    "sha256": "363c6757ccf511579ed0215b3e9ce723e0bc728d26981ee9c77ceda94d626603",
+    "version": "3.9.0"
   },
   "darwin-amd64": {
     "sys": "darwin-amd64",
-    "url": "https://bin.equinox.io/a/cC8QZtu8eV3/ngrok-v3-3.7.0-darwin-amd64",
-    "sha256": "30903672a673454feaafde92e09f04804a3fcea69ef9c02027b6fb12e2ae8df2",
-    "version": "3.7.0"
+    "url": "https://bin.equinox.io/a/n7RJLYWCbkH/ngrok-v3-3.9.0-darwin-amd64",
+    "sha256": "29d699bca2cac98964ebb4f49573c5b5f005d2db1f182d6fc34d98ebc675df6c",
+    "version": "3.9.0"
   },
   "darwin-arm64": {
     "sys": "darwin-arm64",
-    "url": "https://bin.equinox.io/a/jwjx5C5dodJ/ngrok-v3-3.7.0-darwin-arm64",
-    "sha256": "99df3b5a7a1cbf943931aba41fdbb9b7081ea860ef9dec41b7fb08e53433d498",
-    "version": "3.7.0"
+    "url": "https://bin.equinox.io/a/h74Tf9SEyC4/ngrok-v3-3.9.0-darwin-arm64",
+    "sha256": "134a4b69f53731b6fac0a60ee2c7eef9450b966dd51b895c10fc5705a4211a55",
+    "version": "3.9.0"
   }
 }
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index ac5d9afd486b0..5c7b3ecb1d355 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -26,6 +26,7 @@
 , withLdns ? true
 , libkrb5
 , libfido2
+, libxcrypt
 , hostname
 , nixosTests
 , withFIDO ? stdenv.hostPlatform.isUnix && !stdenv.hostPlatform.isMusl
@@ -63,7 +64,8 @@ stdenv.mkDerivation {
     # https://github.com/NixOS/nixpkgs/pull/107606
     ++ lib.optional withKerberos pkgs.libkrb5
     ++ extraNativeBuildInputs;
-  buildInputs = [ zlib openssl libedit ]
+  buildInputs = [ zlib libedit ]
+    ++ [ (if linkOpenssl then openssl else libxcrypt) ]
     ++ lib.optional withFIDO libfido2
     ++ lib.optional withKerberos libkrb5
     ++ lib.optional withLdns ldns
diff --git a/pkgs/tools/networking/openvpn3/default.nix b/pkgs/tools/networking/openvpn3/default.nix
index b6037d67d8240..5ab94c798f4f1 100644
--- a/pkgs/tools/networking/openvpn3/default.nix
+++ b/pkgs/tools/networking/openvpn3/default.nix
@@ -18,7 +18,7 @@
 , systemd
 , enableSystemdResolved ? false
 , tinyxml-2
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     python3.pkgs.docutils
     python3.pkgs.jinja2
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     python3.pkgs.wrapPython
   ] ++ pythonPath;
 
diff --git a/pkgs/tools/networking/phodav/default.nix b/pkgs/tools/networking/phodav/default.nix
index 7a3ce12b55fb2..f4bb164939019 100644
--- a/pkgs/tools/networking/phodav/default.nix
+++ b/pkgs/tools/networking/phodav/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "WebDav server implementation and library using libsoup";
-    homepage = "https://wiki.gnome.org/phodav";
+    homepage = "https://gitlab.gnome.org/GNOME/phodav";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ wegank ];
     platforms = platforms.unix;
diff --git a/pkgs/tools/networking/uget/default.nix b/pkgs/tools/networking/uget/default.nix
index cbbb1c3169490..a2387f838ff52 100644
--- a/pkgs/tools/networking/uget/default.nix
+++ b/pkgs/tools/networking/uget/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, intltool, openssl, curl, libnotify,
-  libappindicator-gtk3, gst_all_1, gtk3, dconf, wrapGAppsHook, aria2 ? null
+  libappindicator-gtk3, gst_all_1, gtk3, dconf, wrapGAppsHook3, aria2 ? null
 }:
 
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/nix/nix-query-tree-viewer/default.nix b/pkgs/tools/nix/nix-query-tree-viewer/default.nix
index 03fa64545f182..f5c8a46131bfd 100644
--- a/pkgs/tools/nix/nix-query-tree-viewer/default.nix
+++ b/pkgs/tools/nix/nix-query-tree-viewer/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, rustPlatform, glib, gtk3, wrapGAppsHook }:
+{ lib, fetchFromGitHub, rustPlatform, glib, gtk3, wrapGAppsHook3 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-query-tree-viewer";
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index f36497cda34d3..a8006d34b00de 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -20,15 +20,6 @@ let
     patches = (drv.patches or [ ]) ++ [
       # Part of the GC solution in https://github.com/NixOS/nix/pull/4944
       ./patches/boehmgc-coroutine-sp-fallback.patch
-
-      # Required since 2.20, and has always been a valid change
-      # Awaiting 8.2 patch release of https://github.com/ivmai/bdwgc/commit/d1d4194c010bff2dc9237223319792cae834501c
-      # or master release of https://github.com/ivmai/bdwgc/commit/86b3bf0c95b66f718c3cb3d35fd7387736c2a4d7
-      (fetchpatch {
-        name = "boehmgc-traceable_allocator-public.diff";
-        url = "https://github.com/NixOS/nix/raw/2.20.0/dep-patches/boehmgc-traceable_allocator-public.diff";
-        hash = "sha256-FLsHY/JS46neiSyyQkVpbHZEFvWSCzWrFQu1CC71sh4=";
-      })
     ];
   });
 
diff --git a/pkgs/tools/security/cryptomator/default.nix b/pkgs/tools/security/cryptomator/default.nix
index 8fb34dbbbcc23..cac3717625e46 100644
--- a/pkgs/tools/security/cryptomator/default.nix
+++ b/pkgs/tools/security/cryptomator/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub
 , autoPatchelfHook
 , fuse3
-, maven, jdk, makeShellWrapper, glib, wrapGAppsHook
+, maven, jdk, makeShellWrapper, glib, wrapGAppsHook3
 , libayatana-appindicator
 }:
 
@@ -86,7 +86,7 @@ mavenJdk.buildMavenPackage rec {
   nativeBuildInputs = [
     autoPatchelfHook
     makeShellWrapper
-    wrapGAppsHook
+    wrapGAppsHook3
     jdk
   ];
   buildInputs = [ fuse3 jdk glib libayatana-appindicator ];
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index 5a330c7126fab..851e6f578db6d 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -16,7 +16,7 @@
 , openssl
 , p11-kit
 , pcsclite
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   '';
 
 
-  nativeBuildInputs = [ wrapGAppsHook autoreconfHook autoconf-archive pkg-config makeWrapper ];
+  nativeBuildInputs = [ wrapGAppsHook3 autoreconfHook autoconf-archive pkg-config makeWrapper ];
   buildInputs = [ curl gtk3 libassuan libbsd libproxy libxml2 openssl p11-kit pcsclite ];
 
   preConfigure = ''
diff --git a/pkgs/tools/security/gencfsm/default.nix b/pkgs/tools/security/gencfsm/default.nix
index 537b2caf45b39..42a0b3d9188d6 100644
--- a/pkgs/tools/security/gencfsm/default.nix
+++ b/pkgs/tools/security/gencfsm/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, autoconf, automake, intltool, libtool, pkg-config
-, encfs, libsecret , glib , libgee, gtk3, vala, wrapGAppsHook, xorg
+, encfs, libsecret , glib , libgee, gtk3, vala, wrapGAppsHook3, xorg
 , gobject-introspection
 }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     libtool
     pkg-config
     vala
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ];
   buildInputs = [
diff --git a/pkgs/tools/security/gnome-keysign/default.nix b/pkgs/tools/security/gnome-keysign/default.nix
index 56ea016eda93d..af794097cf552 100644
--- a/pkgs/tools/security/gnome-keysign/default.nix
+++ b/pkgs/tools/security/gnome-keysign/default.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchFromGitLab
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 , gobject-introspection
 , gtk3
 , glib
@@ -21,7 +21,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ] ++ (with python3.pkgs; [
     babel
@@ -55,7 +55,7 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = with lib; {
     description = "GTK/GNOME application to use GnuPG for signing other peoples’ keys";
-    homepage = "https://wiki.gnome.org/Apps/Keysign";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-keysign";
     license = licenses.gpl3Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
diff --git a/pkgs/tools/security/keybase/gui.nix b/pkgs/tools/security/keybase/gui.nix
index 577e91c24e59d..e9f5f52e8a0b4 100644
--- a/pkgs/tools/security/keybase/gui.nix
+++ b/pkgs/tools/security/keybase/gui.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, alsa-lib, atk, cairo, cups, udev, libdrm, mesa
 , dbus, expat, fontconfig, freetype, gdk-pixbuf, glib, gtk3, libappindicator-gtk3
-, libnotify, nspr, nss, pango, systemd, xorg, autoPatchelfHook, wrapGAppsHook
+, libnotify, nspr, nss, pango, systemd, xorg, autoPatchelfHook, wrapGAppsHook3
 , runtimeShell, gsettings-desktop-schemas }:
 
 let
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/security/onioncircuits/default.nix b/pkgs/tools/security/onioncircuits/default.nix
index 95692ef1c188c..048631e2b774d 100644
--- a/pkgs/tools/security/onioncircuits/default.nix
+++ b/pkgs/tools/security/onioncircuits/default.nix
@@ -5,7 +5,7 @@
 , gobject-introspection
 , intltool
 , python3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -23,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [
     gobject-introspection
     intltool
-    wrapGAppsHook
+    wrapGAppsHook3
     python3.pkgs.distutils-extra
   ];
 
diff --git a/pkgs/tools/security/onlykey/default.nix b/pkgs/tools/security/onlykey/default.nix
index c63173d889b2e..a9337be7ac050 100644
--- a/pkgs/tools/security/onlykey/default.nix
+++ b/pkgs/tools/security/onlykey/default.nix
@@ -5,7 +5,7 @@
 , makeDesktopItem
 , stdenv
 , writeShellScript
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 let
@@ -53,7 +53,7 @@ stdenv.mkDerivation {
   pname = "${onlykey.packageName}";
   inherit (onlykey) version;
   dontUnpack = true;
-  nativeBuildInputs = [ wrapGAppsHook copyDesktopItems ];
+  nativeBuildInputs = [ wrapGAppsHook3 copyDesktopItems ];
   desktopItems = [
     (makeDesktopItem {
       name = onlykey.packageName;
diff --git a/pkgs/tools/security/pcsc-tools/default.nix b/pkgs/tools/security/pcsc-tools/default.nix
index c479caa0a6137..371a159f8c618 100644
--- a/pkgs/tools/security/pcsc-tools/default.nix
+++ b/pkgs/tools/security/pcsc-tools/default.nix
@@ -6,9 +6,9 @@
 , gobject-introspection
 , makeWrapper
 , pkg-config
-, wrapGAppsHook
-, systemd
-, dbus
+, wrapGAppsHook3
+, systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
+, dbusSupport ? stdenv.isLinux, dbus
 , pcsclite
 , PCSC
 , wget
@@ -16,8 +16,13 @@
 , perlPackages
 , testers
 , nix-update-script
+
+# gui does not cross compile properly
+, withGui ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
 }:
 
+assert systemdSupport -> dbusSupport;
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "pcsc-tools";
   version = "1.7.1";
@@ -33,17 +38,21 @@ stdenv.mkDerivation (finalAttrs: {
     "--datarootdir=${placeholder "out"}/share"
   ];
 
-  buildInputs = [ dbus perlPackages.perl pcsclite ]
-    ++ lib.optional stdenv.isDarwin PCSC
-    ++ lib.optional stdenv.isLinux systemd;
+  buildInputs = lib.optionals dbusSupport [
+    dbus
+  ] ++ [
+    perlPackages.perl pcsclite
+  ] ++ lib.optional stdenv.isDarwin PCSC
+    ++ lib.optional systemdSupport systemd;
 
   nativeBuildInputs = [
     autoconf-archive
     autoreconfHook
-    gobject-introspection
     makeWrapper
     pkg-config
-    wrapGAppsHook
+  ] ++ lib.optionals withGui [
+    gobject-introspection
+    wrapGAppsHook3
   ];
 
   preFixup = ''
@@ -54,6 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     wrapProgram $out/bin/scriptor \
       --set PERL5LIB "${with perlPackages; makePerlPath [ ChipcardPCSC libintl-perl ]}"
 
+  '' + lib.optionalString withGui ''
     wrapProgram $out/bin/gscriptor \
       ''${makeWrapperArgs[@]} \
       --set PERL5LIB "${with perlPackages; makePerlPath [
@@ -66,6 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
           Cairo
           CairoGObject
       ]}"
+  '' + ''
 
     wrapProgram $out/bin/ATR_analysis \
       --set PERL5LIB "${with perlPackages; makePerlPath [ ChipcardPCSC libintl-perl ]}"
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 956bf451c7bfd..b078ee737bd95 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -10,6 +10,10 @@
 , dbus
 , polkit
 , systemdLibs
+, dbusSupport ? stdenv.isLinux
+, systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs
+, udevSupport ? dbusSupport
+, libusb1
 , IOKit
 , testers
 , nix-update-script
@@ -17,9 +21,12 @@
 , polkitSupport ? false
 }:
 
+assert polkitSupport -> dbusSupport;
+assert systemdSupport -> dbusSupport;
+
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "2.0.3";
+  version = "2.1.0";
 
   outputs = [ "out" "lib" "dev" "doc" "man" ];
 
@@ -28,18 +35,20 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rousseau";
     repo = "PCSC";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-VDQh2PYAMFwgWvZFD20H3JxgKSFrSUoDLv/6fKEoy5Y=";
+    hash = "sha256-aJKI6pWrZJFmiTxZ9wgCuxKRWRMFVRAkzlo+tSqV8B4=";
   };
 
   configureFlags = [
     "--enable-confdir=/etc"
     # The OS should care on preparing the drivers into this location
     "--enable-usbdropdir=/var/lib/pcsc/drivers"
-    (lib.enableFeature stdenv.isLinux "libsystemd")
+    (lib.enableFeature systemdSupport "libsystemd")
     (lib.enableFeature polkitSupport "polkit")
-  ] ++ lib.optionals stdenv.isLinux [
     "--enable-ipcdir=/run/pcscd"
+  ] ++ lib.optionals systemdSupport [
     "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+  ] ++ lib.optionals (!udevSupport) [
+    "--disable-libudev"
   ];
 
   makeFlags = [
@@ -50,8 +59,8 @@ stdenv.mkDerivation (finalAttrs: {
   # see also: https://github.com/LudovicRousseau/PCSC/issues/25
   postPatch = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     substituteInPlace src/Makefile.am \
-      --replace "noinst_PROGRAMS = testpcsc pcsc-wirecheck pcsc-wirecheck-gen" \
-                "noinst_PROGRAMS = testpcsc"
+      --replace-fail "noinst_PROGRAMS = testpcsc pcsc-wirecheck pcsc-wirecheck-gen" \
+                     "noinst_PROGRAMS = testpcsc"
   '';
 
   postInstall = ''
@@ -70,25 +79,31 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [ python3 ]
-    ++ lib.optionals stdenv.isLinux [ systemdLibs ]
+    ++ lib.optionals systemdSupport [ systemdLibs ]
     ++ lib.optionals stdenv.isDarwin [ IOKit ]
-    ++ lib.optionals polkitSupport [ dbus polkit ];
+    ++ lib.optionals dbusSupport [ dbus ]
+    ++ lib.optionals polkitSupport [ polkit ]
+    ++ lib.optionals (!udevSupport) [ libusb1 ];
 
   passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      command = "pcscd --version";
+    tests = {
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "pcscd --version";
+      };
     };
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Middleware to access a smart card using SCard API (PC/SC)";
     homepage = "https://pcsclite.apdu.fr/";
     changelog = "https://salsa.debian.org/rousseau/PCSC/-/blob/${finalAttrs.version}/ChangeLog";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     mainProgram = "pcscd";
-    maintainers = [ maintainers.anthonyroussel ];
-    platforms = with platforms; unix;
+    maintainers = [ lib.maintainers.anthonyroussel ];
+    pkgConfigModules = [ "libpcsclite" ];
+    platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index 10984e489fd4f..756b2a67565a4 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -4,7 +4,7 @@
 , fetchpatch
 , pkg-config
 , autoreconfHook
-, wrapGAppsHook
+, wrapGAppsHook3
 , libgpg-error
 , libassuan
 , libsForQt5
@@ -29,7 +29,7 @@ let
     gnome3 = {
       flag = "gnome3";
       buildInputs = [ gcr ];
-      nativeBuildInputs = [ wrapGAppsHook ];
+      nativeBuildInputs = [ wrapGAppsHook3 ];
     };
     qt = {
       flag = "qt";
diff --git a/pkgs/tools/security/xsser/default.nix b/pkgs/tools/security/xsser/default.nix
index c5fab523166e8..c1d93c03f7e4e 100644
--- a/pkgs/tools/security/xsser/default.nix
+++ b/pkgs/tools/security/xsser/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonApplication, fetchFromGitHub, wrapGAppsHook, gobject-introspection, gtk3, pango
+{ lib, buildPythonApplication, fetchFromGitHub, wrapGAppsHook3, gobject-introspection, gtk3, pango
 , pillow, pycurl, beautifulsoup4, pygeoip, pygobject3, cairocffi, selenium }:
 
 buildPythonApplication rec {
@@ -22,7 +22,7 @@ buildPythonApplication rec {
     substituteInPlace setup.py --replace /usr/share share
   '';
 
-  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
 
   buildInputs = [
     gtk3
diff --git a/pkgs/tools/security/yubihsm-shell/default.nix b/pkgs/tools/security/yubihsm-shell/default.nix
index 24d96f43ba434..3302b26bfb904 100644
--- a/pkgs/tools/security/yubihsm-shell/default.nix
+++ b/pkgs/tools/security/yubihsm-shell/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yubihsm-shell";
-  version = "2.4.2";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubihsm-shell";
     rev = version;
-    hash = "sha256-Un3DNmrD9aC9+A3+NNM21yrH1g14THXPHkJ0SUYrL/M=";
+    hash = "sha256-QTDFL/UTnnG0TuojJ0eVKw8fNEqZz86CXWb6uHvzUbs=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index 36f5ea2ed7de4..2964368633ab8 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "2.0.11";
+  version = "2.0.12";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3F9VgLrk+P/KWYI8uY12XrXxHWCXoBR6zhP6xDp0EO0=";
+    sha256 = "sha256-QOhGjLwVeht5S0jG5Fs/2e0RKExAcDJIMSGqdgARewM=";
   };
 
-  cargoHash = "sha256-YjGuGvwDTGrPObxttgBOga3pYLVbNh2lBauOyIdHiLw=";
+  cargoHash = "sha256-TE8W2wYmqC4f9dNwM3UB8444e8eE1sYX/T6hfuCeDOo=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/cm-rgb/default.nix b/pkgs/tools/system/cm-rgb/default.nix
index adc291d4f85d5..03cf76b5385a5 100644
--- a/pkgs/tools/system/cm-rgb/default.nix
+++ b/pkgs/tools/system/cm-rgb/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , atk
 , gobject-introspection
-, wrapGAppsHook
+, wrapGAppsHook3
 , click
 , hidapi
 , psutil
@@ -26,7 +26,7 @@ buildPythonApplication rec {
 
     # Populate GI_TYPELIB_PATH
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/system/gkraken/default.nix b/pkgs/tools/system/gkraken/default.nix
index 330d9f1129f7b..9866c049fa7aa 100644
--- a/pkgs/tools/system/gkraken/default.nix
+++ b/pkgs/tools/system/gkraken/default.nix
@@ -10,7 +10,7 @@
 , gtk3
 , libnotify
 , dbus
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -38,7 +38,7 @@ python3Packages.buildPythonApplication rec {
     ninja
     gtk3
     desktop-file-utils
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/system/psensor/default.nix b/pkgs/tools/system/psensor/default.nix
index 47456b76f325c..6cd1f6858e05b 100644
--- a/pkgs/tools/system/psensor/default.nix
+++ b/pkgs/tools/system/psensor/default.nix
@@ -9,7 +9,7 @@
 , libnotify
 , udisks2
 , libXNVCtrl
-, wrapGAppsHook
+, wrapGAppsHook3
 , libappindicator
 }:
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     sha256 = "1ark901va79gfq5p8h8dqypjgm3f8crmj37520q3slwz2rfphkq8";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   buildInputs = [
     lm_sensors
diff --git a/pkgs/tools/text/comrak/default.nix b/pkgs/tools/text/comrak/default.nix
index 177951aa5f2fe..f850302a9af87 100644
--- a/pkgs/tools/text/comrak/default.nix
+++ b/pkgs/tools/text/comrak/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comrak";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "kivikakk";
     repo = pname;
     rev = version;
-    sha256 = "sha256-4bTLyBa2hlFHSROEffsH6sv4Fu3pfh50zmYM1RUIRX4=";
+    sha256 = "sha256-RUwJxoD6H0CgS7xyfzMLdoy19p/FuOg82EbocZh7vWs=";
   };
 
-  cargoHash = "sha256-ti5jzFwr0GGpuFJmLxzJCwZkb6iekW83R6Z1iluDQyY=";
+  cargoHash = "sha256-rbGl7jQABZu4aMpzlv49uMuKmw7U+9zLS6pAJIJajR8=";
 
   meta = with lib; {
     description = "A CommonMark-compatible GitHub Flavored Markdown parser and formatter";
diff --git a/pkgs/tools/text/gtranslator/default.nix b/pkgs/tools/text/gtranslator/default.nix
index 8795ff33806af..ce56bdab43b1b 100644
--- a/pkgs/tools/text/gtranslator/default.nix
+++ b/pkgs/tools/text/gtranslator/default.nix
@@ -6,6 +6,7 @@
 , pkg-config
 , itstool
 , gettext
+, desktop-file-utils
 , wrapGAppsHook4
 , libxml2
 , libadwaita
@@ -22,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gtranslator";
-  version = "45.3";
+  version = "46.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "MBAgTfXHpa4Cf1owsVRNaXfUF/Dku53il/CtGoAzGHM=";
+    hash = "sha256-tK8xhIkUkf2JwaBGVlIxAVbAfRVraiThwH86TPdXlWg=";
   };
 
   nativeBuildInputs = [
@@ -35,6 +36,7 @@ stdenv.mkDerivation rec {
     pkg-config
     itstool
     gettext
+    desktop-file-utils
     wrapGAppsHook4
   ];
 
@@ -61,9 +63,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "GNOME translation making program";
     mainProgram = "gtranslator";
-    homepage = "https://wiki.gnome.org/Apps/Gtranslator";
+    homepage = "https://gitlab.gnome.org/GNOME/gtranslator";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ bobby285271 ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/text/languagetool/default.nix b/pkgs/tools/text/languagetool/default.nix
index ed4543140e863..58525bdeae4c7 100644
--- a/pkgs/tools/text/languagetool/default.nix
+++ b/pkgs/tools/text/languagetool/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "LanguageTool";
-  version = "6.3";
+  version = "6.4";
 
   src = fetchzip {
     url = "https://www.languagetool.org/download/${pname}-${version}.zip";
-    sha256 = "sha256-S6iBg7nEKCLrFzUnCseTaxFl6/YeRic2tJnBPLuXmWw=";
+    sha256 = "sha256-MIP7+K3kmzrqXWcR23Rn+gMYR0zrGnnCYGhv81P2Pc4=";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre ];
diff --git a/pkgs/tools/text/markdownlint-cli/default.nix b/pkgs/tools/text/markdownlint-cli/default.nix
index cfe92cf9e42b1..736c59d2c5cf0 100644
--- a/pkgs/tools/text/markdownlint-cli/default.nix
+++ b/pkgs/tools/text/markdownlint-cli/default.nix
@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "markdownlint-cli";
-  version = "0.39.0";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "igorshubovych";
     repo = "markdownlint-cli";
     rev = "v${version}";
-    hash = "sha256-kNnTSSu55zqOwKCPxXhCmGOseDzAWaB6oToyWDSe0Cc=";
+    hash = "sha256-h9h1qJ6xKQRRNSr3PsMeuMMyzfJbq49BluKvhJK86v4=";
   };
 
-  npmDepsHash = "sha256-mpqLI9wYxp9g6uO/Peau51KS4KdNmVulb6sVO1uDC6c=";
+  npmDepsHash = "sha256-Ez83Q/zXF61L0hoEb+i4h8oyelrHfgHueAW2mqhCjMQ=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/tools/text/mdbook-pagetoc/default.nix b/pkgs/tools/text/mdbook-pagetoc/default.nix
index eaeecf7648096..77b3b754b1afd 100644
--- a/pkgs/tools/text/mdbook-pagetoc/default.nix
+++ b/pkgs/tools/text/mdbook-pagetoc/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-pagetoc";
-  version = "0.1.9";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "slowsage";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-g7UaQZzIdpv4hZgEtoJ6fyPgA9yQPw3LiATwngjHnWE=";
+    hash = "sha256-A8J3cKSA//NGIVK3uE43YH3ph9DHGFlg7uOo10j2Kh8=";
   };
 
-  cargoHash = "sha256-qSsZaXneGW6zspgy8wHFZvRyTexy6VdySleZv0ieBsI=";
+  cargoHash = "sha256-FvDvPXA4/dxVOIt1LwesBrWEsjdYcrhHescQVAiggBA=";
 
   meta = with lib; {
     description = "Table of contents for mdbook (in sidebar)";
diff --git a/pkgs/tools/text/poedit/default.nix b/pkgs/tools/text/poedit/default.nix
index 48368e64dc434..58185538193f3 100644
--- a/pkgs/tools/text/poedit/default.nix
+++ b/pkgs/tools/text/poedit/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, pkg-config, wxGTK32,
   boost, icu, lucenepp, asciidoc, libxslt, xmlto, gtk3, gtkspell3, pugixml,
-  nlohmann_json, hicolor-icon-theme, wrapGAppsHook }:
+  nlohmann_json, hicolor-icon-theme, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "poedit";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-CfCWfKRzeGGk8/B0BLauO4Xb88/Si1ezvcGKeURgC9o=";
   };
 
-  nativeBuildInputs = [ autoconf automake asciidoc wrapGAppsHook
+  nativeBuildInputs = [ autoconf automake asciidoc wrapGAppsHook3
     libxslt xmlto boost libtool pkg-config ];
 
   buildInputs = [ lucenepp nlohmann_json wxGTK32 icu pugixml gtk3 gtkspell3 hicolor-icon-theme ];
diff --git a/pkgs/tools/text/recode/default.nix b/pkgs/tools/text/recode/default.nix
index 68cd034b8ee4b..0ded5eea09cd2 100644
--- a/pkgs/tools/text/recode/default.nix
+++ b/pkgs/tools/text/recode/default.nix
@@ -8,13 +8,13 @@
 , libintl
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "recode";
   version = "3.7.14";
 
   # Use official tarball, avoid need to bootstrap/generate build system
   src = fetchurl {
-    url = "https://github.com/rrthomas/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
+    url = "https://github.com/rrthomas/recode/releases/download/v${finalAttrs.version}/recode-${finalAttrs.version}.tar.gz";
     hash = "sha256-eGqv1USFGisTsKN36sFQD4IM5iYVzMLmMLUB53Q7nzM=";
   };
 
@@ -35,9 +35,9 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/rrthomas/recode";
     description = "Converts files between various character sets and usages";
     mainProgram = "recode";
-    changelog = "https://github.com/rrthomas/recode/raw/v${version}/NEWS";
+    changelog = "https://github.com/rrthomas/recode/raw/v${finalAttrs.version}/NEWS";
     platforms = lib.platforms.unix;
     license = with lib.licenses; [ lgpl3Plus gpl3Plus ];
     maintainers = with lib.maintainers; [ jcumming ];
   };
-}
+})
diff --git a/pkgs/tools/text/snippetpixie/default.nix b/pkgs/tools/text/snippetpixie/default.nix
index 0483d8c2c0cb3..40267ea7e1481 100644
--- a/pkgs/tools/text/snippetpixie/default.nix
+++ b/pkgs/tools/text/snippetpixie/default.nix
@@ -5,7 +5,7 @@
 , ninja
 , vala
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , appstream
 , desktop-file-utils
 , python3
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     ninja
     vala
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     appstream
     desktop-file-utils
     python3
diff --git a/pkgs/tools/typesetting/pdfchain/default.nix b/pkgs/tools/typesetting/pdfchain/default.nix
index 6d772a6fea20a..4335f8105d7dc 100644
--- a/pkgs/tools/typesetting/pdfchain/default.nix
+++ b/pkgs/tools/typesetting/pdfchain/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchDebianPatch
-, autoconf, gtkmm3, glib, pdftk, pkg-config, wrapGAppsHook
+, autoconf, gtkmm3, glib, pdftk, pkg-config, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    pkg-config wrapGAppsHook autoconf
+    pkg-config wrapGAppsHook3 autoconf
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/typesetting/tex/texlive/generate-fixed-hashes.nix b/pkgs/tools/typesetting/tex/texlive/generate-fixed-hashes.nix
index 532e3c5cfafdd..0cff459bc620b 100644
--- a/pkgs/tools/typesetting/tex/texlive/generate-fixed-hashes.nix
+++ b/pkgs/tools/typesetting/tex/texlive/generate-fixed-hashes.nix
@@ -1,10 +1,23 @@
-with import ../../../../.. { };
+{ pkgs ? (import ../../../../.. { }) }:
 
-with lib; let
-  getFods = drv: lib.optional (isDerivation drv.tex) (drv.tex // { tlType = "run"; })
-    ++ lib.optional (drv ? texdoc) (drv.texdoc // { tlType = "doc"; })
-    ++ lib.optional (drv ? texsource) (drv.texsource // { tlType = "source"; })
-    ++ lib.optional (drv ? tlpkg) (drv.tlpkg // { tlType = "tlpkg"; });
+let
+  inherit (pkgs) runCommand writeText texlive nix;
+  inherit (pkgs.lib)
+    attrValues
+    concatMap
+    concatMapStrings
+    isDerivation
+    filter
+    optional
+    optionalString
+    sort
+    strings
+    ;
+
+  getFods = drv: optional (isDerivation drv.tex) (drv.tex // { tlType = "run"; })
+    ++ optional (drv ? texdoc) (drv.texdoc // { tlType = "doc"; })
+    ++ optional (drv ? texsource) (drv.texsource // { tlType = "source"; })
+    ++ optional (drv ? tlpkg) (drv.tlpkg // { tlType = "tlpkg"; });
 
   sorted = sort (a: b: a.pname < b.pname) (attrValues texlive.pkgs);
   fods = concatMap getFods sorted;
diff --git a/pkgs/tools/typesetting/xmlto/default.nix b/pkgs/tools/typesetting/xmlto/default.nix
index 09597be8540df..848b72eee0876 100644
--- a/pkgs/tools/typesetting/xmlto/default.nix
+++ b/pkgs/tools/typesetting/xmlto/default.nix
@@ -1,13 +1,32 @@
-{ fetchurl, fetchpatch, lib, stdenv, libxml2, libxslt
-, docbook_xml_dtd_45, docbook_xsl, flex, w3m
-, bash, getopt, makeWrapper }:
+{
+  bash,
+  coreutils,
+  docbook_xml_dtd_45,
+  docbook_xsl,
+  docbook-xsl-ns,
+  fetchpatch,
+  fetchurl,
+  findutils,
+  flex,
+  getopt,
+  gnugrep,
+  gnused,
+  lib,
+  libxml2,
+  libxslt,
+  makeWrapper,
+  stdenv,
+  testers,
+  w3m,
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xmlto";
   version = "0.0.28";
+
   src = fetchurl {
-    url = "https://releases.pagure.org/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0xhj8b2pwp4vhl9y16v3dpxpsakkflfamr191mprzsspg4xdyc0i";
+    url = "https://releases.pagure.org/xmlto/xmlto-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-ETDfOnlX659vDSnkqhx1cyp9+21jm+AThZtcfsVCEnY=";
   };
 
   # Note: These patches modify `xmlif/xmlif.l`, which requires `flex` to be rerun.
@@ -28,17 +47,34 @@ stdenv.mkDerivation rec {
     patchShebangs xmlif/test/run-test
 
     substituteInPlace "xmlto.in" \
-      --replace "/bin/bash" "${bash}/bin/bash"
-    substituteInPlace "xmlto.in" \
-      --replace "/usr/bin/locale" "$(type -P locale)"
-    substituteInPlace "xmlto.in" \
-      --replace "mktemp" "$(type -P mktemp)"
+      --replace-fail "@BASH@" "${bash}/bin/bash" \
+      --replace-fail "@FIND@" "${findutils}/bin/find" \
+      --replace-fail "@GETOPT@" "${getopt}/bin/getopt" \
+      --replace-fail "@GREP@" "${gnugrep}/bin/grep" \
+      --replace-fail "@MKTEMP@" "$(type -P mktemp)" \
+      --replace-fail "@SED@" "${gnused}/bin/sed" \
+      --replace-fail "@TAIL@" "${coreutils}/bin/tail"
+
+    for f in format/docbook/* xmlto.in; do
+      substituteInPlace $f \
+        --replace-fail "http://docbook.sourceforge.net/release/xsl/current" "${docbook-xsl-ns}/xml/xsl/docbook"
+    done
   '';
 
   # `libxml2' provides `xmllint', needed at build-time and run-time.
   # `libxslt' provides `xsltproc', used by `xmlto' at run-time.
-  nativeBuildInputs = [ makeWrapper flex getopt ];
-  buildInputs = [ libxml2 libxslt docbook_xml_dtd_45 docbook_xsl ];
+  nativeBuildInputs = [
+    makeWrapper
+    flex
+    getopt
+  ];
+
+  buildInputs = [
+    docbook_xml_dtd_45
+    docbook_xsl
+    libxml2
+    libxslt
+  ];
 
   postInstall = ''
     # `w3m' is needed for HTML to text conversions.
@@ -46,18 +82,24 @@ stdenv.mkDerivation rec {
        --prefix PATH : "${lib.makeBinPath [ libxslt libxml2 getopt w3m ]}"
   '';
 
+  passthru.tests.version = testers.testVersion {
+    command = "${lib.getExe finalAttrs.finalPackage} --version";
+    package = finalAttrs.finalPackage;
+  };
+
   meta = {
+    changelog = "https://pagure.io/xmlto/blob/master/f/ChangeLog";
     description = "Front-end to an XSL toolchain";
-
+    homepage = "https://pagure.io/xmlto/";
+    license = lib.licenses.gpl2Plus;
     longDescription = ''
       xmlto is a front-end to an XSL toolchain.  It chooses an
       appropriate stylesheet for the conversion you want and applies
       it using an external XSL-T processor.  It also performs any
       necessary post-processing.
     '';
-
-    license = lib.licenses.gpl2Plus;
-    homepage = "https://pagure.io/xmlto/";
+    mainProgram = "xmlto";
+    maintainers = [ ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/tools/video/untrunc-anthwlock/default.nix b/pkgs/tools/video/untrunc-anthwlock/default.nix
index 6ec52db7ebfde..3e1595046414b 100644
--- a/pkgs/tools/video/untrunc-anthwlock/default.nix
+++ b/pkgs/tools/video/untrunc-anthwlock/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ffmpeg_4, libui, unstableGitUpdater, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, ffmpeg_4, libui, unstableGitUpdater, wrapGAppsHook3 }:
 
 stdenv.mkDerivation {
   pname = "untrunc-anthwlock";
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     hash = "sha256-h+aFPhlbEM6EfCKbsJPelBY5ys7kv5K4rbK/HTHeEcw=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook3 ];
 
   buildInputs = [ ffmpeg_4 libui ];
 
diff --git a/pkgs/tools/wayland/gtklock/default.nix b/pkgs/tools/wayland/gtklock/default.nix
index eac509c6b3d86..79e3870b81a45 100644
--- a/pkgs/tools/wayland/gtklock/default.nix
+++ b/pkgs/tools/wayland/gtklock/default.nix
@@ -5,7 +5,7 @@
 , ninja
 , scdoc
 , pkg-config
-, wrapGAppsHook
+, wrapGAppsHook3
 , gtk3
 , pam
 , gtk-session-lock
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     ninja
     scdoc
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index ab8a257bd456b..ccf984abd7d95 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1329,6 +1329,7 @@ mapAliases ({
   wordpress6_2 = throw "'wordpress6_2' has been removed in favor of the latest version"; # Added 2023-10-10
   wormhole-rs = magic-wormhole-rs; # Added 2022-05-30. preserve, reason: Arch package name, main binary name
   wmii_hg = wmii;
+  wrapGAppsHook = wrapGAppsHook3; # Added 2024-03-26
   wxGTK30 = throw "wxGTK30 has been removed from nixpkgs as it has reached end of life"; # Added 2023-03-22
   wxGTK30-gtk2 = wxGTK30; # Added 2022-12-03
   wxGTK30-gtk3 = wxGTK30; # Added 2022-12-03
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 80b6ef933604c..af563c7ed52f4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1434,13 +1434,18 @@ with pkgs;
     name = "find-xml-catalogs-hook";
   } ../build-support/setup-hooks/find-xml-catalogs.sh;
 
-  wrapGAppsHook = callPackage ../build-support/setup-hooks/wrap-gapps-hook {
-    makeWrapper = makeBinaryWrapper;
+  wrapGAppsHook3 = wrapGAppsNoGuiHook.override {
+    isGraphical = true;
   };
 
-  wrapGAppsHook4 = wrapGAppsHook.override { gtk3 = __splicedPackages.gtk4; };
+  wrapGAppsHook4 = wrapGAppsNoGuiHook.override {
+    isGraphical = true;
+    gtk3 = __splicedPackages.gtk4;
+  };
 
-  wrapGAppsNoGuiHook = wrapGAppsHook.override { isGraphical = false; };
+  wrapGAppsNoGuiHook = callPackage ../build-support/setup-hooks/wrap-gapps-hook {
+    makeWrapper = makeBinaryWrapper;
+  };
 
   separateDebugInfo = makeSetupHook {
     name = "separate-debug-info-hook";
@@ -4426,8 +4431,6 @@ with pkgs;
 
   bundletool = callPackage ../development/tools/bundletool { };
 
-  bustle = haskellPackages.bustle;
-
   bwm_ng = callPackage ../tools/networking/bwm-ng { };
 
   bwbasic = callPackage ../development/interpreters/bwbasic { };
@@ -18642,15 +18645,7 @@ with pkgs;
 
   doclifter = callPackage ../development/tools/misc/doclifter { };
 
-  docutils = with python3Packages; toPythonApplication (
-    docutils.overridePythonAttrs (attrs: rec {
-      version = "0.20.1";
-      src = attrs.src.override {
-        inherit version;
-        hash = "sha256-8IpOJ2w6FYOobc4+NKuj/gTQK7ot1R7RYQYkToqSPjs=";
-      };
-    })
-  );
+  docutils = with python3Packages; toPythonApplication docutils;
 
   doctl = callPackage ../development/tools/doctl { };
 
@@ -24998,7 +24993,7 @@ with pkgs;
   whereami = callPackage ../development/libraries/whereami { };
 
   wildmidi = callPackage ../development/libraries/wildmidi {
-    inherit (darwin.apple_sdk.frameworks) OpenAL;
+    inherit (darwin.apple_sdk.frameworks) OpenAL CoreAudioKit;
   };
 
   wiredtiger = callPackage ../development/libraries/wiredtiger { };
@@ -25432,17 +25427,17 @@ with pkgs;
   };
 
   # Steel Bank Common Lisp
-  sbcl_2_4_2 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.4.2"; };
+  sbcl_2_4_3 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.4.3"; };
     faslExt = "fasl";
     flags = [ "--dynamic-space-size" "3000" ];
   };
-  sbcl_2_4_3 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.4.3"; };
+  sbcl_2_4_4 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.4.4"; };
     faslExt = "fasl";
     flags = [ "--dynamic-space-size" "3000" ];
   };
-  sbcl = sbcl_2_4_3;
+  sbcl = sbcl_2_4_4;
 
   sbclPackages = recurseIntoAttrs sbcl.pkgs;
 
@@ -27174,9 +27169,7 @@ with pkgs;
 
   fatrace = callPackage ../os-specific/linux/fatrace { };
 
-  ffado = libsForQt5.callPackage ../os-specific/linux/ffado {
-    inherit (linuxPackages) kernel;
-  };
+  ffado = libsForQt5.callPackage ../os-specific/linux/ffado { };
   libffado = ffado;
 
   fbterm = callPackage ../os-specific/linux/fbterm { };
@@ -31276,8 +31269,6 @@ with pkgs;
 
   fractal = callPackage ../applications/networking/instant-messengers/fractal { };
 
-  fragments = callPackage ../applications/networking/p2p/fragments { };
-
   freedv = callPackage ../applications/radio/freedv {
     inherit (darwin.apple_sdk.frameworks) AppKit AVFoundation Cocoa CoreMedia;
     codec2 = codec2.override {
@@ -31320,10 +31311,19 @@ with pkgs;
 
   pulseaudio-module-xrdp = callPackage ../applications/networking/remote/xrdp/pulseaudio-module-xrdp { };
 
-  freerdp = callPackage ../applications/networking/remote/freerdp {
-    inherit (darwin.apple_sdk.frameworks) AudioToolbox AVFoundation Carbon Cocoa CoreMedia;
-    inherit (gst_all_1) gstreamer gst-plugins-base gst-plugins-good;
-  };
+  inherit
+    ({
+      freerdp = callPackage ../applications/networking/remote/freerdp {
+        inherit (darwin.apple_sdk.frameworks) AudioToolbox AVFoundation Carbon Cocoa CoreMedia;
+        inherit (gst_all_1) gstreamer gst-plugins-base gst-plugins-good;
+      };
+      freerdp3 = callPackage ../applications/networking/remote/freerdp/3.nix {
+        inherit (darwin.apple_sdk.frameworks) AudioToolbox AVFoundation Carbon Cocoa CoreMedia;
+      };
+    })
+    freerdp
+    freerdp3
+    ;
 
   freerdpUnstable = freerdp;
 
@@ -31428,7 +31428,7 @@ with pkgs;
 
   m32edit = callPackage ../applications/audio/midas/m32edit.nix { };
 
-  manim = callPackage ../applications/video/manim { };
+  manim = python3Packages.toPythonApplication python3Packages.manim;
 
   manim-slides = python3Packages.toPythonApplication (
     python3Packages.manim-slides.override {
@@ -33674,10 +33674,6 @@ with pkgs;
 
   oranda = callPackage ../applications/misc/oranda { };
 
-  orca = python3Packages.callPackage ../applications/misc/orca {
-    inherit pkg-config;
-  };
-
   orca-c = callPackage ../applications/audio/orca-c { };
 
   organicmaps = qt6Packages.callPackage ../applications/misc/organicmaps { };
@@ -34417,8 +34413,6 @@ with pkgs;
 
   shavee = callPackage ../applications/misc/shavee { };
 
-  shell_gpt = callPackage ../tools/llm/shell_gpt { };
-
   shfmt = callPackage ../tools/text/shfmt { };
 
   shipments = callPackage ../applications/misc/shipments { };
@@ -37815,6 +37809,7 @@ with pkgs;
     gnome43Extensions
     gnome44Extensions
     gnome45Extensions
+    gnome46Extensions
   ;
 
   gnome-connections = callPackage ../desktops/gnome/apps/gnome-connections { };
@@ -39046,8 +39041,6 @@ with pkgs;
 
   scilla = callPackage ../tools/security/scilla { };
 
-  scotch = callPackage ../applications/science/math/scotch { };
-
   mininet = callPackage ../tools/virtualization/mininet { };
 
   msieve = callPackage ../applications/science/math/msieve { };
@@ -40092,7 +40085,7 @@ with pkgs;
   rfc-bibtex = callPackage ../tools/typesetting/rfc-bibtex { };
 
   pick-colour-picker = python3Packages.callPackage ../applications/graphics/pick-colour-picker {
-    inherit glib gtk3 gobject-introspection wrapGAppsHook;
+    inherit glib gtk3 gobject-introspection wrapGAppsHook3;
   };
 
   rpl = callPackage ../tools/text/rpl { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 42226374159fc..cc772b49912a5 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -3312,6 +3312,9 @@ with self; {
       "-Wno-error=implicit-int"
       "-Wno-error=int-conversion"
     ]);
+    postPatch = ''
+      substituteInPlace Makefile.PL --replace pkg-config $PKG_CONFIG
+    '';
     NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.pcsclite}/lib -lpcsclite";
     # tests fail; look unfinished
     doCheck = false;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8ba934720ea54..dac95ee350117 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7116,6 +7116,8 @@ self: super: with self; {
 
   manhole = callPackage ../development/python-modules/manhole { };
 
+  manim = callPackage ../development/python-modules/manim { };
+
   manimpango = callPackage ../development/python-modules/manimpango {
     inherit (pkgs.darwin.apple_sdk.frameworks) AppKit;
   };
@@ -8710,10 +8712,9 @@ self: super: with self; {
 
   nfcpy = callPackage ../development/python-modules/nfcpy { };
 
-  nftables = toPythonModule (pkgs.nftables.override {
-    python3 = python;
-    withPython = true;
-  });
+  nftables = callPackage ../os-specific/linux/nftables/python.nix {
+    inherit (pkgs) nftables;
+  };
 
   nh3 = callPackage ../development/python-modules/nh3 { };
 
@@ -10978,6 +10979,12 @@ self: super: with self; {
     SDL2_image = pkgs.SDL2_image_2_0;
   };
 
+  pygame-ce = callPackage ../development/python-modules/pygame-ce {
+    inherit (pkgs.darwin.apple_sdk.frameworks) AppKit;
+    SDL2_image = pkgs.SDL2_image_2_0;
+    SDL2_mixer = pkgs.SDL2_mixer_2_0;
+  };
+
   pygame-sdl2 = callPackage ../development/python-modules/pygame-sdl2 { };
 
   pygame-gui = callPackage ../development/python-modules/pygame-gui { };
@@ -13410,6 +13417,8 @@ self: super: with self; {
 
   ruamel-yaml-clib = callPackage ../development/python-modules/ruamel-yaml-clib { };
 
+  rubicon-objc = callPackage ../development/python-modules/rubicon-objc { };
+
   rubymarshal = callPackage ../development/python-modules/rubymarshal { };
 
   ruffus = callPackage ../development/python-modules/ruffus { };
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 5ebc1c78a89fe..0706e5e5a09f8 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -266,7 +266,6 @@ let
         agda
         arion
         bench
-        bustle
         blucontrol
         cabal-install
         cabal2nix