about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/losslessaudiochecker/default.nix2
-rw-r--r--pkgs/applications/audio/sony-headphones-client/default.nix2
-rw-r--r--pkgs/applications/editors/howl/default.nix2
-rw-r--r--pkgs/applications/editors/molsketch/default.nix5
-rw-r--r--pkgs/applications/emulators/pcsx2/default.nix2
-rw-r--r--pkgs/applications/emulators/yuzu/generic.nix2
-rw-r--r--pkgs/applications/emulators/yuzu/vulkan_version.patch13
-rw-r--r--pkgs/applications/gis/openorienteering-mapper/default.nix7
-rw-r--r--pkgs/applications/gis/openorienteering-mapper/fix-qttranslations-path.diff13
-rw-r--r--pkgs/applications/gis/qmapshack/default.nix12
-rw-r--r--pkgs/applications/gis/qmapshack/fix-qttranslations-path.patch74
-rw-r--r--pkgs/applications/misc/birdtray/default.nix11
-rw-r--r--pkgs/applications/misc/birdtray/fix-qttranslations-path.diff13
-rw-r--r--pkgs/applications/misc/crow-translate/default.nix10
-rw-r--r--pkgs/applications/misc/crow-translate/fix-qttranslations-path.patch13
-rw-r--r--pkgs/applications/misc/edgetx/default.nix7
-rw-r--r--pkgs/applications/misc/etesync-dav/default.nix11
-rw-r--r--pkgs/applications/misc/gpsbabel/default.nix7
-rw-r--r--pkgs/applications/misc/gpxlab/default.nix10
-rw-r--r--pkgs/applications/misc/gpxlab/fix-qttranslations-path.patch17
-rw-r--r--pkgs/applications/misc/gpxsee/default.nix8
-rw-r--r--pkgs/applications/misc/gpxsee/fix-qttranslations-path.diff18
-rw-r--r--pkgs/applications/misc/mediainfo-gui/default.nix2
-rw-r--r--pkgs/applications/misc/mediainfo/default.nix2
-rw-r--r--pkgs/applications/misc/merkaartor/default.nix2
-rw-r--r--pkgs/applications/misc/mupdf/0001-Use-command-v-in-favor-of-which.patch26
-rw-r--r--pkgs/applications/misc/mupdf/default.nix19
-rw-r--r--pkgs/applications/misc/opentx/default.nix7
-rw-r--r--pkgs/applications/misc/ubpm/default.nix5
-rw-r--r--pkgs/applications/misc/valentina/default.nix10
-rw-r--r--pkgs/applications/misc/valentina/fix-qttranslations-path.patch37
-rw-r--r--pkgs/applications/networking/instant-messengers/linphone/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/qtox/default.nix2
-rw-r--r--pkgs/applications/networking/mailreaders/trojita/default.nix8
-rw-r--r--pkgs/applications/networking/mailreaders/trojita/fix-qttranslations-path.patch13
-rw-r--r--pkgs/applications/office/PageEdit/default.nix4
-rw-r--r--pkgs/applications/radio/rscw/default.nix2
-rw-r--r--pkgs/applications/science/astronomy/stellarium/default.nix4
-rw-r--r--pkgs/applications/science/biology/sratoolkit/default.nix2
-rw-r--r--pkgs/applications/science/electronics/flatcam/default.nix8
-rw-r--r--pkgs/applications/science/electronics/xyce/default.nix2
-rw-r--r--pkgs/applications/science/logic/ekrhyper/default.nix2
-rw-r--r--pkgs/applications/science/misc/golly/default.nix2
-rw-r--r--pkgs/applications/video/davinci-resolve/default.nix4
-rw-r--r--pkgs/build-support/cc-wrapper/add-hardening.sh27
-rw-r--r--pkgs/build-support/cc-wrapper/cc-wrapper.sh4
-rw-r--r--pkgs/build-support/libredirect/libredirect.c5
-rw-r--r--pkgs/build-support/libredirect/test.c12
-rw-r--r--pkgs/data/fonts/maple-font/default.nix9
-rw-r--r--pkgs/data/fonts/roboto-mono/default.nix2
-rw-r--r--pkgs/data/fonts/rubik/default.nix2
-rw-r--r--pkgs/data/misc/unicode-character-database/default.nix4
-rw-r--r--pkgs/data/misc/unihan-database/default.nix4
-rw-r--r--pkgs/desktops/rox/rox-filer/default.nix2
-rw-r--r--pkgs/development/compilers/flutter/engine-artifacts/default.nix2
-rw-r--r--pkgs/development/compilers/glslang/default.nix19
-rw-r--r--pkgs/development/interpreters/python/hooks/default.nix25
-rw-r--r--pkgs/development/interpreters/python/hooks/pypa-build-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/hooks/pypa-install-hook.sh26
-rw-r--r--pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh17
-rw-r--r--pkgs/development/interpreters/python/mk-python-derivation.nix51
-rw-r--r--pkgs/development/interpreters/python/python-packages-base.nix9
-rw-r--r--pkgs/development/interpreters/python/python2/mk-python-derivation.nix252
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/default.nix4
-rw-r--r--pkgs/development/interpreters/tcl/generic.nix19
-rw-r--r--pkgs/development/libraries/SDL2/default.nix4
-rw-r--r--pkgs/development/libraries/avahi/default.nix7
-rw-r--r--pkgs/development/libraries/dab_lib/default.nix2
-rw-r--r--pkgs/development/libraries/fdk-aac/default.nix2
-rw-r--r--pkgs/development/libraries/gettext/0001-msginit-Do-not-use-POT-Creation-Date.patch32
-rw-r--r--pkgs/development/libraries/gettext/default.nix3
-rw-r--r--pkgs/development/libraries/glog/default.nix32
-rw-r--r--pkgs/development/libraries/gnu-config/default.nix26
-rw-r--r--pkgs/development/libraries/java/mockobjects/default.nix2
-rw-r--r--pkgs/development/libraries/kdb/default.nix6
-rw-r--r--pkgs/development/libraries/kde-frameworks/kirigami2.nix6
-rw-r--r--pkgs/development/libraries/libarchive/default.nix26
-rw-r--r--pkgs/development/libraries/liblc3/default.nix4
-rw-r--r--pkgs/development/libraries/libraw/default.nix30
-rw-r--r--pkgs/development/libraries/libsndfile/default.nix4
-rw-r--r--pkgs/development/libraries/liburing/default.nix12
-rw-r--r--pkgs/development/libraries/libzen/default.nix2
-rw-r--r--pkgs/development/libraries/liquidfun/default.nix2
-rw-r--r--pkgs/development/libraries/mesa-glu/default.nix2
-rw-r--r--pkgs/development/libraries/nss/generic.nix2
-rw-r--r--pkgs/development/libraries/pipewire/default.nix6
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix19
-rw-r--r--pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch79
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtbase.nix3
-rw-r--r--pkgs/development/libraries/qt-5/modules/qttools.nix2
-rw-r--r--pkgs/development/libraries/qt-5/modules/qttranslations.nix3
-rw-r--r--pkgs/development/libraries/qt-6/default.nix15
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtbase.nix3
-rw-r--r--pkgs/development/libraries/qt-6/modules/qttranslations.nix3
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtwebengine.nix11
-rw-r--r--pkgs/development/libraries/qt-6/patches/0008-qtbase-allow-translations-outside-prefix.patch13
-rw-r--r--pkgs/development/libraries/qt-6/patches/qtwebengine-locales-path.patch28
-rw-r--r--pkgs/development/libraries/qt-6/qtModule.nix2
-rw-r--r--pkgs/development/libraries/re2/default.nix9
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/snappy/default.nix9
-rw-r--r--pkgs/development/libraries/spirv-headers/default.nix4
-rw-r--r--pkgs/development/libraries/tpm2-tss/default.nix35
-rw-r--r--pkgs/development/libraries/vulkan-headers/default.nix4
-rwxr-xr-xpkgs/development/libraries/vulkan-headers/update.sh3
-rw-r--r--pkgs/development/libraries/vulkan-loader/default.nix4
-rw-r--r--pkgs/development/libraries/vulkan-utility-libraries/default.nix24
-rw-r--r--pkgs/development/lua-modules/overrides.nix4
-rw-r--r--pkgs/development/python-modules/afdko/default.nix2
-rw-r--r--pkgs/development/python-modules/aioambient/default.nix17
-rw-r--r--pkgs/development/python-modules/ansible-pylibssh/default.nix5
-rw-r--r--pkgs/development/python-modules/anywidget/default.nix10
-rw-r--r--pkgs/development/python-modules/astroid/default.nix4
-rw-r--r--pkgs/development/python-modules/attrs/default.nix20
-rw-r--r--pkgs/development/python-modules/attrs/remove-hatch-plugins.patch74
-rw-r--r--pkgs/development/python-modules/autarco/default.nix26
-rw-r--r--pkgs/development/python-modules/awkward-cpp/default.nix2
-rw-r--r--pkgs/development/python-modules/bootstrap/build/default.nix49
-rw-r--r--pkgs/development/python-modules/bootstrap/flit-core/default.nix29
-rw-r--r--pkgs/development/python-modules/bootstrap/installer/default.nix29
-rw-r--r--pkgs/development/python-modules/bqplot/default.nix10
-rw-r--r--pkgs/development/python-modules/bqscales/default.nix14
-rw-r--r--pkgs/development/python-modules/build/default.nix71
-rw-r--r--pkgs/development/python-modules/cairocffi/default.nix17
-rw-r--r--pkgs/development/python-modules/celery-types/default.nix14
-rw-r--r--pkgs/development/python-modules/cemm/default.nix12
-rw-r--r--pkgs/development/python-modules/cmake/default.nix43
-rw-r--r--pkgs/development/python-modules/cmake/stub/cmake/__init__.py19
-rw-r--r--pkgs/development/python-modules/cmake/stub/pyproject.toml13
-rw-r--r--pkgs/development/python-modules/cohere/default.nix10
-rw-r--r--pkgs/development/python-modules/cypari2/default.nix3
-rw-r--r--pkgs/development/python-modules/distributed/default.nix7
-rw-r--r--pkgs/development/python-modules/django-scim2/default.nix2
-rw-r--r--pkgs/development/python-modules/drms/default.nix5
-rw-r--r--pkgs/development/python-modules/esphome-dashboard-api/default.nix8
-rw-r--r--pkgs/development/python-modules/fastparquet/default.nix25
-rw-r--r--pkgs/development/python-modules/fastparquet/version.patch7
-rw-r--r--pkgs/development/python-modules/fb-re2/default.nix11
-rw-r--r--pkgs/development/python-modules/fe25519/default.nix12
-rw-r--r--pkgs/development/python-modules/flask-reverse-proxy-fix/default.nix10
-rw-r--r--pkgs/development/python-modules/flask-security-too/default.nix5
-rw-r--r--pkgs/development/python-modules/fountains/default.nix2
-rw-r--r--pkgs/development/python-modules/ge25519/default.nix12
-rw-r--r--pkgs/development/python-modules/gevent/default.nix7
-rw-r--r--pkgs/development/python-modules/gpytorch/default.nix16
-rw-r--r--pkgs/development/python-modules/grpc-interceptor/default.nix17
-rw-r--r--pkgs/development/python-modules/gyp/default.nix6
-rw-r--r--pkgs/development/python-modules/installer/default.nix25
-rw-r--r--pkgs/development/python-modules/ipycanvas/default.nix10
-rw-r--r--pkgs/development/python-modules/ipyniivue/default.nix13
-rw-r--r--pkgs/development/python-modules/ipyparallel/default.nix8
-rw-r--r--pkgs/development/python-modules/ipytablewidgets/default.nix9
-rw-r--r--pkgs/development/python-modules/jedi/default.nix15
-rw-r--r--pkgs/development/python-modules/jsonschema/default.nix2
-rw-r--r--pkgs/development/python-modules/jupyter-collaboration/default.nix2
-rw-r--r--pkgs/development/python-modules/knx-frontend/default.nix12
-rw-r--r--pkgs/development/python-modules/laszip/default.nix18
-rw-r--r--pkgs/development/python-modules/matplotlib/default.nix8
-rw-r--r--pkgs/development/python-modules/mip/default.nix14
-rw-r--r--pkgs/development/python-modules/ml-dtypes/default.nix8
-rw-r--r--pkgs/development/python-modules/monai-deploy/default.nix6
-rw-r--r--pkgs/development/python-modules/msprime/default.nix6
-rw-r--r--pkgs/development/python-modules/multiset/default.nix18
-rw-r--r--pkgs/development/python-modules/napalm/hp-procurve.nix22
-rw-r--r--pkgs/development/python-modules/netcdf4/default.nix9
-rw-r--r--pkgs/development/python-modules/newversion/default.nix10
-rw-r--r--pkgs/development/python-modules/ninja/default.nix1
-rw-r--r--pkgs/development/python-modules/ninja/stub/ninja/__init__.py2
-rw-r--r--pkgs/development/python-modules/nitime/default.nix28
-rw-r--r--pkgs/development/python-modules/pandas/default.nix8
-rw-r--r--pkgs/development/python-modules/pg8000/default.nix6
-rw-r--r--pkgs/development/python-modules/pillow/default.nix10
-rw-r--r--pkgs/development/python-modules/pint-pandas/default.nix6
-rw-r--r--pkgs/development/python-modules/pip-tools/default.nix13
-rw-r--r--pkgs/development/python-modules/pip/default.nix30
-rw-r--r--pkgs/development/python-modules/pipdeptree/default.nix2
-rw-r--r--pkgs/development/python-modules/poetry-core/default.nix41
-rw-r--r--pkgs/development/python-modules/polyline/default.nix12
-rw-r--r--pkgs/development/python-modules/proxy-py/default.nix19
-rw-r--r--pkgs/development/python-modules/py-dormakaba-dkey/default.nix12
-rw-r--r--pkgs/development/python-modules/pyairvisual/default.nix13
-rw-r--r--pkgs/development/python-modules/pydeck/default.nix3
-rw-r--r--pkgs/development/python-modules/pydicom-seg/default.nix13
-rw-r--r--pkgs/development/python-modules/pyhanko-certvalidator/default.nix6
-rw-r--r--pkgs/development/python-modules/pyinsteon/default.nix12
-rw-r--r--pkgs/development/python-modules/pymdown-extensions/default.nix14
-rw-r--r--pkgs/development/python-modules/pymilvus/default.nix6
-rw-r--r--pkgs/development/python-modules/pypandoc/default.nix6
-rw-r--r--pkgs/development/python-modules/pypck/default.nix12
-rw-r--r--pkgs/development/python-modules/pyproject-api/default.nix10
-rw-r--r--pkgs/development/python-modules/pyproject-hooks/default.nix37
-rw-r--r--pkgs/development/python-modules/pyqt-builder/default.nix19
-rw-r--r--pkgs/development/python-modules/python-creole/default.nix13
-rw-r--r--pkgs/development/python-modules/python-homewizard-energy/default.nix12
-rw-r--r--pkgs/development/python-modules/python-lsp-server/default.nix14
-rw-r--r--pkgs/development/python-modules/python-magic/default.nix8
-rw-r--r--pkgs/development/python-modules/python-matter-server/default.nix12
-rw-r--r--pkgs/development/python-modules/python-otbr-api/default.nix14
-rw-r--r--pkgs/development/python-modules/python-telegram-bot/default.nix9
-rw-r--r--pkgs/development/python-modules/python-vagrant/default.nix18
-rw-r--r--pkgs/development/python-modules/pytrends/default.nix4
-rw-r--r--pkgs/development/python-modules/pyvisa-sim/default.nix11
-rw-r--r--pkgs/development/python-modules/qcodes-loop/default.nix18
-rw-r--r--pkgs/development/python-modules/rasterio/default.nix6
-rw-r--r--pkgs/development/python-modules/remarshal/default.nix12
-rw-r--r--pkgs/development/python-modules/repoze_sphinx_autointerface/default.nix13
-rw-r--r--pkgs/development/python-modules/reproject/default.nix8
-rw-r--r--pkgs/development/python-modules/riscv-config/default.nix11
-rw-r--r--pkgs/development/python-modules/rst2pdf/default.nix7
-rw-r--r--pkgs/development/python-modules/scikit-build-core/default.nix10
-rw-r--r--pkgs/development/python-modules/scikit-misc/default.nix8
-rw-r--r--pkgs/development/python-modules/scim2-filter-parser/default.nix10
-rw-r--r--pkgs/development/python-modules/scipy/default.nix31
-rwxr-xr-xpkgs/development/python-modules/scipy/update.sh8
-rw-r--r--pkgs/development/python-modules/scramp/default.nix3
-rw-r--r--pkgs/development/python-modules/setupmeta/default.nix4
-rw-r--r--pkgs/development/python-modules/setuptools/default.nix70
-rw-r--r--pkgs/development/python-modules/socksio/default.nix10
-rw-r--r--pkgs/development/python-modules/soxr/default.nix6
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-spelling/default.nix8
-rw-r--r--pkgs/development/python-modules/stim/default.nix15
-rw-r--r--pkgs/development/python-modules/stravalib/default.nix9
-rw-r--r--pkgs/development/python-modules/tornado/4.nix9
-rw-r--r--pkgs/development/python-modules/tornado/5.nix9
-rw-r--r--pkgs/development/python-modules/tornado/default.nix30
-rw-r--r--pkgs/development/python-modules/tweedledum/default.nix5
-rw-r--r--pkgs/development/python-modules/wheel/default.nix17
-rw-r--r--pkgs/development/python-modules/xlsx2csv/default.nix4
-rw-r--r--pkgs/development/python-modules/xpath-expressions/default.nix20
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/waf/default.nix76
-rw-r--r--pkgs/development/tools/build-managers/waf/hook.nix24
-rw-r--r--pkgs/development/tools/build-managers/waf/setup-hook.sh (renamed from pkgs/development/tools/build-managers/wafHook/setup-hook.sh)28
-rw-r--r--pkgs/development/tools/build-managers/wafHook/default.nix10
-rw-r--r--pkgs/development/tools/misc/blackfire/php-probe.nix2
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json58
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix27
-rw-r--r--pkgs/development/tools/rust/maturin/default.nix6
-rw-r--r--pkgs/development/tools/spirv-tools/default.nix6
-rw-r--r--pkgs/development/tools/tabnine/default.nix2
-rw-r--r--pkgs/development/tools/vulkan-validation-layers/default.nix26
-rw-r--r--pkgs/games/qgo/default.nix6
-rw-r--r--pkgs/misc/jackaudio/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/cf-setup-hook.sh2
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh2
-rw-r--r--pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix2
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix26
-rw-r--r--pkgs/os-specific/linux/xone/default.nix2
-rw-r--r--pkgs/os-specific/linux/xpadneo/default.nix2
-rw-r--r--pkgs/servers/home-assistant/default.nix5
-rw-r--r--pkgs/servers/home-assistant/intents.nix8
-rw-r--r--pkgs/servers/matrix-synapse/default.nix5
-rw-r--r--pkgs/servers/matrix-synapse/plugins/mjolnir-antispam.nix2
-rw-r--r--pkgs/servers/search/elasticsearch/plugins.nix2
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/3_1.nix4
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/3_2.nix4
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/3_3.nix6
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/default.nix20
-rw-r--r--pkgs/stdenv/generic/setup.sh2
-rw-r--r--pkgs/tools/archivers/unar/default.nix2
-rw-r--r--pkgs/tools/audio/stt/default.nix3
-rw-r--r--pkgs/tools/backup/gphotos-sync/default.nix14
-rw-r--r--pkgs/tools/graphics/spirv-cross/default.nix9
-rw-r--r--pkgs/tools/graphics/vulkan-extension-layer/default.nix10
-rw-r--r--pkgs/tools/graphics/vulkan-tools-lunarg/add-missing-macro-definition.patch26
-rw-r--r--pkgs/tools/graphics/vulkan-tools-lunarg/default.nix16
-rw-r--r--pkgs/tools/graphics/vulkan-tools-lunarg/skip-qnx-extension.patch13
-rw-r--r--pkgs/tools/graphics/vulkan-tools/default.nix5
-rw-r--r--pkgs/tools/misc/ent/default.nix2
-rw-r--r--pkgs/tools/misc/file/32-bit-time_t.patch38
-rw-r--r--pkgs/tools/misc/file/default.nix17
-rw-r--r--pkgs/tools/misc/file/pyzip.patch36
-rw-r--r--pkgs/tools/misc/ksnip/default.nix4
-rw-r--r--pkgs/tools/misc/usbimager/default.nix2
-rw-r--r--pkgs/tools/networking/bully/default.nix2
-rw-r--r--pkgs/tools/networking/ookla-speedtest/default.nix4
-rw-r--r--pkgs/tools/package-management/poetry/default.nix4
-rw-r--r--pkgs/tools/security/apachetomcatscanner/default.nix6
-rw-r--r--pkgs/tools/security/mpw/default.nix2
-rw-r--r--pkgs/tools/security/nitrokey-app/default.nix4
-rw-r--r--pkgs/tools/security/qdigidoc/default.nix5
-rw-r--r--pkgs/tools/security/web-eid-app/default.nix4
-rw-r--r--pkgs/tools/text/tesh/default.nix22
-rw-r--r--pkgs/tools/typesetting/xmlroff/default.nix2
-rw-r--r--pkgs/tools/virtualization/awsebcli/default.nix5
-rw-r--r--pkgs/tools/virtualization/mkosi/default.nix5
-rw-r--r--pkgs/top-level/all-packages.nix19
-rw-r--r--pkgs/top-level/python-packages.nix20
289 files changed, 2628 insertions, 1143 deletions
diff --git a/pkgs/applications/audio/losslessaudiochecker/default.nix b/pkgs/applications/audio/losslessaudiochecker/default.nix
index b7150d6b67713..5ec91f4260f83 100644
--- a/pkgs/applications/audio/losslessaudiochecker/default.nix
+++ b/pkgs/applications/audio/losslessaudiochecker/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoPatchelfHook ];
 
-  setSourceRoot = "sourceRoot=$PWD";
+  sourceRoot = ".";
 
   dontBuild = true;
 
diff --git a/pkgs/applications/audio/sony-headphones-client/default.nix b/pkgs/applications/audio/sony-headphones-client/default.nix
index 03fc6299d5c0a..86746cbc53756 100644
--- a/pkgs/applications/audio/sony-headphones-client/default.nix
+++ b/pkgs/applications/audio/sony-headphones-client/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config copyDesktopItems ];
   buildInputs = [ bluez dbus glew glfw imgui ];
 
-  sourceRoot = "./${src.name}/Client";
+  sourceRoot = "${src.name}/Client";
 
   cmakeFlags = [ "-Wno-dev" ];
 
diff --git a/pkgs/applications/editors/howl/default.nix b/pkgs/applications/editors/howl/default.nix
index ff9a30074120e..030c6666e11dd 100644
--- a/pkgs/applications/editors/howl/default.nix
+++ b/pkgs/applications/editors/howl/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "1qc58l3rkr37cj6vhf8c7bnwbz93nscyraz7jxqwjq6k4gj0cjw3";
   };
 
-  sourceRoot = "./howl-${version}/src";
+  sourceRoot = "howl-${version}/src";
 
   # The Makefile uses "/usr/local" if not explicitly overridden
   installFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/applications/editors/molsketch/default.nix b/pkgs/applications/editors/molsketch/default.nix
index d688a50f28d39..55db4096ce153 100644
--- a/pkgs/applications/editors/molsketch/default.nix
+++ b/pkgs/applications/editors/molsketch/default.nix
@@ -3,11 +3,11 @@
 , fetchurl
 , cmake
 , pkg-config
+, qttools
 , wrapQtAppsHook
 , hicolor-icon-theme
 , openbabel
 , desktop-file-utils
-, qttranslations
 }:
 
 mkDerivation rec {
@@ -37,12 +37,11 @@ mkDerivation rec {
     mv $out/lib/molsketch/* $out/lib
   '';
 
-  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
+  nativeBuildInputs = [ cmake pkg-config qttools wrapQtAppsHook ];
   buildInputs = [
     hicolor-icon-theme
     openbabel
     desktop-file-utils
-    qttranslations
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/emulators/pcsx2/default.nix b/pkgs/applications/emulators/pcsx2/default.nix
index fea7bf17ef7b0..1b016e0559dd4 100644
--- a/pkgs/applications/emulators/pcsx2/default.nix
+++ b/pkgs/applications/emulators/pcsx2/default.nix
@@ -18,7 +18,6 @@
 , qtbase
 , qtsvg
 , qttools
-, qttranslations
 , qtwayland
 , rapidyaml
 , SDL2
@@ -83,7 +82,6 @@ llvmPackages_16.stdenv.mkDerivation rec {
     qtbase
     qtsvg
     qttools
-    qttranslations
     qtwayland
     rapidyaml
     SDL2
diff --git a/pkgs/applications/emulators/yuzu/generic.nix b/pkgs/applications/emulators/yuzu/generic.nix
index 71306bdc43b53..3fdd6db84661a 100644
--- a/pkgs/applications/emulators/yuzu/generic.nix
+++ b/pkgs/applications/emulators/yuzu/generic.nix
@@ -110,7 +110,7 @@ in stdenv.mkDerivation {
   # This changes `ir/opt` to `ir/var/empty` in `externals/dynarmic/src/dynarmic/CMakeLists.txt`
   # making the build fail, as that path does not exist
   dontFixCmake = true;
-  patches = [./vulkan_version.patch];
+
   cmakeFlags = [
     # actually has a noticeable performance impact
     "-DYUZU_ENABLE_LTO=ON"
diff --git a/pkgs/applications/emulators/yuzu/vulkan_version.patch b/pkgs/applications/emulators/yuzu/vulkan_version.patch
deleted file mode 100644
index 7b77179e9f4e5..0000000000000
--- a/pkgs/applications/emulators/yuzu/vulkan_version.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Yuzu requires a version of Vulkan that has not yet been released as a stable Vulkan SDK. In case this patch fails, check which version Yuzu is currently using and verify that it still works with the version shipped in Nixpkgs.
-
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -314,7 +314,7 @@
- find_package(zstd 1.5 REQUIRED)
- 
- if (NOT YUZU_USE_EXTERNAL_VULKAN_HEADERS)
--    find_package(Vulkan 1.3.256 REQUIRED)
-+    find_package(Vulkan 1.3.250 REQUIRED)
- endif()
- 
- if (ENABLE_LIBUSB)
diff --git a/pkgs/applications/gis/openorienteering-mapper/default.nix b/pkgs/applications/gis/openorienteering-mapper/default.nix
index b73fb71f698fc..9722c3cb4dee5 100644
--- a/pkgs/applications/gis/openorienteering-mapper/default.nix
+++ b/pkgs/applications/gis/openorienteering-mapper/default.nix
@@ -14,8 +14,6 @@
 , qtlocation
 , qtsensors
 , qttools
-, qttranslations
-, substituteAll
 , zlib
 }:
 
@@ -31,11 +29,6 @@ mkDerivation rec {
   };
 
   patches = [
-    # https://github.com/NixOS/nixpkgs/issues/86054
-    (substituteAll {
-      src = ./fix-qttranslations-path.diff;
-      inherit qttranslations;
-    })
     # https://github.com/OpenOrienteering/mapper/pull/1907
     (fetchpatch {
       url = "https://github.com/OpenOrienteering/mapper/commit/bc52aa567e90a58d6963b44d5ae1909f3f841508.patch";
diff --git a/pkgs/applications/gis/openorienteering-mapper/fix-qttranslations-path.diff b/pkgs/applications/gis/openorienteering-mapper/fix-qttranslations-path.diff
deleted file mode 100644
index 06c465a8fb338..0000000000000
--- a/pkgs/applications/gis/openorienteering-mapper/fix-qttranslations-path.diff
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git i/src/util/translation_util.cpp w/src/util/translation_util.cpp
-index da03d216..c1f12751 100644
---- i/src/util/translation_util.cpp
-+++ w/src/util/translation_util.cpp
-@@ -103,7 +103,7 @@ TranslationUtil::TranslationUtil(const QString& code, QString translation_file)
- 	}
- 	
- 	QString translation_name = QLatin1String("qt_") + language.code;
--	if (!qt_translator.load(translation_name, QLibraryInfo::location(QLibraryInfo::TranslationsPath)))
-+	if (!qt_translator.load(translation_name, QLatin1String("@qttranslations@/translations")))
- 		load(qt_translator, translation_name);
- 	
- 	load(app_translator, translation_file);
diff --git a/pkgs/applications/gis/qmapshack/default.nix b/pkgs/applications/gis/qmapshack/default.nix
index 2665e74ed3952..3460f60d2b63d 100644
--- a/pkgs/applications/gis/qmapshack/default.nix
+++ b/pkgs/applications/gis/qmapshack/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchFromGitHub, cmake, substituteAll, wrapQtAppsHook
-, qtscript, qttranslations, qtwebengine, gdal, proj, routino, quazip }:
+{ lib, stdenv, fetchFromGitHub, cmake, wrapQtAppsHook
+, qtscript, qtwebengine, gdal, proj, routino, quazip }:
 
 stdenv.mkDerivation rec {
   pname = "qmapshack";
@@ -12,14 +12,6 @@ stdenv.mkDerivation rec {
     hash = "sha256-qG/fiR2J5wQZaR+xvBGjdp3L7viqki2ktkzBUf6fZi8=";
   };
 
-  patches = [
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    (substituteAll {
-      src = ./fix-qttranslations-path.patch;
-      inherit qttranslations;
-    })
-  ];
-
   nativeBuildInputs = [ cmake wrapQtAppsHook ];
 
   buildInputs = [ qtscript qtwebengine gdal proj routino quazip ];
diff --git a/pkgs/applications/gis/qmapshack/fix-qttranslations-path.patch b/pkgs/applications/gis/qmapshack/fix-qttranslations-path.patch
deleted file mode 100644
index 9f05611f5a283..0000000000000
--- a/pkgs/applications/gis/qmapshack/fix-qttranslations-path.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-diff --git i/src/qmapshack/setup/CAppSetupLinux.cpp w/src/qmapshack/setup/CAppSetupLinux.cpp
-index 7581ef32..26eba3c8 100644
---- i/src/qmapshack/setup/CAppSetupLinux.cpp
-+++ w/src/qmapshack/setup/CAppSetupLinux.cpp
-@@ -30,7 +30,7 @@ void CAppSetupLinux::initQMapShack() {
-   prepareGdal("", "");
- 
-   // setup translators
--  QString resourceDir = QLibraryInfo::location(QLibraryInfo::TranslationsPath);
-+  QLatin1String resourceDir = QLatin1String("@qttranslations@/translations");
-   QString translationPath = QCoreApplication::applicationDirPath();
-   translationPath.replace(QRegExp("bin$"), "share/qmapshack/translations");
-   prepareTranslator(resourceDir, "qt_");
-diff --git i/src/qmapshack/setup/CAppSetupMac.cpp w/src/qmapshack/setup/CAppSetupMac.cpp
-index 37602802..ae4a5a23 100644
---- i/src/qmapshack/setup/CAppSetupMac.cpp
-+++ w/src/qmapshack/setup/CAppSetupMac.cpp
-@@ -56,7 +56,7 @@ void CAppSetupMac::initQMapShack() {
- 
-   // setup translators
-   QString translationPath = getApplicationDir(relTranslationDir).absolutePath();
--  prepareTranslator(translationPath, "qt_");
-+  prepareTranslator(QLatin1String("@qttranslations@/translations"), "qt_");
-   prepareTranslator(translationPath, "qmapshack_");
- 
-   // load and apply style sheet
-diff --git i/src/qmaptool/setup/CAppSetupLinux.cpp w/src/qmaptool/setup/CAppSetupLinux.cpp
-index b703e7bb..637d653e 100644
---- i/src/qmaptool/setup/CAppSetupLinux.cpp
-+++ w/src/qmaptool/setup/CAppSetupLinux.cpp
-@@ -29,7 +29,7 @@ void CAppSetupLinux::initQMapTool() {
-   prepareGdal("", "");
- 
-   // setup translators
--  QString resourceDir = QLibraryInfo::location(QLibraryInfo::TranslationsPath);
-+  QLatin1String resourceDir = QLatin1String("@qttranslations@/translations");
-   QString translationPath = QCoreApplication::applicationDirPath();
-   translationPath.replace(QRegExp("bin$"), "share/qmaptool/translations");
-   prepareTranslator(resourceDir, "qt_");
-diff --git i/src/qmaptool/setup/CAppSetupMac.cpp w/src/qmaptool/setup/CAppSetupMac.cpp
-index dd68b9c1..84351cf4 100644
---- i/src/qmaptool/setup/CAppSetupMac.cpp
-+++ w/src/qmaptool/setup/CAppSetupMac.cpp
-@@ -57,7 +57,7 @@ void CAppSetupMac::initQMapTool() {
- 
-   // setup translators
-   QString translationPath = getApplicationDir(relTranslationDir).absolutePath();
--  prepareTranslator(translationPath, "qt_");
-+  prepareTranslator(QLatin1String("@qttranslations@/translations"), "qt_");
-   prepareTranslator(translationPath, "qmaptool_");
- 
-   migrateDirContent(defaultCachePath());
-diff --git i/src/qmt_rgb2pct/main.cpp w/src/qmt_rgb2pct/main.cpp
-index 589d3d52..5f7c12f8 100644
---- i/src/qmt_rgb2pct/main.cpp
-+++ w/src/qmt_rgb2pct/main.cpp
-@@ -47,7 +47,7 @@ static void prepareTranslator(QString translationPath, QString translationPrefix
- static void loadTranslations() {
- #if defined(Q_OS_LINUX) || defined(Q_OS_FREEBSD) || defined(__FreeBSD_kernel__) || defined(__GNU__) || \
-     defined(Q_OS_CYGWIN)
--  QString resourceDir = QLibraryInfo::location(QLibraryInfo::TranslationsPath);
-+  QLatin1String resourceDir = QLatin1String("@qttranslations@/translations");
-   QString translationPath = QCoreApplication::applicationDirPath();
-   translationPath.replace(QRegExp("bin$"), "share/" APP_STR "/translations");
-   prepareTranslator(resourceDir, "qt_");
-@@ -58,7 +58,7 @@ static void loadTranslations() {
-   // os x
-   static QString relTranslationDir = "Resources/translations";  // app
-   QString translationPath = getApplicationDir(relTranslationDir).absolutePath();
--  prepareTranslator(translationPath, "qt_");
-+  prepareTranslator(QLatin1String("@qttranslations@/translations"), "qt_");
-   prepareTranslator(translationPath, APP_STR "_");
- #endif
- 
diff --git a/pkgs/applications/misc/birdtray/default.nix b/pkgs/applications/misc/birdtray/default.nix
index f007fb71377be..5ab42d36b3a02 100644
--- a/pkgs/applications/misc/birdtray/default.nix
+++ b/pkgs/applications/misc/birdtray/default.nix
@@ -7,7 +7,6 @@
   , qtbase
   , qttools
   , qtx11extras
-  , qttranslations
 }:
 
 mkDerivation rec {
@@ -21,21 +20,11 @@ mkDerivation rec {
     sha256 = "1469ng6zk0qx0qfsihrnlz1j9i1wk0hx4vqdaplz9mdpyxvmlryk";
   };
 
-  patches = [
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    ./fix-qttranslations-path.diff
-  ];
-
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     qtbase qttools qtx11extras
   ];
 
-  postPatch = ''
-    substituteInPlace src/birdtrayapp.cpp \
-      --subst-var-by qttranslations ${qttranslations}
-  '';
-
   # Wayland support is broken.
   # https://github.com/gyunaev/birdtray/issues/113#issuecomment-621742315
   qtWrapperArgs = [ "--set QT_QPA_PLATFORM xcb" ];
diff --git a/pkgs/applications/misc/birdtray/fix-qttranslations-path.diff b/pkgs/applications/misc/birdtray/fix-qttranslations-path.diff
deleted file mode 100644
index 2a379b5e2744e..0000000000000
--- a/pkgs/applications/misc/birdtray/fix-qttranslations-path.diff
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/birdtrayapp.cpp b/src/birdtrayapp.cpp
-index 847b4d3..3a3709a 100644
---- a/src/birdtrayapp.cpp
-+++ b/src/birdtrayapp.cpp
-@@ -130,7 +130,7 @@ bool BirdtrayApp::loadTranslations() {
-             [](QString path) { return path.append("/translations"); });
-     QLocale locale = QLocale::system();
-     bool success = loadTranslation(
--            qtTranslator, locale, "qt", {QLibraryInfo::location(QLibraryInfo::TranslationsPath)});
-+            qtTranslator, locale, "qt", {QLatin1String("@qttranslations@/translations")});
-     success &= loadTranslation(dynamicTranslator, locale, "dynamic", locations);
-     success &= loadTranslation(mainTranslator, locale, "main", locations);
-     return success;
diff --git a/pkgs/applications/misc/crow-translate/default.nix b/pkgs/applications/misc/crow-translate/default.nix
index 77611e2da43c6..9c207dcd77c7b 100644
--- a/pkgs/applications/misc/crow-translate/default.nix
+++ b/pkgs/applications/misc/crow-translate/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchzip
-, substituteAll
 , cmake
 , extra-cmake-modules
 , qttools
@@ -10,7 +9,6 @@
 , tesseract4
 , qtmultimedia
 , qtx11extras
-, qttranslations
 , wrapQtAppsHook
 , gst_all_1
 , testers
@@ -26,14 +24,6 @@ stdenv.mkDerivation rec {
     hash = "sha256-PvfruCqmTBFLWLeIL9NV6+H2AifXcY97ImHzD1zEs28=";
   };
 
-  patches = [
-    (substituteAll {
-      # See https://github.com/NixOS/nixpkgs/issues/86054
-      src = ./fix-qttranslations-path.patch;
-      inherit qttranslations;
-    })
-  ];
-
   postPatch = ''
     substituteInPlace data/io.crow_translate.CrowTranslate.desktop \
       --replace "Exec=qdbus" "Exec=${lib.getBin qttools}/bin/qdbus"
diff --git a/pkgs/applications/misc/crow-translate/fix-qttranslations-path.patch b/pkgs/applications/misc/crow-translate/fix-qttranslations-path.patch
deleted file mode 100644
index 65cfbdf1acf28..0000000000000
--- a/pkgs/applications/misc/crow-translate/fix-qttranslations-path.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git i/src/settings/appsettings.cpp w/src/settings/appsettings.cpp
-index 32cabfb..aab92ea 100644
---- i/src/settings/appsettings.cpp
-+++ w/src/settings/appsettings.cpp
-@@ -79,7 +79,7 @@ void AppSettings::applyLocale(const QLocale &locale)
-     const QLocale newLocale = locale == defaultLocale() ? QLocale::system() : locale;
-     QLocale::setDefault(newLocale);
-     s_appTranslator.load(newLocale, QStringLiteral(PROJECT_NAME), QStringLiteral("_"), QStandardPaths::locate(QStandardPaths::AppDataLocation, i18nDir, QStandardPaths::LocateDirectory));
--    s_qtTranslator.load(newLocale, QStringLiteral("qt"), QStringLiteral("_"), QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+    s_qtTranslator.load(newLocale, QStringLiteral("qt"), QStringLiteral("_"), QLatin1String("@qttranslations@/translations"));
- }
- 
- QLocale AppSettings::defaultLocale()
diff --git a/pkgs/applications/misc/edgetx/default.nix b/pkgs/applications/misc/edgetx/default.nix
index 785ad0ba229a5..9e7cf60af1a19 100644
--- a/pkgs/applications/misc/edgetx/default.nix
+++ b/pkgs/applications/misc/edgetx/default.nix
@@ -1,6 +1,6 @@
 { lib, mkDerivation, fetchFromGitHub
 , cmake, gcc-arm-embedded, python3Packages
-, qtbase, qtmultimedia, qttranslations, SDL, gtest
+, qtbase, qtmultimedia, qttools, SDL, gtest
 , dfu-util
 }:
 
@@ -16,9 +16,9 @@ mkDerivation rec {
     sha256 = "sha256-bKMAyONy1Udd+2nDVEMrtIsnfqrNuBVMWU7nCqvZ+3E=";
   };
 
-  nativeBuildInputs = [ cmake gcc-arm-embedded python3Packages.pillow ];
+  nativeBuildInputs = [ cmake gcc-arm-embedded python3Packages.pillow qttools ];
 
-  buildInputs = [ qtbase qtmultimedia qttranslations SDL ];
+  buildInputs = [ qtbase qtmultimedia SDL ];
 
   postPatch = ''
     sed -i companion/src/burnconfigdialog.cpp \
@@ -27,7 +27,6 @@ mkDerivation rec {
 
   cmakeFlags = [
     "-DGTEST_ROOT=${gtest.src}/googletest"
-    "-DQT_TRANSLATIONS_DIR=${qttranslations}/translations"
     "-DDFU_UTIL_PATH=${dfu-util}/bin/dfu-util"
     # file RPATH_CHANGE could not write new RPATH
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
diff --git a/pkgs/applications/misc/etesync-dav/default.nix b/pkgs/applications/misc/etesync-dav/default.nix
index 301a5eb09b222..dbf22e9508304 100644
--- a/pkgs/applications/misc/etesync-dav/default.nix
+++ b/pkgs/applications/misc/etesync-dav/default.nix
@@ -16,6 +16,17 @@ let
           inherit version;
           hash = "sha256-4RIMIoyi9VO0cN9KX6knq2YlhGdSYGmYGz6wqRkCaH0=";
         };
+
+        patches = [
+          # Pulling in this patch lets us continue running tests without any
+          # other changes using setuptools >= 67.5.0.
+          (fetchpatch {
+            name = "remove-deprecated-pkg-resources.patch";
+            url = "https://github.com/pallets/flask/commit/751d85f3de3f726446bb12e4ddfae885a6645ba1.patch";
+            hash = "sha256-T4vKSSe3P0xtb2/iQjm0RH2Bwk1ZHWiPoX1Ycr63EqU=";
+            includes = [ "src/flask/cli.py" ];
+          })
+        ];
       });
       flask-wtf = super.flask-wtf.overridePythonAttrs (old: rec {
         version = "0.15.1";
diff --git a/pkgs/applications/misc/gpsbabel/default.nix b/pkgs/applications/misc/gpsbabel/default.nix
index 60a1e40a614ed..0898c3ccee9a4 100644
--- a/pkgs/applications/misc/gpsbabel/default.nix
+++ b/pkgs/applications/misc/gpsbabel/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchurl, pkg-config, which
-, qtbase, qmake, qttools, qttranslations, wrapQtAppsHook
+, qmake, qttools, wrapQtAppsHook
 , libusb1, shapelib, zlib
 , withGUI ? false, qtserialport
 , withMapPreview ? (!stdenv.isDarwin), qtwebengine
@@ -21,11 +21,6 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs testo
-  '' + lib.optionalString withGUI ''
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    substituteInPlace gui/mainwindow.cc \
-      --replace 'QLibraryInfo::location(QLibraryInfo::TranslationsPath)' \
-                'QLatin1String("${qttranslations}/translations")'
   '' + lib.optionalString withDoc ''
     substituteInPlace gbversion.h.qmake.in \
       --replace /usr/share/doc $doc/share/doc
diff --git a/pkgs/applications/misc/gpxlab/default.nix b/pkgs/applications/misc/gpxlab/default.nix
index 8d2b95ea4f31d..9d3d7c27ec8cf 100644
--- a/pkgs/applications/misc/gpxlab/default.nix
+++ b/pkgs/applications/misc/gpxlab/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, mkDerivation, lib, fetchFromGitHub, substituteAll
-, qmake, qttools, qttranslations
+{ stdenv, mkDerivation, lib, fetchFromGitHub
+, qmake, qttools
 }:
 
 mkDerivation rec {
@@ -13,12 +13,6 @@ mkDerivation rec {
     sha256 = "080vnwcciqblfrbfyz9gjhl2lqw1hkdpbgr5qfrlyglkd4ynjd84";
   };
 
-  patches = (substituteAll {
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    src = ./fix-qttranslations-path.patch;
-    inherit qttranslations;
-  });
-
   nativeBuildInputs = [ qmake qttools ];
 
   preConfigure = ''
diff --git a/pkgs/applications/misc/gpxlab/fix-qttranslations-path.patch b/pkgs/applications/misc/gpxlab/fix-qttranslations-path.patch
deleted file mode 100644
index 8dcba75d764fb..0000000000000
--- a/pkgs/applications/misc/gpxlab/fix-qttranslations-path.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git i/GPXLab/main.cpp w/GPXLab/main.cpp
-index b12d2dd..58d37c5 100644
---- i/GPXLab/main.cpp
-+++ w/GPXLab/main.cpp
-@@ -19,10 +19,10 @@ int main(int argc, char *argv[])
-     app.installTranslator(&gpxlab);
- 
-     QTranslator qt;
--#if defined(Q_OS_WIN32) || defined(Q_OS_MAC)
-+#if defined(Q_OS_WIN32)
-     qt.load(QLocale::system(), "qt", "_", TRANSLATIONS_DIR);
- #else
--    qt.load(QLocale::system(), "qt", "_", QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+    qt.load(QLocale::system(), "qt", "_", QLatin1String("@qttranslations@/translations"));
- #endif
-     app.installTranslator(&qt);
- 
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index 694323df82d94..c08deed34db06 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -3,10 +3,8 @@
 , fetchFromGitHub
 , qmake
 , nix-update-script
-, substituteAll
 , qtbase
 , qttools
-, qttranslations
 , qtlocation ? null # qt5 only
 , qtpositioning ? null # qt6 only
 , qtpbfimageplugin
@@ -31,12 +29,6 @@ stdenv.mkDerivation rec {
     hash = "sha256-Zf2eyDx5QK69W6HNz/IGGHkX2qCDnxYsU8KLCgU9teY=";
   };
 
-  patches = (substituteAll {
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    src = ./fix-qttranslations-path.diff;
-    inherit qttranslations;
-  });
-
   buildInputs = [ qtpbfimageplugin qtserialport ]
     ++ (if isQt6 then [
     qtbase
diff --git a/pkgs/applications/misc/gpxsee/fix-qttranslations-path.diff b/pkgs/applications/misc/gpxsee/fix-qttranslations-path.diff
deleted file mode 100644
index 757d9b8c65714..0000000000000
--- a/pkgs/applications/misc/gpxsee/fix-qttranslations-path.diff
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git i/src/GUI/app.cpp w/src/GUI/app.cpp
-index 37e9d3f..d4a065c 100644
---- i/src/GUI/app.cpp
-+++ w/src/GUI/app.cpp
-@@ -35,11 +35,10 @@ App::App(int &argc, char **argv) : QApplication(argc, argv)
- 		installTranslator(gpxsee);
- 
- 	QTranslator *qt = new QTranslator(this);
--#if defined(Q_OS_WIN32) || defined(Q_OS_MAC)
-+#if defined(Q_OS_WIN32)
- 	if (qt->load(QLocale::system(), "qt", "_", ProgramPaths::translationsDir()))
- #else // Q_OS_WIN32 || Q_OS_MAC
--	if (qt->load(QLocale::system(), "qt", "_", QLibraryInfo::location(
--	  QLibraryInfo::TranslationsPath)))
-+	if (qt->load(QLocale::system(), "qt", "_", QLatin1String("@qttranslations@/translations")))
- #endif // Q_OS_WIN32 || Q_OS_MAC
- 		installTranslator(qt);
- 
diff --git a/pkgs/applications/misc/mediainfo-gui/default.nix b/pkgs/applications/misc/mediainfo-gui/default.nix
index 134c1b33b7297..ff7fbbc22c155 100644
--- a/pkgs/applications/misc/mediainfo-gui/default.nix
+++ b/pkgs/applications/misc/mediainfo-gui/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libmediainfo wxGTK32 desktop-file-utils libSM imagemagick ]
     ++ lib.optionals stdenv.isDarwin [ Cocoa ];
 
-  sourceRoot = "./MediaInfo/Project/GNU/GUI/";
+  sourceRoot = "MediaInfo/Project/GNU/GUI";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/misc/mediainfo/default.nix b/pkgs/applications/misc/mediainfo/default.nix
index ffa7f68378dbf..06669089a18d3 100644
--- a/pkgs/applications/misc/mediainfo/default.nix
+++ b/pkgs/applications/misc/mediainfo/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libzen libmediainfo zlib ];
 
-  sourceRoot = "./MediaInfo/Project/GNU/CLI/";
+  sourceRoot = "MediaInfo/Project/GNU/CLI";
 
   configureFlags = [ "--with-libmediainfo=${libmediainfo}" ];
 
diff --git a/pkgs/applications/misc/merkaartor/default.nix b/pkgs/applications/misc/merkaartor/default.nix
index c8ac515571c7f..9d474ca91f04c 100644
--- a/pkgs/applications/misc/merkaartor/default.nix
+++ b/pkgs/applications/misc/merkaartor/default.nix
@@ -5,7 +5,6 @@
 , qmake
 , qttools
 , wrapQtAppsHook
-, qttranslations
 , gdal
 , proj
 , qtsvg
@@ -48,7 +47,6 @@ stdenv.mkDerivation rec {
   '';
 
   qmakeFlags = [
-    "TRANSDIR_SYSTEM=${qttranslations}/translations"
     "USEWEBENGINE=1"
   ] ++ lib.optional withGeoimage "GEOIMAGE=1"
     ++ lib.optional withGpsdlib "GPSDLIB=1"
diff --git a/pkgs/applications/misc/mupdf/0001-Use-command-v-in-favor-of-which.patch b/pkgs/applications/misc/mupdf/0001-Use-command-v-in-favor-of-which.patch
index 26ed3aec9fb71..771ad05835283 100644
--- a/pkgs/applications/misc/mupdf/0001-Use-command-v-in-favor-of-which.patch
+++ b/pkgs/applications/misc/mupdf/0001-Use-command-v-in-favor-of-which.patch
@@ -1,25 +1,13 @@
-From b2935ed7e2962d73f3b493c38c0bb1e8659c0a60 Mon Sep 17 00:00:00 2001
-From: toonn <toonn@toonn.io>
-Date: Tue, 8 Mar 2022 23:59:19 +0100
-Subject: [PATCH 1/2] Use command -v in favor of which
+Use command -v in favor of which
 
----
- Makerules | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Makerules b/Makerules
-index 0fdaecb..6d52cca 100644
 --- a/Makerules
 +++ b/Makerules
-@@ -145,7 +145,7 @@ else ifeq ($(OS),MACOS)
-   LD = xcrun ld
-   RANLIB = xcrun ranlib
- 
--  ifeq (, $(shell which pkg-config))
-+  ifeq (, $(shell command -v pkg-config))
+@@ -170,7 +170,7 @@
+   ifneq ($(ARCHFLAGS),)
+     $(warning "MacOS with ARCHFLAGS set. Assuming we are building for arm64, and setting HAVE_LIBCRYPTO to no.")
+     HAVE_LIBCRYPTO := no
+-  else ifeq (, $(shell which pkg-config))
++  else ifeq (, $(shell command -v pkg-config))
      $(warning "No pkg-config found, install it for proper integration of libcrypto")
    else
      HAVE_LIBCRYPTO := $(shell pkg-config --exists 'libcrypto >= 1.1.0' && echo yes)
--- 
-2.17.2 (Apple Git-113)
-
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index 6e3d37e2ef385..606649d5bb12d 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -27,6 +27,7 @@
 , freeglut
 , libGLU
 , xcbuild
+, gitUpdater
 
 # for passthru.tests
 , cups-filters
@@ -52,12 +53,12 @@ let
 
 in
 stdenv.mkDerivation rec {
-  version = "1.22.1";
+  version = "1.23.0";
   pname = "mupdf";
 
   src = fetchurl {
     url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    sha256 = "sha256-1i88DkVuu8QucfWkfw+M0SzsK/Co1yt541+jWmU4slo=";
+    sha256 = "sha256-3kFAaS5pMULDEeAwrBVuOO4XXXq2wb4QxcmuljhGFk4=";
   };
 
   patches = [ ./0001-Use-command-v-in-favor-of-which.patch
@@ -151,14 +152,22 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  passthru.tests = {
-    inherit cups-filters zathura;
-    inherit (python3.pkgs) pikepdf pymupdf;
+  passthru = {
+    tests = {
+      inherit cups-filters zathura;
+      inherit (python3.pkgs) pikepdf pymupdf;
+    };
+
+    updateScript = gitUpdater {
+      url = "https://git.ghostscript.com/mupdf.git";
+      ignoredVersions = ".rc.*";
+    };
   };
 
   meta = with lib; {
     homepage = "https://mupdf.com";
     description = "Lightweight PDF, XPS, and E-book viewer and toolkit written in portable C";
+    changelog = "https://git.ghostscript.com/?p=mupdf.git;a=blob_plain;f=CHANGES;hb=${version}";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ vrthra fpletz ];
     platforms = platforms.unix;
diff --git a/pkgs/applications/misc/opentx/default.nix b/pkgs/applications/misc/opentx/default.nix
index e9a526a1f65f5..0634c03e7bd7f 100644
--- a/pkgs/applications/misc/opentx/default.nix
+++ b/pkgs/applications/misc/opentx/default.nix
@@ -1,6 +1,6 @@
 { lib, mkDerivation, fetchFromGitHub
 , cmake, gcc-arm-embedded, python3Packages
-, qtbase, qtmultimedia, qttranslations, SDL, gtest
+, qtbase, qtmultimedia, qttools, SDL, gtest
 , dfu-util, avrdude
 }:
 
@@ -15,9 +15,9 @@ mkDerivation rec {
     sha256 = "sha256-F3zykJhKuIpLQSTjn7mcdjEmgRAlwCZpkTaKQR9ve3g=";
   };
 
-  nativeBuildInputs = [ cmake gcc-arm-embedded python3Packages.pillow ];
+  nativeBuildInputs = [ cmake gcc-arm-embedded python3Packages.pillow qttools ];
 
-  buildInputs = [ qtbase qtmultimedia qttranslations SDL ];
+  buildInputs = [ qtbase qtmultimedia SDL ];
 
   postPatch = ''
     sed -i companion/src/burnconfigdialog.cpp \
@@ -27,7 +27,6 @@ mkDerivation rec {
 
   cmakeFlags = [
     "-DGTEST_ROOT=${gtest.src}/googletest"
-    "-DQT_TRANSLATIONS_DIR=${qttranslations}/translations"
     # XXX I would prefer to include these here, though we will need to file a bug upstream to get that changed.
     #"-DDFU_UTIL_PATH=${dfu-util}/bin/dfu-util"
     #"-DAVRDUDE_PATH=${avrdude}/bin/avrdude"
diff --git a/pkgs/applications/misc/ubpm/default.nix b/pkgs/applications/misc/ubpm/default.nix
index a9053374c7afa..6e0d7f7f25f53 100644
--- a/pkgs/applications/misc/ubpm/default.nix
+++ b/pkgs/applications/misc/ubpm/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitea, qmake, qttools, qtbase, qtserialport
-, qtconnectivity, qtcharts, qttranslations, wrapQtAppsHook }:
+, qtconnectivity, qtcharts, wrapQtAppsHook }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ubpm";
@@ -15,7 +15,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     substituteInPlace sources/mainapp/mainapp.pro \
-      --replace '$$[QT_INSTALL_TRANSLATIONS]' '${qttranslations}/translations' \
       --replace 'INSTALLDIR = /tmp/ubpm.AppDir' "INSTALLDIR = $out" \
       --replace '/usr/bin' '/bin' \
       --replace 'INSTALLS += target translations themes devices help lin' 'INSTALLS += target translations themes devices help'
@@ -40,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   # *.so plugins are being wrapped automatically which breaks them
   dontWrapQtApps = true;
 
-  buildInputs = [ qtbase qtserialport qtconnectivity qtcharts qttranslations ];
+  buildInputs = [ qtbase qtserialport qtconnectivity qtcharts ];
 
   meta = with lib; {
     homepage = "https://codeberg.org/LazyT/ubpm";
diff --git a/pkgs/applications/misc/valentina/default.nix b/pkgs/applications/misc/valentina/default.nix
index f5cd55c534c34..c00159c0c64d9 100644
--- a/pkgs/applications/misc/valentina/default.nix
+++ b/pkgs/applications/misc/valentina/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitLab, substituteAll, installShellFiles
+{ lib, stdenv, fetchFromGitLab, installShellFiles
 , qmake, qttools
-, qtsvg, qttranslations, qtxmlpatterns
+, qtsvg, qtxmlpatterns
 , wrapQtAppsHook
 }:
 
@@ -15,12 +15,6 @@ stdenv.mkDerivation rec {
     hash = "sha256-N9fC2tCP4TVNncatHaz5W5Mp3jOmAcEWYCl30+0myaE=";
   };
 
-  patches = (substituteAll {
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    src = ./fix-qttranslations-path.patch;
-    inherit qttranslations;
-  });
-
   postPatch = ''
     substituteInPlace src/app/translations.pri \
       --replace '$$[QT_INSTALL_BINS]/$$LRELEASE' '${lib.getDev qttools}/bin/lrelease'
diff --git a/pkgs/applications/misc/valentina/fix-qttranslations-path.patch b/pkgs/applications/misc/valentina/fix-qttranslations-path.patch
deleted file mode 100644
index de3fe05cc8b03..0000000000000
--- a/pkgs/applications/misc/valentina/fix-qttranslations-path.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-diff --git i/src/libs/vmisc/vabstractapplication.cpp w/src/libs/vmisc/vabstractapplication.cpp
-index b64817bab..5f9aa3518 100644
---- i/src/libs/vmisc/vabstractapplication.cpp
-+++ w/src/libs/vmisc/vabstractapplication.cpp
-@@ -221,26 +221,26 @@ void VAbstractApplication::LoadTranslation(const QString &locale)
-     ClearTranslation();
- 
-     qtTranslator = new QTranslator(this);
--#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
-+#if defined(Q_OS_WIN)
-     qtTranslator->load("qt_" + locale, translationsPath(locale));
- #else
--    qtTranslator->load("qt_" + locale, QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+    qtTranslator->load("qt_" + locale, QLatin1String("@qttranslations@/translations"));
- #endif
-     installTranslator(qtTranslator);
- 
-     qtxmlTranslator = new QTranslator(this);
--#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
-+#if defined(Q_OS_WIN)
-     qtxmlTranslator->load("qtxmlpatterns_" + locale, translationsPath(locale));
- #else
--    qtxmlTranslator->load("qtxmlpatterns_" + locale, QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+    qtxmlTranslator->load("qtxmlpatterns_" + locale, QLatin1String("@qttranslations@/translations"));
- #endif
-     installTranslator(qtxmlTranslator);
- 
-     qtBaseTranslator = new QTranslator(this);
--#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
-+#if defined(Q_OS_WIN)
-     qtBaseTranslator->load("qtbase_" + locale, translationsPath(locale));
- #else
--    qtBaseTranslator->load("qtbase_" + locale, QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+    qtBaseTranslator->load("qtbase_" + locale, QLatin1String("@qttranslations@/translations"));
- #endif
-     installTranslator(qtBaseTranslator);
- 
diff --git a/pkgs/applications/networking/instant-messengers/linphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/default.nix
index 0002e1d57de53..ebf3341e309a9 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -12,7 +12,7 @@
 , mkDerivation
 , qtgraphicaleffects
 , qtquickcontrols2
-, qttranslations
+, qttools
 }:
 
 # How to update Linphone? (The Qt desktop app)
@@ -73,11 +73,11 @@ mkDerivation rec {
     minizip-ng
     qtgraphicaleffects
     qtquickcontrols2
-    qttranslations
   ];
 
   nativeBuildInputs = [
     cmake
+    qttools
   ];
 
   cmakeFlags = [
diff --git a/pkgs/applications/networking/instant-messengers/qtox/default.nix b/pkgs/applications/networking/instant-messengers/qtox/default.nix
index 659b6411b48a8..8273a6fdbc6d8 100644
--- a/pkgs/applications/networking/instant-messengers/qtox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qtox/default.nix
@@ -12,7 +12,6 @@
 , qtbase
 , qtsvg
 , qttools
-, qttranslations
 , ffmpeg
 , filter-audio
 , libexif
@@ -44,7 +43,6 @@ mkDerivation rec {
     libXScrnSaver
     qtbase
     qtsvg
-    qttranslations
     ffmpeg
     filter-audio
     libexif
diff --git a/pkgs/applications/networking/mailreaders/trojita/default.nix b/pkgs/applications/networking/mailreaders/trojita/default.nix
index cd0a61f6636d6..395e9b0f4e3f5 100644
--- a/pkgs/applications/networking/mailreaders/trojita/default.nix
+++ b/pkgs/applications/networking/mailreaders/trojita/default.nix
@@ -16,8 +16,6 @@
 , qtkeychain
 , qttools
 , qtwebkit
-, qttranslations
-, substituteAll
 , withI18n ? false
 }:
 
@@ -39,12 +37,6 @@ in mkDerivation rec {
     sha256 = "sha256-15G9YjT3qBKbeOKfb/IgXOO+DaJaTULP9NJn/MFYZS8=";
   };
 
-  patches = (substituteAll {
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    src = ./fix-qttranslations-path.patch;
-    inherit qttranslations;
-  });
-
   buildInputs = [
     akonadi-contacts
     gpgme
diff --git a/pkgs/applications/networking/mailreaders/trojita/fix-qttranslations-path.patch b/pkgs/applications/networking/mailreaders/trojita/fix-qttranslations-path.patch
deleted file mode 100644
index c4eac3956508d..0000000000000
--- a/pkgs/applications/networking/mailreaders/trojita/fix-qttranslations-path.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git i/src/Gui/main.cpp w/src/Gui/main.cpp
-index 851db4f1..e997f46e 100644
---- i/src/Gui/main.cpp
-+++ w/src/Gui/main.cpp
-@@ -52,7 +52,7 @@ int main(int argc, char **argv)
- 
-     QTranslator qtTranslator;
-     qtTranslator.load(QLatin1String("qt_") + QLocale::system().name(),
--                      QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+                      QLatin1String("@qttranslations@/translations"));
-     app.installTranslator(&qtTranslator);
- 
-     QLatin1String localeSuffix("/locale");
diff --git a/pkgs/applications/office/PageEdit/default.nix b/pkgs/applications/office/PageEdit/default.nix
index b95eb6cb51e47..858995c05fa72 100644
--- a/pkgs/applications/office/PageEdit/default.nix
+++ b/pkgs/applications/office/PageEdit/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchFromGitHub, cmake, qtsvg, qtwebengine, qttranslations, wrapQtAppsHook }:
+{ lib, stdenv, fetchFromGitHub, cmake, qtsvg, qtwebengine, wrapQtAppsHook, qttools }:
 
 stdenv.mkDerivation rec {
   pname = "pageedit";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-naoflFANeMwabbdrNL3+ndvEXYT4Yqf+Mo77HcCexHE=";
   };
 
-  nativeBuildInputs = [ cmake qttranslations wrapQtAppsHook ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook qttools ];
   propagatedBuildInputs = [ qtsvg qtwebengine ];
   cmakeFlags = [ "-DINSTALL_BUNDLED_DICTS=0" ];
 
diff --git a/pkgs/applications/radio/rscw/default.nix b/pkgs/applications/radio/rscw/default.nix
index 3c42b3b81330d..7fe638df61d0c 100644
--- a/pkgs/applications/radio/rscw/default.nix
+++ b/pkgs/applications/radio/rscw/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "1hxwxmqc5jinr14ya1idigqigc8qhy1vimzcwy2vmwdjay2sqik2";
   };
 
-  setSourceRoot = "sourceRoot=`pwd`";
+  sourceRoot = ".";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ gtk2 fftw ];
diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/applications/science/astronomy/stellarium/default.nix
index 00b36de280891..e2e1cda4c2592 100644
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@@ -11,13 +11,13 @@
 , qtpositioning
 , qtmultimedia
 , qtserialport
-, qttranslations
 , qtwayland
 , qtwebengine
 , calcmysky
 , qxlsx
 , indilib
 , libnova
+, qttools
 }:
 
 stdenv.mkDerivation rec {
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
     perl
     wrapGAppsHook
     wrapQtAppsHook
+    qttools
   ];
 
   buildInputs = [
@@ -60,7 +61,6 @@ stdenv.mkDerivation rec {
     qtpositioning
     qtmultimedia
     qtserialport
-    qttranslations
     qtwebengine
     calcmysky
     qxlsx
diff --git a/pkgs/applications/science/biology/sratoolkit/default.nix b/pkgs/applications/science/biology/sratoolkit/default.nix
index 8a1bb5376eaf4..a36157ed5d169 100644
--- a/pkgs/applications/science/biology/sratoolkit/default.nix
+++ b/pkgs/applications/science/biology/sratoolkit/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     stdenv.cc.cc.lib
   ];
 
-  sourceRoot = "./sratoolkit.${version}-ubuntu64/bin";
+  sourceRoot = "sratoolkit.${version}-ubuntu64/bin";
 
   installPhase = ''
     find -L . -executable -type f -! -name "*remote-fuser*" -exec install -m755 -D {} $out/bin/{} \;
diff --git a/pkgs/applications/science/electronics/flatcam/default.nix b/pkgs/applications/science/electronics/flatcam/default.nix
index 338823bbf386c..169130b410103 100644
--- a/pkgs/applications/science/electronics/flatcam/default.nix
+++ b/pkgs/applications/science/electronics/flatcam/default.nix
@@ -13,13 +13,16 @@ let
     packageOverrides = self: super: {
       shapely = super.shapely.overridePythonAttrs (old: rec {
         version = "1.8.4";
+
         src = fetchPypi {
           pname = "Shapely";
           inherit version;
           hash = "sha256-oZXlHKr6IYKR8suqP+9p/TNTyT7EtlsqRyLEz0DDGYw=";
         };
+
         # Environment variable used in shapely/_buildcfg.py
         GEOS_LIBRARY_PATH = "${geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";
+
         patches = [
           # Patch to search form GOES .so/.dylib files in a Nix-aware way
           (substituteAll {
@@ -28,6 +31,11 @@ let
             libc = lib.optionalString (!stdenv.isDarwin) "${stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}.6";
           })
         ];
+
+        postPatch = ''
+          substituteInPlace pyproject.toml \
+            --replace 'setuptools<64' 'setuptools'
+        '';
       });
     };
   };
diff --git a/pkgs/applications/science/electronics/xyce/default.nix b/pkgs/applications/science/electronics/xyce/default.nix
index 4709065e45bdc..aee1d25a04cc9 100644
--- a/pkgs/applications/science/electronics/xyce/default.nix
+++ b/pkgs/applications/science/electronics/xyce/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
 
   srcs = [ xyce_src regression_src ];
 
-  sourceRoot = "./${xyce_src.name}";
+  sourceRoot = xyce_src.name;
 
   preConfigure = "./bootstrap";
 
diff --git a/pkgs/applications/science/logic/ekrhyper/default.nix b/pkgs/applications/science/logic/ekrhyper/default.nix
index 187cbc9a92ae4..4a5124b235823 100644
--- a/pkgs/applications/science/logic/ekrhyper/default.nix
+++ b/pkgs/applications/science/logic/ekrhyper/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
   nativeBuildInputs = [ ocaml perl ];
-  setSourceRoot = "export sourceRoot=$(echo */ekrh/src/)";
+  setSourceRoot = "export sourceRoot=$(echo */ekrh/src)";
   preInstall = "export INSTALLDIR=$out";
   postInstall = ''for i in "$out/casc"/*; do ln -s "$i" "$out/bin/ekrh-casc-$(basename $i)"; done '';
 
diff --git a/pkgs/applications/science/misc/golly/default.nix b/pkgs/applications/science/misc/golly/default.nix
index 7d91c76579f95..8814b33c4b143 100644
--- a/pkgs/applications/science/misc/golly/default.nix
+++ b/pkgs/applications/science/misc/golly/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   ];
 
   setSourceRoot = ''
-    sourceRoot=$(echo */gui-wx/)
+    sourceRoot=$(echo */gui-wx)
   '';
 
   postPatch = ''
diff --git a/pkgs/applications/video/davinci-resolve/default.nix b/pkgs/applications/video/davinci-resolve/default.nix
index d6a8125f324c9..928be528ce4eb 100644
--- a/pkgs/applications/video/davinci-resolve/default.nix
+++ b/pkgs/applications/video/davinci-resolve/default.nix
@@ -109,9 +109,7 @@ let
       '';
 
       # The unpack phase won't generate a directory
-      setSourceRoot = ''
-        sourceRoot=$PWD
-      '';
+      sourceRoot = ".";
 
       installPhase = ''
         runHook preInstall
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 7f5cd4cf4af3b..8d02b4e5124d8 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -1,4 +1,5 @@
-declare -a hardeningCFlags=()
+declare -a hardeningCFlagsAfter=()
+declare -a hardeningCFlagsBefore=()
 
 declare -A hardeningEnableMap=()
 
@@ -48,15 +49,19 @@ for flag in "${!hardeningEnableMap[@]}"; do
     fortify | fortify3)
       # Use -U_FORTIFY_SOURCE to avoid warnings on toolchains that explicitly
       # set -D_FORTIFY_SOURCE=0 (like 'clang -fsanitize=address').
-      hardeningCFlags+=('-O2' '-U_FORTIFY_SOURCE')
+      hardeningCFlagsBefore+=('-O2' '-U_FORTIFY_SOURCE')
+      # Unset any _FORTIFY_SOURCE values the command-line may have set before
+      # enforcing our own value, avoiding (potentially fatal) redefinition
+      # warnings
+      hardeningCFlagsAfter+=('-U_FORTIFY_SOURCE')
       case $flag in
         fortify)
           if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
-          hardeningCFlags+=('-D_FORTIFY_SOURCE=2')
+          hardeningCFlagsAfter+=('-D_FORTIFY_SOURCE=2')
         ;;
         fortify3)
           if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify3 >&2; fi
-          hardeningCFlags+=('-D_FORTIFY_SOURCE=3')
+          hardeningCFlagsAfter+=('-D_FORTIFY_SOURCE=3')
         ;;
         *)
           # Ignore unsupported.
@@ -65,20 +70,20 @@ for flag in "${!hardeningEnableMap[@]}"; do
       ;;
     stackprotector)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
-      hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
+      hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
       ;;
     pie)
       # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
-      hardeningCFlags=('-fPIE' "${hardeningCFlags[@]}")
+      hardeningCFlagsBefore=('-fPIE' "${hardeningCFlagsBefore[@]}")
       if [[ ! (" ${params[*]} " =~ " -shared " || " ${params[*]} " =~ " -static ") ]]; then
         if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
-        hardeningCFlags=('-pie' "${hardeningCFlags[@]}")
+        hardeningCFlagsBefore=('-pie' "${hardeningCFlagsBefore[@]}")
       fi
       ;;
     pic)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
-      hardeningCFlags+=('-fPIC')
+      hardeningCFlagsBefore+=('-fPIC')
       ;;
     strictoverflow)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
@@ -89,14 +94,14 @@ for flag in "${!hardeningEnableMap[@]}"; do
         #
         # See: https://github.com/llvm/llvm-project/blob/llvmorg-16.0.6/clang/lib/Driver/ToolChains/Clang.cpp#L6315
         #
-        hardeningCFlags+=('-fwrapv')
+        hardeningCFlagsBefore+=('-fwrapv')
       else
-        hardeningCFlags+=('-fno-strict-overflow')
+        hardeningCFlagsBefore+=('-fno-strict-overflow')
       fi
       ;;
     format)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
-      hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
+      hardeningCFlagsBefore+=('-Wformat' '-Wformat-security' '-Werror=format-security')
       ;;
     *)
       # Ignore unsupported. Checked in Nix that at least *some*
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 244a0bb6623b8..9dcd29c644316 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -171,8 +171,8 @@ fi
 source @out@/nix-support/add-hardening.sh
 
 # Add the flags for the C compiler proper.
-extraAfter=($NIX_CFLAGS_COMPILE_@suffixSalt@)
-extraBefore=(${hardeningCFlags[@]+"${hardeningCFlags[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
+extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_CFLAGS_COMPILE_@suffixSalt@)
+extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
 
 if [ "$dontLink" != 1 ]; then
 
diff --git a/pkgs/build-support/libredirect/libredirect.c b/pkgs/build-support/libredirect/libredirect.c
index 19211a813eb84..fdbdcb6ebb86f 100644
--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@@ -70,9 +70,12 @@ static void init()
 
 }
 
-static const char * rewrite(const char * path, char * buf)
+static const char * rewrite(const char * volatile path, char * buf)
 {
+    // Marking the path volatile is needed so the the following check isn't
+    // optimized away by the compiler.
     if (path == NULL) return path;
+
     for (int n = 0; n < nrRedirects; ++n) {
         int len = strlen(from[n]);
         if (strncmp(path, from[n], len) != 0) continue;
diff --git a/pkgs/build-support/libredirect/test.c b/pkgs/build-support/libredirect/test.c
index 7dd384ae3ed7e..20b27759f019f 100644
--- a/pkgs/build-support/libredirect/test.c
+++ b/pkgs/build-support/libredirect/test.c
@@ -45,6 +45,17 @@ void test_subprocess(void) {
     assert(system(SUBTEST) == 0);
 }
 
+void test_stat_with_null_path(void) {
+    // This checks whether the compiler optimizes away the null pointer check
+    // on the path passed to stat(). If that's the case, the following code
+    // should segfault.
+    struct stat buf;
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wnonnull"
+    stat(NULL, &buf);
+#pragma GCC diagnostic pop
+}
+
 void assert_mktemp_path(
     const char * orig_prefix,
     const char * orig_suffix,
@@ -147,6 +158,7 @@ int main(int argc, char *argv[])
 
     test_spawn();
     test_system();
+    test_stat_with_null_path();
 
     // Only run subprocess if no arguments are given
     // as the subprocess will be called without argument
diff --git a/pkgs/data/fonts/maple-font/default.nix b/pkgs/data/fonts/maple-font/default.nix
index af4746fa2c461..a90a1e830171c 100644
--- a/pkgs/data/fonts/maple-font/default.nix
+++ b/pkgs/data/fonts/maple-font/default.nix
@@ -5,10 +5,9 @@
 }:
 
 let
-  maple-font = { pname, sha256, desc }: stdenv.mkDerivation
-    rec{
-
-      inherit pname desc;
+  maple-font = { pname, sha256, desc }:
+    stdenv.mkDerivation rec{
+      inherit pname;
       version = "6.4";
       src = fetchurl {
         url = "https://github.com/subframe7536/Maple-font/releases/download/v${version}/${pname}.zip";
@@ -17,7 +16,7 @@ let
 
       # Work around the "unpacker appears to have produced no directories"
       # case that happens when the archive doesn't have a subdirectory.
-      setSourceRoot = "sourceRoot=`pwd`";
+      sourceRoot = ".";
       nativeBuildInputs = [ unzip ];
       installPhase = ''
         find . -name '*.ttf'    -exec install -Dt $out/share/fonts/truetype {} \;
diff --git a/pkgs/data/fonts/roboto-mono/default.nix b/pkgs/data/fonts/roboto-mono/default.nix
index fd3372123c608..5d7cc57a4b435 100644
--- a/pkgs/data/fonts/roboto-mono/default.nix
+++ b/pkgs/data/fonts/roboto-mono/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  sourceRoot = "./";
+  sourceRoot = ".";
 
   unpackCmd = ''
     ttfName=$(basename $(stripHash $curSrc))
diff --git a/pkgs/data/fonts/rubik/default.nix b/pkgs/data/fonts/rubik/default.nix
index dec500c119f1d..c9e20fa6351a1 100644
--- a/pkgs/data/fonts/rubik/default.nix
+++ b/pkgs/data/fonts/rubik/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  sourceRoot = "./";
+  sourceRoot = ".";
 
   unpackCmd = ''
     ttfName=$(basename $(stripHash $curSrc))
diff --git a/pkgs/data/misc/unicode-character-database/default.nix b/pkgs/data/misc/unicode-character-database/default.nix
index 3c21a6f295609..24078799eb73c 100644
--- a/pkgs/data/misc/unicode-character-database/default.nix
+++ b/pkgs/data/misc/unicode-character-database/default.nix
@@ -16,9 +16,7 @@ stdenv.mkDerivation rec {
     unzip
   ];
 
-  setSourceRoot = ''
-    sourceRoot=$PWD
-  '';
+  sourceRoot = ".";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/data/misc/unihan-database/default.nix b/pkgs/data/misc/unihan-database/default.nix
index fc0826d7f2834..1dbc17463f197 100644
--- a/pkgs/data/misc/unihan-database/default.nix
+++ b/pkgs/data/misc/unihan-database/default.nix
@@ -16,9 +16,7 @@ stdenv.mkDerivation rec {
     unzip
   ];
 
-  setSourceRoot = ''
-    sourceRoot=$PWD
-  '';
+  sourceRoot = ".";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/desktops/rox/rox-filer/default.nix b/pkgs/desktops/rox/rox-filer/default.nix
index b05be287a89d4..676e99b1a9036 100644
--- a/pkgs/desktops/rox/rox-filer/default.nix
+++ b/pkgs/desktops/rox/rox-filer/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   ];
 
   # go to the source directory after unpacking the sources
-  setSourceRoot = "export sourceRoot=rox-filer-${version}/ROX-Filer/";
+  sourceRoot = "rox-filer-${version}/ROX-Filer";
 
   # account for 'setSourceRoot' offset
   patchFlags = [ "-p2" ];
diff --git a/pkgs/development/compilers/flutter/engine-artifacts/default.nix b/pkgs/development/compilers/flutter/engine-artifacts/default.nix
index 603b1456018d3..30c293c8d75db 100644
--- a/pkgs/development/compilers/flutter/engine-artifacts/default.nix
+++ b/pkgs/development/compilers/flutter/engine-artifacts/default.nix
@@ -191,7 +191,7 @@ let
             hash = (if artifactDirectory == null then hashes else hashes.${artifactDirectory}).${archive};
           });
 
-      setSourceRoot = if overrideUnpackCmd then "sourceRoot=`pwd`" else null;
+      sourceRoot = if overrideUnpackCmd then "." else null;
       unpackCmd = if overrideUnpackCmd then "unzip -o $src -d $out" else null;
 
       installPhase =
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index a53e78103ad55..9753a1077a639 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
 , bison
 , cmake
 , jq
@@ -10,24 +9,15 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "12.2.0";
+  version = "12.3.1";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = version;
-    hash = "sha256-2i6DZA42b0s1ul6VDhjPi9lpSYvsRD8r9yiRoRfVoW0=";
+    hash = "sha256-NP5ph598YSPbpzJJUR2r+EkqFmuItxgvOSDgDaN+Swg=";
   };
 
-  patches = [
-    # Fix build on Darwin
-    # FIXME: remove for next release
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/glslang/commit/6a7ec4be7b8a22ab16cea0f294b5973dbcdd637a.diff";
-      hash = "sha256-O1N62X6LZNRNHHz90TLJDbt6pDr28EI6IKMbMXcKBj8=";
-    })
-  ];
-
   # These get set at all-packages, keep onto them for child drvs
   passthru = {
     spirv-tools = spirv-tools;
@@ -48,8 +38,11 @@ stdenv.mkDerivation rec {
 
   # Fix the paths in .pc, even though it's unclear if these .pc are really useful.
   postFixup = ''
-    substituteInPlace "$out"/lib/pkgconfig/SPIRV-Tools{,-shared}.pc \
+    substituteInPlace $out/lib/pkgconfig/*.pc \
       --replace '=''${prefix}//' '=/'
+
+    # add a symlink for backwards compatibility
+    ln -s $out/bin/glslang $out/bin/glslangValidator
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index 46b01999f96c2..74aff43f7caee 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -1,7 +1,8 @@
 self: dontUse: with self;
 
 let
-  pythonInterpreter = python.pythonForBuild.interpreter;
+  inherit (python) pythonForBuild;
+  pythonInterpreter = pythonForBuild.interpreter;
   pythonSitePackages = python.sitePackages;
   pythonCheckInterpreter = python.interpreter;
   setuppy = ../run_setup.py;
@@ -66,11 +67,9 @@ in {
     makePythonHook {
       name = "pypa-build-hook.sh";
       propagatedBuildInputs = [ build wheel ];
-      substitutions = {
-        inherit pythonInterpreter;
-      };
-    } ./pypa-build-hook.sh) {};
-
+    } ./pypa-build-hook.sh) {
+      inherit (pythonForBuild.pkgs) build;
+    };
 
   pipInstallHook = callPackage ({ makePythonHook, pip }:
     makePythonHook {
@@ -81,6 +80,17 @@ in {
       };
     } ./pip-install-hook.sh) {};
 
+  pypaInstallHook = callPackage ({ makePythonHook, installer }:
+    makePythonHook {
+      name = "pypa-install-hook";
+      propagatedBuildInputs = [ installer ];
+      substitutions = {
+        inherit pythonInterpreter pythonSitePackages;
+      };
+    } ./pypa-install-hook.sh) {
+      inherit (pythonForBuild.pkgs) installer;
+    };
+
   pytestCheckHook = callPackage ({ makePythonHook, pytest }:
     makePythonHook {
       name = "pytest-check-hook";
@@ -134,9 +144,8 @@ in {
   pythonRelaxDepsHook = callPackage ({ makePythonHook, wheel }:
     makePythonHook {
       name = "python-relax-deps-hook";
-      propagatedBuildInputs = [ wheel ];
       substitutions = {
-        inherit pythonInterpreter;
+        inherit pythonInterpreter pythonSitePackages wheel;
       };
     } ./python-relax-deps-hook.sh) {};
 
diff --git a/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh b/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
index 3b71300497691..5d77613bf565f 100644
--- a/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
@@ -6,7 +6,7 @@ pypaBuildPhase() {
     runHook preBuild
 
     echo "Creating a wheel..."
-    @pythonInterpreter@ -m build --no-isolation --outdir dist/ --wheel $pypaBuildFlags
+    pyproject-build --no-isolation --outdir dist/ --wheel $pypaBuildFlags
     echo "Finished creating a wheel..."
 
     runHook postBuild
diff --git a/pkgs/development/interpreters/python/hooks/pypa-install-hook.sh b/pkgs/development/interpreters/python/hooks/pypa-install-hook.sh
new file mode 100644
index 0000000000000..2d925742daa73
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/pypa-install-hook.sh
@@ -0,0 +1,26 @@
+# Setup hook for PyPA installer.
+echo "Sourcing pypa-install-hook"
+
+pypaInstallPhase() {
+    echo "Executing pypaInstallPhase"
+    runHook preInstall
+
+    pushd dist > /dev/null
+
+    for wheel in *.whl; do
+        @pythonInterpreter@ -m installer --prefix "$out" "$wheel"
+        echo "Successfully installed $wheel"
+    done
+
+    popd > /dev/null
+
+    export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"
+
+    runHook postInstall
+    echo "Finished executing pypaInstallPhase"
+}
+
+if [ -z "${dontUsePypaInstall-}" ] && [ -z "${installPhase-}" ]; then
+    echo "Using pypaInstallPhase"
+    installPhase=pypaInstallPhase
+fi
diff --git a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
index 31bdec914f690..1ac91fb40e4e5 100644
--- a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
@@ -78,24 +78,27 @@ pythonRelaxDepsHook() {
     pushd dist
 
     # See https://peps.python.org/pep-0491/#escaping-and-unicode
-    local -r pkg_name="${pname//[^[:alnum:].]/_}-$version"
+    local -r pkg_name="${pname//[^[:alnum:].]/_}"
     local -r unpack_dir="unpacked"
-    local -r metadata_file="$unpack_dir/$pkg_name/$pkg_name.dist-info/METADATA"
+    local -r metadata_file="$unpack_dir/$pkg_name*/$pkg_name*.dist-info/METADATA"
 
     # We generally shouldn't have multiple wheel files, but let's be safer here
     for wheel in "$pkg_name"*".whl"; do
-        @pythonInterpreter@ -m wheel unpack --dest "$unpack_dir" "$wheel"
+        PYTHONPATH="@wheel@/@pythonSitePackages@:$PYTHONPATH" \
+            @pythonInterpreter@ -m wheel unpack --dest "$unpack_dir" "$wheel"
         rm -rf "$wheel"
 
-        _pythonRelaxDeps "$metadata_file"
-        _pythonRemoveDeps "$metadata_file"
+        # Using no quotes on purpose since we need to expand the glob from `$metadata_file`
+        _pythonRelaxDeps $metadata_file
+        _pythonRemoveDeps $metadata_file
 
         if (( "${NIX_DEBUG:-0}" >= 1 )); then
             echo "pythonRelaxDepsHook: resulting METADATA for '$wheel':"
-            cat "$unpack_dir/$pkg_name/$pkg_name.dist-info/METADATA"
+            cat $metadata_file
         fi
 
-        @pythonInterpreter@ -m wheel pack "$unpack_dir/$pkg_name"
+        PYTHONPATH="@wheel@/@pythonSitePackages@:$PYTHONPATH" \
+            @pythonInterpreter@ -m wheel pack "$unpack_dir/$pkg_name"*
     done
 
     # Remove the folder since it will otherwise be in the dist output.
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index 79e45b8dc395b..8a75dbf43a742 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -12,8 +12,8 @@
 , update-python-libraries
 , setuptools
 , flitBuildHook
-, pipBuildHook
-, pipInstallHook
+, pypaBuildHook
+, pypaInstallHook
 , pythonCatchConflictsHook
 , pythonImportsCheckHook
 , pythonNamespacesHook
@@ -161,6 +161,20 @@ let
 
     in inputs: builtins.map (checkDrv) inputs;
 
+  isBootstrapInstallPackage = builtins.elem (attrs.pname or null) [
+    "flit-core" "installer"
+  ];
+
+  isBootstrapPackage = isBootstrapInstallPackage || builtins.elem (attrs.pname or null) ([
+    "build" "packaging" "pyproject-hooks" "wheel"
+  ] ++ lib.optionals (python.pythonOlder "3.11") [
+    "tomli"
+  ]);
+
+  isSetuptoolsDependency = builtins.elem (attrs.pname or null) [
+    "setuptools" "wheel"
+  ];
+
   # Keep extra attributes from `attrs`, e.g., `patchPhase', etc.
   self = toPythonModule (stdenv.mkDerivation ((builtins.removeAttrs attrs [
     "disabled" "checkPhase" "checkInputs" "nativeCheckInputs" "doCheck" "doInstallCheck" "dontWrapPythonPrograms" "catchConflicts" "format"
@@ -174,7 +188,15 @@ let
       wrapPython
       ensureNewerSourcesForZipFilesHook  # move to wheel installer (pip) or builder (setuptools, flit, ...)?
       pythonRemoveTestsDirHook
-    ] ++ lib.optionals catchConflicts [
+    ] ++ lib.optionals (catchConflicts && !isBootstrapPackage && !isSetuptoolsDependency) [
+      #
+      # 1. When building a package that is also part of the bootstrap chain, we
+      #    must ignore conflicts after installation, because there will be one with
+      #    the package in the bootstrap.
+      #
+      # 2. When a package is a dependency of setuptools, we must ignore conflicts
+      #    because the hook that checks for conflicts uses setuptools.
+      #
       pythonCatchConflictsHook
     ] ++ lib.optionals removeBinBytecode [
       pythonRemoveBinBytecodeHook
@@ -184,15 +206,26 @@ let
       setuptoolsBuildHook
     ] ++ lib.optionals (format == "flit") [
       flitBuildHook
-    ] ++ lib.optionals (format == "pyproject") [
-      pipBuildHook
-    ] ++ lib.optionals (format == "wheel") [
+    ] ++ lib.optionals (format == "pyproject") [(
+      if isBootstrapPackage then
+        pypaBuildHook.override {
+          inherit (python.pythonForBuild.pkgs.bootstrap) build;
+          wheel = null;
+        }
+      else
+        pypaBuildHook
+    )] ++ lib.optionals (format == "wheel") [
       wheelUnpackHook
     ] ++ lib.optionals (format == "egg") [
       eggUnpackHook eggBuildHook eggInstallHook
-    ] ++ lib.optionals (!(format == "other") || dontUsePipInstall) [
-      pipInstallHook
-    ] ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+    ] ++ lib.optionals (format != "other") [(
+      if isBootstrapInstallPackage then
+        pypaInstallHook.override {
+          inherit (python.pythonForBuild.pkgs.bootstrap) installer;
+        }
+      else
+        pypaInstallHook
+    )] ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
       # This is a test, however, it should be ran independent of the checkPhase and checkInputs
       pythonImportsCheckHook
     ] ++ lib.optionals (python.pythonAtLeast "3.3") [
diff --git a/pkgs/development/interpreters/python/python-packages-base.nix b/pkgs/development/interpreters/python/python-packages-base.nix
index 6a723413c850c..91ca84b34b83d 100644
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@@ -32,12 +32,17 @@ let
       }
       else result;
 
-  buildPythonPackage = makeOverridablePythonPackage (lib.makeOverridable (callPackage ./mk-python-derivation.nix {
+  mkPythonDerivation = if python.isPy3k then
+    ./mk-python-derivation.nix
+  else
+    ./python2/mk-python-derivation.nix;
+
+  buildPythonPackage = makeOverridablePythonPackage (lib.makeOverridable (callPackage mkPythonDerivation {
     inherit namePrefix;     # We want Python libraries to be named like e.g. "python3.6-${name}"
     inherit toPythonModule; # Libraries provide modules
   }));
 
-  buildPythonApplication = makeOverridablePythonPackage (lib.makeOverridable (callPackage ./mk-python-derivation.nix {
+  buildPythonApplication = makeOverridablePythonPackage (lib.makeOverridable (callPackage mkPythonDerivation {
     namePrefix = "";        # Python applications should not have any prefix
     toPythonModule = x: x;  # Application does not provide modules.
   }));
diff --git a/pkgs/development/interpreters/python/python2/mk-python-derivation.nix b/pkgs/development/interpreters/python/python2/mk-python-derivation.nix
new file mode 100644
index 0000000000000..e5f9c00b2fb22
--- /dev/null
+++ b/pkgs/development/interpreters/python/python2/mk-python-derivation.nix
@@ -0,0 +1,252 @@
+# Generic builder only used for EOL and deprecated Python 2.
+
+{ lib
+, config
+, python
+, wrapPython
+, unzip
+, ensureNewerSourcesForZipFilesHook
+# Whether the derivation provides a Python module or not.
+, toPythonModule
+, namePrefix
+, update-python-libraries
+, setuptools
+, pipBuildHook
+, pipInstallHook
+, pythonCatchConflictsHook
+, pythonImportsCheckHook
+, pythonOutputDistHook
+, pythonRemoveBinBytecodeHook
+, pythonRemoveTestsDirHook
+, setuptoolsBuildHook
+, setuptoolsCheckHook
+, wheelUnpackHook
+, eggUnpackHook
+, eggBuildHook
+, eggInstallHook
+}:
+
+{ name ? "${attrs.pname}-${attrs.version}"
+
+# Build-time dependencies for the package
+, nativeBuildInputs ? []
+
+# Run-time dependencies for the package
+, buildInputs ? []
+
+# Dependencies needed for running the checkPhase.
+# These are added to buildInputs when doCheck = true.
+, checkInputs ? []
+, nativeCheckInputs ? []
+
+# propagate build dependencies so in case we have A -> B -> C,
+# C can import package A propagated by B
+, propagatedBuildInputs ? []
+
+# DEPRECATED: use propagatedBuildInputs
+, pythonPath ? []
+
+# Enabled to detect some (native)BuildInputs mistakes
+, strictDeps ? true
+
+, outputs ? [ "out" ]
+
+# used to disable derivation, useful for specific python versions
+, disabled ? false
+
+# Raise an error if two packages are installed with the same name
+# TODO: For cross we probably need a different PYTHONPATH, or not
+# add the runtime deps until after buildPhase.
+, catchConflicts ? (python.stdenv.hostPlatform == python.stdenv.buildPlatform)
+
+# Additional arguments to pass to the makeWrapper function, which wraps
+# generated binaries.
+, makeWrapperArgs ? []
+
+# Skip wrapping of python programs altogether
+, dontWrapPythonPrograms ? false
+
+# Don't use Pip to install a wheel
+# Note this is actually a variable for the pipInstallPhase in pip's setupHook.
+# It's included here to prevent an infinite recursion.
+, dontUsePipInstall ? false
+
+# Skip setting the PYTHONNOUSERSITE environment variable in wrapped programs
+, permitUserSite ? false
+
+# Remove bytecode from bin folder.
+# When a Python script has the extension `.py`, bytecode is generated
+# Typically, executables in bin have no extension, so no bytecode is generated.
+# However, some packages do provide executables with extensions, and thus bytecode is generated.
+, removeBinBytecode ? true
+
+# Several package formats are supported.
+# "setuptools" : Install a common setuptools/distutils based package. This builds a wheel.
+# "wheel" : Install from a pre-compiled wheel.
+# "pyproject": Install a package using a ``pyproject.toml`` file (PEP517). This builds a wheel.
+# "egg": Install a package from an egg.
+# "other" : Provide your own buildPhase and installPhase.
+, format ? "setuptools"
+
+, meta ? {}
+
+, passthru ? {}
+
+, doCheck ? config.doCheckByDefault or false
+
+, disabledTestPaths ? []
+
+, ... } @ attrs:
+
+assert lib.assertMsg (format != "flit") "flit is not a supported Python 2 format";
+
+let
+  inherit (python) stdenv;
+
+  withDistOutput = lib.elem format ["pyproject" "setuptools" "flit" "wheel"];
+
+  name_ = name;
+
+  validatePythonMatches = attrName: let
+    isPythonModule = drv:
+      # all pythonModules have the pythonModule attribute
+      (drv ? "pythonModule")
+      # Some pythonModules are turned in to a pythonApplication by setting the field to false
+      && (!builtins.isBool drv.pythonModule);
+    isMismatchedPython = drv: drv.pythonModule != python;
+
+    optionalLocation = let
+        pos = builtins.unsafeGetAttrPos (if attrs ? "pname" then "pname" else "name") attrs;
+      in lib.optionalString (pos != null) " at ${pos.file}:${toString pos.line}:${toString pos.column}";
+
+    leftPadName = name: against: let
+        len = lib.max (lib.stringLength name) (lib.stringLength against);
+      in lib.strings.fixedWidthString len " " name;
+
+    throwMismatch = drv: let
+      myName = "'${namePrefix}${name}'";
+      theirName = "'${drv.name}'";
+    in throw ''
+      Python version mismatch in ${myName}:
+
+      The Python derivation ${myName} depends on a Python derivation
+      named ${theirName}, but the two derivations use different versions
+      of Python:
+
+          ${leftPadName myName theirName} uses ${python}
+          ${leftPadName theirName myName} uses ${toString drv.pythonModule}
+
+      Possible solutions:
+
+        * If ${theirName} is a Python library, change the reference to ${theirName}
+          in the ${attrName} of ${myName} to use a ${theirName} built from the same
+          version of Python
+
+        * If ${theirName} is used as a tool during the build, move the reference to
+          ${theirName} in ${myName} from ${attrName} to nativeBuildInputs
+
+        * If ${theirName} provides executables that are called at run time, pass its
+          bin path to makeWrapperArgs:
+
+              makeWrapperArgs = [ "--prefix PATH : ''${lib.makeBinPath [ ${lib.getName drv } ] }" ];
+
+      ${optionalLocation}
+    '';
+
+    checkDrv = drv:
+      if (isPythonModule drv) && (isMismatchedPython drv)
+      then throwMismatch drv
+      else drv;
+
+    in inputs: builtins.map (checkDrv) inputs;
+
+  # Keep extra attributes from `attrs`, e.g., `patchPhase', etc.
+  self = toPythonModule (stdenv.mkDerivation ((builtins.removeAttrs attrs [
+    "disabled" "checkPhase" "checkInputs" "nativeCheckInputs" "doCheck" "doInstallCheck" "dontWrapPythonPrograms" "catchConflicts" "format"
+    "disabledTestPaths" "outputs"
+  ]) // {
+
+    name = namePrefix + name_;
+
+    nativeBuildInputs = [
+      python
+      wrapPython
+      ensureNewerSourcesForZipFilesHook  # move to wheel installer (pip) or builder (setuptools, flit, ...)?
+      pythonRemoveTestsDirHook
+    ] ++ lib.optionals catchConflicts [
+      pythonCatchConflictsHook
+    ] ++ lib.optionals removeBinBytecode [
+      pythonRemoveBinBytecodeHook
+    ] ++ lib.optionals (lib.hasSuffix "zip" (attrs.src.name or "")) [
+      unzip
+    ] ++ lib.optionals (format == "setuptools") [
+      setuptoolsBuildHook
+    ] ++ lib.optionals (format == "pyproject") [(
+      pipBuildHook
+    )] ++ lib.optionals (format == "wheel") [
+      wheelUnpackHook
+    ] ++ lib.optionals (format == "egg") [
+      eggUnpackHook eggBuildHook eggInstallHook
+    ] ++ lib.optionals (format != "other") [(
+      pipInstallHook
+    )] ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+      # This is a test, however, it should be ran independent of the checkPhase and checkInputs
+      pythonImportsCheckHook
+    ] ++ lib.optionals withDistOutput [
+      pythonOutputDistHook
+    ] ++ nativeBuildInputs;
+
+    buildInputs = validatePythonMatches "buildInputs" (buildInputs ++ pythonPath);
+
+    propagatedBuildInputs = validatePythonMatches "propagatedBuildInputs" (propagatedBuildInputs ++ [
+      # we propagate python even for packages transformed with 'toPythonApplication'
+      # this pollutes the PATH but avoids rebuilds
+      # see https://github.com/NixOS/nixpkgs/issues/170887 for more context
+      python
+    ]);
+
+    inherit strictDeps;
+
+    LANG = "${if python.stdenv.isDarwin then "en_US" else "C"}.UTF-8";
+
+    # Python packages don't have a checkPhase, only an installCheckPhase
+    doCheck = false;
+    doInstallCheck = attrs.doCheck or true;
+    nativeInstallCheckInputs = [
+    ] ++ lib.optionals (format == "setuptools") [
+      # Longer-term we should get rid of this and require
+      # users of this function to set the `installCheckPhase` or
+      # pass in a hook that sets it.
+      setuptoolsCheckHook
+    ] ++ nativeCheckInputs;
+    installCheckInputs = checkInputs;
+
+    postFixup = lib.optionalString (!dontWrapPythonPrograms) ''
+      wrapPythonPrograms
+    '' + attrs.postFixup or "";
+
+    # Python packages built through cross-compilation are always for the host platform.
+    disallowedReferences = lib.optionals (python.stdenv.hostPlatform != python.stdenv.buildPlatform) [ python.pythonForBuild ];
+
+    outputs = outputs ++ lib.optional withDistOutput "dist";
+
+    meta = {
+      # default to python's platforms
+      platforms = python.meta.platforms;
+      isBuildPythonPackage = python.meta.platforms;
+    } // meta;
+  } // lib.optionalAttrs (attrs?checkPhase) {
+    # If given use the specified checkPhase, otherwise use the setup hook.
+    # Longer-term we should get rid of `checkPhase` and use `installCheckPhase`.
+    installCheckPhase = attrs.checkPhase;
+  } //  lib.optionalAttrs (disabledTestPaths != []) {
+      disabledTestPaths = lib.escapeShellArgs disabledTestPaths;
+  }));
+
+  passthru.updateScript = let
+      filename = builtins.head (lib.splitString ":" self.meta.position);
+    in attrs.passthru.updateScript or [ update-python-libraries filename ];
+in lib.extendDerivation
+  (disabled -> throw "${name} not supported for interpreter ${python.executable}")
+  passthru
+  self
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 11119b768825c..71f3f8be9b013 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.18";
+  version = "3.4.19";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-+yHTJWedZNCkkRMIRT103QMTFJODlbJ2PwVbTghEo0M=";
+    hash = "sha256-+ZYpS9UOB16qCjhrKwFGBn43t3KNOv/QIrLKIPAywWs=";
   };
 
   patches = [
diff --git a/pkgs/development/interpreters/tcl/generic.nix b/pkgs/development/interpreters/tcl/generic.nix
index 6ce6e35189bf2..8d4903add8999 100644
--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, callPackage, makeSetupHook
+{ lib, stdenv, callPackage, makeSetupHook, runCommand
+, tzdata
 
 # Version specific stuff
 , release, version, src
@@ -7,7 +8,7 @@
 
 let
   baseInterp =
-    stdenv.mkDerivation {
+    stdenv.mkDerivation rec {
       pname = "tcl";
       inherit version src;
 
@@ -15,6 +16,14 @@ let
 
       setOutputFlags = false;
 
+      postPatch = ''
+        substituteInPlace library/clock.tcl \
+          --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo" \
+          --replace "/usr/share/lib/zoneinfo" "" \
+          --replace "/usr/lib/zoneinfo" "" \
+          --replace "/usr/local/etc/zoneinfo" ""
+      '';
+
       preConfigure = ''
         cd unix
       '';
@@ -55,6 +64,12 @@ let
           name = "tcl-package-hook";
           propagatedBuildInputs = [ buildPackages.makeWrapper ];
         } ./tcl-package-hook.sh) {};
+        # verify that Tcl's clock library can access tzdata
+        tests.tzdata = runCommand "${pname}-test-tzdata" {} ''
+          ${baseInterp}/bin/tclsh <(echo "set t [clock scan {2004-10-30 05:00:00} \
+                                        -format {%Y-%m-%d %H:%M:%S} \
+                                        -timezone :America/New_York]") > $out
+        '';
       };
     };
 
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index aa1cd1d809f0f..4c8c7ed8f435c 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -55,11 +55,11 @@
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.28.1";
+  version = "2.28.2";
 
   src = fetchurl {
     url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-SXfOulwAVNvmwvEUZBrO1DzjvytB6mS2o3LWuhKcsV0=";
+    hash = "sha256-ZLEQL6Igk1FbAu8z3Yc53uG6V+nbumoJKUK4u+0aHF4=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/avahi/default.nix b/pkgs/development/libraries/avahi/default.nix
index ac97871d9ca1a..772650bd3a8a0 100644
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@@ -36,14 +36,21 @@ stdenv.mkDerivation rec {
   patches = [
     # CVE-2021-36217 / CVE-2021-3502
     (fetchpatch {
+      name = "CVE-2021-3502.patch";
       url = "https://github.com/lathiat/avahi/commit/9d31939e55280a733d930b15ac9e4dda4497680c.patch";
       sha256 = "sha256-BXWmrLWUvDxKPoIPRFBpMS3T4gijRw0J+rndp6iDybU=";
     })
     # CVE-2021-3468
     (fetchpatch {
+      name = "CVE-2021-3468.patch";
       url = "https://github.com/lathiat/avahi/commit/447affe29991ee99c6b9732fc5f2c1048a611d3b.patch";
       sha256 = "sha256-qWaCU1ZkCg2PmijNto7t8E3pYRN/36/9FrG8okd6Gu8=";
     })
+    (fetchpatch {
+      name = "CVE-2023-1981.patch";
+      url = "https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f.patch";
+      sha256 = "sha256-BEYFGCnQngp+OpiKIY/oaKygX7isAnxJpUPCUvg+efc=";
+    })
   ];
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/dab_lib/default.nix b/pkgs/development/libraries/dab_lib/default.nix
index 0d236c36aa3cf..82d591abc139b 100644
--- a/pkgs/development/libraries/dab_lib/default.nix
+++ b/pkgs/development/libraries/dab_lib/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-KSkOg0a5iq+13kClQqj+TaEP/PsLUrm8bMmiJEAZ+C4=";
   };
 
-  sourceRoot = "${finalAttrs.src.name}/library/";
+  sourceRoot = "${finalAttrs.src.name}/library";
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ faad2 fftwFloat zlib ];
diff --git a/pkgs/development/libraries/fdk-aac/default.nix b/pkgs/development/libraries/fdk-aac/default.nix
index 84513d20a57a3..71077d6e315e2 100644
--- a/pkgs/development/libraries/fdk-aac/default.nix
+++ b/pkgs/development/libraries/fdk-aac/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  enableParallelBuilding = true;
+
   configureFlags = lib.optional exampleSupport "--enable-example";
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/gettext/0001-msginit-Do-not-use-POT-Creation-Date.patch b/pkgs/development/libraries/gettext/0001-msginit-Do-not-use-POT-Creation-Date.patch
new file mode 100644
index 0000000000000..eea9dc6e03783
--- /dev/null
+++ b/pkgs/development/libraries/gettext/0001-msginit-Do-not-use-POT-Creation-Date.patch
@@ -0,0 +1,32 @@
+From 1e000ca711886055176a2f90197a383d09de0e67 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miguel=20=C3=81ngel=20Arruga=20Vivas?=
+ <rosen644835@gmail.com>
+Date: Fri, 18 Dec 2020 14:19:36 +0100
+Subject: [PATCH] msginit: Do not use POT-Creation-Date.
+
+* gettext-tools/src/msginit.c (po_revision_date): Do not use
+POT-Creation-Date when the file is automatically generated.
+---
+ gettext-tools/src/msginit.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/gettext-tools/src/msginit.c b/gettext-tools/src/msginit.c
+index 8ca9a3b77..06e0e7195 100644
+--- a/gettext-tools/src/msginit.c
++++ b/gettext-tools/src/msginit.c
+@@ -1075,9 +1075,9 @@ static const char *
+ po_revision_date (const char *header)
+ {
+   if (no_translator)
+-    /* Because the PO file is automatically generated, we use the
+-       POT-Creation-Date, not the current time.  */
+-    return get_field (header, "POT-Creation-Date");
++    /* Because the PO file is automatically generated, we don't
++       generate PO-Revision-Date field.  */
++    return NULL;
+   else
+     {
+       /* Assume the translator will modify the PO file now.  */
+-- 
+2.29.2
+
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index ec929272dea0e..0222cb4480459 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -17,6 +17,9 @@ stdenv.mkDerivation rec {
   };
   patches = [
     ./absolute-paths.diff
+    # fix reproducibile output, in particular in the grub2 build
+    # https://savannah.gnu.org/bugs/index.php?59658
+    ./0001-msginit-Do-not-use-POT-Creation-Date.patch
   ] ++ lib.optional stdenv.hostPlatform.isWindows (fetchpatch {
     url = "https://aur.archlinux.org/cgit/aur.git/plain/gettext_formatstring-ruby.patch?h=mingw-w64-gettext&id=e8b577ee3d399518d005e33613f23363a7df07ee";
     name = "gettext_formatstring-ruby.patch";
diff --git a/pkgs/development/libraries/glog/default.nix b/pkgs/development/libraries/glog/default.nix
index a64bb0967aa7b..85e9770f989e3 100644
--- a/pkgs/development/libraries/glog/default.nix
+++ b/pkgs/development/libraries/glog/default.nix
@@ -19,24 +19,48 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
+    # glog's custom FindUnwind.cmake module detects LLVM's unwind in case
+    # stdenv.cc is clang. But the module doesn't get installed, causing
+    # consumers of the CMake config file to fail at the configuration step.
+    # Explicitly disabling unwind support sidesteps the issue.
+    "-DWITH_UNWIND=OFF"
   ];
 
-  # TODO: Re-enable Darwin tests once we're on a release that has https://github.com/google/glog/issues/709#issuecomment-960381653 fixed
-  doCheck = !stdenv.isDarwin;
+  doCheck = true;
+
   # There are some non-thread safe tests that can fail
   enableParallelChecking = false;
   nativeCheckInputs = [ perl ];
 
-  GTEST_FILTER =
+  env.GTEST_FILTER =
     let
       filteredTests = lib.optionals stdenv.hostPlatform.isMusl [
         "Symbolize.SymbolizeStackConsumption"
         "Symbolize.SymbolizeWithDemanglingStackConsumption"
       ] ++ lib.optionals stdenv.hostPlatform.isStatic [
         "LogBacktraceAt.DoesBacktraceAtRightLineWhenEnabled"
+      ] ++ lib.optionals stdenv.cc.isClang [
+        # Clang optimizes an expected allocation away.
+        # See https://github.com/google/glog/issues/937
+        "DeathNoAllocNewHook.logging"
+      ] ++ lib.optionals stdenv.isDarwin [
+        "LogBacktraceAt.DoesBacktraceAtRightLineWhenEnabled"
+      ];
+    in
+    "-${builtins.concatStringsSep ":" filteredTests}";
+
+  checkPhase =
+    let
+      excludedTests = lib.optionals stdenv.isDarwin [
+        "mock-log"
       ];
+      excludedTestsRegex = lib.optionalString (excludedTests != [ ]) "(${lib.concatStringsSep "|" excludedTests})";
     in
-    lib.optionalString doCheck "-${builtins.concatStringsSep ":" filteredTests}";
+    ''
+      runHook preCheck
+      ctest -E "${excludedTestsRegex}" --output-on-failure
+      runHook postCheck
+    '';
 
   meta = with lib; {
     homepage = "https://github.com/google/glog";
diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index 75a20bbbc355a..2b088eb459ad5 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -23,9 +23,29 @@ in stdenv.mkDerivation {
   pname = "gnu-config";
   version = "2023-07-31";
 
-  buildCommand = ''
-    install -Dm755 ${configGuess} $out/config.guess
-    install -Dm755 ${configSub} $out/config.sub
+  unpackPhase = ''
+    runHook preUnpack
+    cp ${configGuess} ./config.guess
+    cp ${configSub} ./config.sub
+    chmod +w ./config.sub ./config.guess
+    runHook postUnpack
+  '';
+
+  # If this isn't set, `pkgs.gnu-config.overrideAttrs( _: { patches
+  # = ...; })` will behave very counterintuitively: the (unpatched)
+  # gnu-config from the updateAutotoolsGnuConfigScriptsHook stdenv's
+  # defaultNativeBuildInputs will "update" the patched gnu-config by
+  # reverting the patch!
+  dontUpdateAutotoolsGnuConfigScripts = true;
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 ./config.guess $out/config.guess
+    install -Dm755 ./config.sub $out/config.sub
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/java/mockobjects/default.nix b/pkgs/development/libraries/java/mockobjects/default.nix
index 022f68a9d3511..113c377240b43 100644
--- a/pkgs/development/libraries/java/mockobjects/default.nix
+++ b/pkgs/development/libraries/java/mockobjects/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   # Work around the "unpacker appears to have produced no directories"
-  setSourceRoot = "sourceRoot=`pwd`";
+  sourceRoot = ".";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/kdb/default.nix b/pkgs/development/libraries/kdb/default.nix
index 5ab33fcf46fd9..f9aa5dc369c67 100644
--- a/pkgs/development/libraries/kdb/default.nix
+++ b/pkgs/development/libraries/kdb/default.nix
@@ -4,12 +4,12 @@
 , fetchpatch
 , extra-cmake-modules
 , qtbase
-, qttranslations
 , kcoreaddons
 , python3
 , sqlite
 , postgresql
 , libmysqlclient
+, qttools
 }:
 
 mkDerivation rec {
@@ -34,9 +34,9 @@ mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ extra-cmake-modules ];
+  nativeBuildInputs = [ extra-cmake-modules qttools ];
 
-  buildInputs = [ qttranslations kcoreaddons python3 sqlite postgresql libmysqlclient ];
+  buildInputs = [ kcoreaddons python3 sqlite postgresql libmysqlclient ];
 
   propagatedBuildInputs = [ qtbase ];
 
diff --git a/pkgs/development/libraries/kde-frameworks/kirigami2.nix b/pkgs/development/libraries/kde-frameworks/kirigami2.nix
index 281a490bf90aa..a47182fda5e57 100644
--- a/pkgs/development/libraries/kde-frameworks/kirigami2.nix
+++ b/pkgs/development/libraries/kde-frameworks/kirigami2.nix
@@ -1,8 +1,8 @@
-{ mkDerivation, extra-cmake-modules, qtbase, qtquickcontrols2, qttranslations, qtgraphicaleffects }:
+{ mkDerivation, extra-cmake-modules, qtbase, qtquickcontrols2, qtgraphicaleffects, qttools }:
 
 mkDerivation {
   pname = "kirigami2";
-  nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ qtbase qtquickcontrols2 qttranslations qtgraphicaleffects ];
+  nativeBuildInputs = [ extra-cmake-modules qttools ];
+  buildInputs = [ qtbase qtquickcontrols2 qtgraphicaleffects ];
   outputs = [ "out" "dev" ];
 }
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index c8f050c300ce9..de305474a3abc 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -30,7 +30,7 @@ let
   autoreconfHook = buildPackages.autoreconfHook269;
 in
 assert xarSupport -> libxml2 != null;
-(stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
   version = "3.6.2";
 
@@ -43,6 +43,16 @@ assert xarSupport -> libxml2 != null;
 
   outputs = [ "out" "lib" "dev" ];
 
+  patches = [
+    # fixes static linking; upstream in releases after 3.6.2
+    # https://github.com/libarchive/libarchive/pull/1825 merged upstream
+    (assert finalAttrs.version == "3.6.2"; fetchpatch {
+      name = "001-only-add-iconv-to-pc-file-if-needed.patch";
+      url = "https://github.com/libarchive/libarchive/commit/1f35c466aaa9444335a1b854b0b7223b0d2346c2.patch";
+      hash = "sha256-lb+zwWSH6/MLUIROvu9I/hUjSbb2jOWO755WC/r+lbY=";
+    })
+  ];
+
   postPatch = let
     skipTestPaths = [
       # test won't work in nix sandbox
@@ -119,16 +129,4 @@ assert xarSupport -> libxml2 != null;
   passthru.tests = {
     inherit cmake nix samba;
   };
-})).overrideAttrs(previousAttrs:
-  assert previousAttrs.version == "3.6.2";
-  lib.optionalAttrs stdenv.hostPlatform.isStatic {
-    patches = [
-      # fixes static linking; upstream in releases after 3.6.2
-      # https://github.com/libarchive/libarchive/pull/1825 merged upstream
-      (fetchpatch {
-        name = "001-only-add-iconv-to-pc-file-if-needed.patch";
-        url = "https://github.com/libarchive/libarchive/commit/1f35c466aaa9444335a1b854b0b7223b0d2346c2.patch";
-        hash = "sha256-lb+zwWSH6/MLUIROvu9I/hUjSbb2jOWO755WC/r+lbY=";
-      })
-    ];
-  })
+})
diff --git a/pkgs/development/libraries/liblc3/default.nix b/pkgs/development/libraries/liblc3/default.nix
index 3e27e4064c591..f2ec852d3bf0a 100644
--- a/pkgs/development/libraries/liblc3/default.nix
+++ b/pkgs/development/libraries/liblc3/default.nix
@@ -7,7 +7,7 @@
 
 let
   name = "liblc3";
-  version = "1.0.3";
+  version = "1.0.4";
 in
 stdenv.mkDerivation {
   pname = name;
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     owner = "google";
     repo = "liblc3";
     rev = "v${version}";
-    sha256 = "sha256-PEnK12FWAtxOMR3WyuxOQTgF+lD9S5YX+oKuWRbFfXM=";
+    sha256 = "sha256-nQJgF/cWoCx5TkX4xOaLB9SzvhVXPY29bLh7UwPMWEE=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libraw/default.nix b/pkgs/development/libraries/libraw/default.nix
index 26d7616ba8f00..b03be435aac51 100644
--- a/pkgs/development/libraries/libraw/default.nix
+++ b/pkgs/development/libraries/libraw/default.nix
@@ -1,4 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, lcms2, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoreconfHook
+, lcms2
+, pkg-config
+
+# for passthru.tests
+, deepin
+, freeimage
+, hdrmerge
+, imagemagick
+, python3
+}:
 
 stdenv.mkDerivation rec {
   pname = "libraw";
@@ -11,6 +25,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-K9mULf6V/TCl5Vu4iuIdSGF9HzQlgNQLRFHIpNbmAlY";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-1729.patch";
+      url = "https://github.com/LibRaw/LibRaw/commit/9ab70f6dca19229cb5caad7cc31af4e7501bac93.patch";
+      hash = "sha256-OAyqphxvtSM15NI77HwtGTmTmP9YNu3xhZ6D1CceJ7I=";
+    })
+  ];
+
   outputs = [ "out" "lib" "dev" "doc" ];
 
   propagatedBuildInputs = [ lcms2 ];
@@ -19,6 +41,12 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    inherit imagemagick hdrmerge freeimage;
+    inherit (deepin) deepin-image-viewer;
+    inherit (python3.pkgs) rawkit;
+  };
+
   meta = with lib; {
     description = "Library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others)";
     homepage = "https://www.libraw.org/";
diff --git a/pkgs/development/libraries/libsndfile/default.nix b/pkgs/development/libraries/libsndfile/default.nix
index 0dc795a96d843..7c6613873f3a0 100644
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsndfile";
-  version = "1.2.0";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-zd0HDUzVYLyFjhIudBJQaKJUtYMjZeQRLALSkyD9tXU=";
+    hash = "sha256-MOOX/O0UaoeMaQPW9PvvE0izVp+6IoE5VbtTx0RvMkI=";
   };
 
   nativeBuildInputs = [ autoreconfHook autogen pkg-config python3 ];
diff --git a/pkgs/development/libraries/liburing/default.nix b/pkgs/development/libraries/liburing/default.nix
index 0f1757f4e6187..5779389dda1bb 100644
--- a/pkgs/development/libraries/liburing/default.nix
+++ b/pkgs/development/libraries/liburing/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit }:
+{ lib, stdenv, fetchgit, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "liburing";
@@ -10,6 +10,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vbe9uh9AqXyPkzwD6zHoHH3JMeAJEl2FSGzny1T7diM=";
   };
 
+  patches = [
+    # Pull upstream fix for parallel build failures:
+    #   https://github.com/axboe/liburing/pull/891
+    (fetchpatch {
+      name = "parallel.patch";
+      url = "https://github.com/axboe/liburing/commit/c34dca74854cb6e7f2b09affa2a4ab0145e62371.patch";
+      hash = "sha256-RZSgHdQy5d7mXtMvkMyr+/kMhp1w+S5v9cqk5NSii5o=";
+    })
+  ];
+
   separateDebugInfo = true;
   enableParallelBuilding = true;
   # Upstream's configure script is not autoconf generated, but a hand written one.
diff --git a/pkgs/development/libraries/libzen/default.nix b/pkgs/development/libraries/libzen/default.nix
index 12ac860320c7d..ecc3736d1fbbb 100644
--- a/pkgs/development/libraries/libzen/default.nix
+++ b/pkgs/development/libraries/libzen/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
   configureFlags = [ "--enable-shared" ];
 
-  sourceRoot = "./ZenLib/Project/GNU/Library/";
+  sourceRoot = "ZenLib/Project/GNU/Library";
 
   preConfigure = "sh autogen.sh";
 
diff --git a/pkgs/development/libraries/liquidfun/default.nix b/pkgs/development/libraries/liquidfun/default.nix
index d3e3187bf757a..6ab138016d19c 100644
--- a/pkgs/development/libraries/liquidfun/default.nix
+++ b/pkgs/development/libraries/liquidfun/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ libGLU libGL libX11 libXi ];
 
-  sourceRoot = "liquidfun/Box2D/";
+  sourceRoot = "liquidfun/Box2D";
 
   preConfigurePhases = "preConfigure";
 
diff --git a/pkgs/development/libraries/mesa-glu/default.nix b/pkgs/development/libraries/mesa-glu/default.nix
index 1c08812db45cd..b583eb93153a4 100644
--- a/pkgs/development/libraries/mesa-glu/default.nix
+++ b/pkgs/development/libraries/mesa-glu/default.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   outputs = [ "out" "dev" ];
 
+  enableParallelBuilding = true;
+
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
   meta = {
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index b4330796e52ce..8badbf9e8760b 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     patchShebangs nss
 
-    for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do
+    for f in nss/coreconf/config.gypi nss/build.sh; do
       substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
     done
 
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 08b92288e5447..941d4da56894b 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -75,7 +75,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.77";
+    version = "0.3.78";
 
     outputs = [
       "out"
@@ -93,7 +93,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-dRAo/GzWvXKVCGLM12YyTQmgXHEYn3QbOyaZKmlqTYY=";
+      sha256 = "sha256-tiVuab8kugp9ZOKL/m8uZQps/pcrVihwB3rRf6SGuzc=";
     };
 
     patches = [
@@ -221,7 +221,7 @@ let
       moveToOutput "bin/pw-jack" "$jack"
     '';
 
-    passthru.tests = nixosTests.installed-tests.pipewire;
+    passthru.tests.installed-tests = nixosTests.installed-tests.pipewire;
 
     meta = with lib; {
       description = "Server and user space API to deal with multimedia pipelines";
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 59198a636bba3..12a3fd8e01573 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -46,6 +46,7 @@ let
       ./qtbase.patch.d/0009-qtbase-qtpluginpath.patch
       ./qtbase.patch.d/0010-qtbase-assert.patch
       ./qtbase.patch.d/0011-fix-header_module.patch
+      ./qtbase.patch.d/9999-backport-dbus-crash.patch
     ];
     qtdeclarative = [
       ./qtdeclarative.patch
@@ -334,7 +335,17 @@ let
       } ../hooks/wrap-qt-apps-hook.sh;
     };
 
-in makeScopeWithSplicing' {
-  otherSplices = generateSplicesForMkScope "qt5";
-  f = addPackages;
-}
+  baseScope = makeScopeWithSplicing' {
+    otherSplices = generateSplicesForMkScope "qt5";
+    f = addPackages;
+  };
+
+  bootstrapScope = baseScope.overrideScope(final: prev: {
+    qtbase = prev.qtbase.override { qttranslations = null; };
+    qtdeclarative = null;
+  });
+
+  finalScope = baseScope.overrideScope(final: prev: {
+    qttranslations = bootstrapScope.qttranslations;
+  });
+in finalScope
diff --git a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch
new file mode 100644
index 0000000000000..e1aa0119aa2f2
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch
@@ -0,0 +1,79 @@
+commit eb0c6846a5d05d686f0686f0f1ddddcad762ad26 (HEAD -> kde/5.15)
+Author: K900 <me@0upti.me>
+Date:   Mon Aug 14 22:44:02 2023 +0300
+
+    QLibraryPrivate: Actually merge load hints
+
+    Or old and new load hints in mergeLoadHints() instead of just storing
+    new ones. Andjust QLibraryPrivate::setLoadHints() to handle objects
+    with no file name differently and just set load hints directly.
+
+    Mention that load hints are merged once the file name is set
+    in the documentation for QLibrary::setLoadHints().
+
+    Add a regression test into tst_qfactoryloader.
+
+    Update and extend tst_QPluginLoader::loadHints() to take into account
+    load hints merging.
+
+    Fixes: QTBUG-114480
+    Change-Id: I3b9afaec7acde1f5ff992d913f8d7217392c7e00
+    Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
+    Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
+
+diff --git a/src/corelib/plugin/qlibrary.cpp b/src/corelib/plugin/qlibrary.cpp
+index 5d2f024267..45b5a3fe27 100644
+--- a/src/corelib/plugin/qlibrary.cpp
++++ b/src/corelib/plugin/qlibrary.cpp
+@@ -526,7 +526,7 @@ void QLibraryPrivate::mergeLoadHints(QLibrary::LoadHints lh)
+     if (pHnd.loadRelaxed())
+         return;
+
+-    loadHintsInt.storeRelaxed(lh);
++    loadHintsInt.fetchAndOrRelaxed(lh);
+ }
+
+ QFunctionPointer QLibraryPrivate::resolve(const char *symbol)
+@@ -538,6 +538,13 @@ QFunctionPointer QLibraryPrivate::resolve(const char *symbol)
+
+ void QLibraryPrivate::setLoadHints(QLibrary::LoadHints lh)
+ {
++    // Set the load hints directly for a dummy if this object is not associated
++    // with a file. Such object is not shared between multiple instances.
++    if (fileName.isEmpty()) {
++        loadHintsInt.storeRelaxed(lh);
++        return;
++    }
++
+     // this locks a global mutex
+     QMutexLocker lock(&qt_library_mutex);
+     mergeLoadHints(lh);
+@@ -1166,6 +1173,10 @@ QString QLibrary::errorString() const
+     lazy symbol resolution, and will not export external symbols for resolution
+     in other dynamically-loaded libraries.
+
++    \note Hints can only be cleared when this object is not associated with a
++    file. Hints can only be added once the file name is set (\a hints will
++    be or'ed with the old hints).
++
+     \note Setting this property after the library has been loaded has no effect
+     and loadHints() will not reflect those changes.
+
+diff --git a/src/corelib/plugin/qpluginloader.cpp b/src/corelib/plugin/qpluginloader.cpp
+index 0a63b93762..ceee5d6385 100644
+--- a/src/corelib/plugin/qpluginloader.cpp
++++ b/src/corelib/plugin/qpluginloader.cpp
+@@ -414,10 +414,11 @@ QString QPluginLoader::errorString() const
+ void QPluginLoader::setLoadHints(QLibrary::LoadHints loadHints)
+ {
+     if (!d) {
+-        d = QLibraryPrivate::findOrCreate(QString());   // ugly, but we need a d-ptr
++        d = QLibraryPrivate::findOrCreate({}, {}, loadHints); // ugly, but we need a d-ptr
+         d->errorString.clear();
++    } else {
++        d->setLoadHints(loadHints);
+     }
+-    d->setLoadHints(loadHints);
+ }
+
+ QLibrary::LoadHints QPluginLoader::loadHints() const
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index ed280cc0151ab..ffd2d06769ff3 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -15,6 +15,7 @@
   # optional dependencies
 , cups ? null, postgresql ? null
 , withGtk3 ? false, dconf, gtk3
+, qttranslations ? null
 
   # options
 , libGLSupported ? !stdenv.isDarwin
@@ -330,6 +331,8 @@ stdenv.mkDerivation (finalAttrs: {
     ] ++ lib.optionals (mysqlSupport) [
       "-L" "${libmysqlclient}/lib"
       "-I" "${libmysqlclient}/include"
+    ] ++ lib.optional (qttranslations != null) [
+      "-translationdir" "${qttranslations}/translations"
     ]
   );
 
diff --git a/pkgs/development/libraries/qt-5/modules/qttools.nix b/pkgs/development/libraries/qt-5/modules/qttools.nix
index be96236d72850..bac70d146bf91 100644
--- a/pkgs/development/libraries/qt-5/modules/qttools.nix
+++ b/pkgs/development/libraries/qt-5/modules/qttools.nix
@@ -36,7 +36,7 @@ qtModule {
     "bin/macdeployqt"
   ];
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin ''-DNIXPKGS_QMLIMPORTSCANNER="${qtdeclarative.dev}/bin/qmlimportscanner"'';
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.isDarwin && qtdeclarative != null) ''-DNIXPKGS_QMLIMPORTSCANNER="${qtdeclarative.dev}/bin/qmlimportscanner"'';
 
   setupHook = ../hooks/qttools-setup-hook.sh;
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qttranslations.nix b/pkgs/development/libraries/qt-5/modules/qttranslations.nix
index f49a4eb9a85d0..bcd52cdc4a8f6 100644
--- a/pkgs/development/libraries/qt-5/modules/qttranslations.nix
+++ b/pkgs/development/libraries/qt-5/modules/qttranslations.nix
@@ -2,5 +2,6 @@
 
 qtModule {
   pname = "qttranslations";
-  qtInputs = [ qttools ];
+  nativeBuildInputs = [ qttools ];
+  outputs = [ "out" ];
 }
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index d90834e0b3e2d..0a4fbe713ec0b 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -48,6 +48,7 @@ let
           ./patches/0005-qtbase-deal-with-a-font-face-at-index-0-as-Regular-f.patch
           ./patches/0006-qtbase-qt-cmake-always-use-cmake-from-path.patch
           ./patches/0007-qtbase-find-qt-tools-in-QTTOOLSPATH.patch
+          ./patches/0008-qtbase-allow-translations-outside-prefix.patch
           ./patches/0008-qtbase-find-qmlimportscanner-in-macdeployqt-via-environment.patch
           ./patches/0009-qtbase-check-in-the-QML-folder-of-this-library-does-actuall.patch
           ./patches/0010-qtbase-pass-to-qmlimportscanner-the-QML2_IMPORT_PATH.patch
@@ -171,6 +172,14 @@ let
 
   # TODO(@Artturin): convert to makeScopeWithSplicing'
   # simple example of how to do that in 5568a4d25ca406809530420996d57e0876ca1a01
-  self = lib.makeScope newScope addPackages;
-in
-self
+  baseScope = lib.makeScope newScope addPackages;
+
+  bootstrapScope = baseScope.overrideScope'(final: prev: {
+    qtbase = prev.qtbase.override { qttranslations = null; };
+    qtdeclarative = null;
+  });
+
+  finalScope = baseScope.overrideScope'(final: prev: {
+    qttranslations = bootstrapScope.qttranslations;
+  });
+in finalScope
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
index 4a4ebb320757f..c0a20503e64c0 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
@@ -93,6 +93,7 @@
 , libGL
 , debug ? false
 , developerBuild ? false
+, qttranslations ? null
 }:
 
 let
@@ -233,7 +234,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals stdenv.isDarwin [
     # error: 'path' is unavailable: introduced in macOS 10.15
     "-DQT_FEATURE_cxx17_filesystem=OFF"
-  ];
+  ] ++ lib.optional (qttranslations != null) "-DINSTALL_TRANSLATIONSDIR=${qttranslations}/translations";
 
   NIX_LDFLAGS = toString (lib.optionals stdenv.isDarwin [
     # Undefined symbols for architecture arm64: "___gss_c_nt_hostbased_service_oid_desc"
diff --git a/pkgs/development/libraries/qt-6/modules/qttranslations.nix b/pkgs/development/libraries/qt-6/modules/qttranslations.nix
index 4795cd9e1bfe1..61c642de10850 100644
--- a/pkgs/development/libraries/qt-6/modules/qttranslations.nix
+++ b/pkgs/development/libraries/qt-6/modules/qttranslations.nix
@@ -4,5 +4,6 @@
 
 qtModule {
   pname = "qttranslations";
-  qtInputs = [ qttools ];
+  nativeBuildInputs = [ qttools ];
+  outputs = [ "out" ];
 }
diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
index 0c243d4ba7a97..5d9aa71e85374 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
@@ -14,8 +14,6 @@
 , python3
 , which
 , nodejs
-, qtbase
-, perl
 , xorg
 , libXcursor
 , libXScrnSaver
@@ -51,8 +49,6 @@
 , systemd
 , pipewire
 , gn
-, runCommand
-, writeScriptBin
 , ffmpeg_4
 , lib
 , stdenv
@@ -60,10 +56,8 @@
 , libxml2
 , libxslt
 , lcms2
-, re2
 , libkrb5
 , mesa
-, xkeyboard_config
 , enableProprietaryCodecs ? true
   # darwin
 , llvmPackages_14
@@ -135,7 +129,11 @@ qtModule {
     # environment variable, since NixOS relies on it working.
     # See https://github.com/NixOS/nixpkgs/issues/226484 for more context.
     ../patches/qtwebengine-xkb-includes.patch
+
     ../patches/qtwebengine-link-pulseaudio.patch
+
+    # Override locales install path so they go to QtWebEngine's $out
+    ../patches/qtwebengine-locales-path.patch
   ];
 
   postPatch = ''
@@ -225,7 +223,6 @@ qtModule {
     libxml2
     libxslt
     lcms2
-    re2
 
     libevent
     ffmpeg_4
diff --git a/pkgs/development/libraries/qt-6/patches/0008-qtbase-allow-translations-outside-prefix.patch b/pkgs/development/libraries/qt-6/patches/0008-qtbase-allow-translations-outside-prefix.patch
new file mode 100644
index 0000000000000..e96cbdbef11de
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/0008-qtbase-allow-translations-outside-prefix.patch
@@ -0,0 +1,13 @@
+diff --git a/cmake/QtBuild.cmake b/cmake/QtBuild.cmake
+index b45ec1d208..05f69c131b 100644
+--- a/cmake/QtBuild.cmake
++++ b/cmake/QtBuild.cmake
+@@ -30,7 +30,7 @@ function(qt_configure_process_path name default docstring)
+             set(rel_path ".")
+         elseif(rel_path MATCHES "^\.\./")
+             # INSTALL_SYSCONFDIR is allowed to be outside the prefix.
+-            if(NOT name STREQUAL "INSTALL_SYSCONFDIR")
++            if(NOT (name STREQUAL "INSTALL_SYSCONFDIR" OR name STREQUAL "INSTALL_TRANSLATIONSDIR"))
+                 message(FATAL_ERROR
+                     "Path component '${name}' is outside computed install prefix: ${rel_path} ")
+                 return()
diff --git a/pkgs/development/libraries/qt-6/patches/qtwebengine-locales-path.patch b/pkgs/development/libraries/qt-6/patches/qtwebengine-locales-path.patch
new file mode 100644
index 0000000000000..58f2d96f80978
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/qtwebengine-locales-path.patch
@@ -0,0 +1,28 @@
+diff --git a/src/core/api/CMakeLists.txt b/src/core/api/CMakeLists.txt
+index f860e0ba7..30e1a767a 100644
+--- a/src/core/api/CMakeLists.txt
++++ b/src/core/api/CMakeLists.txt
+@@ -193,7 +193,8 @@ if(QT_FEATURE_framework)
+ 
+ else()
+     install(FILES ${localeFiles}
+-        DESTINATION ${INSTALL_TRANSLATIONSDIR}/qtwebengine_locales
++        # Nixpkgs: INSTALL_TRANSLATIONSDIR points to Qt base translations store path
++        DESTINATION ${INSTALL_DATADIR}/qtwebengine_locales
+         CONFIGURATIONS ${config}
+     )
+     install(FILES ${resourceFiles}
+diff --git a/src/core/web_engine_library_info.cpp b/src/core/web_engine_library_info.cpp
+index c03c9a3b2..430fdfab2 100644
+--- a/src/core/web_engine_library_info.cpp
++++ b/src/core/web_engine_library_info.cpp
+@@ -203,7 +203,8 @@ QString localesPath()
+             candidatePaths << getResourcesPath(frameworkBundle()) % QDir::separator()
+                             % QLatin1String("qtwebengine_locales");
+ #endif
+-            candidatePaths << QLibraryInfo::path(QLibraryInfo::TranslationsPath) % QDir::separator()
++            // Nixpkgs: match the changes made in CMakeLists.txt
++            candidatePaths << QLibraryInfo::path(QLibraryInfo::DataPath) % QDir::separator()
+                             % QLatin1String("qtwebengine_locales");
+             candidatePaths << fallbackDir();
+         }
diff --git a/pkgs/development/libraries/qt-6/qtModule.nix b/pkgs/development/libraries/qt-6/qtModule.nix
index 98606d24a9689..ce917a2741591 100644
--- a/pkgs/development/libraries/qt-6/qtModule.nix
+++ b/pkgs/development/libraries/qt-6/qtModule.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (args // {
   buildInputs = args.buildInputs or [ ];
   nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [ cmake ninja perl ]
     ++ lib.optionals stdenv.isDarwin [ moveBuildTree ];
-  propagatedBuildInputs = args.qtInputs ++ (args.propagatedBuildInputs or [ ]);
+  propagatedBuildInputs = (args.qtInputs or [ ]) ++ (args.propagatedBuildInputs or [ ]);
 
   moveToDev = false;
 
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index 2020352323995..adaef49976a78 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -8,23 +8,26 @@
 , haskellPackages
 , mercurial
 , python3Packages
+, abseil-cpp
 }:
 
 stdenv.mkDerivation rec {
   pname = "re2";
-  version = "2023-03-01";
+  version = "2023-08-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
     rev = version;
-    hash = "sha256-T+P7qT8x5dXkLZAL8VjvqPD345sa6ALX1f5rflE0dwc=";
+    hash = "sha256-RexwqNR/Izf2Rzu1cvMw+le6C4EmL4CeWCOc+vXUBZQ=";
   };
 
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ninja ];
 
+  propagatedBuildInputs = [ abseil-cpp ];
+
   postPatch = ''
     substituteInPlace re2Config.cmake.in \
       --replace "\''${PACKAGE_PREFIX_DIR}/" ""
@@ -65,7 +68,7 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.bsd3;
     homepage = "https://github.com/google/re2";
-    maintainers = with maintainers; [ azahi ];
+    maintainers = with maintainers; [ azahi networkexception ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index dd68fef04e6b4..678aac37e8985 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.47";
+  version = "1.3.48";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wFn7vJA6FCfgFCjjDdyOtBv209yeJNFlG1fKMQ84Bj0=";
+    sha256 = "sha256-7C1syZAhMv0N+AuE/SuXqhatKhlzDOix4ZDxLRyuWOs=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/snappy/default.nix b/pkgs/development/libraries/snappy/default.nix
index a45d0a419e62e..004dd388385fd 100644
--- a/pkgs/development/libraries/snappy/default.nix
+++ b/pkgs/development/libraries/snappy/default.nix
@@ -23,16 +23,17 @@ stdenv.mkDerivation rec {
       url = "https://build.opensuse.org/public/source/openSUSE:Factory/snappy/reenable-rtti.patch?rev=a759aa6fba405cd40025e3f0ab89941d";
       sha256 = "sha256-RMuM5yd6zP1eekN/+vfS54EyY4cFbGDVor1E1vj3134=";
     })
+    # Fix -Wsign-compare warning on clang.
+    (fetchpatch {
+      url = "https://github.com/google/snappy/commit/27f34a580be4a3becf5f8c0cba13433f53c21337.patch";
+      sha256 = "sha256-eq6ueeMAkd2bYmPJcKAZZzd5QlXyeWOrsxFIwR8KOpQ=";
+    })
   ];
 
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
 
-  # See https://github.com/NixOS/nixpkgs/pull/219778#issuecomment-1464884412
-  # and https://github.com/NixOS/nixpkgs/pull/221215#issuecomment-1482564003.
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-sign-compare";
-
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
     "-DSNAPPY_BUILD_TESTS=OFF"
diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index dc85ac20bf6a4..44ad21d6a141a 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.250.0";
+  version = "1.3.261.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-5mVcbOAuzux/Yuo0NMwZRTsdQr46UxjrtMhT5mPHyCQ=";
+    hash = "sha256-P/ZD53Xa4Fk9+N/bW5HhsfA+LjUnCbBsQDHvXesKu5M=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/tpm2-tss/default.nix b/pkgs/development/libraries/tpm2-tss/default.nix
index 9d7cb73cc539c..f637df8913546 100644
--- a/pkgs/development/libraries/tpm2-tss/default.nix
+++ b/pkgs/development/libraries/tpm2-tss/default.nix
@@ -31,16 +31,16 @@ stdenv.mkDerivation rec {
     shadow
   ];
 
-  # cmocka is checked / used(?) in the configure script
+  buildInputs = [
+    openssl json_c curl libgcrypt uthash libuuid
+  ]
+  # cmocka is checked in the configure script
   # when unit and/or integration testing is enabled
-  buildInputs = [ openssl json_c curl libgcrypt uthash libuuid ]
-    # cmocka doesn't build with pkgsStatic, and we don't need it anyway
-    # when tests are not run
-    ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
-    cmocka
-  ];
+  # cmocka doesn't build with pkgsStatic, and we don't need it anyway
+  # when tests are not run
+  ++ lib.optional doInstallCheck cmocka;
 
-  nativeCheckInputs = [
+  nativeInstallCheckInputs = [
     cmocka which openssl procps_pkg iproute2 ibm-sw-tpm2
   ];
 
@@ -70,27 +70,24 @@ stdenv.mkDerivation rec {
       --replace 'git describe --tags --always --dirty' 'echo "${version}"'
   '';
 
-  configureFlags = lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+  configureFlags = lib.optionals doInstallCheck [
     "--enable-unit"
     "--enable-integration"
   ];
 
-  doCheck = true;
-  preCheck = ''
-    # Since we rewrote the load path in the dynamic loader for the TCTI
-    # The various tcti implementation should be placed in their target directory
-    # before we could run tests
-    installPhase
-    # install already done, dont need another one
-    dontInstall=1
-  '';
-
   postInstall = ''
     # Do not install the upstream udev rules, they rely on specific
     # users/groups which aren't guaranteed to exist on the system.
     rm -R $out/lib/udev
   '';
 
+  doCheck = false;
+  doInstallCheck = stdenv.buildPlatform == stdenv.hostPlatform;
+  # Since we rewrote the load path in the dynamic loader for the TCTI
+  # The various tcti implementation should be placed in their target directory
+  # before we could run tests, so we make turn checkPhase into installCheckPhase
+  installCheckTarget = "check";
+
   meta = with lib; {
     description = "OSS implementation of the TCG TPM2 Software Stack (TSS2)";
     homepage = "https://github.com/tpm2-software/tpm2-tss";
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index 7206fc1bc5303..48e036ad030d0 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.254";
+  version = "1.3.261";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "v${version}";
-    hash = "sha256-4erHZKx4jksAtyG8ZHtlVoEY3EqE4p2pEtcGHqv7G7A=";
+    hash = "sha256-zKHew7SGUq1C3XGp/HrCle6KyqB4cziPcTYVqAr814s=";
   };
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/development/libraries/vulkan-headers/update.sh b/pkgs/development/libraries/vulkan-headers/update.sh
index b61be25ca2e74..7f6292ed23b74 100755
--- a/pkgs/development/libraries/vulkan-headers/update.sh
+++ b/pkgs/development/libraries/vulkan-headers/update.sh
@@ -6,16 +6,17 @@ set -euf -o pipefail
 V_PACKAGES=(
     "vulkan-headers"
     "vulkan-loader"
-    "spirv-tools"
     "vulkan-validation-layers"
     "vulkan-tools"
     "vulkan-tools-lunarg"
     "vulkan-extension-layer"
+    "vulkan-utility-libraries"
 )
 
 SDK_PACKAGES=(
     "spirv-headers"
     "spirv-cross"
+    "spirv-tools"
 )
 
 nix-update glslang --version-regex '(\d+\.\d+\.\d+)' --commit
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index a4cb0ae823307..6e994eaa78c62 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.254";
+  version = "1.3.261";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "v${version}";
-    hash = "sha256-bxmDhKDM+OOTsSJEoGXlWPZciBcwevv0e4gHweH46JU=";
+    hash = "sha256-5QCVHfvjE98EnL2Dr7g9fdrJAg+np1Q6hgqcuZCWReQ=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/vulkan-utility-libraries/default.nix b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
new file mode 100644
index 0000000000000..54e7afb3e58c2
--- /dev/null
+++ b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
@@ -0,0 +1,24 @@
+{ lib, stdenv, fetchFromGitHub, cmake, python3, vulkan-headers }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vulkan-utility-libraries";
+  version = "1.3.261";
+
+  src = fetchFromGitHub {
+    owner = "KhronosGroup";
+    repo = "Vulkan-Utility-Libraries";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-szkBKNcxTHMYhhHFWr5WjD91Vf/AyZaGymvlDU9ff7s=";
+  };
+
+  nativeBuildInputs = [ cmake python3 ];
+  buildInputs = [ vulkan-headers ];
+
+  meta = with lib; {
+    description = "A set of utility libraries for Vulkan";
+    homepage = "https://github.com/KhronosGroup/Vulkan-Utility-Libraries";
+    platforms = platforms.all;
+    license = licenses.asl20;
+    maintainers = [];
+  };
+})
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 50dbcdecc6932..a389388ff65de 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -524,9 +524,7 @@ with prev;
       tar xf *.tar.gz
     '';
     # Without this, source root is wrongly set to ./readline-2.6/doc
-    setSourceRoot = ''
-      sourceRoot=./readline-${lib.versions.majorMinor oa.version}
-    '';
+    sourceRoot = "readline-${lib.versions.majorMinor oa.version}";
   });
 
   sqlite = prev.sqlite.overrideAttrs (drv: {
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index dc14fdf51ac61..214a85f8c9152 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -23,6 +23,7 @@
 , setuptools-scm
 , scikit-build
 , cmake
+, ninja
 , antlr4_9
 , libxml2
 , pytestCheckHook
@@ -47,6 +48,7 @@ buildPythonPackage rec {
     setuptools-scm
     scikit-build
     cmake
+    ninja
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/aioambient/default.nix b/pkgs/development/python-modules/aioambient/default.nix
index 15d3d7ae5617d..d907014a169d8 100644
--- a/pkgs/development/python-modules/aioambient/default.nix
+++ b/pkgs/development/python-modules/aioambient/default.nix
@@ -3,6 +3,7 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , pytest-aiohttp
 , pytest-asyncio
@@ -27,6 +28,20 @@ buildPythonPackage rec {
     hash = "sha256-ar2UGSlVukMD5EZsEn7TFfIOovaI+B3Ym+UeGo95oks=";
   };
 
+  patches = [
+    # This patch removes references to setuptools and wheel that are no longer
+    # necessary and changes poetry to poetry-core, so that we don't need to add
+    # unnecessary nativeBuildInputs.
+    #
+    #   https://github.com/bachya/aioambient/pull/295
+    #
+    (fetchpatch {
+      name = "clean-up-build-dependencies.patch";
+      url = "https://github.com/bachya/aioambient/commit/fa21a2e82678a231a73c8a1153032980926f4c35.patch";
+      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace 'websockets = ">=11.0.1"' 'websockets = "*"'
@@ -43,6 +58,8 @@ buildPythonPackage rec {
     websockets
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-aiohttp
diff --git a/pkgs/development/python-modules/ansible-pylibssh/default.nix b/pkgs/development/python-modules/ansible-pylibssh/default.nix
index 5eb60419fcf7a..cfe8d7e1e1fa5 100644
--- a/pkgs/development/python-modules/ansible-pylibssh/default.nix
+++ b/pkgs/development/python-modules/ansible-pylibssh/default.nix
@@ -23,6 +23,11 @@ buildPythonPackage rec {
     hash = "sha256-spaGux6dYvtUtpOdU6oN7SEn8IgBof2NpQSPvr+Zplg=";
   };
 
+  # remove after https://github.com/ansible/pylibssh/pull/502 is merged
+  postPatch = ''
+    sed -i "/setuptools_scm_git_archive/d" pyproject.toml
+  '';
+
   nativeBuildInputs = [
     cython
     wheel
diff --git a/pkgs/development/python-modules/anywidget/default.nix b/pkgs/development/python-modules/anywidget/default.nix
index d993af0654f83..f96ef47e7332c 100644
--- a/pkgs/development/python-modules/anywidget/default.nix
+++ b/pkgs/development/python-modules/anywidget/default.nix
@@ -7,7 +7,6 @@
 , hatchling
 , importlib-metadata
 , ipywidgets
-, jupyterlab
 , psygnal
 , typing-extensions
 , watchfiles
@@ -25,10 +24,17 @@ buildPythonPackage rec {
     hash = "sha256-OUKxmYceEKURJeQTVI7oLT4SdZM90V7BoZf0UykkEV4=";
   };
 
+  # We do not need the jupyterlab build dependency, because we do not need to
+  # build any JS components; these are present already in the PyPI artifact.
+  #
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"jupyterlab==3.*"' ""
+  '';
+
   nativeBuildInputs = [
     hatch-jupyter-builder
     hatchling
-    jupyterlab
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/astroid/default.nix b/pkgs/development/python-modules/astroid/default.nix
index 5e5f9e22fb407..5fd0a5281b2c0 100644
--- a/pkgs/development/python-modules/astroid/default.nix
+++ b/pkgs/development/python-modules/astroid/default.nix
@@ -5,8 +5,10 @@
 , isPyPy
 , lazy-object-proxy
 , setuptools
+, wheel
 , typing-extensions
 , typed-ast
+, pip
 , pylint
 , pytestCheckHook
 , wrapt
@@ -28,6 +30,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
@@ -40,6 +43,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    pip
     pytestCheckHook
     typing-extensions
   ];
diff --git a/pkgs/development/python-modules/attrs/default.nix b/pkgs/development/python-modules/attrs/default.nix
index 855b4bf86982c..a298dc36f507c 100644
--- a/pkgs/development/python-modules/attrs/default.nix
+++ b/pkgs/development/python-modules/attrs/default.nix
@@ -3,22 +3,31 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, setuptools
+, hatchling
 }:
 
 buildPythonPackage rec {
   pname = "attrs";
-  version = "22.2.0";
-  disabled = pythonOlder "3.6";
+  version = "23.1.0";
+  disabled = pythonOlder "3.7";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ySJ7/C8BmTwD9o2zfR0VyWkBiDI8BnxkHxo1ylgYX5k=";
+    hash = "sha256-YnmDbVgVE6JvG/I1+azTM7yRFWg/FPfo+uRsmPxQ4BU=";
   };
 
+  patches = [
+    # hatch-vcs and hatch-fancy-pypi-readme depend on pytest, which depends on attrs
+    ./remove-hatch-plugins.patch
+  ];
+
+  postPatch = ''
+    substituteAllInPlace pyproject.toml
+  '';
+
   nativeBuildInputs = [
-    setuptools
+    hatchling
   ];
 
   outputs = [
@@ -47,6 +56,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python attributes without boilerplate";
     homepage = "https://github.com/python-attrs/attrs";
+    changelog = "https://github.com/python-attrs/attrs/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/attrs/remove-hatch-plugins.patch b/pkgs/development/python-modules/attrs/remove-hatch-plugins.patch
new file mode 100644
index 0000000000000..7d7b83a366e0b
--- /dev/null
+++ b/pkgs/development/python-modules/attrs/remove-hatch-plugins.patch
@@ -0,0 +1,74 @@
+diff --git a/pyproject.toml b/pyproject.toml
+index fb8fae3..998211f 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: MIT
+ 
+ [build-system]
+-requires = ["hatchling", "hatch-vcs", "hatch-fancy-pypi-readme"]
++requires = ["hatchling"]
+ build-backend = "hatchling.build"
+ 
+ 
+@@ -26,7 +26,8 @@ classifiers = [
+     "Typing :: Typed",
+ ]
+ dependencies = ["importlib_metadata;python_version<'3.8'"]
+-dynamic = ["version", "readme"]
++dynamic = ["readme"]
++version = "@version@"
+ 
+ [project.optional-dependencies]
+ tests-no-zope = [
+@@ -67,50 +68,9 @@ Changelog = "https://www.attrs.org/en/stable/changelog.html"
+ Funding = "https://github.com/sponsors/hynek"
+ Tidelift = "https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi"
+ 
+-
+-[tool.hatch.version]
+-source = "vcs"
+-raw-options = { local_scheme = "no-local-version" }
+-
+ [tool.hatch.build.targets.wheel]
+ packages = ["src/attr", "src/attrs"]
+ 
+-[tool.hatch.metadata.hooks.fancy-pypi-readme]
+-content-type = "text/markdown"
+-
+-# PyPI doesn't support the <picture> tag.
+-[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
+-text = """<p align="center">
+-  <a href="https://www.attrs.org/">
+-    <img src="https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg" width="35%" alt="attrs" />
+-  </a>
+-</p>
+-"""
+-
+-[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
+-path = "README.md"
+-start-after = "<!-- teaser-begin -->"
+-
+-[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
+-text = """
+-
+-## Release Information
+-
+-"""
+-
+-[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
+-path = "CHANGELOG.md"
+-pattern = "\n(###.+?\n)## "
+-
+-[[tool.hatch.metadata.hooks.fancy-pypi-readme.fragments]]
+-text = """
+-
+----
+-
+-[Full changelog](https://www.attrs.org/en/stable/changelog.html)
+-"""
+-
+-
+ # Make coverage play nicely with pytest-xdist.
+ [tool.hatch.build.targets.wheel.hooks.autorun]
+ dependencies = ["hatch-autorun"]
diff --git a/pkgs/development/python-modules/autarco/default.nix b/pkgs/development/python-modules/autarco/default.nix
index 37625fdb1bd2b..b5a8715f6ced2 100644
--- a/pkgs/development/python-modules/autarco/default.nix
+++ b/pkgs/development/python-modules/autarco/default.nix
@@ -3,6 +3,7 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , pytest-asyncio
 , pytestCheckHook
@@ -24,6 +25,22 @@ buildPythonPackage rec {
     hash = "sha256-3f6N4b6WZPAUUQTuGeb20q0f7ZqDR+O24QRze5RpRlw=";
   };
 
+  patches = [
+    # https://github.com/klaasnicolaas/python-autarco/pull/265
+    (fetchpatch {
+      name = "remove-setuptools-dependency.patch";
+      url = "https://github.com/klaasnicolaas/python-autarco/commit/bf40e8a4f64cd9c9cf72930260895537ea5b2adc.patch";
+      hash = "sha256-Fgijy7sd67LUIqh3qjQjyothnjdW7Zcil/bQSuVsBR8=";
+    })
+  ];
+
+  postPatch = ''
+    # Upstream doesn't set a version for the pyproject.toml
+    substituteInPlace pyproject.toml \
+      --replace "0.0.0" "${version}" \
+      --replace "--cov" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -33,19 +50,14 @@ buildPythonPackage rec {
     yarl
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # Upstream doesn't set a version for the pyproject.toml
-    substituteInPlace pyproject.toml \
-      --replace "0.0.0" "${version}" \
-      --replace "--cov" ""
-  '';
-
   pythonImportsCheck = [
     "autarco"
   ];
diff --git a/pkgs/development/python-modules/awkward-cpp/default.nix b/pkgs/development/python-modules/awkward-cpp/default.nix
index a32ff89555ce7..5dd902bcb9683 100644
--- a/pkgs/development/python-modules/awkward-cpp/default.nix
+++ b/pkgs/development/python-modules/awkward-cpp/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , pythonOlder
 , cmake
+, ninja
 , numpy
 , pybind11
 , scikit-build-core
@@ -23,6 +24,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cmake
+    ninja
     pybind11
     scikit-build-core
   ] ++ scikit-build-core.optional-dependencies.pyproject;
diff --git a/pkgs/development/python-modules/bootstrap/build/default.nix b/pkgs/development/python-modules/bootstrap/build/default.nix
new file mode 100644
index 0000000000000..639d2e3292cb0
--- /dev/null
+++ b/pkgs/development/python-modules/bootstrap/build/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, python
+, build
+, flit-core
+, installer
+, packaging
+, pyproject-hooks
+, tomli
+}:
+let
+  buildBootstrapPythonModule = basePackage: attrs: stdenv.mkDerivation ({
+    pname = "${python.libPrefix}-bootstrap-${basePackage.pname}";
+    inherit (basePackage) version src meta;
+
+    buildPhase = ''
+      runHook preBuild
+
+      PYTHONPATH="${flit-core}/${python.sitePackages}" \
+        ${python.interpreter} -m flit_core.wheel
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      PYTHONPATH="${installer}/${python.sitePackages}" \
+        ${python.interpreter} -m installer \
+          --destdir "$out" --prefix "" dist/*.whl
+
+      runHook postInstall
+    '';
+  } // attrs);
+
+  bootstrap-packaging = buildBootstrapPythonModule packaging {};
+
+  bootstrap-pyproject-hooks = buildBootstrapPythonModule pyproject-hooks {};
+
+  bootstrap-tomli = buildBootstrapPythonModule tomli {};
+in
+buildBootstrapPythonModule build {
+  propagatedBuildInputs = [
+    bootstrap-packaging
+    bootstrap-pyproject-hooks
+  ] ++ lib.optionals (python.pythonOlder "3.11") [
+    bootstrap-tomli
+  ];
+}
diff --git a/pkgs/development/python-modules/bootstrap/flit-core/default.nix b/pkgs/development/python-modules/bootstrap/flit-core/default.nix
new file mode 100644
index 0000000000000..ab9e52538d341
--- /dev/null
+++ b/pkgs/development/python-modules/bootstrap/flit-core/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, stdenv
+, python
+, flit-core
+}:
+
+stdenv.mkDerivation {
+  pname = "${python.libPrefix}-bootstrap-${flit-core.pname}";
+  inherit (flit-core) version src patches meta;
+
+  sourceRoot = "source/flit_core";
+
+  buildPhase = ''
+    runHook preBuild
+
+    ${python.interpreter} -m flit_core.wheel
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    ${python.interpreter} bootstrap_install.py dist/flit_core-*.whl \
+      --install-root "$out" --installdir "/${python.sitePackages}"
+
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/development/python-modules/bootstrap/installer/default.nix b/pkgs/development/python-modules/bootstrap/installer/default.nix
new file mode 100644
index 0000000000000..b569e7fa6dc80
--- /dev/null
+++ b/pkgs/development/python-modules/bootstrap/installer/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, stdenv
+, python
+, flit-core
+, installer
+}:
+
+stdenv.mkDerivation {
+  pname = "${python.libPrefix}-bootstrap-${installer.pname}";
+  inherit (installer) version src meta;
+
+  buildPhase = ''
+    runHook preBuild
+
+    PYTHONPATH="${flit-core}/${python.sitePackages}" \
+      ${python.interpreter} -m flit_core.wheel
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    PYTHONPATH=src ${python.interpreter} -m installer \
+      --destdir "$out" --prefix "" dist/installer-*.whl
+
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/development/python-modules/bqplot/default.nix b/pkgs/development/python-modules/bqplot/default.nix
index 074c75fffb7aa..5695be669bbc7 100644
--- a/pkgs/development/python-modules/bqplot/default.nix
+++ b/pkgs/development/python-modules/bqplot/default.nix
@@ -3,6 +3,7 @@
 , pythonOlder
 , fetchPypi
 , jupyter-packaging
+, jupyterlab
 , bqscales
 , ipywidgets
 , numpy
@@ -23,8 +24,17 @@ buildPythonPackage rec {
     hash = "sha256-FNjeb5pNGUW76mwTIOpNHJMlb3JoN3T24AINzFefPdI=";
   };
 
+  # upstream seems in flux for 0.13 release. they seem to want to migrate from
+  # jupyter_packaging to hatch, so let's patch instead of fixing upstream
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "jupyter_packaging~=" "jupyter_packaging>=" \
+      --replace "jupyterlab~=" "jupyterlab>="
+  '';
+
   nativeBuildInputs = [
     jupyter-packaging
+    jupyterlab
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bqscales/default.nix b/pkgs/development/python-modules/bqscales/default.nix
index 3bd015a58f67a..8b0ebb610ad9d 100644
--- a/pkgs/development/python-modules/bqscales/default.nix
+++ b/pkgs/development/python-modules/bqscales/default.nix
@@ -13,7 +13,6 @@
 buildPythonPackage rec {
   pname = "bqscales";
   version = "0.3.1";
-
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -22,6 +21,19 @@ buildPythonPackage rec {
     hash = "sha256-C+/GLpqYpePngbn5W0MwvpdmVgFZF7aGHyKMgO5XM90=";
   };
 
+  # We relax dependencies here instead of pulling in a patch because upstream
+  # has released a new version using hatch-jupyter-builder, but it is not yet
+  # trivial to upgrade to that.
+  #
+  # Per https://github.com/bqplot/bqscales/issues/76, jupyterlab is not needed
+  # as a build dependency right now.
+  #
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"jupyterlab==3.*",' "" \
+      --replace 'jupyter_packaging~=' 'jupyter_packaging>='
+  '';
+
   nativeBuildInputs = [
     hatchling
     jupyter-packaging
diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index 0eaad47c44f02..f86f47e2bd852 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, build
 , buildPythonPackage
 , fetchFromGitHub
 , flit-core
@@ -41,36 +42,52 @@ buildPythonPackage rec {
     tomli
   ];
 
-  nativeCheckInputs = [
-    filelock
-    pytest-mock
-    pytest-rerunfailures
-    pytest-xdist
-    pytestCheckHook
-    setuptools
-    toml
-  ];
+  # We need to disable tests because this package is part of the bootstrap chain
+  # and its test dependencies cannot be built yet when this is being built.
+  doCheck = false;
 
-  pytestFlagsArray = [
-    "-W"
-    "ignore::DeprecationWarning"
-  ];
+  passthru.tests = {
+    pytest = buildPythonPackage {
+      pname = "${pname}-pytest";
+      inherit version;
+      format = "other";
 
-  __darwinAllowLocalNetworking = true;
+      dontBuild = true;
+      dontInstall = true;
 
-  disabledTests = [
-    # Tests often fail with StopIteration
-    "test_isolat"
-    "test_default_pip_is_never_too_old"
-    "test_build"
-    "test_with_get_requires"
-    "test_init"
-    "test_output"
-    "test_wheel_metadata"
-  ] ++ lib.optionals stdenv.isDarwin [
-    # Expects Apple's Python and its quirks
-    "test_can_get_venv_paths_with_conflicting_default_scheme"
-  ];
+      nativeCheckInputs = [
+        build
+        filelock
+        pytest-mock
+        pytest-rerunfailures
+        pytest-xdist
+        pytestCheckHook
+        setuptools
+        toml
+      ];
+
+      pytestFlagsArray = [
+        "-W"
+        "ignore::DeprecationWarning"
+      ];
+
+      __darwinAllowLocalNetworking = true;
+
+      disabledTests = [
+        # Tests often fail with StopIteration
+        "test_isolat"
+        "test_default_pip_is_never_too_old"
+        "test_build"
+        "test_with_get_requires"
+        "test_init"
+        "test_output"
+        "test_wheel_metadata"
+      ] ++ lib.optionals stdenv.isDarwin [
+        # Expects Apple's Python and its quirks
+        "test_can_get_venv_paths_with_conflicting_default_scheme"
+      ];
+    };
+  };
 
   pythonImportsCheck = [
     "build"
diff --git a/pkgs/development/python-modules/cairocffi/default.nix b/pkgs/development/python-modules/cairocffi/default.nix
index ff79eacf99b80..fb0a81e202d97 100644
--- a/pkgs/development/python-modules/cairocffi/default.nix
+++ b/pkgs/development/python-modules/cairocffi/default.nix
@@ -11,25 +11,24 @@
 , pytestCheckHook
 , cairo
 , cffi
+, flit-core
 , numpy
 , withXcffib ? false
 , xcffib
 , glib
 , gdk-pixbuf
-, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "cairocffi";
-  version = "1.5.1";
+  version = "1.6.1";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  format = "pyproject";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Bxq3ty41MzALC/1VpSBWtP/cHtbmVneeKs7Ztwm4opU=";
+    hash = "sha256-eOa75HNXZAxFPQvpKfpJzQXM4uEobz0qHKnL2n79uLc=";
   };
 
   patches = [
@@ -45,11 +44,9 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    setuptools
+    flit-core
   ];
 
-  propagatedNativeBuildInputs = [ cffi ];
-
   propagatedBuildInputs = [ cairo cffi ]
     ++ lib.optional withXcffib xcffib;
 
@@ -59,6 +56,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [
+    "cairocffi"
+  ];
+
   meta = with lib; {
     changelog = "https://github.com/Kozea/cairocffi/blob/v${version}/NEWS.rst";
     homepage = "https://github.com/SimonSapin/cairocffi";
diff --git a/pkgs/development/python-modules/celery-types/default.nix b/pkgs/development/python-modules/celery-types/default.nix
index 753d7fcc677bb..6379d041f1606 100644
--- a/pkgs/development/python-modules/celery-types/default.nix
+++ b/pkgs/development/python-modules/celery-types/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , poetry-core
 , pythonOlder
@@ -18,10 +19,15 @@ buildPythonPackage rec {
     hash = "sha256-1OLUJxsuxG/sCKDxKiU4i7o5HyaJdIW8rPo8UofMI28=";
   };
 
-  patchPhase = ''
-    substituteInPlace pyproject.toml \
-      --replace "poetry.masonry.api" "poetry.core.masonry.api"
-  '';
+  patches = [
+    # remove extraneous build dependencies:
+    # https://github.com/sbdchd/celery-types/pull/138
+    (fetchpatch {
+      name = "clean-up-build-dependencies.patch";
+      url = "https://github.com/sbdchd/celery-types/commit/ff83f06a0302084e1a690e2a5a8b25f2c0dfc6e7.patch";
+      hash = "sha256-c68SMugg6Qk88FC842/czoxLpk0uVAVSlWsvo4NI9uo=";
+    })
+  ];
 
   propagatedBuildInputs = [
     typing-extensions
diff --git a/pkgs/development/python-modules/cemm/default.nix b/pkgs/development/python-modules/cemm/default.nix
index 3036393344c93..9f9ae3b16be5a 100644
--- a/pkgs/development/python-modules/cemm/default.nix
+++ b/pkgs/development/python-modules/cemm/default.nix
@@ -3,6 +3,7 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , pytest-asyncio
 , pytestCheckHook
@@ -24,6 +25,15 @@ buildPythonPackage rec {
     hash = "sha256-BorgGHxoEeIGyJKqe9mFRDpcGHhi6/8IV7ubEI8yQE4=";
   };
 
+  patches = [
+    # https://github.com/klaasnicolaas/python-cemm/pull/360
+    (fetchpatch {
+      name = "remove-setuptools-dependency.patch";
+      url = "https://github.com/klaasnicolaas/python-cemm/commit/1e373dac078f18563264e6733baf6a93962cac4b.patch";
+      hash = "sha256-DVNn4BZwi8yNpKFmzt7YSYhzzB4vaAyrd/My8TtYzj0=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace '"0.0.0"' '"${version}"' \
@@ -39,6 +49,8 @@ buildPythonPackage rec {
     yarl
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/cmake/default.nix b/pkgs/development/python-modules/cmake/default.nix
new file mode 100644
index 0000000000000..c9ee7d11c8fbc
--- /dev/null
+++ b/pkgs/development/python-modules/cmake/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, flit-core
+, cmake
+}:
+
+buildPythonPackage rec {
+  pname = "cmake";
+  inherit (cmake) version;
+  format = "pyproject";
+
+  src = ./stub;
+
+  postUnpack = ''
+    substituteInPlace "$sourceRoot/pyproject.toml" \
+      --subst-var version
+
+    substituteInPlace "$sourceRoot/cmake/__init__.py" \
+      --subst-var version \
+      --subst-var-by CMAKE_BIN_DIR "${cmake}/bin"
+  '';
+
+  inherit (cmake) setupHooks;
+
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  pythonImportsCheck = [
+    "cmake"
+  ];
+
+  meta = with lib; {
+    description = "CMake is an open-source, cross-platform family of tools designed to build, test and package software";
+    longDescription = ''
+      This is a stub of the cmake package on PyPI that uses the cmake program
+      provided by nixpkgs instead of downloading cmake from the web.
+    '';
+    homepage = "https://github.com/scikit-build/cmake-python-distributions";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ tjni ];
+  };
+}
diff --git a/pkgs/development/python-modules/cmake/stub/cmake/__init__.py b/pkgs/development/python-modules/cmake/stub/cmake/__init__.py
new file mode 100644
index 0000000000000..512a13f3d94ab
--- /dev/null
+++ b/pkgs/development/python-modules/cmake/stub/cmake/__init__.py
@@ -0,0 +1,19 @@
+import os
+import subprocess
+import sys
+
+__version__ = '@version@'
+
+CMAKE_BIN_DIR = '@CMAKE_BIN_DIR@'
+
+def _program(name, args):
+    return subprocess.call([os.path.join(CMAKE_BIN_DIR, name)] + args, close_fds=False)
+
+def cmake():
+    raise SystemExit(_program('cmake', sys.argv[1:]))
+
+def cpack():
+    raise SystemExit(_program('cpack', sys.argv[1:]))
+
+def ctest():
+    raise SystemExit(_program('ctest', sys.argv[1:]))
diff --git a/pkgs/development/python-modules/cmake/stub/pyproject.toml b/pkgs/development/python-modules/cmake/stub/pyproject.toml
new file mode 100644
index 0000000000000..f5c0502a3b7fb
--- /dev/null
+++ b/pkgs/development/python-modules/cmake/stub/pyproject.toml
@@ -0,0 +1,13 @@
+[build-system]
+requires = ["flit_core"]
+build-backend = "flit_core.buildapi"
+
+[project]
+name = "cmake"
+version = "@version@"
+description = "CMake is an open-source, cross-platform family oftools designed to build, test and package software"
+
+[project.scripts]
+cmake = "cmake:cmake"
+cpack = "cmake:cpack"
+ctest = "cmake:ctest"
diff --git a/pkgs/development/python-modules/cohere/default.nix b/pkgs/development/python-modules/cohere/default.nix
index 34df37e4db9f5..29ec01f238230 100644
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , poetry-core
 , pythonOlder
@@ -22,6 +23,15 @@ buildPythonPackage rec {
     hash = "sha256-9hFDj0Cd/F1aChU6WFNJ9agLFpxxArWZTZmZ7PhECGY=";
   };
 
+  patches = [
+    # https://github.com/cohere-ai/cohere-python/pull/289
+    (fetchpatch {
+      name = "replace-poetry-with-poetry-core.patch";
+      url = "https://github.com/cohere-ai/cohere-python/commit/e86480336331c0cf6f67e26b0825467dfca5b277.patch";
+      hash = "sha256-P1Ioq5ypzT3tx6cxrI3ep34Fi4cUx88YkfJ5ErN3VHk=";
+    })
+  ];
+
   nativeBuildInputs = [
     poetry-core
   ];
diff --git a/pkgs/development/python-modules/cypari2/default.nix b/pkgs/development/python-modules/cypari2/default.nix
index bc8a5df2ed177..70cd89afdcade 100644
--- a/pkgs/development/python-modules/cypari2/default.nix
+++ b/pkgs/development/python-modules/cypari2/default.nix
@@ -37,11 +37,12 @@ buildPythonPackage rec {
     export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
 
     # install "." instead of "*.whl"
-    ${python.pythonForBuild.pkgs.bootstrapped-pip}/bin/pip install . --no-index --no-warn-script-location --prefix="$out" --no-cache
+    pip install . --no-index --no-warn-script-location --prefix="$out" --no-cache
   '';
 
   nativeBuildInputs = [
     pari
+    python.pythonForBuild.pkgs.pip
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index 6fea3e2c28d27..fc52b3b9fc5b4 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "distributed";
-  version = "2023.8.0";
+  version = "2023.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -34,11 +34,12 @@ buildPythonPackage rec {
     owner = "dask";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-FvNh7gfxUR1iIUY3kMolhzcbWupQL39E9JXWip8bdrQ=";
+    hash = "sha256-HJyqDi5MqxEjAWWv8ZqNGAzeFn5rZGPwiDz5KaCm6Xk=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
+      --replace "versioneer[toml]==" "versioneer[toml]>=" \
       --replace 'dynamic = ["version"]' 'version = "${version}"'
   '';
 
@@ -46,7 +47,7 @@ buildPythonPackage rec {
     setuptools
     setuptools-scm
     versioneer
-  ];
+  ] ++ versioneer.optional-dependencies.toml;
 
   propagatedBuildInputs = [
     click
diff --git a/pkgs/development/python-modules/django-scim2/default.nix b/pkgs/development/python-modules/django-scim2/default.nix
index 536d851a4099f..d4eab102d719c 100644
--- a/pkgs/development/python-modules/django-scim2/default.nix
+++ b/pkgs/development/python-modules/django-scim2/default.nix
@@ -27,8 +27,10 @@ buildPythonPackage rec {
     hash = "sha256-larDh4f9/xVr11/n/WfkJ2Tx45DMQqyK3ZzkWAvzeig=";
   };
 
+  # remove this when upstream releases a new version > 0.19.0
   postPatch = ''
     substituteInPlace pyproject.toml \
+      --replace "poetry>=0.12" "poetry-core>=1.5.2" \
       --replace "poetry.masonry.api" "poetry.core.masonry.api"
   '';
 
diff --git a/pkgs/development/python-modules/drms/default.nix b/pkgs/development/python-modules/drms/default.nix
index 739cf1bf505ba..913e069f4fbef 100644
--- a/pkgs/development/python-modules/drms/default.nix
+++ b/pkgs/development/python-modules/drms/default.nix
@@ -5,10 +5,12 @@
 , pandas
 , six
 , astropy
+, oldest-supported-numpy
 , pytestCheckHook
 , pytest-doctestplus
 , pythonOlder
 , setuptools-scm
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -23,7 +25,10 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
+    numpy
+    oldest-supported-numpy
     setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/esphome-dashboard-api/default.nix b/pkgs/development/python-modules/esphome-dashboard-api/default.nix
index 24abd9d47a957..0cb49cd6486ee 100644
--- a/pkgs/development/python-modules/esphome-dashboard-api/default.nix
+++ b/pkgs/development/python-modules/esphome-dashboard-api/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
+, wheel
 , aiohttp
 }:
 
@@ -17,8 +18,15 @@ buildPythonPackage rec {
     hash = "sha256-RFfS0xzRXoM6ETXmviiMPxffPzspjTqpkvHOlTJXN9g=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "setuptools~=65.6" "setuptools" \
+      --replace "wheel~=0.37.1" "wheel"
+  '';
+
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/fastparquet/default.nix b/pkgs/development/python-modules/fastparquet/default.nix
index 593d677ca2f3f..05cb76f1dd48f 100644
--- a/pkgs/development/python-modules/fastparquet/default.nix
+++ b/pkgs/development/python-modules/fastparquet/default.nix
@@ -3,8 +3,9 @@
 , fetchFromGitHub
 , python
 , cython
+, oldest-supported-numpy
 , setuptools
-, substituteAll
+, setuptools-scm
 , numpy
 , pandas
 , cramjam
@@ -14,6 +15,7 @@
 , pytestCheckHook
 , pythonOlder
 , packaging
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -30,24 +32,23 @@ buildPythonPackage rec {
     hash = "sha256-pJ0zK0upEV7TyuNMIcozugkwBlYpK/Dg6BdB0kBpn9k=";
   };
 
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   nativeBuildInputs = [
     cython
+    oldest-supported-numpy
     setuptools
-  ];
-
-  patches = [
-    (substituteAll {
-      src = ./version.patch;
-      inherit version;
-    })
+    setuptools-scm
+    wheel
   ];
 
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'pytest-runner'," "" \
-      --replace "oldest-supported-numpy" "numpy"
+    substituteInPlace pyproject.toml \
+      --replace '"pytest-runner"' ""
 
-    sed -i '/"git", "status"/d' setup.py
+    sed -i \
+      -e "/pytest-runner/d" \
+      -e '/"git", "status"/d' setup.py
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/fastparquet/version.patch b/pkgs/development/python-modules/fastparquet/version.patch
deleted file mode 100644
index 86d80e2a411b4..0000000000000
--- a/pkgs/development/python-modules/fastparquet/version.patch
+++ /dev/null
@@ -1,7 +0,0 @@
-diff --git a/fastparquet/_version.py b/fastparquet/_version.py
-new file mode 100644
-index 0000000..eb2c9c9
---- /dev/null
-+++ b/fastparquet/_version.py
-@@ -0,0 +1 @@
-+__version__ = "@version@"
diff --git a/pkgs/development/python-modules/fb-re2/default.nix b/pkgs/development/python-modules/fb-re2/default.nix
index 32a6a1d60ca10..df494068c4445 100644
--- a/pkgs/development/python-modules/fb-re2/default.nix
+++ b/pkgs/development/python-modules/fb-re2/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , re2
 }:
@@ -13,6 +14,16 @@ buildPythonPackage rec {
     sha256 = "83b2c2cd58d3874e6e3a784cf4cf2f1a57ce1969e50180f92b010eea24ef26cf";
   };
 
+  patches = [
+    # Bump stdlib to c++17 to fix build with recent re2
+    # https://github.com/facebook/pyre2/issues/24
+    # https://github.com/facebook/pyre2/pull/25
+    (fetchpatch {
+      url = "https://github.com/facebook/pyre2/pull/25/commits/08fb06ec3ccd412ca69483d27234684a04cb91a0.patch";
+      hash = "sha256-kzxE2AxpE1tJJK0dJgoFfVka9zy2u0HEqiHoS7DQDQ0=";
+    })
+  ];
+
   buildInputs = [ re2 ];
 
   # no tests in PyPI tarball
diff --git a/pkgs/development/python-modules/fe25519/default.nix b/pkgs/development/python-modules/fe25519/default.nix
index ef10b0f6894e9..6a935cadd179b 100644
--- a/pkgs/development/python-modules/fe25519/default.nix
+++ b/pkgs/development/python-modules/fe25519/default.nix
@@ -1,12 +1,14 @@
 { lib
 , bitlist
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , fountains
 , parts
 , pytestCheckHook
 , pythonOlder
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -21,8 +23,18 @@ buildPythonPackage rec {
     hash = "sha256-la+17tPHjceMTe7Wk8DGVaSptk8XJa+l7GTeqLIFDvs=";
   };
 
+  patches = [
+    # https://github.com/nthparty/fe25519/pull/1
+    (fetchpatch {
+      name = "relax-setuptools-dependency.patch";
+      url = "https://github.com/nthparty/fe25519/commit/0565f60ddbb1aa4755c68edc85b7df12a3a7311e.patch";
+      hash = "sha256-FcqkHPdkYN6y+Pvviul2wDsmhhcycfRGqFhmX5sxo1k=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-reverse-proxy-fix/default.nix b/pkgs/development/python-modules/flask-reverse-proxy-fix/default.nix
index 18e483292885b..6d079b66f149d 100644
--- a/pkgs/development/python-modules/flask-reverse-proxy-fix/default.nix
+++ b/pkgs/development/python-modules/flask-reverse-proxy-fix/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, isPy3k
 , flask
 , werkzeug
 }:
@@ -9,6 +8,7 @@
 buildPythonPackage rec {
   pname = "flask-reverse-proxy-fix";
   version = "0.2.1";
+  format = "setuptools";
 
   # master fixes flask import syntax and has no major changes
   # new release requested: https://github.com/sublee/flask-silk/pull/6
@@ -16,15 +16,17 @@ buildPythonPackage rec {
     owner = "antarctica";
     repo = "flask-reverse-proxy-fix";
     rev = "v${version}";
-    sha256 = "1jbr67cmnryn0igv05qkvqjwrwj2rsajvvjnv3cdkm9bkgb4h5k5";
+    hash = "sha256-ZRZI1psr1dnY2FbuLZXOQvLMJd4TF7BfBNZnW9kxeck=";
   };
 
-  disabled = !isPy3k;
-
   postPatch = ''
     sed -i 's@werkzeug.contrib.fixers@werkzeug.middleware.proxy_fix@g' flask_reverse_proxy_fix/middleware/__init__.py
   '';
 
+  # This is needed so that setup.py does not add "devNone" to the version,
+  # after which setuptools throws an error for an invalid version.
+  env.CI_COMMIT_TAG = "v${version}";
+
   propagatedBuildInputs = [
     flask
     werkzeug
diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security-too/default.nix
index 743cc2902b979..e18cc8579ba9d 100644
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@@ -57,6 +57,11 @@ buildPythonPackage rec {
     hash = "sha256-lZzm43m30y+2qjxNddFEeg9HDlQP9afq5VtuR25zaLc=";
   };
 
+  postPatch = ''
+    # This should be removed after updating to version 5.3.0.
+    sed -i '/filterwarnings =/a ignore:pkg_resources is deprecated:DeprecationWarning' pytest.ini
+  '';
+
   propagatedBuildInputs = [
     blinker
     email-validator
diff --git a/pkgs/development/python-modules/fountains/default.nix b/pkgs/development/python-modules/fountains/default.nix
index d86b8ff584549..d6efde228fbdc 100644
--- a/pkgs/development/python-modules/fountains/default.nix
+++ b/pkgs/development/python-modules/fountains/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, wheel
 , bitlist
 , pythonOlder
 }:
@@ -20,6 +21,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ge25519/default.nix b/pkgs/development/python-modules/ge25519/default.nix
index 689901ca42415..f4aaf72b71e31 100644
--- a/pkgs/development/python-modules/ge25519/default.nix
+++ b/pkgs/development/python-modules/ge25519/default.nix
@@ -2,12 +2,14 @@
 , bitlist
 , buildPythonPackage
 , fe25519
+, fetchpatch
 , fetchPypi
 , fountains
 , parts
 , pytestCheckHook
 , pythonOlder
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -22,8 +24,18 @@ buildPythonPackage rec {
     hash = "sha256-oOvrfRSpvwfCcmpV7FOxcBOW8Ex89d2+otjORrzX4o0=";
   };
 
+  patches = [
+    # https://github.com/nthparty/ge25519/pull/1
+    (fetchpatch {
+      name = "relax-setuptools-dependency.patch";
+      url = "https://github.com/nthparty/ge25519/commit/64de94aa67387a30905057c39729d24feaba9064.patch";
+      hash = "sha256-UTT7VD4lscEA2JiGLx9CRVD1ygXgzcOWqgh5jGMS64Y=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gevent/default.nix b/pkgs/development/python-modules/gevent/default.nix
index 690c0b73e6ea4..b21e40c7a600b 100644
--- a/pkgs/development/python-modules/gevent/default.nix
+++ b/pkgs/development/python-modules/gevent/default.nix
@@ -4,8 +4,11 @@
 , isPyPy
 , python
 , libev
+, cffi
+, cython_3
 , greenlet
 , setuptools
+, wheel
 , zope_event
 , zope_interface
 , pythonOlder
@@ -24,7 +27,11 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
+    cython_3
     setuptools
+    wheel
+  ] ++ lib.optionals (!isPyPy) [
+    cffi
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/gpytorch/default.nix b/pkgs/development/python-modules/gpytorch/default.nix
index 74d85d801f699..1fea3699d9f54 100644
--- a/pkgs/development/python-modules/gpytorch/default.nix
+++ b/pkgs/development/python-modules/gpytorch/default.nix
@@ -3,6 +3,9 @@
 , fetchFromGitHub
 , linear_operator
 , scikit-learn
+, setuptools
+, setuptools-scm
+, wheel
 , torch
 , pytestCheckHook
 }:
@@ -19,10 +22,13 @@ buildPythonPackage rec {
     hash = "sha256-cpkfjx5G/4duL1Rr4nkHTHi03TDcYbcx3bKP2Ny7Ijo=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace 'find_version("gpytorch", "version.py")' \"$version\"
-  '';
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
 
   propagatedBuildInputs = [
     linear_operator
@@ -33,7 +39,9 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
   ];
+
   pythonImportsCheck = [ "gpytorch" ];
+
   disabledTests = [
     # AssertionError on number of warnings emitted
     "test_deprecated_methods"
diff --git a/pkgs/development/python-modules/grpc-interceptor/default.nix b/pkgs/development/python-modules/grpc-interceptor/default.nix
index 1dadad2238d77..bfccc74966ae0 100644
--- a/pkgs/development/python-modules/grpc-interceptor/default.nix
+++ b/pkgs/development/python-modules/grpc-interceptor/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pythonOlder
 , poetry-core
 , grpcio
@@ -20,13 +21,17 @@ buildPythonPackage rec {
     owner = "d5h-foss";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-zulK0SVehzHcrmgIyH0D5sUOiAN53eIg88IoVyF6/DA=";
+    hash = "sha256-zulK0SVehzHcrmgIyH0D5sUOiAN53eIg88IoVyF6/DA=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "poetry.masonry.api" "poetry.core.masonry.api"
-  '';
+  patches = [
+    # https://github.com/d5h-foss/grpc-interceptor/pull/44
+    (fetchpatch {
+      name = "replace-poetry-with-poetry-core.patch";
+      url = "https://github.com/d5h-foss/grpc-interceptor/commit/916cb394acd8dd7abb4f5edcb4e88aee961a32d0.patch";
+      hash = "sha256-W2SF2zyjusTxgvCxBDLpisD03bofzDug1eyd4FLJmKs=";
+    })
+  ];
 
   nativeBuildInputs = [
     poetry-core
@@ -37,6 +42,8 @@ buildPythonPackage rec {
     protobuf
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook
diff --git a/pkgs/development/python-modules/gyp/default.nix b/pkgs/development/python-modules/gyp/default.nix
index ca9a8dc5a2d7c..385f28b4615ad 100644
--- a/pkgs/development/python-modules/gyp/default.nix
+++ b/pkgs/development/python-modules/gyp/default.nix
@@ -27,6 +27,12 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "gyp" "gyp.generator" ];
 
+  # Make mac_tool.py executable so that patchShebangs hook processes it. This
+  # file is copied and run by builds using gyp on macOS
+  preFixup = ''
+    chmod +x "$out/${python.sitePackages}/gyp/mac_tool.py"
+  '';
+
   meta = with lib; {
     description = "A tool to generate native build files";
     homepage = "https://gyp.gsrc.io";
diff --git a/pkgs/development/python-modules/installer/default.nix b/pkgs/development/python-modules/installer/default.nix
index 02934550273b6..d4f1e33ca606f 100644
--- a/pkgs/development/python-modules/installer/default.nix
+++ b/pkgs/development/python-modules/installer/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , pytestCheckHook
 , flit-core
+, installer
 , mock
 }:
 
@@ -21,10 +22,26 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ flit-core ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    mock
-  ];
+  # We need to disable tests because this package is part of the bootstrap chain
+  # and its test dependencies cannot be built yet when this is being built.
+  doCheck = false;
+
+  passthru.tests = {
+    pytest = buildPythonPackage {
+      pname = "${pname}-pytest";
+      inherit version;
+      format = "other";
+
+      dontBuild = true;
+      dontInstall = true;
+
+      nativeCheckInputs = [
+        installer
+        mock
+        pytestCheckHook
+      ];
+    };
+  };
 
   meta = with lib; {
     description = "A low-level library for installing a Python package from a wheel distribution";
diff --git a/pkgs/development/python-modules/ipycanvas/default.nix b/pkgs/development/python-modules/ipycanvas/default.nix
index 05fdb6e858826..85961b450ec17 100644
--- a/pkgs/development/python-modules/ipycanvas/default.nix
+++ b/pkgs/development/python-modules/ipycanvas/default.nix
@@ -20,6 +20,16 @@ buildPythonPackage rec {
     hash = "sha256-+cOUBoG8ODgzkPjEbqXYRF1uEcbaZITDfYnfWuHawTE=";
   };
 
+  # We relax dependencies here instead of pulling in a patch because upstream
+  # has released a new version using hatch-jupyter-builder, but it is not yet
+  # trivial to upgrade to that.
+  #
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"jupyterlab==3.*",' "" \
+      --replace 'jupyter_packaging~=' 'jupyter_packaging>='
+  '';
+
   nativeBuildInputs = [ jupyter-packaging ];
 
   propagatedBuildInputs = [ ipywidgets numpy pillow ];
diff --git a/pkgs/development/python-modules/ipyniivue/default.nix b/pkgs/development/python-modules/ipyniivue/default.nix
index a126030d0cb1f..2f711f92a087d 100644
--- a/pkgs/development/python-modules/ipyniivue/default.nix
+++ b/pkgs/development/python-modules/ipyniivue/default.nix
@@ -21,7 +21,18 @@ buildPythonPackage rec {
     hash = "sha256-kym7949VI6C+62p3IOQ2QIzWnuSBcrmySb83oqUwhjI=";
   };
 
-  nativeBuildInputs = [ hatchling hatch-jupyter-builder ];
+  # We do not need the jupyterlab build dependency, because we do not need to
+  # build any JS components; these are present already in the PyPI artifact.
+  #
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"jupyterlab==3.*",' ""
+  '';
+
+  nativeBuildInputs = [
+    hatchling
+    hatch-jupyter-builder
+  ];
 
   propagatedBuildInputs = [ ipywidgets jupyter-ui-poll ];
 
diff --git a/pkgs/development/python-modules/ipyparallel/default.nix b/pkgs/development/python-modules/ipyparallel/default.nix
index 272a192e3adab..509b70b7fd3a2 100644
--- a/pkgs/development/python-modules/ipyparallel/default.nix
+++ b/pkgs/development/python-modules/ipyparallel/default.nix
@@ -28,6 +28,14 @@ buildPythonPackage rec {
     hash = "sha256-o5ql75VgFwvw6a/typ/wReG5wYMsSTAzd+3Mkc6p+3c=";
   };
 
+  # We do not need the jupyterlab build dependency, because we do not need to
+  # build any JS components; these are present already in the PyPI artifact.
+  #
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"jupyterlab>=3.0.0,==3.*",' ""
+  '';
+
   nativeBuildInputs = [
     hatchling
   ];
diff --git a/pkgs/development/python-modules/ipytablewidgets/default.nix b/pkgs/development/python-modules/ipytablewidgets/default.nix
index 6e05a3a36f0a5..4aad3219eb52b 100644
--- a/pkgs/development/python-modules/ipytablewidgets/default.nix
+++ b/pkgs/development/python-modules/ipytablewidgets/default.nix
@@ -27,6 +27,15 @@ buildPythonPackage rec {
     hash = "sha256-14vIih+r/PHLxhgG29YtwuosSBLpewD2CluWpH2+pLc=";
   };
 
+  # Opened https://github.com/progressivis/ipytablewidgets/issues/3 to ask if
+  # jupyterlab can be updated upstream. (From commits, it looks like it was
+  # set to this version on purpose.) In the meantime, the build still works.
+  #
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'jupyterlab>=3.0.0,<3.7' 'jupyterlab>=3.0.0'
+  '';
+
   nativeBuildInputs = [
     jupyter-packaging
     jupyterlab
diff --git a/pkgs/development/python-modules/jedi/default.nix b/pkgs/development/python-modules/jedi/default.nix
index d12691c177f04..5f802767c83ad 100644
--- a/pkgs/development/python-modules/jedi/default.nix
+++ b/pkgs/development/python-modules/jedi/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , buildPythonPackage
-, pythonAtLeast
 , pythonOlder
 , fetchFromGitHub
 , attrs
@@ -12,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "jedi";
-  version = "0.18.2";
+  version = "0.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -21,7 +20,7 @@ buildPythonPackage rec {
     owner = "davidhalter";
     repo = "jedi";
     rev = "v${version}";
-    hash = "sha256-hNRmUFpRzVKJQAtfsSNV4jeTR8vVj1+mGBIPO6tUGto=";
+    hash = "sha256-Hw0+KQkB9ICWbBJDQQmHyKngzJlJ8e3wlpe4aSrlkvo=";
     fetchSubmodules = true;
   };
 
@@ -43,16 +42,6 @@ buildPythonPackage rec {
   ] ++ lib.optionals (stdenv.isAarch64 && pythonOlder "3.9") [
     # AssertionError: assert 'foo' in ['setup']
     "test_init_extension_module"
-  ] ++ lib.optionals (pythonAtLeast "3.11") [
-    # disabled until 3.11 is added to _SUPPORTED_PYTHONS in jedi/api/environment.py
-    "test_find_system_environments"
-
-    # disabled until https://github.com/davidhalter/jedi/issues/1858 is resolved
-    "test_interpreter"
-    "test_scanning_venvs"
-    "test_create_environment_venv_path"
-    "test_create_environment_executable"
-    "test_venv_and_pths"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
index a23e3a5b931ca..0f3d69b18d8c9 100644
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -8,6 +8,7 @@
 , importlib-resources
 , jsonschema-specifications
 , pkgutil-resolve-name
+, pip
 , pytestCheckHook
 , pythonOlder
 , referencing
@@ -81,6 +82,7 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
+    pip
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/jupyter-collaboration/default.nix b/pkgs/development/python-modules/jupyter-collaboration/default.nix
index 17ec031451375..0038f57b114d9 100644
--- a/pkgs/development/python-modules/jupyter-collaboration/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration/default.nix
@@ -10,6 +10,7 @@
 , jupyter-server
 , jupyter-server-fileid
 , jupyter-ydoc
+, jupyterlab
 , ypy-websocket
 , pytest-asyncio
 , pytest-jupyter
@@ -38,6 +39,7 @@ buildPythonPackage rec {
     hatch-jupyter-builder
     hatch-nodejs-version
     hatchling
+    jupyterlab
     pythonRelaxDepsHook
   ];
 
diff --git a/pkgs/development/python-modules/knx-frontend/default.nix b/pkgs/development/python-modules/knx-frontend/default.nix
index ff8b8f587ce49..47b9fa4d83579 100644
--- a/pkgs/development/python-modules/knx-frontend/default.nix
+++ b/pkgs/development/python-modules/knx-frontend/default.nix
@@ -1,7 +1,9 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -16,8 +18,18 @@ buildPythonPackage rec {
     hash = "sha256-MeurZ6731qjeBK6HTwXYLVs6+nXF9Hf1p8/NNwxmae4=";
   };
 
+  patches = [
+    # https://github.com/XKNX/knx-frontend/pull/96
+    (fetchpatch {
+      name = "relax-setuptools-dependency.patch";
+      url = "https://github.com/XKNX/knx-frontend/commit/72ac6dc42eeeb488992b0709ee58ea4a79287817.patch";
+      hash = "sha256-EpfgEq4pIx7ahqJZalzo30ruj8NlZYHcKHxFXCGL98w=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/laszip/default.nix b/pkgs/development/python-modules/laszip/default.nix
index 2c6f4196595f4..85187d08f99ff 100644
--- a/pkgs/development/python-modules/laszip/default.nix
+++ b/pkgs/development/python-modules/laszip/default.nix
@@ -2,17 +2,18 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , scikit-build-core
 , pybind11
 , cmake
 , LASzip
+, ninja
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "laszip-python";
   version = "0.2.3";
-
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,14 +25,25 @@ buildPythonPackage rec {
     hash = "sha256-MiPzL9TDCf1xnCv7apwdfcpkFnBRi4PO/atTQxqL8cw=";
   };
 
+  patches = [
+    # Removes depending on the cmake and ninja PyPI packages, since we can pass
+    # in the tools directly, and scikit-build-core can use them.
+    # https://github.com/tmontaigu/laszip-python/pull/9
+    (fetchpatch {
+      name = "remove-cmake-ninja-pypi-dependencies.patch";
+      url = "https://github.com/tmontaigu/laszip-python/commit/17e648d04945fa2d095d6d74d58c790a4fcde84a.patch";
+      hash = "sha256-k58sS1RqVzT1WPh2OVt/D4Y045ODtj6U3bUjegd44VY=";
+    })
+  ];
+
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-std=c++17";
 
   nativeBuildInputs = [
     cmake
+    ninja
     pybind11
     scikit-build-core
-    scikit-build-core.optional-dependencies.pyproject
-  ];
+  ] ++ scikit-build-core.optional-dependencies.pyproject;
 
   dontUseCmakeConfigure = true;
 
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 2cfd5d21db19c..e5df4ea7d4ea8 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -8,10 +8,13 @@
 
 # https://github.com/matplotlib/matplotlib/blob/main/doc/devel/dependencies.rst
 # build-system
+, certifi
+, oldest-supported-numpy
 , pkg-config
 , pybind11
 , setuptools
 , setuptools-scm
+, wheel
 
 # native libraries
 , ffmpeg-headless
@@ -116,11 +119,14 @@ buildPythonPackage rec {
     '';
 
   nativeBuildInputs = [
+    certifi
+    numpy
+    oldest-supported-numpy # TODO remove after updating to 3.8.0
     pkg-config
     pybind11
     setuptools
     setuptools-scm
-    numpy
+    wheel
   ] ++ lib.optionals enableGtk3 [
     gobject-introspection
   ];
diff --git a/pkgs/development/python-modules/mip/default.nix b/pkgs/development/python-modules/mip/default.nix
index e7ba8740cbbfc..db2786915b568 100644
--- a/pkgs/development/python-modules/mip/default.nix
+++ b/pkgs/development/python-modules/mip/default.nix
@@ -8,6 +8,9 @@
 , numpy
 , pytestCheckHook
 , pythonOlder
+, setuptools
+, setuptools-scm
+, wheel
 , gurobi
 , gurobipy
 # Enable support for the commercial Gurobi solver (requires a license)
@@ -20,9 +23,9 @@
 buildPythonPackage rec {
   pname = "mip";
   version = "1.15.0";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
-  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
@@ -30,7 +33,14 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [ matplotlib networkx numpy pytestCheckHook ];
-  nativeBuildInputs = [ dos2unix ];
+
+  nativeBuildInputs = [
+    dos2unix
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
   propagatedBuildInputs = [
     cffi
   ] ++ lib.optionals gurobiSupport ([
diff --git a/pkgs/development/python-modules/ml-dtypes/default.nix b/pkgs/development/python-modules/ml-dtypes/default.nix
index c329196d51de7..eae60372af0d2 100644
--- a/pkgs/development/python-modules/ml-dtypes/default.nix
+++ b/pkgs/development/python-modules/ml-dtypes/default.nix
@@ -27,6 +27,14 @@ buildPythonPackage rec {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "numpy~=1.21.2" "numpy" \
+      --replace "numpy~=1.23.3" "numpy" \
+      --replace "pybind11~=2.10.0" "pybind11" \
+      --replace "setuptools~=67.6.0" "setuptools"
+  '';
+
   nativeBuildInputs = [
     setuptools
     pybind11
diff --git a/pkgs/development/python-modules/monai-deploy/default.nix b/pkgs/development/python-modules/monai-deploy/default.nix
index a74fa36629dfe..85c23a39c77ac 100644
--- a/pkgs/development/python-modules/monai-deploy/default.nix
+++ b/pkgs/development/python-modules/monai-deploy/default.nix
@@ -26,6 +26,12 @@ buildPythonPackage rec {
     hash = "sha256-oaNZ0US0YR/PSwAZ5GfRpAW+HRYVhdCZI83fC00rgok=";
   };
 
+  postPatch = ''
+    # Asked in https://github.com/Project-MONAI/monai-deploy-app-sdk/issues/450
+    # if this patch can be incorporated upstream.
+    substituteInPlace pyproject.toml --replace 'versioneer-518' 'versioneer'
+  '';
+
   nativeBuildInputs = [ versioneer ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/msprime/default.nix b/pkgs/development/python-modules/msprime/default.nix
index d33adc13080a6..f4b3a2eb70c6c 100644
--- a/pkgs/development/python-modules/msprime/default.nix
+++ b/pkgs/development/python-modules/msprime/default.nix
@@ -1,7 +1,9 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, oldest-supported-numpy
 , setuptools-scm
+, wheel
 , pythonOlder
 , gsl
 , numpy
@@ -25,8 +27,10 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    setuptools-scm
     gsl
+    oldest-supported-numpy
+    setuptools-scm
+    wheel
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/multiset/default.nix b/pkgs/development/python-modules/multiset/default.nix
index 6d9a28e564baf..0e6e143676bce 100644
--- a/pkgs/development/python-modules/multiset/default.nix
+++ b/pkgs/development/python-modules/multiset/default.nix
@@ -1,8 +1,10 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , setuptools
 , setuptools-scm
+, wheel
 , pytestCheckHook
 }:
 
@@ -16,9 +18,13 @@ buildPythonPackage rec {
     hash = "sha256-5FZxyug4Wo5iSKmwejqDKAwtDMQxJxMFjPus3F7Jlz4=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    setuptools-scm
+  patches = [
+    # https://github.com/wheerd/multiset/pull/115
+    (fetchpatch {
+      name = "relax-setuptools-scm-dependency.patch";
+      url = "https://github.com/wheerd/multiset/commit/296187b07691c94b783f65504afc580a355abd96.patch";
+      hash = "sha256-vnZR1cyM/2/JfbLuVOxJuC9oMVVVploUHpbzagmo+AE=";
+    })
   ];
 
   postPatch = ''
@@ -26,6 +32,12 @@ buildPythonPackage rec {
     sed -i '/python_requires/d' setup.cfg
   '';
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
   pythonImportsCheck = [
     "multiset"
   ];
diff --git a/pkgs/development/python-modules/napalm/hp-procurve.nix b/pkgs/development/python-modules/napalm/hp-procurve.nix
index c0a326b0ef7f0..87dad04cf7813 100644
--- a/pkgs/development/python-modules/napalm/hp-procurve.nix
+++ b/pkgs/development/python-modules/napalm/hp-procurve.nix
@@ -1,30 +1,44 @@
-{ lib, buildPythonPackage, fetchFromGitHub, setuptools, napalm, netmiko
-, pytestCheckHook }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, napalm
+, netmiko
+, pip
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "napalm-hp-procurve";
   version = "0.7.0";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "napalm-automation-community";
     repo = pname;
     rev = version;
-    sha256 = "1lspciddkd1w5lfyz35i0qwgpbn5jq9cbqkwjbsvi4kliz229vkh";
+    hash = "sha256-cO4kxI90krj1knzixRKWxa77OAaxjO8dLTy02VpkV9M=";
   };
 
+  nativeBuildInputs = [
+    pip
+  ];
+
   # dependency installation in setup.py doesn't work
   patchPhase = ''
     echo -n > requirements.txt
   '';
 
-  buildInputs = [ setuptools napalm ];
+  buildInputs = [ napalm ];
+
   propagatedBuildInputs = [ netmiko ];
 
   # setup.cfg seems to contain invalid pytest parameters
   preCheck = ''
     rm setup.cfg
   '';
+
   nativeCheckInputs = [ pytestCheckHook ];
+
   disabledTests = [
     # AssertionError: Some methods vary.
     "test_method_signatures"
diff --git a/pkgs/development/python-modules/netcdf4/default.nix b/pkgs/development/python-modules/netcdf4/default.nix
index e753154006217..9f00a33fdf6bd 100644
--- a/pkgs/development/python-modules/netcdf4/default.nix
+++ b/pkgs/development/python-modules/netcdf4/default.nix
@@ -3,7 +3,9 @@
 , fetchPypi
 , isPyPy
 , python
+, oldest-supported-numpy
 , setuptools
+, wheel
 , numpy
 , zlib
 , netcdf
@@ -26,7 +28,12 @@ buildPythonPackage rec {
     hash = "sha256-A4KwL/aiiEGfb/7IXexA9FH0G4dVVHFUxXXd2fD0rlM=";
   };
 
-  nativeBuildInputs = [ setuptools cython ];
+  nativeBuildInputs = [
+    cython
+    oldest-supported-numpy
+    setuptools
+    wheel
+  ];
 
   propagatedBuildInputs = [
     cftime
diff --git a/pkgs/development/python-modules/newversion/default.nix b/pkgs/development/python-modules/newversion/default.nix
index f1643b9f21cb3..e3283a4eb9e2f 100644
--- a/pkgs/development/python-modules/newversion/default.nix
+++ b/pkgs/development/python-modules/newversion/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , packaging
 , poetry-core
 , pytestCheckHook
@@ -22,6 +23,15 @@ buildPythonPackage rec {
     hash = "sha256-27HWMzSzyAbiOW7OUhlupRWIVJG6DrpXObXmxlCsmxU=";
   };
 
+  patches = [
+    # https://github.com/vemel/newversion/pull/9
+    (fetchpatch {
+      name = "remove-setuptools-dependency.patch";
+      url = "https://github.com/vemel/newversion/commit/b50562671029dd6834bc7a8ad0dd3f9e0fbdfc1d.patch";
+      hash = "sha256-6dXVQ9Hk0/EfSwPbW19ZV8MAFcSx+ZRO5G94kbh23GM=";
+    })
+  ];
+
   nativeBuildInputs = [
     poetry-core
   ];
diff --git a/pkgs/development/python-modules/ninja/default.nix b/pkgs/development/python-modules/ninja/default.nix
index 0ff6785693029..808bf9fb8c0e1 100644
--- a/pkgs/development/python-modules/ninja/default.nix
+++ b/pkgs/development/python-modules/ninja/default.nix
@@ -16,6 +16,7 @@ buildPythonPackage rec {
       --subst-var version
 
     substituteInPlace "$sourceRoot/ninja/__init__.py" \
+      --subst-var version \
       --subst-var-by BIN_DIR "${ninja}/bin"
   '';
 
diff --git a/pkgs/development/python-modules/ninja/stub/ninja/__init__.py b/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
index fcf70f10ba310..d6e7abe152059 100644
--- a/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
+++ b/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
@@ -2,6 +2,8 @@ import os
 import subprocess
 import sys
 
+__version__ = '@version@'
+
 BIN_DIR = '@BIN_DIR@'
 
 def _program(name, args):
diff --git a/pkgs/development/python-modules/nitime/default.nix b/pkgs/development/python-modules/nitime/default.nix
index 105cecd95b10b..b0870c984911b 100644
--- a/pkgs/development/python-modules/nitime/default.nix
+++ b/pkgs/development/python-modules/nitime/default.nix
@@ -5,6 +5,9 @@
 , pythonOlder
 , pytestCheckHook
 , cython
+, setuptools
+, setuptools-scm
+, wheel
 , numpy
 , scipy
 , matplotlib
@@ -23,11 +26,32 @@ buildPythonPackage rec {
     hash = "sha256-NnoVrSt6MTTcNup1e+/1v5JoHCYcycuQH4rHLzXJt+Y=";
   };
 
-  buildInputs = [ cython ];
-  propagatedBuildInputs = [ numpy scipy matplotlib networkx nibabel ];
+  # Upstream wants to build against the oldest version of numpy possible, but
+  # we only want to build against the most recent version.
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "numpy==" "numpy>="
+  '';
+
+  nativeBuildInputs = [
+    cython
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    scipy
+    matplotlib
+    networkx
+    nibabel
+  ];
 
   nativeCheckInputs = [ pytestCheckHook ];
+
   doCheck = !stdenv.isDarwin;  # tests hang indefinitely
+
   pythonImportsCheck = [ "nitime" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 0c3b28d1d215d..d79b9eea4bce2 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -6,8 +6,10 @@
 
 # build-system
 , cython
+, oldest-supported-numpy
 , setuptools
 , versioneer
+, wheel
 
 # propagates
 , numpy
@@ -75,7 +77,9 @@ buildPythonPackage rec {
     setuptools
     cython
     numpy
+    oldest-supported-numpy
     versioneer
+    wheel
   ] ++ versioneer.optional-dependencies.toml;
 
   enableParallelBuilding = true;
@@ -168,10 +172,6 @@ buildPythonPackage rec {
     all = lib.concatLists (lib.attrValues extras);
   };
 
-  # Doesn't work with -Werror,-Wunused-command-line-argument
-  # https://github.com/NixOS/nixpkgs/issues/39687
-  hardeningDisable = lib.optional stdenv.cc.isClang "strictoverflow";
-
   nativeCheckInputs = [
     glibcLocales
     hypothesis
diff --git a/pkgs/development/python-modules/pg8000/default.nix b/pkgs/development/python-modules/pg8000/default.nix
index 1e2fc644b29d8..9e0815ddfc71f 100644
--- a/pkgs/development/python-modules/pg8000/default.nix
+++ b/pkgs/development/python-modules/pg8000/default.nix
@@ -7,6 +7,7 @@
 , pythonOlder
 , scramp
 , setuptools
+, versioningit
 }:
 
 buildPythonPackage rec {
@@ -23,6 +24,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    versioningit
   ];
 
   propagatedBuildInputs = [
@@ -33,10 +35,6 @@ buildPythonPackage rec {
     importlib-metadata
   ];
 
-  postPatch = ''
-    sed '/^\[metadata\]/a version = ${version}' setup.cfg
-  '';
-
   # Tests require a running PostgreSQL instance
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index f1489e1f458d2..bb669f421177d 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -24,6 +24,16 @@ import ./generic.nix (rec {
     hash = "sha256-nIK1s+BDx68NlXktDSDM9o9hof7Gs1MOcYtohCJyc5Y=";
   };
 
+  patches = [
+    # Pull in zlib-1.3 fix pending upstream inclusion
+    #   https://github.com/python-pillow/Pillow/pull/7344
+    (fetchpatch {
+      name = "zlib-1.3.patch";
+      url = "https://github.com/python-pillow/Pillow/commit/9ef7cb39def45b0fe1cdf4828ca20838a1fc39d1.patch";
+      hash = "sha256-N7V6Xz+SBHSm3YIgmbty7zbqkv8MzpLMhU4Xxerhx8w=";
+    })
+  ];
+
   passthru.tests = {
     inherit imageio matplotlib pilkit pydicom reportlab;
   };
diff --git a/pkgs/development/python-modules/pint-pandas/default.nix b/pkgs/development/python-modules/pint-pandas/default.nix
index a4dd78a557e6f..6cc7cd22a97da 100644
--- a/pkgs/development/python-modules/pint-pandas/default.nix
+++ b/pkgs/development/python-modules/pint-pandas/default.nix
@@ -3,6 +3,8 @@
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
+, setuptools-scm
+, wheel
 , pint
 , pandas
 , pytestCheckHook
@@ -20,8 +22,12 @@ buildPythonPackage rec {
     hash = "sha256-FuH6wksSCkkL2AyQN46hwTnfeAZFwkWRl6KEEhsxmUY=";
   };
 
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   nativeBuildInputs = [
     setuptools
+    setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pip-tools/default.nix b/pkgs/development/python-modules/pip-tools/default.nix
index f1fcf59ce2fe1..d549822713556 100644
--- a/pkgs/development/python-modules/pip-tools/default.nix
+++ b/pkgs/development/python-modules/pip-tools/default.nix
@@ -11,19 +11,21 @@
 , pythonOlder
 , setuptools
 , setuptools-scm
+, tomli
+, tomli-w
 , wheel
 }:
 
 buildPythonPackage rec {
   pname = "pip-tools";
-  version = "6.13.0";
+  version = "7.2.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YdRr0uuAFu1Kkk4Zbm5bCiaM07q9eeWTBIcg2yNSK7E=";
+    hash = "sha256-YWSItTnhS4qoVDbtWXozwpH0iFwdLgvsl0AKvlr/LA0=";
   };
 
   patches = [ ./fix-setup-py-bad-syntax-detection.patch ];
@@ -39,11 +41,16 @@ buildPythonPackage rec {
     pip
     setuptools
     wheel
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    tomli
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-xdist
     pytestCheckHook
+    tomli-w
   ];
 
   preCheck = lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
diff --git a/pkgs/development/python-modules/pip/default.nix b/pkgs/development/python-modules/pip/default.nix
index ebac5724d66fa..bc06cb39e247b 100644
--- a/pkgs/development/python-modules/pip/default.nix
+++ b/pkgs/development/python-modules/pip/default.nix
@@ -1,10 +1,12 @@
 { lib
 , buildPythonPackage
-, bootstrapped-pip
 , fetchFromGitHub
+, installShellFiles
 , mock
 , scripttest
+, setuptools
 , virtualenv
+, wheel
 , pretend
 , pytest
 
@@ -14,33 +16,40 @@
 
 buildPythonPackage rec {
   pname = "pip";
-  version = "23.0.1";
-  format = "other";
+  version = "23.2.1";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-BSonlwKmegrlrQTTIL0avPi61/TY2M0f7kOZpSzPRQk=";
-    name = "${pname}-${version}-source";
+    hash = "sha256-mUlzfYmq1FE3X1/2o7sYJzMgwHRI4ib4EMhpg83VvrI=";
   };
 
-  nativeBuildInputs = [ bootstrapped-pip ];
-
   postPatch = ''
     # Remove vendored Windows PE binaries
     # Note: These are unused but make the package unreproducible.
     find -type f -name '*.exe' -delete
   '';
 
-  # pip detects that we already have bootstrapped_pip "installed", so we need
-  # to force it a little.
-  pipInstallFlags = [ "--ignore-installed" ];
+  nativeBuildInputs = [
+    installShellFiles
+    setuptools
+    wheel
+  ];
 
   nativeCheckInputs = [ mock scripttest virtualenv pretend pytest ];
+
   # Pip wants pytest, but tests are not distributed
   doCheck = false;
 
+  postInstall = ''
+    installShellCompletion --cmd pip \
+      --bash <($out/bin/pip completion --bash) \
+      --fish <($out/bin/pip completion --fish) \
+      --zsh <($out/bin/pip completion --zsh)
+  '';
+
   passthru.tests = { inherit pip-tools; };
 
   meta = {
@@ -48,6 +57,5 @@ buildPythonPackage rec {
     license = with lib.licenses; [ mit ];
     homepage = "https://pip.pypa.io/";
     changelog = "https://pip.pypa.io/en/stable/news/#v${lib.replaceStrings [ "." ] [ "-" ] version}";
-    priority = 10;
   };
 }
diff --git a/pkgs/development/python-modules/pipdeptree/default.nix b/pkgs/development/python-modules/pipdeptree/default.nix
index d248672b170a3..250ad2f2399d2 100644
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     hatch-vcs
   ];
 
-  propagatedBuildInput = [
+  propagatedBuildInputs = [
     pip
   ];
 
diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index 270c78a69826f..1205b860b8da2 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -6,53 +6,72 @@
 , pythonOlder
 , build
 , git
-, importlib-metadata
-, pep517
 , pytest-mock
 , pytestCheckHook
 , setuptools
+, tomli-w
 , virtualenv
 }:
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "1.5.1";
+  version = "1.6.1";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    hash = "sha256-h3d0h+WCrrNlfPOlUx6Rj0aG6untD6MiunqvPj4yT+0=";
+    hash = "sha256-Gc22Y2T4uO39jiOqEUFeOfnVCbknuDjmzFPZgk2eY74=";
   };
 
   # revert update of vendored dependencies to unbreak e.g. zeroconf on x86_64-darwin
   patches = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
     (fetchpatch {
+      url = "https://github.com/python-poetry/poetry-core/commit/0bdf29e9631fda9436066a07ca8e69a4aa97a31e.patch";
+      revert = true;
+      hash = "sha256-Uqlv17GUcmVkB6ZFePtrbUonsbkiIXay7LLuT/WcPh8=";
+    })
+    (fetchpatch {
+      url = "https://github.com/python-poetry/poetry-core/commit/48447a18a60c43240bf075fc0c2501f6d68f0211.patch";
+      revert = true;
+      hash = "sha256-23GazppqYmuAmkE/xMtuzng2PbxhYNwgtmsvb6lfvig=";
+    })
+    (fetchpatch {
+      url = "https://github.com/python-poetry/poetry-core/commit/bc97ac6030049a01e5337fcb53493112a9c75a81.patch";
+      revert = true;
+      hash = "sha256-8NAG+Xm/BNL16NONZJRNB3JiRRKvjMsZJH2FWlw+dHk=";
+    })
+    (fetchpatch {
+      url = "https://github.com/python-poetry/poetry-core/commit/835bc91393fbb983de6227d67b076aea1360ea68.patch";
+      revert = true;
+      hash = "sha256-Z5viypprDY9GGeX6luBsIoSI9D0lN9g14U9uMh4DTfA=";
+    })
+    (fetchpatch {
       url = "https://github.com/python-poetry/poetry-core/commit/80d7dcdc722dee0e09e5f3303b663003d794832c.patch";
       revert = true;
       hash = "sha256-CPjkNCmuAiowp/kyKqnEfUQNmXK95RMJOIa24nG6xi8=";
     })
     (fetchpatch {
       url = "https://github.com/python-poetry/poetry-core/commit/43fd7fe62676421b3661c96844b5d7cf49b87c07.patch";
+      excludes = [
+        "vendors/poetry.lock"
+        "vendors/pyproject.toml"
+      ];
       revert = true;
-      hash = "sha256-fXq8L23qjLraLeMzB1bwW1jU0eGd236/GHIoYKwOuL0=";
+      hash = "sha256-mbu16qFH9ymDZ0KIMiYMy7js5OmxY7z5qg6ZfgfgeLs=";
     })
   ];
 
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
-  ];
-
   nativeCheckInputs = [
     build
     git
-    pep517
     pytest-mock
     pytestCheckHook
     setuptools
+    tomli-w
     virtualenv
   ];
 
diff --git a/pkgs/development/python-modules/polyline/default.nix b/pkgs/development/python-modules/polyline/default.nix
index 26cec2331cb7f..5ab360ae7e379 100644
--- a/pkgs/development/python-modules/polyline/default.nix
+++ b/pkgs/development/python-modules/polyline/default.nix
@@ -1,9 +1,11 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytestCheckHook
 , pythonOlder
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -20,6 +22,15 @@ buildPythonPackage rec {
     hash = "sha256-e9ZDqcS3MaMlXi2a2JHI6NtRPqIV7rjsucGXEH6V8LA=";
   };
 
+  patches = [
+    # https://github.com/frederickjansen/polyline/pull/15
+    (fetchpatch {
+      name = "relax-build-dependencies.patch";
+      url = "https://github.com/frederickjansen/polyline/commit/cb9fc80606c33dbbcaa0d94de25ae952358443b6.patch";
+      hash = "sha256-epg2pZAG+9QuICa1ms+/EO2DDmYEz+KEtxxnvG7rsWY=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --cov=polyline --cov-report term-missing" ""
@@ -27,6 +38,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/proxy-py/default.nix b/pkgs/development/python-modules/proxy-py/default.nix
index 911637bf85055..7c88211f5d276 100644
--- a/pkgs/development/python-modules/proxy-py/default.nix
+++ b/pkgs/development/python-modules/proxy-py/default.nix
@@ -3,6 +3,7 @@
 , bash
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , gnumake
 , httpx
 , openssl
@@ -13,6 +14,7 @@
 , pythonOlder
 , setuptools-scm
 , typing-extensions
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -29,6 +31,22 @@ buildPythonPackage rec {
     hash = "sha256-dA7a9RicBFCSf6IoGX/CdvI8x/xMOFfNtyuvFn9YmHI=";
   };
 
+  patches = [
+    # this patch is so that the one following it applies cleanly
+    # https://github.com/abhinavsingh/proxy.py/pull/1209
+    (fetchpatch {
+      name = "update-build-dependencies.patch";
+      url = "https://github.com/abhinavsingh/proxy.py/commit/2e535360ce5ed9734f2c00dc6aefe5ebd281cea5.patch";
+      hash = "sha256-eR3R4M7jwQMnY5ob0V6G71jXcrkV7YZvo1JOUG4gnrY=";
+    })
+    # https://github.com/abhinavsingh/proxy.py/pull/1345
+    (fetchpatch {
+      name = "remove-setuptools-scm-git-archive-dependency.patch";
+      url = "https://github.com/abhinavsingh/proxy.py/commit/027bfa6b912745f588d272f1a1082f6ca416f815.patch";
+      hash = "sha256-O2LlSrSrB3u2McAZRY+KviuU7Hv1tOuf0n+D/H4BWvI=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace Makefile \
     --replace "SHELL := /bin/bash" "SHELL := ${bash}/bin/bash"
@@ -40,6 +58,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/py-dormakaba-dkey/default.nix b/pkgs/development/python-modules/py-dormakaba-dkey/default.nix
index 6c70ad8861c7b..27443d166e76f 100644
--- a/pkgs/development/python-modules/py-dormakaba-dkey/default.nix
+++ b/pkgs/development/python-modules/py-dormakaba-dkey/default.nix
@@ -4,8 +4,10 @@
 , buildPythonPackage
 , cryptography
 , fetchFromGitHub
+, fetchpatch
 , pythonOlder
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -22,8 +24,18 @@ buildPythonPackage rec {
     hash = "sha256-1jIsKQa27XNVievU02jjanRWFtJDYsHolgPBab6qpM0=";
   };
 
+  patches = [
+    # https://github.com/emontnemery/py-dormakaba-dkey/pull/45
+    (fetchpatch {
+      name = "relax-setuptools-dependency.patch";
+      url = "https://github.com/emontnemery/py-dormakaba-dkey/commit/cfda4be71d39f2cfd1c0d4f7fff9018050c57f1a.patch";
+      hash = "sha256-JGsaLQNbUfz0uK/MeGnR2XTJDs4RnTOEg7BavfDPArg=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyairvisual/default.nix b/pkgs/development/python-modules/pyairvisual/default.nix
index 75525b9434453..c9563039b0a8c 100644
--- a/pkgs/development/python-modules/pyairvisual/default.nix
+++ b/pkgs/development/python-modules/pyairvisual/default.nix
@@ -4,6 +4,7 @@
 , buildPythonPackage
 , certifi
 , fetchFromGitHub
+, fetchpatch
 , numpy
 , poetry-core
 , pygments
@@ -28,6 +29,15 @@ buildPythonPackage rec {
     hash = "sha256-+yqN3q+uA/v01uCguzUSoeCJK9lRmiiYn8d272+Dd2M=";
   };
 
+  patches = [
+    # https://github.com/bachya/pyairvisual/pull/298
+    (fetchpatch {
+      name = "clean-up-build-dependencies.patch";
+      url = "https://github.com/bachya/pyairvisual/commit/eb32beb7229a53ff81917cc417ed66b26aae47dd.patch";
+      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml --replace \
       'certifi = ">=2023.07.22"' \
@@ -46,6 +56,9 @@ buildPythonPackage rec {
     pysmb
   ];
 
+  # this lets tests bind to localhost in sandbox mode on macOS
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-aiohttp
diff --git a/pkgs/development/python-modules/pydeck/default.nix b/pkgs/development/python-modules/pydeck/default.nix
index ccdc8509b8cba..da009608b6784 100644
--- a/pkgs/development/python-modules/pydeck/default.nix
+++ b/pkgs/development/python-modules/pydeck/default.nix
@@ -4,6 +4,7 @@
 , ipykernel
 , ipywidgets
 , jinja2
+, jupyter
 , numpy
 , pandas
 , pytestCheckHook
@@ -26,6 +27,8 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
+    jinja2
+    jupyter
     setuptools
     wheel
   ];
diff --git a/pkgs/development/python-modules/pydicom-seg/default.nix b/pkgs/development/python-modules/pydicom-seg/default.nix
index c18c0210c86de..52708208d4c9c 100644
--- a/pkgs/development/python-modules/pydicom-seg/default.nix
+++ b/pkgs/development/python-modules/pydicom-seg/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pythonOlder
 , pytestCheckHook
 , pythonRelaxDepsHook
@@ -26,10 +27,14 @@ buildPythonPackage rec {
     fetchSubmodules = true;
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "poetry.masonry.api" "poetry.core.masonry.api"
-  '';
+  patches = [
+    # https://github.com/razorx89/pydicom-seg/pull/54
+    (fetchpatch {
+      name = "replace-poetry-with-poetry-core.patch";
+      url = "https://github.com/razorx89/pydicom-seg/commit/ac91eaefe3b0aecfe745869972c08de5350d2b61.patch";
+      hash = "sha256-xBOVjWZPjyQ8gSj6JLe9B531e11TI3FUFFtL+IelZOM=";
+    })
+  ];
 
   pythonRelaxDeps = [
     "jsonschema"
diff --git a/pkgs/development/python-modules/pyhanko-certvalidator/default.nix b/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
index 5018f8f924a53..5e83dc793ca5c 100644
--- a/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
+++ b/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
@@ -5,7 +5,6 @@
 , cryptography
 , fetchFromGitHub
 , freezegun
-, openssl
 , oscrypto
 , pytest-asyncio
 , pytestCheckHook
@@ -29,6 +28,11 @@ buildPythonPackage rec {
     hash = "sha256-q2YxncyMHmbRmcoLb68huK02CYiKqF2CFRl8vkUfxg4=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace ', "pytest-runner",' ""
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/pyinsteon/default.nix b/pkgs/development/python-modules/pyinsteon/default.nix
index 1747fc677398c..948c3fd29bb00 100644
--- a/pkgs/development/python-modules/pyinsteon/default.nix
+++ b/pkgs/development/python-modules/pyinsteon/default.nix
@@ -4,6 +4,7 @@
 , async-generator
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pypubsub
 , pyserial
 , pyserial-asyncio
@@ -11,6 +12,7 @@
 , pythonOlder
 , setuptools
 , voluptuous
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -27,8 +29,18 @@ buildPythonPackage rec {
     hash = "sha256-KKF+XYQgdmLbbicyMFyZBG4ol69xAWCF2W/r15gH2Mo=";
   };
 
+  patches = [
+    # https://github.com/pyinsteon/pyinsteon/pull/361
+    (fetchpatch {
+      name = "relax-setuptools-dependency.patch";
+      url = "https://github.com/pyinsteon/pyinsteon/commit/676bc5fff11b73a4c3fd189a6ac6d3de9ca21ae0.patch";
+      hash = "sha256-kTu1+IwDrcdqelyK/vfhxw8MQBis5I1jag7YTytKQhs=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pymdown-extensions/default.nix b/pkgs/development/python-modules/pymdown-extensions/default.nix
index 05da3476ea618..1f4bcb1cce293 100644
--- a/pkgs/development/python-modules/pymdown-extensions/default.nix
+++ b/pkgs/development/python-modules/pymdown-extensions/default.nix
@@ -6,6 +6,12 @@
 , markdown
 , pyyaml
 , pygments
+
+# for passthru.tests
+, mkdocstrings
+, mkdocs-material
+, mkdocs-mermaid2-plugin
+, hydrus
 }:
 
 let
@@ -38,14 +44,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pymdown-extensions";
-  version = "9.9.2";
+  version = "10.1.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "facelessuser";
     repo = "pymdown-extensions";
     rev = "refs/tags/${version}";
-    hash = "sha256-ld3NuBTjDJUN4ZK+eTwmmfzcB8XCtg8xaLMECo95+Cg=";
+    hash = "sha256-KqDEmWAWXdDpQPsP9Vrced+Ozz9IZiD8rCG57hPR7Xs=";
   };
 
   nativeBuildInputs = [ hatchling ];
@@ -59,6 +65,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = map (ext: "pymdownx.${ext}") extensions;
 
+  passthru.tests = {
+    inherit mkdocstrings mkdocs-material mkdocs-mermaid2-plugin hydrus;
+  };
+
   meta = with lib; {
     description = "Extensions for Python Markdown";
     homepage = "https://facelessuser.github.io/pymdown-extensions/";
diff --git a/pkgs/development/python-modules/pymilvus/default.nix b/pkgs/development/python-modules/pymilvus/default.nix
index 307ee7fbfd645..a27f49c8613a7 100644
--- a/pkgs/development/python-modules/pymilvus/default.nix
+++ b/pkgs/development/python-modules/pymilvus/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , environs
 , fetchFromGitHub
+, gitpython
 , grpcio
 , grpcio-testing
 , mmh3
@@ -13,6 +14,7 @@
 , scikit-learn
 , setuptools-scm
 , ujson
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -29,15 +31,17 @@ buildPythonPackage rec {
     hash = "sha256-wwhgO2iCzPXobyZI0narHPn2WCAB9sS1+AoLrP1Ih6Q=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   pythonRelaxDeps = [
     "grpcio"
   ];
 
   nativeBuildInputs = [
+    gitpython
     pythonRelaxDepsHook
     setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pypandoc/default.nix b/pkgs/development/python-modules/pypandoc/default.nix
index a12ae560bfc50..ac7f88d48575c 100644
--- a/pkgs/development/python-modules/pypandoc/default.nix
+++ b/pkgs/development/python-modules/pypandoc/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pandoc
 , pandocfilters
+, poetry-core
 , pythonOlder
 , substituteAll
 , texlive
@@ -11,6 +12,7 @@
 buildPythonPackage rec {
   pname = "pypandoc";
   version = "1.10";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
@@ -30,6 +32,10 @@ buildPythonPackage rec {
     ./skip-tests.patch
   ];
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   nativeCheckInputs = [
     texlive.combined.scheme-small
     pandocfilters
diff --git a/pkgs/development/python-modules/pypck/default.nix b/pkgs/development/python-modules/pypck/default.nix
index 3cdd7fa4acebb..3eef4a86ce8f9 100644
--- a/pkgs/development/python-modules/pypck/default.nix
+++ b/pkgs/development/python-modules/pypck/default.nix
@@ -2,11 +2,13 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytest-asyncio
 , pytest-timeout
 , pytestCheckHook
 , pythonOlder
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -23,8 +25,18 @@ buildPythonPackage rec {
     hash = "sha256-Vlt4+fRULb9mB0ceRmc7MJ50DnF9DAJPHA8iCbNVvcE=";
   };
 
+  patches = [
+    # https://github.com/alengwenus/pypck/pull/109
+    (fetchpatch {
+      name = "relax-setuptools-dependency.patch";
+      url = "https://github.com/alengwenus/pypck/commit/17023ebe8082120b1eec086842ca809ec6e9df2b.patch";
+      hash = "sha256-kTu1+IwDrcdqelyK/vfhxw8MQBis5I1jag7YTytKQhs=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pyproject-api/default.nix b/pkgs/development/python-modules/pyproject-api/default.nix
index 6ca6ac25a98d3..6cbef5b8a77f1 100644
--- a/pkgs/development/python-modules/pyproject-api/default.nix
+++ b/pkgs/development/python-modules/pyproject-api/default.nix
@@ -6,7 +6,6 @@
 # build time
 , hatchling
 , hatch-vcs
-, setuptools-scm
 
 # runtime
 , packaging
@@ -21,13 +20,14 @@
 # tests
 , pytest-mock
 , pytestCheckHook
+, setuptools
 , virtualenv
 , wheel
 }:
 
 buildPythonPackage rec {
   pname = "pyproject-api";
-  version = "1.5.0";
+  version = "1.5.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "tox-dev";
     repo = "pyproject-api";
     rev = "refs/tags/${version}";
-    hash = "sha256-VO+huA9i7uMpCVaWHC29XlfestSu+N9vWWHteY21uqs=";
+    hash = "sha256-HX+5BypfEOfQ3vg3vha0QCVrEarjMu/Q8id+xgmWGfA=";
   };
 
   outputs = [
@@ -44,12 +44,11 @@ buildPythonPackage rec {
     "doc"
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     hatchling
     hatch-vcs
-    setuptools-scm
 
     # docs
     sphinxHook
@@ -66,6 +65,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytest-mock
     pytestCheckHook
+    setuptools
     virtualenv
     wheel
   ];
diff --git a/pkgs/development/python-modules/pyproject-hooks/default.nix b/pkgs/development/python-modules/pyproject-hooks/default.nix
index d751160b54d83..3624b5f02edb2 100644
--- a/pkgs/development/python-modules/pyproject-hooks/default.nix
+++ b/pkgs/development/python-modules/pyproject-hooks/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , flit-core
+, pyproject-hooks
 , pytestCheckHook
 , pythonOlder
 , setuptools
@@ -30,17 +31,33 @@ buildPythonPackage rec {
     tomli
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    setuptools
-    testpath
-  ];
+  # We need to disable tests because this package is part of the bootstrap chain
+  # and its test dependencies cannot be built yet when this is being built.
+  doCheck = false;
 
-  disabledTests = [
-    # fail to import setuptools
-    "test_setup_py"
-    "test_issue_104"
-  ];
+  passthru.tests = {
+    pytest = buildPythonPackage {
+      pname = "${pname}-pytest";
+      inherit version;
+      format = "other";
+
+      dontBuild = true;
+      dontInstall = true;
+
+      nativeCheckInputs = [
+        pyproject-hooks
+        pytestCheckHook
+        setuptools
+        testpath
+      ];
+
+      disabledTests = [
+        # fail to import setuptools
+        "test_setup_py"
+        "test_issue_104"
+      ];
+    };
+  };
 
   pythonImportsCheck = [
     "pyproject_hooks"
diff --git a/pkgs/development/python-modules/pyqt-builder/default.nix b/pkgs/development/python-modules/pyqt-builder/default.nix
index 0227aa1023315..345b5aa13a1e2 100644
--- a/pkgs/development/python-modules/pyqt-builder/default.nix
+++ b/pkgs/development/python-modules/pyqt-builder/default.nix
@@ -1,15 +1,28 @@
-{ lib, fetchPypi, buildPythonPackage, packaging, sip }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, packaging
+, setuptools
+, sip
+, wheel
+}:
 
 buildPythonPackage rec {
   pname = "pyqt-builder";
-  version = "1.14.1";
+  version = "1.15.2";
+  format = "pyproject";
 
   src = fetchPypi {
     pname = "PyQt-builder";
     inherit version;
-    hash = "sha256-g7w+MAr/i0FAWAS2qcKRM4mrWcSK2fDLhYSm73O8pQI=";
+    hash = "sha256-dGz+g8A+v/RFjUeKHAZxR5Dvk+RY7NWii8KDe6yI63Q=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
   propagatedBuildInputs = [ packaging sip ];
 
   pythonImportsCheck = [ "pyqtbuild" ];
diff --git a/pkgs/development/python-modules/python-creole/default.nix b/pkgs/development/python-modules/python-creole/default.nix
index a02a08e2b44b2..52d13d452affc 100644
--- a/pkgs/development/python-modules/python-creole/default.nix
+++ b/pkgs/development/python-modules/python-creole/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , runtimeShell
 
 # build
@@ -27,14 +28,20 @@ buildPythonPackage rec {
     hash = "sha256-8pXOnLNjhIv0d+BqjW8wlb6BT6CmFHSsxn5wLOv3LBQ=";
   };
 
+  patches = [
+    # https://github.com/jedie/python-creole/pull/77
+    (fetchpatch {
+      name = "replace-poetry-with-poetry-core.patch";
+      url = "https://github.com/jedie/python-creole/commit/bfc46730ab4a189f3142246cead8d26005a28671.patch";
+      hash = "sha256-WtoEQyu/154Cfj6eSnNA+t37+o7Ij328QGMKxwcLg5k=";
+    })
+  ];
+
   nativeBuildInputs = [
     poetry-core
   ];
 
   postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "poetry.masonry.api" "poetry.core.masonry.api"
-
     substituteInPlace Makefile \
       --replace "/bin/bash" "${runtimeShell}"
 
diff --git a/pkgs/development/python-modules/python-homewizard-energy/default.nix b/pkgs/development/python-modules/python-homewizard-energy/default.nix
index bfb53c92df414..c6b5f1ec4539a 100644
--- a/pkgs/development/python-modules/python-homewizard-energy/default.nix
+++ b/pkgs/development/python-modules/python-homewizard-energy/default.nix
@@ -4,6 +4,7 @@
 , awesomeversion
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , protobuf
 , pytest-asyncio
@@ -25,6 +26,15 @@ buildPythonPackage rec {
     hash = "sha256-XTSnIL/hBL1Rsyv/tBce/WCvA3n7mZern0v3i6gTOeA=";
   };
 
+  patches = [
+    # https://github.com/DCSBL/python-homewizard-energy/pull/235
+    (fetchpatch {
+      name = "remove-setuptools-dependency.patch";
+      url = "https://github.com/DCSBL/python-homewizard-energy/commit/b006b0bc1f3d0b4a7569654a1afa90dd4cffaf18.patch";
+      hash = "sha256-WQeepxiYnBfFcQAmrc3pavBz5j1Qo0HmUcOxsK/pr50=";
+    })
+  ];
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -34,6 +44,8 @@ buildPythonPackage rec {
     aiohttp
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index 67bbaf998dbbd..2dca97b7f858c 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -4,6 +4,7 @@
 , buildPythonPackage
 , docstring-to-markdown
 , fetchFromGitHub
+, fetchpatch
 , flake8
 , flaky
 , jedi
@@ -28,6 +29,7 @@
 , ujson
 , websockets
 , whatthepatch
+, wheel
 , yapf
 }:
 
@@ -45,7 +47,14 @@ buildPythonPackage rec {
     hash = "sha256-plciPUROFileVULGBZpwUTkW2NZVHy4Nuf4+fSjd8nM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  patches = [
+    # https://github.com/python-lsp/python-lsp-server/pull/416
+    (fetchpatch {
+      name = "bump-jedi-upper-pin-to-0.20.patch";
+      url = "https://github.com/python-lsp/python-lsp-server/commit/f33a93afc8c3a0f16751f9e1f6601a37967fd7df.patch";
+      hash = "sha256-lBpzXxjlQp2ig0z2DRJw+jQZ5eRLIOJYjGrzfgvknDA=";
+    })
+  ];
 
   postPatch = ''
     substituteInPlace pyproject.toml \
@@ -53,6 +62,8 @@ buildPythonPackage rec {
       --replace "--cov pylsp --cov test" ""
   '';
 
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   pythonRelaxDeps = [
     "autopep8"
     "flake8"
@@ -65,6 +76,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     pythonRelaxDepsHook
     setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-magic/default.nix b/pkgs/development/python-modules/python-magic/default.nix
index 056b466216bfc..890cfb50c2cc7 100644
--- a/pkgs/development/python-modules/python-magic/default.nix
+++ b/pkgs/development/python-modules/python-magic/default.nix
@@ -29,6 +29,14 @@ buildPythonPackage rec {
       url = "https://github.com/ahupp/python-magic/commit/4ffcd59113fa26d7c2e9d5897b1eef919fd4b457.patch";
       hash = "sha256-67GpjlGiR4/os/iZ69V+ZziVLpjmid+7t+gQ2aQy9I0=";
     })
+
+    # Upstream patch to amend test suite for-5.45:
+    #   https://github.com/ahupp/python-magic/pull/290
+    (fetchpatch {
+      name = "file-5.45.patch";
+      url = "https://github.com/ahupp/python-magic/commit/3d2405ca80cd39b2a91decd26af81dcf181390a4.patch";
+      hash = "sha256-HRsnO9MGfMD9BkJdC4SrEFQ1OZEaXpwakXFLoaCPK94=";
+    })
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/python-matter-server/default.nix b/pkgs/development/python-modules/python-matter-server/default.nix
index c04beb032f950..ccb013d14e548 100644
--- a/pkgs/development/python-modules/python-matter-server/default.nix
+++ b/pkgs/development/python-modules/python-matter-server/default.nix
@@ -1,10 +1,12 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pythonOlder
 
 # build
 , setuptools
+, wheel
 
 # propagates
 , aiohttp
@@ -39,8 +41,18 @@ buildPythonPackage rec {
     hash = "sha256-t++7jQreibGpJRjJawicxjFIye5X6R1dpFqiM6yvRf0=";
   };
 
+  patches = [
+    # https://github.com/home-assistant-libs/python-matter-server/pull/379
+    (fetchpatch {
+      name = "relax-setuptools-dependency.patch";
+      url = "https://github.com/home-assistant-libs/python-matter-server/commit/1bbc945634db92ea081051645b03c3d9c358fb15.patch";
+      hash = "sha256-kTu1+IwDrcdqelyK/vfhxw8MQBis5I1jag7YTytKQhs=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-otbr-api/default.nix b/pkgs/development/python-modules/python-otbr-api/default.nix
index f11bb76057f55..d6137cf191e2e 100644
--- a/pkgs/development/python-modules/python-otbr-api/default.nix
+++ b/pkgs/development/python-modules/python-otbr-api/default.nix
@@ -4,10 +4,13 @@
 , buildPythonPackage
 , cryptography
 , fetchFromGitHub
+, fetchpatch
+, pytest-asyncio
 , pytestCheckHook
 , pythonOlder
 , setuptools
 , voluptuous
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -24,8 +27,18 @@ buildPythonPackage rec {
     hash = "sha256-bPN2h60ypjlKpXs1xDS7bZcGRXvatA3EdlAX/HLxxTM=";
   };
 
+  patches = [
+    # https://github.com/home-assistant-libs/python-otbr-api/pull/68
+    (fetchpatch {
+      name = "relax-setuptools-dependency.patch";
+      url = "https://github.com/home-assistant-libs/python-otbr-api/commit/37eb19c12d17ac7d040ded035d8401def872fbda.patch";
+      hash = "sha256-JGsaLQNbUfz0uK/MeGnR2XTJDs4RnTOEg7BavfDPArg=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
@@ -36,6 +49,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    pytest-asyncio
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/python-telegram-bot/default.nix b/pkgs/development/python-modules/python-telegram-bot/default.nix
index cea69bf5b14b0..605d8157051cf 100644
--- a/pkgs/development/python-modules/python-telegram-bot/default.nix
+++ b/pkgs/development/python-modules/python-telegram-bot/default.nix
@@ -14,13 +14,15 @@
 , pytestCheckHook
 , pythonOlder
 , pytz
+, setuptools
+, wheel
 , tornado
 }:
 
 buildPythonPackage rec {
   pname = "python-telegram-bot";
   version = "20.4";
-  format = "setuptools";
+  format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
@@ -31,6 +33,11 @@ buildPythonPackage rec {
     hash = "sha256-owbJJZjBkMjsgfBLRl+rnePrIvQ0sUZs7rP9ie912pw=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
   propagatedBuildInputs = [
     aiolimiter
     apscheduler
diff --git a/pkgs/development/python-modules/python-vagrant/default.nix b/pkgs/development/python-modules/python-vagrant/default.nix
index a9d585c777da1..61d780809db5e 100644
--- a/pkgs/development/python-modules/python-vagrant/default.nix
+++ b/pkgs/development/python-modules/python-vagrant/default.nix
@@ -1,21 +1,29 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , setuptools
+, setuptools-scm
+, wheel
 }:
 
 buildPythonPackage rec {
-  version = "1.0.0";
+  version = "1.1.0";
   pname = "python-vagrant";
   format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-qP6TzPL/N+zJXsL0nqdKkabOc6TbShapjdJtOXz9CeU=";
+  src = fetchFromGitHub {
+    owner = "pycontribs";
+    repo = "python-vagrant";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-apvYzH0IY6ZyUP/FiOVbGN3dXejgN7gn7Mq2tlEaTww=";
   };
 
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   nativeBuildInputs = [
     setuptools
+    setuptools-scm
+    wheel
   ];
 
   # The tests try to connect to qemu
diff --git a/pkgs/development/python-modules/pytrends/default.nix b/pkgs/development/python-modules/pytrends/default.nix
index 84a5aed8c7ad1..d52436348ad74 100644
--- a/pkgs/development/python-modules/pytrends/default.nix
+++ b/pkgs/development/python-modules/pytrends/default.nix
@@ -2,6 +2,8 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, setuptools-scm
+, wheel
 , requests
 , lxml
 , pandas
@@ -27,6 +29,8 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [ requests lxml pandas ];
diff --git a/pkgs/development/python-modules/pyvisa-sim/default.nix b/pkgs/development/python-modules/pyvisa-sim/default.nix
index 56fef67a1f9fb..55d6ff6b5db61 100644
--- a/pkgs/development/python-modules/pyvisa-sim/default.nix
+++ b/pkgs/development/python-modules/pyvisa-sim/default.nix
@@ -7,6 +7,9 @@
 , stringparser
 , typing-extensions
 , pytestCheckHook
+, setuptools
+, setuptools-scm
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -19,9 +22,15 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyVISA-sim";
     inherit version;
-    sha256 = "sha256-vWxW941/1e58pqL/Rzq+eoZJpwsvLphgIe48SuJtohY=";
+    hash = "sha256-vWxW941/1e58pqL/Rzq+eoZJpwsvLphgIe48SuJtohY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
   propagatedBuildInputs = [
     pyvisa
     pyyaml
diff --git a/pkgs/development/python-modules/qcodes-loop/default.nix b/pkgs/development/python-modules/qcodes-loop/default.nix
index ef65af007d909..2590a557b8cea 100644
--- a/pkgs/development/python-modules/qcodes-loop/default.nix
+++ b/pkgs/development/python-modules/qcodes-loop/default.nix
@@ -1,4 +1,5 @@
 { lib
+, fetchpatch
 , fetchPypi
 , pythonOlder
 , buildPythonPackage
@@ -8,7 +9,9 @@
 , matplotlib
 , numpy
 , pandas
+, setuptools
 , versioningit
+, wheel
 , xarray
 , hickle
 , ipython
@@ -24,18 +27,29 @@
 buildPythonPackage rec {
   pname = "qcodes-loop";
   version = "0.1.1";
+  format = "pyproject";
 
   disabled = pythonOlder "3.8";
-  format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "qcodes_loop";
-    sha256 = "sha256-pDR0Ws8cYQifftdE9dKcSzMxmouFo4tJmQvNanm6zyM=";
+    hash = "sha256-pDR0Ws8cYQifftdE9dKcSzMxmouFo4tJmQvNanm6zyM=";
   };
 
+  patches = [
+    # https://github.com/QCoDeS/Qcodes_loop/pull/39
+    (fetchpatch {
+      name = "relax-versioningit-dependency.patch";
+      url = "https://github.com/QCoDeS/Qcodes_loop/commit/58006d3fb57344ae24dd44bceca98004617b5b57.patch";
+      hash = "sha256-mSlm/Ql8e5xPL73ifxSoVc9+U58AAcAmBkdW5P6zEsg=";
+    })
+  ];
+
   nativeBuildInputs = [
+    setuptools
     versioningit
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rasterio/default.nix b/pkgs/development/python-modules/rasterio/default.nix
index 7410b8029a85a..02cdcbed68cd3 100644
--- a/pkgs/development/python-modules/rasterio/default.nix
+++ b/pkgs/development/python-modules/rasterio/default.nix
@@ -15,6 +15,7 @@
 , matplotlib
 , ipython
 , numpy
+, oldest-supported-numpy
 , packaging
 , pytest-randomly
 , pytestCheckHook
@@ -22,6 +23,7 @@
 , setuptools
 , shapely
 , snuggs
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -41,6 +43,10 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     cython
     gdal
+    numpy
+    oldest-supported-numpy
+    setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/remarshal/default.nix b/pkgs/development/python-modules/remarshal/default.nix
index 738c2f18f661c..5d2e002538c2b 100644
--- a/pkgs/development/python-modules/remarshal/default.nix
+++ b/pkgs/development/python-modules/remarshal/default.nix
@@ -18,23 +18,16 @@
 
 buildPythonPackage rec {
   pname = "remarshal";
-  version = "0.14.0";
+  version = "0.17.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "dbohdan";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256:nTM3jrPf0kGE15J+ZXBIt2+NGSW2a6VlZCKj70n5kHM=";
+    hash = "sha256-FytVq9p7Yo0lS5rHj0crPIpHFjxolW8esSPkj2wLfaI=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "poetry.masonry.api" "poetry.core.masonry.api" \
-      --replace 'PyYAML = "^5.3"' 'PyYAML = "*"' \
-      --replace 'tomlkit = "^0.7"' 'tomlkit = "*"'
-  '';
-
   nativeBuildInputs = [
     poetry-core
   ];
@@ -52,6 +45,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/remarshal-project/remarshal/releases/tag/v${version}";
     description = "Convert between TOML, YAML and JSON";
     license = licenses.mit;
     homepage = "https://github.com/dbohdan/remarshal";
diff --git a/pkgs/development/python-modules/repoze_sphinx_autointerface/default.nix b/pkgs/development/python-modules/repoze_sphinx_autointerface/default.nix
index e98159128247a..073977d1252e3 100644
--- a/pkgs/development/python-modules/repoze_sphinx_autointerface/default.nix
+++ b/pkgs/development/python-modules/repoze_sphinx_autointerface/default.nix
@@ -1,20 +1,31 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pytestCheckHook
 , zope_interface
+, zope_testrunner
 , sphinx
 }:
 
 buildPythonPackage rec {
   pname = "repoze.sphinx.autointerface";
   version = "1.0.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-SGvxQjpGlrkVPkiM750ybElv/Bbd6xSwyYh7RsYOKKE=";
   };
 
-  propagatedBuildInputs = [ zope_interface sphinx ];
+  propagatedBuildInputs = [
+    zope_interface
+    sphinx
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    zope_testrunner
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/repoze/repoze.sphinx.autointerface";
diff --git a/pkgs/development/python-modules/reproject/default.nix b/pkgs/development/python-modules/reproject/default.nix
index 3baf811140f91..00060c08bc2ed 100644
--- a/pkgs/development/python-modules/reproject/default.nix
+++ b/pkgs/development/python-modules/reproject/default.nix
@@ -6,6 +6,7 @@
 , cython
 , fetchPypi
 , numpy
+, oldest-supported-numpy
 , pytest-astropy
 , pytestCheckHook
 , pythonOlder
@@ -25,9 +26,16 @@ buildPythonPackage rec {
     hash = "sha256-OKxPPKcVVrEVUGR8Zaphn7ur9HOuqQKa9gnMo2RQQME=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "cython==" "cython>="
+  '';
+
   nativeBuildInputs = [
     astropy-extension-helpers
     cython
+    numpy
+    oldest-supported-numpy
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/riscv-config/default.nix b/pkgs/development/python-modules/riscv-config/default.nix
index 75dd855af33fb..409c3a0d7ed1f 100644
--- a/pkgs/development/python-modules/riscv-config/default.nix
+++ b/pkgs/development/python-modules/riscv-config/default.nix
@@ -1,5 +1,6 @@
 { buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , lib
 , cerberus
 , pyyaml
@@ -9,6 +10,7 @@
 buildPythonPackage rec {
   pname = "riscv-config";
   version = "3.5.2";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "riscv-software-src";
@@ -17,6 +19,15 @@ buildPythonPackage rec {
     hash = "sha256-K7W6yyqy/2c4WHyOojuvw2P/v7bND5K6WFfTujkofBw=";
   };
 
+  patches = [
+    # Remove when updating to v3.8.0+
+    (fetchpatch {
+      name = "remove-dangling-pip-import.patch";
+      url = "https://github.com/riscv-software-src/riscv-config/commit/f75e7e13fe600b71254b0391be015ec533d3c3ef.patch";
+      hash = "sha256-oVRynBIJevq3UzlMDRh2rVuBJZoEwEYhDma3Bb/QV2E=";
+    })
+  ];
+
   propagatedBuildInputs = [ cerberus pyyaml ruamel-yaml ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/rst2pdf/default.nix b/pkgs/development/python-modules/rst2pdf/default.nix
index 6d6a484255743..6fb44840f5b2f 100644
--- a/pkgs/development/python-modules/rst2pdf/default.nix
+++ b/pkgs/development/python-modules/rst2pdf/default.nix
@@ -2,6 +2,8 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, setuptools-scm
+, wheel
 , docutils
 , importlib-metadata
 , jinja2
@@ -19,18 +21,19 @@
 buildPythonPackage rec {
   pname = "rst2pdf";
   version = "0.101";
-
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-AF8FssEIFHmeY2oVrAPNe85pbmgKWO52yD6ycNNzTSg=";
+    hash = "sha256-AF8FssEIFHmeY2oVrAPNe85pbmgKWO52yD6ycNNzTSg=";
   };
 
   outputs = [ "out" "man" ];
 
   nativeBuildInputs = [
     setuptools
+    setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/scikit-build-core/default.nix b/pkgs/development/python-modules/scikit-build-core/default.nix
index bf0d3b28c9bb7..b1fb11573eb7a 100644
--- a/pkgs/development/python-modules/scikit-build-core/default.nix
+++ b/pkgs/development/python-modules/scikit-build-core/default.nix
@@ -14,7 +14,9 @@
 , pyproject-metadata
 , pytest-subprocess
 , pytestCheckHook
+, setuptools
 , tomli
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -62,6 +64,8 @@ buildPythonPackage rec {
     ninja
     pytest-subprocess
     pytestCheckHook
+    setuptools
+    wheel
   ] ++ passthru.optional-dependencies.pyproject;
 
   disabledTestPaths = [
@@ -74,12 +78,6 @@ buildPythonPackage rec {
     "tests/test_setuptools_pep518.py"
   ];
 
-  # Tries to access ninja.__version__ which our stub doesn't have.
-  # FIXME: remove for next cycle
-  disabledTests = [
-    "test_get_ninja_programs_cmake_module"
-  ];
-
   pythonImportsCheck = [
     "scikit_build_core"
   ];
diff --git a/pkgs/development/python-modules/scikit-misc/default.nix b/pkgs/development/python-modules/scikit-misc/default.nix
index fa35fbd9ed937..2cb24d76b2b9a 100644
--- a/pkgs/development/python-modules/scikit-misc/default.nix
+++ b/pkgs/development/python-modules/scikit-misc/default.nix
@@ -8,6 +8,8 @@
 , pkg-config
 , numpy
 , openblas
+, setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -23,6 +25,9 @@ buildPythonPackage rec {
 
   postPatch = ''
     patchShebangs .
+
+    substituteInPlace pyproject.toml \
+      --replace 'numpy==' 'numpy>='
   '';
 
   nativeBuildInputs = [
@@ -30,7 +35,10 @@ buildPythonPackage rec {
     gfortran
     git
     meson-python
+    numpy
     pkg-config
+    setuptools
+    wheel
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/scim2-filter-parser/default.nix b/pkgs/development/python-modules/scim2-filter-parser/default.nix
index 9b140ae6fed5e..f3d37df7735cd 100644
--- a/pkgs/development/python-modules/scim2-filter-parser/default.nix
+++ b/pkgs/development/python-modules/scim2-filter-parser/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , django
 , sly
@@ -20,6 +21,15 @@ buildPythonPackage rec {
     hash = "sha256-QEPTYpWlRPWO6Evyt4zoqUST4ousF67GmiOpD7WUqcI=";
   };
 
+  patches = [
+    # https://github.com/15five/scim2-filter-parser/pull/43
+    (fetchpatch {
+      name = "replace-poetry-with-poetry-core.patch";
+      url = "https://github.com/15five/scim2-filter-parser/commit/675d85f3a3ff338e96a408827d64d9e893fa5255.patch";
+      hash = "sha256-PjJH1S5CDe/BMI0+mB34KdpNNcHfexBFYBmHolsWH4o=";
+    })
+  ];
+
   nativeBuildInputs = [
     poetry-core
   ];
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index d51c049589ee6..e58a165f5ccab 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -7,8 +7,6 @@
 , python
 , pythonOlder
 , buildPythonPackage
-, pypaBuildHook
-, pipInstallHook
 , cython
 , gfortran
 , meson-python
@@ -33,11 +31,9 @@ let
   #
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
-  # Even if you do update these hashes manually, don't change their base
-  # (base16 or base64), because the update script uses sed regexes to replace
-  # them with the updated hashes.
-  version = "1.11.1";
-  srcHash = "sha256-bgnYXe3EhzL7+Gfriz1cXCl2eYQJ8zF+rcIwHyZR8bQ=";
+  # The update script uses sed regexes to replace them with the updated hashes.
+  version = "1.11.2";
+  srcHash = "sha256-7FE740/yKUXtujVX60fQB/xvCZFfV69FRihvSi6+UWo=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
@@ -59,7 +55,7 @@ let
   '';
 in buildPythonPackage {
   inherit pname version;
-  format = "other";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "scipy";
@@ -80,12 +76,22 @@ in buildPythonPackage {
     })
   ];
 
+  # Relax deps a bit
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "pybind11>=2.10.4,<2.11.0" "pybind11>=2.10.4,<2.12.0"
+      --replace 'numpy==' 'numpy>=' \
+      --replace "pybind11>=2.10.4,<2.11.0" "pybind11>=2.10.4,<2.12.0" \
+      --replace 'wheel<0.41.0' 'wheel'
   '';
 
-  nativeBuildInputs = [ pypaBuildHook pipInstallHook cython gfortran meson-python pythran pkg-config wheel ];
+  nativeBuildInputs = [
+    cython
+    gfortran
+    meson-python
+    pythran
+    pkg-config
+    wheel
+  ];
 
   buildInputs = [
     blas
@@ -99,14 +105,13 @@ in buildPythonPackage {
 
   propagatedBuildInputs = [ numpy ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [ nose pytest pytest-xdist ];
 
   doCheck = !(stdenv.isx86_64 && stdenv.isDarwin);
 
   preConfigure = ''
-    # Relax deps a bit
-    substituteInPlace pyproject.toml \
-      --replace 'numpy==' 'numpy>='
     # Helps parallelization a bit
     export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
     # We download manually the datasets and this variable tells the pooch
diff --git a/pkgs/development/python-modules/scipy/update.sh b/pkgs/development/python-modules/scipy/update.sh
index b0d6e2da4f41d..c6b3dca491864 100755
--- a/pkgs/development/python-modules/scipy/update.sh
+++ b/pkgs/development/python-modules/scipy/update.sh
@@ -16,10 +16,12 @@ if grep -q 'version = "'$version $fname; then
     echo "Current version $version is the latest available, will update only datasets' hashes (don't take long)"
 else
     echoerr got version $version
-    sed -i -E 's/(version = ).*=/\1'$version'/g' $fname
+    sed -i -E 's/(version = ").*(";)/\1'$version'\2/g' $fname
+    # Verify the sed command above did not fail
+    grep -q $version $fname
     # Update srcHash
-    srcHash='"sha256-'$(nix-prefetch-github scipy scipy --rev v${version} --fetch-submodules | jq --raw-output .sha256)'"'
-    sed -i 's/srcHash = .*=";/srcHash = '$srcHash';/g' $fname
+    srcHash="$(nix-prefetch-github scipy scipy --rev v${version} --fetch-submodules | jq --raw-output .hash)"
+    sed -i -E 's#(srcHash = ").*(";)#\1'$srcHash'\2#g' $fname
 fi
 
 for d in $datasets; do
diff --git a/pkgs/development/python-modules/scramp/default.nix b/pkgs/development/python-modules/scramp/default.nix
index 954a95c94cd8a..aa6013589cd33 100644
--- a/pkgs/development/python-modules/scramp/default.nix
+++ b/pkgs/development/python-modules/scramp/default.nix
@@ -7,6 +7,7 @@
 , pytestCheckHook
 , pythonOlder
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -25,6 +26,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
@@ -40,6 +42,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     # Upstream uses versioningit to set the version
+    sed -i "/versioningit >=/d" pyproject.toml
     sed -i '/^name =.*/a version = "${version}"' pyproject.toml
     sed -i "/dynamic =/d" pyproject.toml
   '';
diff --git a/pkgs/development/python-modules/setupmeta/default.nix b/pkgs/development/python-modules/setupmeta/default.nix
index ef031de983472..258f958ce03f3 100644
--- a/pkgs/development/python-modules/setupmeta/default.nix
+++ b/pkgs/development/python-modules/setupmeta/default.nix
@@ -4,10 +4,12 @@
 , git
 , mock
 , pep440
+, pip
 , pytestCheckHook
 , pythonOlder
 , setuptools-scm
 , six
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -30,12 +32,14 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
+    wheel
   ];
 
   nativeCheckInputs = [
     git
     mock
     pep440
+    pip
     pytestCheckHook
     six
   ];
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index c851cef24b308..ad7638f3cb38b 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -1,73 +1,36 @@
 { stdenv
+, lib
 , buildPythonPackage
 , fetchFromGitHub
 , python
-, bootstrapped-pip
-, lib
-, pipInstallHook
-, setuptoolsBuildHook
+, wheel
 }:
 
-let
+buildPythonPackage rec {
   pname = "setuptools";
-  version = "67.4.0";
-
-  # Create an sdist of setuptools
-  sdist = stdenv.mkDerivation rec {
-    name = "${pname}-${version}-sdist.tar.gz";
-
-    src = fetchFromGitHub {
-      owner = "pypa";
-      repo = pname;
-      rev = "refs/tags/v${version}";
-      hash = "sha256-QDHycUFA2VRUE9alan8rF0efZTNV3Jt0CskjkCc+in0=";
-      name = "${pname}-${version}-source";
-    };
-
-    patches = [
-      ./tag-date.patch
-      ./setuptools-distutils-C++.patch
-    ];
-
-    buildPhase = ''
-      ${python.pythonForBuild.interpreter} setup.py egg_info
-      ${python.pythonForBuild.interpreter} setup.py sdist --formats=gztar
-
-      # Here we untar the sdist and retar it in order to control the timestamps
-      # of all the files included
-      tar -xzf dist/${pname}-${version}.post0.tar.gz -C dist/
-      tar -czf dist/${name} -C dist/ --mtime="@$SOURCE_DATE_EPOCH" --sort=name ${pname}-${version}.post0
-    '';
-
-    installPhase = ''
-      echo "Moving sdist..."
-      mv dist/${name} $out
-    '';
+  version = "68.0.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = "setuptools";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Ew/DpI5XsYMB4kBfkFeeB5wv5cjx4oYTddZCWLgBHBs=";
   };
-in buildPythonPackage {
-  inherit pname version;
-  # Because of bootstrapping we don't use the setuptoolsBuildHook that comes with format="setuptools" directly.
-  # Instead, we override it to remove setuptools to avoid a circular dependency.
-  # The same is done for pip and the pipInstallHook.
-  format = "other";
 
-  src = sdist;
+  patches = [
+    ./tag-date.patch
+    ./setuptools-distutils-C++.patch
+  ];
 
   nativeBuildInputs = [
-    bootstrapped-pip
-    (pipInstallHook.override{pip=null;})
-    (setuptoolsBuildHook.override{setuptools=null; wheel=null;})
+    wheel
   ];
 
   preBuild = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
     export SETUPTOOLS_INSTALL_WINDOWS_SPECIFIC_FILES=0
   '';
 
-  pipInstallFlags = [ "--ignore-installed" ];
-
-  # Adds setuptools to nativeBuildInputs causing infinite recursion.
-  catchConflicts = false;
-
   # Requires pytest, causing infinite recursion.
   doCheck = false;
 
@@ -77,7 +40,6 @@ in buildPythonPackage {
     changelog = "https://setuptools.pypa.io/en/stable/history.html#v${replaceStrings [ "." ] [ "-" ] version}";
     license = with licenses; [ mit ];
     platforms = python.meta.platforms;
-    priority = 10;
     maintainers = teams.python.members;
   };
 }
diff --git a/pkgs/development/python-modules/socksio/default.nix b/pkgs/development/python-modules/socksio/default.nix
index ad0e8e2e6c07f..fb767db631d87 100644
--- a/pkgs/development/python-modules/socksio/default.nix
+++ b/pkgs/development/python-modules/socksio/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , pythonAtLeast
 , flit-core
@@ -19,6 +20,15 @@ buildPythonPackage {
     hash = "sha256-+IvrPaW1w4uYkEad5n0MsPnUlLeLEGyhhF+WwQuRxKw=";
   };
 
+  patches = [
+    # https://github.com/sethmlarson/socksio/pull/61
+    (fetchpatch {
+      name = "unpin-flit-core.patch";
+      url = "https://github.com/sethmlarson/socksio/commit/5c50fd76e7459bb822ff8f712172a78e21b8dd04.patch";
+      hash = "sha256-VVUzFvF2KCXXkCfCU5xu9acT6OLr+PlQQPeVGONtU4A=";
+    })
+  ];
+
   nativeBuildInputs = [
     flit-core
   ];
diff --git a/pkgs/development/python-modules/soxr/default.nix b/pkgs/development/python-modules/soxr/default.nix
index 7c9251dfd7b6c..20532f4c00fae 100644
--- a/pkgs/development/python-modules/soxr/default.nix
+++ b/pkgs/development/python-modules/soxr/default.nix
@@ -2,9 +2,10 @@
 , buildPythonPackage
 , fetchFromGitHub
 
-# build-sytem
+# build-system
 , cython_3
 , numpy
+, oldest-supported-numpy
 , setuptools
 , setuptools-scm
 , gnutar
@@ -29,12 +30,13 @@ buildPythonPackage rec {
     hash = "sha256-q/K7XlqvDHAna+fqN6iiJ9wD8efsuwHiEfKjXS46jz8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     cython_3
     gnutar
     numpy
+    oldest-supported-numpy
     setuptools
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-spelling/default.nix b/pkgs/development/python-modules/sphinxcontrib-spelling/default.nix
index e5e92b8b038e0..2a8085de7c236 100644
--- a/pkgs/development/python-modules/sphinxcontrib-spelling/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-spelling/default.nix
@@ -5,7 +5,9 @@
 , importlib-metadata
 , sphinx
 , pyenchant
-, pbr
+, setuptools
+, setuptools-scm
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -21,7 +23,9 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pbr
+    setuptools
+    setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/stim/default.nix b/pkgs/development/python-modules/stim/default.nix
index 381676047c1a9..734a3b3c9ff1c 100644
--- a/pkgs/development/python-modules/stim/default.nix
+++ b/pkgs/development/python-modules/stim/default.nix
@@ -11,6 +11,8 @@
 , matplotlib
 , networkx
 , scipy
+, setuptools
+, wheel
 , pandas
 }:
 
@@ -28,9 +30,20 @@ buildPythonPackage rec {
     hash = "sha256-zXWdJjFkf74FCWxyVMF8dx0P8GmUkuHFxUo5wYNU2o0=";
   };
 
+  postPatch = ''
+    # asked to relax this in https://github.com/quantumlib/Stim/issues/623
+    substituteInPlace pyproject.toml \
+      --replace "pybind11==" "pybind11>="
+  '';
+
+  nativeBuildInputs = [
+    pybind11
+    setuptools
+    wheel
+  ];
+
   propagatedBuildInputs = [
     numpy
-    pybind11
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/stravalib/default.nix b/pkgs/development/python-modules/stravalib/default.nix
index d41dcda8aba10..b05e147dcaa98 100644
--- a/pkgs/development/python-modules/stravalib/default.nix
+++ b/pkgs/development/python-modules/stravalib/default.nix
@@ -3,6 +3,8 @@
 , fetchPypi
 , nose
 , setuptools
+, setuptools-scm
+, wheel
 , arrow
 , requests
 , units
@@ -22,6 +24,12 @@ buildPythonPackage rec {
     hash = "sha256-P00oxUz0oVQB969c/N2wpKLe09wtvQWPH4DH4EZUaxc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
   nativeCheckInputs = [
     nose
   ];
@@ -33,7 +41,6 @@ buildPythonPackage rec {
     pint
     pydantic
     pytz
-    setuptools
     six
   ];
 
diff --git a/pkgs/development/python-modules/tornado/4.nix b/pkgs/development/python-modules/tornado/4.nix
index e4f59c148735a..7476a22792eef 100644
--- a/pkgs/development/python-modules/tornado/4.nix
+++ b/pkgs/development/python-modules/tornado/4.nix
@@ -2,6 +2,7 @@
 , unittestCheckHook
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , isPy27
 , pythonAtLeast
 }:
@@ -16,6 +17,14 @@ buildPythonPackage rec {
     sha256 = "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-28370.patch";
+      url = "https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f.patch";
+      hash = "sha256-2dpPHkNThOaZD8T2g1vb/I5WYZ/vy/t690539uprJyc=";
+    })
+  ];
+
   nativeCheckInputs = [ unittestCheckHook ];
 
   # We specify the name of the test files to prevent
diff --git a/pkgs/development/python-modules/tornado/5.nix b/pkgs/development/python-modules/tornado/5.nix
index d3961d06c4059..8ba3a8c073ba2 100644
--- a/pkgs/development/python-modules/tornado/5.nix
+++ b/pkgs/development/python-modules/tornado/5.nix
@@ -2,6 +2,7 @@
 , unittestCheckHook
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , isPy27
 , pythonAtLeast
 }:
@@ -16,6 +17,14 @@ buildPythonPackage rec {
     sha256 = "4e5158d97583502a7e2739951553cbd88a72076f152b4b11b64b9a10c4c49409";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-28370.patch";
+      url = "https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f.patch";
+      hash = "sha256-2dpPHkNThOaZD8T2g1vb/I5WYZ/vy/t690539uprJyc=";
+    })
+  ];
+
   nativeCheckInputs = [ unittestCheckHook ];
 
   # We specify the name of the test files to prevent
diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
index e255e603b9a14..ac57f212d229e 100644
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -3,17 +3,29 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+
+# for passthru.tests
+, distributed
+, jupyter-server
+, jupyterlab
+, matplotlib
+, mitmproxy
+, pytest-tornado
+, pytest-tornasync
+, pyzmq
+, sockjs-tornado
+, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "tornado";
-  version = "6.2.0";
+  version = "6.3.3";
 
   src = fetchFromGitHub {
     owner = "tornadoweb";
     repo = "tornado";
     rev = "v${version}";
-    hash = "sha256-IV0QN3GqoclFo9kWJVc21arypmBkvUClo86Zmt/Gv6E=";
+    hash = "sha256-l9Ce/c2wDSmsySr9yXu5Fl/+63QkQay46aDSUTJmetA=";
   };
 
   nativeCheckInputs = [
@@ -38,6 +50,20 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
+  passthru.tests = {
+    inherit
+      distributed
+      jupyter-server
+      jupyterlab
+      matplotlib
+      mitmproxy
+      pytest-tornado
+      pytest-tornasync
+      pyzmq
+      sockjs-tornado
+      urllib3;
+  };
+
   meta = with lib; {
     description = "A web framework and asynchronous networking library";
     homepage = "https://www.tornadoweb.org/";
diff --git a/pkgs/development/python-modules/tweedledum/default.nix b/pkgs/development/python-modules/tweedledum/default.nix
index af5a65a080379..bc4808a268cb6 100644
--- a/pkgs/development/python-modules/tweedledum/default.nix
+++ b/pkgs/development/python-modules/tweedledum/default.nix
@@ -21,6 +21,11 @@ buildPythonPackage rec {
     hash = "sha256-wgrY5ajaMYxznyNvlD0ul1PFr3W8oV9I/OVsStlZEBM=";
   };
 
+  postPatch = ''
+    sed -i '/\[project\]/a version = "${version}"' pyproject.toml
+    sed -i '/\[project\]/a name = "tweedledum"' pyproject.toml
+  '';
+
   nativeBuildInputs = [ cmake ninja scikit-build ];
   dontUseCmakeConfigure = true;
 
diff --git a/pkgs/development/python-modules/wheel/default.nix b/pkgs/development/python-modules/wheel/default.nix
index 3be508a0ec590..16c6c2dc087d1 100644
--- a/pkgs/development/python-modules/wheel/default.nix
+++ b/pkgs/development/python-modules/wheel/default.nix
@@ -1,21 +1,19 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, bootstrapped-pip
-, setuptools
+, flit-core
 }:
 
 buildPythonPackage rec {
   pname = "wheel";
-  version = "0.38.4";
-  format = "other";
+  version = "0.41.1";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
     rev = version;
-    hash = "sha256-yZLU0t/nz6kfnnoLL15bybOxN4+SJUaTJsCpGffl1QU=";
-    name = "${pname}-${version}-source";
+    hash = "sha256-/EaDJ2zI/ly2BrrGhiZGwiBYDVPYWTki+87UqtCS3bw=";
     postFetch = ''
       cd $out
       mv tests/testdata/unicode.dist/unicodedist/åäö_日本語.py \
@@ -25,16 +23,13 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    bootstrapped-pip
-    setuptools
+    flit-core
   ];
 
   # No tests in archive
   doCheck = false;
-  pythonImportsCheck = [ "wheel" ];
 
-  # We add this flag to ignore the copy installed by bootstrapped-pip
-  pipInstallFlags = [ "--ignore-installed" ];
+  pythonImportsCheck = [ "wheel" ];
 
   meta = with lib; {
     homepage = "https://github.com/pypa/wheel";
diff --git a/pkgs/development/python-modules/xlsx2csv/default.nix b/pkgs/development/python-modules/xlsx2csv/default.nix
index 57d1549ee8674..156fbb9d387a5 100644
--- a/pkgs/development/python-modules/xlsx2csv/default.nix
+++ b/pkgs/development/python-modules/xlsx2csv/default.nix
@@ -2,6 +2,8 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, setuptools-scm
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -16,6 +18,8 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    setuptools-scm
+    wheel
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/xpath-expressions/default.nix b/pkgs/development/python-modules/xpath-expressions/default.nix
index eebd30364e475..97e5e62b01aaf 100644
--- a/pkgs/development/python-modules/xpath-expressions/default.nix
+++ b/pkgs/development/python-modules/xpath-expressions/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , lxml
 , poetry-core
 , pythonOlder
@@ -10,16 +11,25 @@
 buildPythonPackage rec {
   pname = "xpath-expressions";
   version = "1.1.0";
-  disabled = pythonOlder "3.5";
   format = "pyproject";
+  disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0l289iw2zmzxyfi3g2z7b917vmsaz47h5jp871zvykpmpigc632h";
+    hash = "sha256-UAzDXrz1Tr9/OOjKAg/5Std9Qlrnizei8/3XL3hMSFA=";
   };
 
+  patches = [
+    # https://github.com/orf/xpath-expressions/pull/4
+    (fetchpatch {
+      name = "replace-poetry-with-poetry-core.patch";
+      url = "https://github.com/orf/xpath-expressions/commit/3c5900fd6b2d08dd9468707f35ab42072cf75bd3.patch";
+      hash = "sha256-IeV6ncJyt/w2s5TPpbM5a3pljNT6Bp5PIiqgTg2iTRA=";
+    })
+  ];
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -29,12 +39,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # Was fixed upstream but not released
-    substituteInPlace pyproject.toml \
-      --replace "poetry.masonry.api" "poetry.core.masonry.api"
-  '';
-
   pythonImportsCheck = [ "xpath" ];
 
   meta = with lib; {
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 2a9ad50c80441..54842ff641350 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.18";
-  source.sha256 = "sha256-tvfScSHUmHSmnJGU1PjvVWsjkMzuxBY1zPTzxYBp9w4=";
+  version = "2.4.19";
+  source.sha256 = "sha256-M03HlkODhHMv3xm/ovYjdTt+2FFg0Izh8gAJmEzvs2I=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/tools/build-managers/waf/default.nix b/pkgs/development/tools/build-managers/waf/default.nix
index 218783fd4926f..58d3a7d86f42b 100644
--- a/pkgs/development/tools/build-managers/waf/default.nix
+++ b/pkgs/development/tools/build-managers/waf/default.nix
@@ -1,44 +1,72 @@
-{ lib, stdenv, fetchFromGitLab, python3, ensureNewerSourcesForZipFilesHook
+{ lib
+, stdenv
+, fetchFromGitLab
+, ensureNewerSourcesForZipFilesHook
+, python3
 # optional list of extra waf tools, e.g. `[ "doxygen" "pytest" ]`
-, withTools ? null
+, extraTools ? []
 }:
-let
-  wafToolsArg = with lib.strings;
-    optionalString (withTools != null) " --tools=\"${concatStringsSep "," withTools}\"";
-in
-stdenv.mkDerivation rec {
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "waf";
-  version = "2.0.25";
+  version = "2.0.26";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
-    rev = "${pname}-${version}";
-    sha256 = "sha256-wqZEAfGRHhcd7Xm2pQ0FTjZGfuPafRrZAUdpc7ACoEA=";
+    rev = "waf-${finalAttrs.version}";
+    hash = "sha256-AXDMWlwivJ0Xot6iwuIIlbV2Anz6ieghyOI9jA4yrko=";
   };
 
-  nativeBuildInputs = [ python3 ensureNewerSourcesForZipFilesHook ];
+  nativeBuildInputs = [
+    ensureNewerSourcesForZipFilesHook
+    python3
+  ];
+
+  buildInputs = [
+    # waf executable uses `#!/usr/bin/env python`
+    python3
+  ];
 
-  # waf bin has #!/usr/bin/env python
-  buildInputs = [ python3 ];
+  strictDeps = true;
 
   configurePhase = ''
+    runHook preConfigure
+
     python waf-light configure
+
+    runHook postConfigure
   '';
-  buildPhase = ''
-    python waf-light build${wafToolsArg}
+
+  buildPhase = let
+    extraToolsList =
+      lib.optionalString (extraTools != [])
+        "--tools=\"${lib.concatStringsSep "," extraTools}\"";
+  in
+  ''
+    runHook preBuild
+
+    python waf-light build ${extraToolsList}
+
+    runHook postBuild
   '';
+
   installPhase = ''
+    runHook preInstall
+
     install -D waf $out/bin/waf
-  '';
 
-  strictDeps = true;
+    runHook postInstall
+  '';
 
-  meta = with lib; {
-    description = "Meta build system";
-    homepage    = "https://waf.io";
-    license     = licenses.bsd3;
-    platforms   = platforms.all;
-    maintainers = with maintainers; [ vrthra ];
+  meta = {
+    homepage = "https://waf.io";
+    description = "The meta build system";
+    changelog  = "https://gitlab.com/ita1024/waf/blob/${finalAttrs.version}/ChangeLog";
+    license = lib.licenses.bsd3;
+    mainProgram = "waf";
+    maintainers = with lib.maintainers; [ AndersonTorres vrthra ];
+    inherit (python3.meta) platforms;
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
   };
-}
+})
diff --git a/pkgs/development/tools/build-managers/waf/hook.nix b/pkgs/development/tools/build-managers/waf/hook.nix
new file mode 100644
index 0000000000000..7282ed9ebf97c
--- /dev/null
+++ b/pkgs/development/tools/build-managers/waf/hook.nix
@@ -0,0 +1,24 @@
+{ lib
+, stdenv
+, pkgs
+, makeSetupHook
+, waf
+}:
+
+makeSetupHook {
+  name = "waf-setup-hook";
+
+  substitutions = {
+    # Sometimes the upstream provides its own waf file; in order to honor it,
+    # waf is not inserted into propagatedBuildInputs, rather it is inserted
+    # directly
+    inherit waf;
+    crossFlags = lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system)
+      ''--cross-compile "--cross-execute=${stdenv.targetPlatform.emulator pkgs}"'';
+  };
+
+  meta = {
+    description = "A setup hook for using Waf in Nixpkgs";
+    inherit (waf.meta) maintainers platforms broken;
+  };
+} ./setup-hook.sh
diff --git a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh b/pkgs/development/tools/build-managers/waf/setup-hook.sh
index 4d95c28de1f1a..2593b0a9d8088 100644
--- a/pkgs/development/tools/build-managers/wafHook/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/waf/setup-hook.sh
@@ -1,3 +1,5 @@
+# shellcheck shell=bash disable=SC2206
+
 wafConfigurePhase() {
     runHook preConfigure
 
@@ -7,7 +9,7 @@ wafConfigurePhase() {
     fi
 
     if [ -z "${dontAddPrefix:-}" ] && [ -n "$prefix" ]; then
-        wafConfigureFlags="${prefixKey:---prefix=}$prefix $wafConfigureFlags"
+        local prefixFlag="${prefixKey:---prefix=}$prefix"
     fi
 
     if [ -n "${PKG_CONFIG}" ]; then
@@ -15,13 +17,15 @@ wafConfigurePhase() {
     fi
 
     local flagsArray=(
-        "${flagsArray[@]}"
+        $prefixFlag
         $wafConfigureFlags "${wafConfigureFlagsArray[@]}"
         ${configureTargets:-configure}
     )
+
     if [ -z "${dontAddWafCrossFlags:-}" ]; then
         flagsArray+=(@crossFlags@)
     fi
+
     echoCmd 'configure flags' "${flagsArray[@]}"
     python "$wafPath" "${flagsArray[@]}"
 
@@ -38,15 +42,11 @@ wafConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "${dontUseWafConfigure-}" -a -z "${configurePhase-}" ]; then
-    configurePhase=wafConfigurePhase
-fi
-
 wafBuildPhase () {
     runHook preBuild
 
     # set to empty if unset
-    : ${wafFlags=}
+    : "${wafFlags=}"
 
     local flagsArray=(
       ${enableParallelBuilding:+-j ${NIX_BUILD_CORES}}
@@ -61,10 +61,6 @@ wafBuildPhase () {
     runHook postBuild
 }
 
-if [ -z "${dontUseWafBuild-}" -a -z "${buildPhase-}" ]; then
-    buildPhase=wafBuildPhase
-fi
-
 wafInstallPhase() {
     runHook preInstall
 
@@ -85,6 +81,14 @@ wafInstallPhase() {
     runHook postInstall
 }
 
-if [ -z "${dontUseWafInstall-}" -a -z "${installPhase-}" ]; then
+if [ -z "${dontUseWafConfigure-}" ] && [ -z "${configurePhase-}" ]; then
+    configurePhase=wafConfigurePhase
+fi
+
+if [ -z "${dontUseWafBuild-}" ] && [ -z "${buildPhase-}" ]; then
+    buildPhase=wafBuildPhase
+fi
+
+if [ -z "${dontUseWafInstall-}" ] && [ -z "${installPhase-}" ]; then
     installPhase=wafInstallPhase
 fi
diff --git a/pkgs/development/tools/build-managers/wafHook/default.nix b/pkgs/development/tools/build-managers/wafHook/default.nix
deleted file mode 100644
index f0f3a683aab01..0000000000000
--- a/pkgs/development/tools/build-managers/wafHook/default.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{ lib, stdenv, pkgs, makeSetupHook, waf }:
-
-makeSetupHook {
-  name = "waf-hook";
-  substitutions = {
-    inherit waf;
-    crossFlags = lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system)
-      ''--cross-compile "--cross-execute=${stdenv.targetPlatform.emulator pkgs}"'';
-  };
-} ./setup-hook.sh
diff --git a/pkgs/development/tools/misc/blackfire/php-probe.nix b/pkgs/development/tools/misc/blackfire/php-probe.nix
index 1b9b0f940cc54..9774200e9b3d6 100644
--- a/pkgs/development/tools/misc/blackfire/php-probe.nix
+++ b/pkgs/development/tools/misc/blackfire/php-probe.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
     autoPatchelfHook
   ];
 
-  setSourceRoot = "sourceRoot=`pwd`";
+  sourceRoot = ".";
 
   dontUnpack = true;
 
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
index b212fffc1b1c6..176881caeed1f 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
@@ -2505,8 +2505,14 @@
     "setuptools"
   ],
   "build": [
-    "flit-core",
-    "setuptools"
+    {
+      "buildSystem": "setuptools",
+      "until": "0.10.0"
+    },
+    {
+      "buildSystem": "flit-core",
+      "from": "0.10.0"
+    }
   ],
   "buildbot": [
     "setuptools"
@@ -5812,11 +5818,7 @@
     "setuptools"
   ],
   "flit": [
-    "flit-core",
-    "setuptools"
-  ],
-  "flit-core": [
-    "setuptools"
+    "flit-core"
   ],
   "flit-scm": [
     "flit-core",
@@ -7540,8 +7542,7 @@
     "setuptools"
   ],
   "installer": [
-    "flit-core",
-    "setuptools"
+    "flit-core"
   ],
   "insteon-frontend-home-assistant": [
     "setuptools"
@@ -10863,8 +10864,24 @@
     "setuptools"
   ],
   "packaging": [
-    "flit-core",
-    "setuptools"
+    {
+      "buildSystem": "setuptools",
+      "until": "20.4"
+    },
+    {
+      "buildSystem": "flit-core",
+      "from": "20.4",
+      "until": "20.8"
+    },
+    {
+      "buildSystem": "setuptools",
+      "from": "20.8",
+      "until": "22.0"
+    },
+    {
+      "buildSystem": "flit-core",
+      "from": "22.0"
+    }
   ],
   "packbits": [
     "setuptools"
@@ -18088,8 +18105,14 @@
     "poetry"
   ],
   "tomli": [
-    "flit-core",
-    "setuptools"
+    {
+      "buildSystem": "poetry-core",
+      "until": "1.0.2"
+    },
+    {
+      "buildSystem": "flit-core",
+      "from": "1.0.2"
+    }
   ],
   "tomli-w": [
     "flit-core",
@@ -19331,7 +19354,14 @@
     "setuptools"
   ],
   "wheel": [
-    "setuptools"
+    {
+      "buildSystem": "setuptools",
+      "until": "0.40.0"
+    },
+    {
+      "buildSystem": "flit-core",
+      "from": "0.40.0"
+    }
   ],
   "wheel-filename": [
     "setuptools"
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
index 14338423ec390..d96d920c70940 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -2738,15 +2738,12 @@ lib.composeManyExtensions [
         }
       );
 
-      wheel = ((
-        pkgs.python3.pkgs.override {
-          python = self.python;
+      wheel = if self.python.isPy2 then
+        super.wheel.override {
+          inherit (self) bootstrapped-pip;
         }
-      ).wheel.override {
-        inherit (self) buildPythonPackage bootstrapped-pip setuptools;
-      }).overrideAttrs (old: {
-        inherit (super.wheel) pname name version src;
-      });
+      else
+        super.wheel;
 
       zipp = if super.zipp == null then null else
       super.zipp.overridePythonAttrs (
@@ -2757,20 +2754,6 @@ lib.composeManyExtensions [
         }
       );
 
-      packaging =
-        let
-          old = super.packaging;
-        in
-        # From 20.5 until 20.7, packaging used flit for packaging (heh)
-          # See https://github.com/pypa/packaging/pull/352 and https://github.com/pypa/packaging/pull/367
-        if (lib.versionAtLeast old.version "20.5" && lib.versionOlder old.version "20.8") then
-          addBuildSystem
-            {
-              inherit self;
-              drv = old;
-              attr = "flit-core";
-            } else old;
-
       psutil = super.psutil.overridePythonAttrs (
         old: {
           buildInputs = (old.buildInputs or [ ]) ++
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 6542dacbe9e75..8780b8892fa1f 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.1.0";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-UH+qOKKQdWXQZZMtrihbWmKaUoSy1NciGh9UTtS/W5E=";
+    hash = "sha256-uaDTL6dfH+zqjMbLtgLaZRe91mDuyKA0afw+3LFF+1U=";
   };
 
-  cargoHash = "sha256-EGgVPRaofia+AwXSr6X4Aa8jbk5qDkXg1XvMoEp0qMQ=";
+  cargoHash = "sha256-DF8O3YrHr0tBStnmnUUUF4QaZcoXYCCweZoEig4etQA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 63ff07b4ce545..0a476e346ceda 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "2023.3.rc1";
+  version = "1.3.261.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
-    rev = "v${version}";
-    hash = "sha256-HV7jNvgTRRGnhurtT5pf5f5gzUOmr3iWNcDc8TE4ICQ=";
+    rev = "sdk-${version}";
+    hash = "sha256-K7cv0mMNrXYOlJsxAPwz3rVX5FnsnBNvaU33k9hYnQc=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/tools/tabnine/default.nix b/pkgs/development/tools/tabnine/default.nix
index fcd00726ba775..4426e2bbf81fc 100644
--- a/pkgs/development/tools/tabnine/default.nix
+++ b/pkgs/development/tools/tabnine/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
 
   # Work around the "unpacker appears to have produced no directories"
   # case that happens when the archive doesn't have a subdirectory.
-  setSourceRoot = "sourceRoot=`pwd`";
+  sourceRoot = ".";
 
   nativeBuildInputs = [ unzip ];
 
diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 2d500eb9eba4a..377f87b164531 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -14,33 +14,16 @@
 , libXrandr
 , spirv-headers
 , vulkan-headers
+, vulkan-utility-libraries
 , wayland
 }:
 
 let
   robin-hood-hashing = callPackage ./robin-hood-hashing.nix {};
-
-  # Current VVL version requires a newer spirv-headers than the latest release tag.
-  # This should hopefully not be too common and the override should be removed after
-  # the next SPIRV headers release.
-  # FIXME: if this ever becomes common, figure out a way to pull revisions directly
-  # from upstream known-good.json
-  spirv-headers' = spirv-headers.overrideAttrs(_: {
-    version = "unstable-2023-04-27";
-
-    src = fetchFromGitHub {
-      owner = "KhronosGroup";
-      repo = "SPIRV-Headers";
-      rev = "7f1d2f4158704337aff1f739c8e494afc5716e7e";
-      hash = "sha256-DHOYIZQqP5uWDYdb+vePpMBaQDOCB5Pcg8wPBMF8itk=";
-    };
-
-    postPatch = "";
-  });
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.254";
+  version = "1.3.261";
 
   # If we were to use "dev" here instead of headers, the setupHook would be
   # placed in that output instead of "out".
@@ -51,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "v${version}";
-    hash = "sha256-hh/lCXSKq8xmygVsFFOGu79DvBvBPcc1l1e5wQskK7M=";
+    hash = "sha256-4kE3pkyYu6hnbv19fHhON+hI2HU4vLm31tNlp5fhndM=";
   };
 
   nativeBuildInputs = [
@@ -68,12 +51,13 @@ stdenv.mkDerivation rec {
     libffi
     libxcb
     vulkan-headers
+    vulkan-utility-libraries
     wayland
   ];
 
   cmakeFlags = [
     "-DGLSLANG_INSTALL_DIR=${glslang}"
-    "-DSPIRV_HEADERS_INSTALL_DIR=${spirv-headers'}"
+    "-DSPIRV_HEADERS_INSTALL_DIR=${spirv-headers}"
     "-DROBIN_HOOD_HASHING_INSTALL_DIR=${robin-hood-hashing}"
     "-DBUILD_LAYER_SUPPORT_FILES=ON"
     "-DPKG_CONFIG_EXECUTABLE=${pkg-config}/bin/pkg-config"
diff --git a/pkgs/games/qgo/default.nix b/pkgs/games/qgo/default.nix
index cc28ebc63f3c2..ec7986c6a36ba 100644
--- a/pkgs/games/qgo/default.nix
+++ b/pkgs/games/qgo/default.nix
@@ -4,7 +4,7 @@
 , qmake
 , qtbase
 , qtmultimedia
-, qttranslations
+, qttools
 }:
 
 mkDerivation {
@@ -41,6 +41,6 @@ mkDerivation {
   postPatch = ''
     sed -i 's|@out@|'"''${out}"'|g' src/src.pro src/defines.h
   '';
-  nativeBuildInputs = [ qmake ];
-  buildInputs = [ qtbase qtmultimedia qttranslations ];
+  nativeBuildInputs = [ qmake qttools ];
+  buildInputs = [ qtbase qtmultimedia ];
 }
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index 7d5b622eaa813..21ed258e2be7c 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "${prefix}jack2";
-  version = "1.9.19";
+  version = "1.9.22";
 
   src = fetchFromGitHub {
     owner = "jackaudio";
     repo = "jack2";
     rev = "v${finalAttrs.version}";
-    sha256 = "01s8i64qczxqawgrzrw19asaqmcspf5l2h3203xzg56wnnhhzcw7";
+    sha256 = "sha256-Cslfys5fcZDy0oee9/nM5Bd1+Cg4s/ayXjJJOSQCL4E=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/cf-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk-11.0/cf-setup-hook.sh
index 3b08c51d196e4..b64eb95f2ded7 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/cf-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/cf-setup-hook.sh
@@ -1,6 +1,6 @@
 forceLinkCoreFoundationFramework() {
   NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks${NIX_CFLAGS_COMPILE:+ }${NIX_CFLAGS_COMPILE-}"
-  NIX_LDFLAGS+=" @out@/Library/Frameworks/CoreFoundation.framework/CoreFoundation"
+  NIX_LDFLAGS+=" @out@/Library/Frameworks/CoreFoundation.framework/CoreFoundation.tbd"
 }
 
 preConfigureHooks+=(forceLinkCoreFoundationFramework)
diff --git a/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
index bbf9625e65577..5d0f58f48b481 100644
--- a/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
@@ -3,7 +3,7 @@ linkSystemCoreFoundationFramework() {
   # gross! many symbols (such as _OBJC_CLASS_$_NSArray) are defined in system CF, but not
   # in the opensource release
   # if the package needs private headers, we assume they also want to link with system CF
-  NIX_LDFLAGS+=" @out@/Library/Frameworks/CoreFoundation.framework/CoreFoundation"
+  NIX_LDFLAGS+=" @out@/Library/Frameworks/CoreFoundation.framework/CoreFoundation.tbd"
 }
 
 preConfigureHooks+=(linkSystemCoreFoundationFramework)
diff --git a/pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix b/pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix
index 824615a4baf2e..4445851894340 100644
--- a/pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation rec {
 
   nativeBuildInputs = [ cabextract ];
 
-  sourceRoot = "./.";
+  sourceRoot = ".";
 
   unpackCmd = ''
     cabextract -F FW_ACC_00U.bin ${src}
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index af8cbf0aa829d..6c7afffd9cec8 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.372";
+  version = "0.373";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-XC0U5UsOjTveRj1b0e1TBlYv/tKebSOu/YEGt/rmAHw=";
+    hash = "sha256-KXZodSvY4Szt/gp0iRkx+ngziCaUYvkjnkvjwPj3OwI=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index e69ec1fb324da..b9367a68728d0 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, zlib, shadow
+{ lib, stdenv, fetchurl, pkg-config, zlib, shadow
 , capabilitiesSupport ? stdenv.isLinux
 , libcap_ng
 , libxcrypt
@@ -19,35 +19,15 @@
 
 stdenv.mkDerivation rec {
   pname = "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
-  version = "2.39";
+  version = "2.39.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/util-linux-${version}.tar.xz";
-    hash = "sha256-MrMKM2zakDGC7WH+s+m5CLdipeZv4U5D77iNNxYgdcs=";
+    hash = "sha256-iQro/4ECR70Z4nTfdug3HSAs2gGtJ3aBsOqI7qoAKGs=";
   };
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
-
-    # FIXME: backport mount fixes for older kernels, remove in next release
-    (fetchpatch {
-      url = "https://github.com/util-linux/util-linux/commit/f94a7760ed7ce81389a6059f020238981627a70d.diff";
-      hash = "sha256-UorqDeECK8pBePkmpo2x90p/jP3rCMshyPCyijSX1wo=";
-    })
-    (fetchpatch {
-      url = "https://github.com/util-linux/util-linux/commit/1bd85b64632280d6bf0e86b4ff29da8b19321c5f.diff";
-      hash = "sha256-dgu4de5ul/si7Vzwe8lr9NvsdI1CWfDQKuqvARaY6sE=";
-    })
-
-    # FIXME: backport bcache detection fixes, remove in next release
-    (fetchpatch {
-      url = "https://github.com/util-linux/util-linux/commit/158639a2a4c6e646fd4fa0acb5f4743e65daa415.diff";
-      hash = "sha256-9F1OQFxKuI383u6MVy/UM15B6B+tkZFRwuDbgoZrWME=";
-    })
-    (fetchpatch {
-      url = "https://github.com/util-linux/util-linux/commit/00a19fb8cdfeeae30a6688ac6b490e80371b2257.diff";
-      hash = "sha256-w1S6IKSoL6JhVew9t6EemNRc/nrJQ5oMqFekcx0kno8=";
-    })
   ];
 
   # We separate some of the utilities into their own outputs. This
diff --git a/pkgs/os-specific/linux/xone/default.nix b/pkgs/os-specific/linux/xone/default.nix
index da0ae54e560f8..104b7952f2be2 100644
--- a/pkgs/os-specific/linux/xone/default.nix
+++ b/pkgs/os-specific/linux/xone/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
 
   setSourceRoot = ''
-    export sourceRoot=$(pwd)/source
+    export sourceRoot=$(pwd)/${src.name}
   '';
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/xpadneo/default.nix b/pkgs/os-specific/linux/xpadneo/default.nix
index bb47bf03f58a7..e470fa66adf35 100644
--- a/pkgs/os-specific/linux/xpadneo/default.nix
+++ b/pkgs/os-specific/linux/xpadneo/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   setSourceRoot = ''
-    export sourceRoot=$(pwd)/source/hid-xpadneo/src
+    export sourceRoot=$(pwd)/${finalAttrs.src.name}/hid-xpadneo/src
   '';
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 96bce463bcb22..c6f7703718ed6 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -49,6 +49,7 @@ let
         };
         postPatch = ''
           substituteInPlace pyproject.toml \
+            --replace "poetry>=1.0.0b1" "poetry-core" \
             --replace "poetry.masonry" "poetry.core.masonry"
         '';
         propagatedBuildInputs = oldAttrs.propagatedBuildInputs ++ [
@@ -324,6 +325,7 @@ in python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python.pkgs; [
     setuptools
+    wheel
   ];
 
   # copy tests early, so patches apply as they would to the git repo
@@ -368,6 +370,9 @@ in python.pkgs.buildPythonApplication rec {
       ) relaxedConstraints)}
       pyproject.toml
     substituteInPlace tests/test_config.py --replace '"/usr"' '"/build/media"'
+
+    sed -i 's/setuptools[~=]/setuptools>/' pyproject.toml
+    sed -i 's/wheel[~=]/wheel>/' pyproject.toml
   '';
 
   propagatedBuildInputs = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/intents.nix b/pkgs/servers/home-assistant/intents.nix
index 0255d97da6b6e..0d4caaea8b39d 100644
--- a/pkgs/servers/home-assistant/intents.nix
+++ b/pkgs/servers/home-assistant/intents.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
-, setuptools
 
 # build
 , hassil
@@ -11,6 +10,8 @@
 , regex
 , voluptuous
 , python
+, setuptools
+, wheel
 
 # tests
 , pytest-xdist
@@ -32,12 +33,17 @@ buildPythonPackage rec {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace 'requires = ["setuptools~=62.3", "wheel~=0.37.1"]' 'requires = ["setuptools", "wheel"]'
+  '';
+
   nativeBuildInputs = [
     hassil
     jinja2
     pyyaml
     regex
     setuptools
+    wheel
     voluptuous
   ];
 
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index ab7d92aef18cc..adf8063f42516 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -36,6 +36,11 @@ python3.pkgs.buildPythonApplication rec {
     # Remove setuptools_rust from runtime dependencies
     # https://github.com/matrix-org/synapse/blob/v1.69.0/pyproject.toml#L177-L185
     sed -i '/^setuptools_rust =/d' pyproject.toml
+
+    # Remove version pin on build dependencies. Upstream does this on purpose to
+    # be extra defensive, but we don't want to deal with updating this
+    sed -i 's/"poetry-core>=\([0-9.]*\),<=[0-9.]*"/"poetry-core>=\1"/' pyproject.toml
+    sed -i 's/"setuptools_rust>=\([0-9.]*\),<=[0-9.]*"/"setuptools_rust>=\1"/' pyproject.toml
   '';
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/servers/matrix-synapse/plugins/mjolnir-antispam.nix b/pkgs/servers/matrix-synapse/plugins/mjolnir-antispam.nix
index e1a9f72859207..d1ab9ab538b3d 100644
--- a/pkgs/servers/matrix-synapse/plugins/mjolnir-antispam.nix
+++ b/pkgs/servers/matrix-synapse/plugins/mjolnir-antispam.nix
@@ -11,7 +11,7 @@ buildPythonPackage rec {
     sha256 = "sha256-/vnojWLpu/fktqPUhAdL1QTESxDwFrBVYAkyF79Fj9w=";
   };
 
-  sourceRoot = "./${src.name}/synapse_antispam";
+  sourceRoot = "${src.name}/synapse_antispam";
 
   buildInputs = [ matrix-synapse-unwrapped ];
 
diff --git a/pkgs/servers/search/elasticsearch/plugins.nix b/pkgs/servers/search/elasticsearch/plugins.nix
index 8c2ff568df317..c23b5ad7a2bd2 100644
--- a/pkgs/servers/search/elasticsearch/plugins.nix
+++ b/pkgs/servers/search/elasticsearch/plugins.nix
@@ -21,7 +21,7 @@ let
       dontUnpack = true;
       # Work around the "unpacker appears to have produced no directories"
       # case that happens when the archive doesn't have a subdirectory.
-      setSourceRoot = "sourceRoot=$(pwd)";
+      sourceRoot = ".";
       nativeBuildInputs = [ unzip ];
       meta = a.meta // {
         platforms = elasticsearch.meta.platforms;
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_1.nix b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
index 40a00313639bd..f5de11c7cc110 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_1.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
@@ -1,6 +1,6 @@
 { callPackage, ... } @ args:
 
 callPackage ./. (args // {
-  version = "3.1.13";
-  sha256 = "0xb8fiissblxb319y5ifqqp86zblwis789ipb753pcb4zpnsaw82";
+  version = "3.1.21";
+  hash = "sha256-PovyQvomT8+vGWS39/QjLauiGkSiuqKQpTrSXdyVyow=";
 })
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_2.nix b/pkgs/servers/sql/mariadb/connector-c/3_2.nix
index 1e9884eb7333f..d9ef5d8966fec 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_2.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_2.nix
@@ -1,6 +1,6 @@
 { callPackage, ... } @ args:
 
 callPackage ./. (args // {
-  version = "3.2.5";
-  sha256 = "0w0fimdiiqrrm012iflz8l4rnafryq7y0qqijzxn7nwzxhm9jsr9";
+  version = "3.2.7";
+  hash = "sha256-nXGWJI5ml8Ccc+Fz/psoIEX1XsnXrnQ8HrrQi56lbdo=";
 })
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_3.nix b/pkgs/servers/sql/mariadb/connector-c/3_3.nix
new file mode 100644
index 0000000000000..ec70d9998283f
--- /dev/null
+++ b/pkgs/servers/sql/mariadb/connector-c/3_3.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./. (args // {
+  version = "3.3.5";
+  hash = "sha256-ynLrJvbbK++nfkj/lm9xvNPLRLM72Lu4ELZebQEcHlw=";
+})
diff --git a/pkgs/servers/sql/mariadb/connector-c/default.nix b/pkgs/servers/sql/mariadb/connector-c/default.nix
index dbf8e36e9e7d2..7a175620c7cbf 100644
--- a/pkgs/servers/sql/mariadb/connector-c/default.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/default.nix
@@ -1,18 +1,21 @@
 { lib, stdenv, fetchurl, cmake
-, curl, openssl, zlib
+, curl, openssl, zlib, zstd
 , libiconv
-, version, sha256, ...
+, version, hash, ...
 }:
 
 with lib;
 
-stdenv.mkDerivation {
+let
+  isVer33 = versionAtLeast version "3.3";
+
+in stdenv.mkDerivation {
   pname = "mariadb-connector-c";
   inherit version;
 
   src = fetchurl {
     url = "https://downloads.mariadb.com/Connectors/c/connector-c-${version}/mariadb-connector-c-${version}-src.tar.gz";
-    inherit sha256;
+    inherit hash;
   };
 
   outputs = [ "out" "dev" ];
@@ -26,8 +29,11 @@ stdenv.mkDerivation {
 
   postPatch = ''
     substituteInPlace mariadb_config/mariadb_config.c.in \
-      --replace '-I%s/@INSTALL_INCLUDEDIR@' "-I$dev/include" \
-      --replace '-L%s/@INSTALL_LIBDIR@' "-L$out/lib/mariadb"
+      --replace '#define INCLUDE "-I%s/@INSTALL_INCLUDEDIR@ -I%s/@INSTALL_INCLUDEDIR@/mysql"' "#define INCLUDE \"-I$dev/include -I$dev/include/mysql\"" \
+      --replace '#define LIBS    "-L%s/@INSTALL_LIBDIR@/ -lmariadb"' "#define LIBS    \"-L$out/lib/mariadb -lmariadb\"" \
+      --replace '#define PKG_LIBDIR "%s/@INSTALL_LIBDIR@"' "#define PKG_LIBDIR \"$out/lib/mariadb\"" \
+      --replace '#define PLUGIN_DIR "%s/@INSTALL_PLUGINDIR@"' "#define PLUGIN_DIR \"$out/lib/mariadb/plugin\"" \
+      --replace '#define PKG_PLUGINDIR "%s/@INSTALL_PLUGINDIR@"' "#define PKG_PLUGINDIR \"$out/lib/mariadb/plugin\""
   '' + lib.optionalString stdenv.hostPlatform.isStatic ''
     # Disables all dynamic plugins
     substituteInPlace cmake/plugins.cmake \
@@ -43,7 +49,7 @@ stdenv.mkDerivation {
   '';
 
   nativeBuildInputs = [ cmake ];
-  propagatedBuildInputs = [ curl openssl zlib ];
+  propagatedBuildInputs = [ curl openssl zlib ] ++ optional isVer33 zstd;
   buildInputs = [ libiconv ];
 
   postInstall = ''
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 7fe5f67b14de8..7c948afc4dac3 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -933,7 +933,7 @@ _allFlags() {
     export system pname name version
     for varName in $(awk 'BEGIN { for (v in ENVIRON) if (v ~ /^[a-z][a-zA-Z0-9_]*$/) print v }'); do
         if (( "${NIX_DEBUG:-0}" >= 1 )); then
-            printf "@%s@ -> %q\n" "${varName}" "${!varName}"
+            printf "@%s@ -> %q\n" "${varName}" "${!varName}" >&2
         fi
         args+=("--subst-var" "$varName")
     done
diff --git a/pkgs/tools/archivers/unar/default.nix b/pkgs/tools/archivers/unar/default.nix
index 2fdaf2def590d..ee1693ee18e25 100644
--- a/pkgs/tools/archivers/unar/default.nix
+++ b/pkgs/tools/archivers/unar/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
 
   dontConfigure = true;
 
-  sourceRoot = "./${src.name}/XADMaster";
+  sourceRoot = "${src.name}/XADMaster";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/tools/audio/stt/default.nix b/pkgs/tools/audio/stt/default.nix
index 8697cb62f5b7f..9f3fcf05b5fad 100644
--- a/pkgs/tools/audio/stt/default.nix
+++ b/pkgs/tools/audio/stt/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     url = "https://github.com/coqui-ai/STT/releases/download/v${version}/native_client.tflite.Linux.tar.xz";
     hash = "sha256-RVYc64pLYumQoVUEFZdxfUUaBMozaqgD0h/yiMaWN90=";
   };
-  setSourceRoot = "sourceRoot=`pwd`";
+
+  sourceRoot = ".";
 
   nativeBuildInputs = [
     autoPatchelfHook
diff --git a/pkgs/tools/backup/gphotos-sync/default.nix b/pkgs/tools/backup/gphotos-sync/default.nix
index 707828fae7138..27caf6df4db00 100644
--- a/pkgs/tools/backup/gphotos-sync/default.nix
+++ b/pkgs/tools/backup/gphotos-sync/default.nix
@@ -21,7 +21,19 @@ python3.pkgs.buildPythonApplication rec {
     ./skip-network-tests.patch
   ];
 
-  nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
+  # Consider fixing this upstream by following up on:
+  # https://github.com/gilesknap/gphotos-sync/issues/441
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "setuptools<57" "setuptools" \
+      --replace "wheel==0.33.1" "wheel"
+  '';
+
+  nativeBuildInputs = with python3.pkgs; [
+    pythonRelaxDepsHook
+    setuptools
+    wheel
+  ];
 
   pythonRelaxDeps = [
     "psutil"
diff --git a/pkgs/tools/graphics/spirv-cross/default.nix b/pkgs/tools/graphics/spirv-cross/default.nix
index 265c6365d6fbf..1bf20910cf54a 100644
--- a/pkgs/tools/graphics/spirv-cross/default.nix
+++ b/pkgs/tools/graphics/spirv-cross/default.nix
@@ -2,17 +2,22 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.3.250.0";
+  version = "1.3.261.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "sdk-${finalAttrs.version}";
-    hash = "sha256-H4UkR/EiBWpdhdPHNBrdRkl4eN8kD9gEOzpnwfFSdpI=";
+    hash = "sha256-abVqLovvcKBJhGhSCbyD5mc1DSfvh4TWssGxi52ukQ8=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
 
+  postFixup = ''
+    substituteInPlace $out/lib/pkgconfig/*.pc \
+      --replace '=''${prefix}//' '=/'
+  '';
+
   meta = with lib; {
     description = "A tool designed for parsing and converting SPIR-V to other shader languages";
     homepage = "https://github.com/KhronosGroup/SPIRV-Cross";
diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index a80e216137dba..96edbcad83f60 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -1,19 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, cmake, writeText, vulkan-headers, jq }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, writeText, vulkan-headers, jq, libX11, libXrandr, libxcb, wayland }:
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.254";
+  version = "1.3.261";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "v${version}";
-    hash = "sha256-YWJk0sAvhmfVbJ6Nv24kzFL4SltQnggNjZ+NjaUO1Io=";
+    hash = "sha256-MeW7mmbjgqEvXEnAYzTNu4omC4fqq1fplIVjDpV2LcA=";
   };
 
-  nativeBuildInputs = [ cmake jq ];
+  nativeBuildInputs = [ cmake pkg-config jq ];
 
-  buildInputs = [ vulkan-headers ];
+  buildInputs = [ vulkan-headers libX11 libXrandr libxcb wayland ];
 
   # Help vulkan-loader find the validation layers
   setupHook = writeText "setup-hook" ''
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/add-missing-macro-definition.patch b/pkgs/tools/graphics/vulkan-tools-lunarg/add-missing-macro-definition.patch
deleted file mode 100644
index 4d57173633031..0000000000000
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/add-missing-macro-definition.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/layersvt/api_dump.h b/layersvt/api_dump.h
-index 6e13b6de3..33bee96e7 100644
---- a/layersvt/api_dump.h
-+++ b/layersvt/api_dump.h
-@@ -60,6 +60,8 @@
- #include <unordered_set>
- #include <utility>
-
-+#define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0]))
-+
- #ifdef ANDROID
-
- #include <android/log.h>
-diff --git a/layersvt/screenshot.cpp b/layersvt/screenshot.cpp
-index b9743371c..6ee65c576 100755
---- a/layersvt/screenshot.cpp
-+++ b/layersvt/screenshot.cpp
-@@ -44,6 +44,8 @@ using namespace std;
-
- #include "screenshot_parsing.h"
-
-+#define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0]))
-+
- #ifdef ANDROID
-
- #include <android/log.h>
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index 8dec2e5130e76..072876e46dec2 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -5,6 +5,7 @@
 , python3
 , jq
 , expat
+, jsoncpp
 , libX11
 , libXdmcp
 , libXrandr
@@ -24,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
-  version = "1.3.250";
+  version = "1.3.261";
 
   src = fetchFromGitHub {
    owner = "LunarG";
    repo = "VulkanTools";
    rev = "v${version}";
-   hash = "sha256-oI2ITvciuE/f8ojFpIwcH+HnYCasz43nKkER3wJxX+c=";
+   hash = "sha256-Kem3nWVaMeDEsidKYMsWr9Bu0yBgjjennDB0sKBDogA=";
    fetchSubmodules = true;
  };
 
@@ -38,6 +39,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     expat
+    jsoncpp
     libX11
     libXdmcp
     libXrandr
@@ -70,6 +72,8 @@ stdenv.mkDerivation rec {
     patchShebangs scripts/*
     sed -i '/^git /d' $update
     ./$update
+
+    substituteInPlace via/CMakeLists.txt --replace "jsoncpp_static" "jsoncpp"
   '';
 
   # Include absolute paths to layer libraries in their associated
@@ -82,14 +86,6 @@ stdenv.mkDerivation rec {
   '';
 
   patches = [
-    # Redefine an internal macro removed in vulkan-validation-layers
-    # FIXME: remove when fixed upstream
-    ./add-missing-macro-definition.patch
-
-    # Skip QNX-specific extension causing build failures
-    # FIXME: remove when fixed upstream
-    ./skip-qnx-extension.patch
-
     ./gtest.patch
   ];
 
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/skip-qnx-extension.patch b/pkgs/tools/graphics/vulkan-tools-lunarg/skip-qnx-extension.patch
deleted file mode 100644
index 777b32f43af42..0000000000000
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/skip-qnx-extension.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 209f3ec39..c711af38b 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -190,7 +190,7 @@ endif()
- # Define macro used for building vk.xml generated files
- function(run_vulkantools_vk_xml_generate dependency output)
-     add_custom_command(OUTPUT ${output}
--        COMMAND ${PYTHON_CMD} -B ${VULKANTOOLS_SCRIPTS_DIR}/vt_genvk.py -registry ${VULKAN_HEADERS_REGISTRY_DIRECTORY}/vk.xml -scripts ${VULKAN_HEADERS_REGISTRY_DIRECTORY} ${output}
-+        COMMAND ${PYTHON_CMD} -B ${VULKANTOOLS_SCRIPTS_DIR}/vt_genvk.py -registry ${VULKAN_HEADERS_REGISTRY_DIRECTORY}/vk.xml -scripts ${VULKAN_HEADERS_REGISTRY_DIRECTORY} ${output} -removeExtensions VK_QNX_external_memory_screen_buffer
-         DEPENDS ${VULKAN_HEADERS_REGISTRY_DIRECTORY}/vk.xml ${VULKAN_HEADERS_REGISTRY_DIRECTORY}/generator.py ${VULKANTOOLS_SCRIPTS_DIR}/${dependency} ${VULKANTOOLS_SCRIPTS_DIR}/vt_genvk.py ${VULKAN_HEADERS_REGISTRY_DIRECTORY}/reg.py
-     )
- endfunction()
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index 3f36e8abf7f97..9327bd9c9d6ed 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.254";
+  version = "1.3.261";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "v${version}";
-    hash = "sha256-MyYngyoIGpGu1jFN1GDm9BcFye1JRz1cN6SaZue1ZGQ=";
+    hash = "sha256-C5FVkI9F/dgIS8qp7VaOn9J2zoNLb1PnmgAemsVO6zM=";
   };
 
   nativeBuildInputs = [
@@ -86,6 +86,7 @@ stdenv.mkDerivation rec {
     # vulkaninfo loads libvulkan using dlopen, so we have to add it manually to RPATH
     "-DCMAKE_INSTALL_RPATH=${libraryPath}"
     "-DPKG_CONFIG_EXECUTABLE=${pkg-config}/bin/pkg-config"
+    "-DGLSLANG_INSTALL_DIR=${glslang}"
     # Hide dev warnings that are useless for packaging
     "-Wno-dev"
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/tools/misc/ent/default.nix b/pkgs/tools/misc/ent/default.nix
index 6904d46677214..bd9dfeafea6bd 100644
--- a/pkgs/tools/misc/ent/default.nix
+++ b/pkgs/tools/misc/ent/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
 
   # Work around the "unpacker appears to have produced no directories"
   # case that happens when the archive doesn't have a subdirectory.
-  setSourceRoot = "sourceRoot=`pwd`";
+  sourceRoot = ".";
 
   nativeBuildInputs = [ unzip ];
 
diff --git a/pkgs/tools/misc/file/32-bit-time_t.patch b/pkgs/tools/misc/file/32-bit-time_t.patch
new file mode 100644
index 0000000000000..19c595215d65b
--- /dev/null
+++ b/pkgs/tools/misc/file/32-bit-time_t.patch
@@ -0,0 +1,38 @@
+https://github.com/file/file/commit/218fdf813fd5ccecbb8887a1b62509cd1c6dd3a1.patch
+
+From 218fdf813fd5ccecbb8887a1b62509cd1c6dd3a1 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Fri, 28 Jul 2023 14:38:25 +0000
+Subject: [PATCH] deal with 32 bit time_t
+
+---
+ src/file.h | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/src/file.h b/src/file.h
+index 2e0494d2f..78f574ea1 100644
+--- a/src/file.h
++++ b/src/file.h
+@@ -27,7 +27,7 @@
+  */
+ /*
+  * file.h - definitions for file(1) program
+- * @(#)$File: file.h,v 1.247 2023/07/27 19:40:22 christos Exp $
++ * @(#)$File: file.h,v 1.248 2023/07/28 14:38:25 christos Exp $
+  */
+ 
+ #ifndef __file_h__
+@@ -159,9 +159,11 @@
+ /*
+  * Dec 31, 23:59:59 9999
+  * we need to make sure that we don't exceed 9999 because some libc
+- * implementations like muslc crash otherwise
++ * implementations like muslc crash otherwise. If you are unlucky
++ * to be running on a system with a 32 bit time_t, then it is even less.
+  */
+-#define	MAX_CTIME	CAST(time_t, 0x3afff487cfULL)
++#define	MAX_CTIME \
++    CAST(time_t, sizeof(time_t) > 4 ? 0x3afff487cfULL : 0x7fffffffULL)
+ 
+ #define FILE_BADSIZE CAST(size_t, ~0ul)
+ #define MAXDESC	64		/* max len of text description/MIME type */
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 7fad2c381c3fd..6026f3c7adaab 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -7,29 +7,22 @@
 
 stdenv.mkDerivation rec {
   pname = "file";
-  version = "5.44";
+  version = "5.45";
 
   src = fetchurl {
     urls = [
       "https://astron.com/pub/file/${pname}-${version}.tar.gz"
       "https://distfiles.macports.org/file/${pname}-${version}.tar.gz"
     ];
-    sha256 = "sha256-N1HH+6jbyDHLjXzIr/IQNUWbjOUVXviwiAon0ChHXzs=";
+    hash = "sha256-/Jf1ECm7DiyfTjv/79r2ePDgOe6HK53lwAKm0Jx4TYI=";
   };
 
   outputs = [ "out" "dev" "man" ];
 
   patches = [
-    # Backport fix to identification for pyzip files.
-    # Needed for strip-nondeterminism.
-    # https://salsa.debian.org/reproducible-builds/strip-nondeterminism/-/issues/20
-    ./pyzip.patch
-
-    # Backport fix for --uncompress always detecting contents as "empty"
-    (fetchurl {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-apps/file/files/file-5.44-decompress-empty.patch?h=dfc57da515a2aaf085bea68267cc727f1bfaa691";
-      hash = "sha256-fUzRQAlLWczBmR5iA1Gk66mHjP40MJcMdgCtm2+u1SQ=";
-    })
+    # Upstream patch to fix 32-bit tests.
+    # Will be included in 5.46+ releases.
+    ./32-bit-time_t.patch
   ];
 
   strictDeps = true;
diff --git a/pkgs/tools/misc/file/pyzip.patch b/pkgs/tools/misc/file/pyzip.patch
deleted file mode 100644
index 57f9e7ef8b64e..0000000000000
--- a/pkgs/tools/misc/file/pyzip.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From dc71304b3b1fd2ed5f7098d59fb7f6ef10cfdc85 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Sat, 31 Dec 2022 20:24:08 +0000
-Subject: [PATCH] pyzip improvements (FC Stegerman)
-
----
- magic/Magdir/archive | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/magic/Magdir/archive b/magic/Magdir/archive
-index a706556d5..d58201e69 100644
---- a/magic/Magdir/archive
-+++ b/magic/Magdir/archive
-@@ -1,5 +1,5 @@
- #------------------------------------------------------------------------------
--# $File: archive,v 1.179 2022/12/21 15:50:59 christos Exp $
-+# $File: archive,v 1.180 2022/12/31 20:24:08 christos Exp $
- # archive:  file(1) magic for archive formats (see also "msdos" for self-
- #           extracting compressed archives)
- #
-@@ -1876,9 +1876,14 @@
- # https://en.wikipedia.org/wiki/ZIP_(file_format)#End_of_central_directory_record_(EOCD)
- # by Michal Gorny <mgorny@gentoo.org>
- -2	uleshort	0
-->&-22	string	PK\005\006	Zip archive, with extra data prepended
-+>&-22	string	PK\005\006
-+# without #!
-+>>0	string	!#!	Zip archive, with extra data prepended
- !:mime	application/zip
- !:ext zip/cbz
-+# with #!
-+>>0	string/w	#!\ 	a
-+>>>&-1	string/T	x	%s script executable (Zip archive)
- 
- # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
- # by Stefan `Sec` Zehl <sec@42.org>
diff --git a/pkgs/tools/misc/ksnip/default.nix b/pkgs/tools/misc/ksnip/default.nix
index 853db8ab45a50..bae675b49599a 100644
--- a/pkgs/tools/misc/ksnip/default.nix
+++ b/pkgs/tools/misc/ksnip/default.nix
@@ -7,7 +7,7 @@
 , kimageannotator
 , wrapQtAppsHook
 , qtsvg
-, qttranslations
+, qttools
 , qtx11extras
 }:
 
@@ -26,13 +26,13 @@ stdenv.mkDerivation rec {
     cmake
     extra-cmake-modules
     wrapQtAppsHook
+    qttools
   ];
 
   buildInputs = [
     kcolorpicker
     kimageannotator
     qtsvg
-    qttranslations
     qtx11extras
   ];
 
diff --git a/pkgs/tools/misc/usbimager/default.nix b/pkgs/tools/misc/usbimager/default.nix
index 533f61a9c7d12..a3660d71da4cb 100644
--- a/pkgs/tools/misc/usbimager/default.nix
+++ b/pkgs/tools/misc/usbimager/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-CEGUXJXqXmD8uT93T9dg49Lf5vTpAzQjdnhYmbR5zTI=";
   };
 
-  sourceRoot = "${src.name}/src/";
+  sourceRoot = "${src.name}/src";
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
   buildInputs = lib.optionals withUdisks [ udisks glib ]
diff --git a/pkgs/tools/networking/bully/default.nix b/pkgs/tools/networking/bully/default.nix
index c82971d8217ac..55ff196154e36 100644
--- a/pkgs/tools/networking/bully/default.nix
+++ b/pkgs/tools/networking/bully/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  sourceRoot = "./${src.name}/src";
+  sourceRoot = "${src.name}/src";
 
   installPhase = ''
     install -Dm555 -t $out/bin bully
diff --git a/pkgs/tools/networking/ookla-speedtest/default.nix b/pkgs/tools/networking/ookla-speedtest/default.nix
index d889414bc118d..b08769b6ca1d3 100644
--- a/pkgs/tools/networking/ookla-speedtest/default.nix
+++ b/pkgs/tools/networking/ookla-speedtest/default.nix
@@ -34,9 +34,7 @@ stdenv.mkDerivation rec {
 
   src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
-  setSourceRoot = ''
-    sourceRoot=$PWD
-  '';
+  sourceRoot = ".";
 
   dontBuild = true;
   dontConfigure = true;
diff --git a/pkgs/tools/package-management/poetry/default.nix b/pkgs/tools/package-management/poetry/default.nix
index 62c4ac5996974..d1dd48c0aad84 100644
--- a/pkgs/tools/package-management/poetry/default.nix
+++ b/pkgs/tools/package-management/poetry/default.nix
@@ -39,10 +39,6 @@ let
           rev = version;
           hash = "sha256-Gc22Y2T4uO39jiOqEUFeOfnVCbknuDjmzFPZgk2eY74=";
         };
-        patches = [ ];
-        nativeCheckInputs = old.nativeCheckInputs ++ [
-          self.tomli-w
-        ];
       });
     } // (plugins self);
   };
diff --git a/pkgs/tools/security/apachetomcatscanner/default.nix b/pkgs/tools/security/apachetomcatscanner/default.nix
index 13a11808b7dd5..41c68aa797928 100644
--- a/pkgs/tools/security/apachetomcatscanner/default.nix
+++ b/pkgs/tools/security/apachetomcatscanner/default.nix
@@ -15,6 +15,12 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-ChVVXUjm6y71iRs64Kv63oiOG1GSqmx6J0YiGtEI0ao=";
   };
 
+  # Posted a PR for discussion upstream that can be followed:
+  # https://github.com/p0dalirius/ApacheTomcatScanner/pull/32
+  postPatch = ''
+    sed -i '/apachetomcatscanner=apachetomcatscanner\.__main__:main/d' setup.py
+  '';
+
   propagatedBuildInputs = with python3.pkgs; [
     requests
     sectools
diff --git a/pkgs/tools/security/mpw/default.nix b/pkgs/tools/security/mpw/default.nix
index 0fe45039b9bee..8d6f7f4f3b1da 100644
--- a/pkgs/tools/security/mpw/default.nix
+++ b/pkgs/tools/security/mpw/default.nix
@@ -15,7 +15,7 @@ in stdenv.mkDerivation rec {
     inherit rev;
   };
 
-  sourceRoot = "./${src.name}/platform-independent/c/cli";
+  sourceRoot = "${src.name}/platform-independent/c/cli";
 
   postPatch = ''
     rm build
diff --git a/pkgs/tools/security/nitrokey-app/default.nix b/pkgs/tools/security/nitrokey-app/default.nix
index 8f8991801f7ce..d48047a7b1c62 100644
--- a/pkgs/tools/security/nitrokey-app/default.nix
+++ b/pkgs/tools/security/nitrokey-app/default.nix
@@ -3,10 +3,10 @@
 , cmake
 , fetchFromGitHub
 , pkg-config
-, qttranslations
 , wrapQtAppsHook
 , libnitrokey
 , cppcodec
+, qttools
 }:
 
 stdenv.mkDerivation rec {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
     wrapQtAppsHook
-    qttranslations
+    qttools
   ];
 
   cmakeFlags = [
diff --git a/pkgs/tools/security/qdigidoc/default.nix b/pkgs/tools/security/qdigidoc/default.nix
index 19ce14f915aac..8a8fa4496c38e 100644
--- a/pkgs/tools/security/qdigidoc/default.nix
+++ b/pkgs/tools/security/qdigidoc/default.nix
@@ -10,8 +10,8 @@
 , openssl
 , pcsclite
 , qtbase
-, qttranslations
 , qtsvg
+, qttools
 }:
 
 mkDerivation rec {
@@ -29,7 +29,7 @@ mkDerivation rec {
     sha256 = "1cikz36w9phgczcqnwk4k3mx3kk919wy2327jksmfa4cjfjq4a8d";
   };
 
-  nativeBuildInputs = [ cmake gettext pkg-config ];
+  nativeBuildInputs = [ cmake gettext pkg-config qttools ];
 
   postPatch = ''
     substituteInPlace client/CMakeLists.txt \
@@ -44,7 +44,6 @@ mkDerivation rec {
     pcsclite
     qtbase
     qtsvg
-    qttranslations
   ];
 
   # qdigidoc4's `QPKCS11::reload()` dlopen()s "opensc-pkcs11.so" in QLibrary,
diff --git a/pkgs/tools/security/web-eid-app/default.nix b/pkgs/tools/security/web-eid-app/default.nix
index f392fb0147bd9..3c89790e2ffc9 100644
--- a/pkgs/tools/security/web-eid-app/default.nix
+++ b/pkgs/tools/security/web-eid-app/default.nix
@@ -5,7 +5,7 @@
 , gtest
 , pcsclite
 , pkg-config
-, qttranslations
+, qttools
 }:
 
 mkDerivation rec {
@@ -23,12 +23,12 @@ mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
+    qttools
   ];
 
   buildInputs = [
     gtest # required during build of lib/libelectronic-id/lib/libpcsc-cpp
     pcsclite
-    qttranslations
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/text/tesh/default.nix b/pkgs/tools/text/tesh/default.nix
index 7961b120d2135..0b702ae0052a4 100644
--- a/pkgs/tools/text/tesh/default.nix
+++ b/pkgs/tools/text/tesh/default.nix
@@ -1,4 +1,4 @@
-{ python3Packages, fetchFromGitHub }:
+{ python3Packages, fetchFromGitHub, fetchpatch }:
 
 let
   version = "0.3.0";
@@ -12,13 +12,23 @@ in python3Packages.buildPythonPackage rec {
     owner = "OceanSprint";
     repo = "tesh";
     rev = version;
-    sha256 = "sha256-/CSYz2YXbjKZszb1HMOCS+srVJ+TcFSeLeuz9VvtlI4=";
+    hash = "sha256-/CSYz2YXbjKZszb1HMOCS+srVJ+TcFSeLeuz9VvtlI4=";
   };
 
-  prePatch = ''
-      substituteInPlace pyproject.toml \
-      --replace "poetry.masonry" "poetry.core.masonry"
-  '';
+  patches = [
+    # https://github.com/OceanSprint/tesh/pull/49
+    (fetchpatch {
+      name = "replace-poetry-with-poetry-core-1.patch";
+      url = "https://github.com/OceanSprint/tesh/commit/49b90f5a3c9cf111931393248943b1da966dc3ec.patch";
+      hash = "sha256-s+eGO4NXTGbyXcLP37kCg4GDrjAsYIlOwNDR1Q7+1Uc=";
+    })
+    # https://github.com/OceanSprint/tesh/pull/50
+    (fetchpatch {
+      name = "replace-poetry-with-poetry-core-2.patch";
+      url = "https://github.com/OceanSprint/tesh/commit/66798b54f28dc0b72159ee3a2144895cf945eaf0.patch";
+      hash = "sha256-f3uL7TZlkrTOWYihwWNfhrY5/xlBrclAMnbxRNXCGJw=";
+    })
+  ];
 
   checkInputs = [ python3Packages.pytest ];
   nativeBuildInputs = [ python3Packages.poetry-core ];
diff --git a/pkgs/tools/typesetting/xmlroff/default.nix b/pkgs/tools/typesetting/xmlroff/default.nix
index 69c48120b0610..dd8adab9ee8a9 100644
--- a/pkgs/tools/typesetting/xmlroff/default.nix
+++ b/pkgs/tools/typesetting/xmlroff/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     popt
   ];
 
-  sourceRoot = "${src.name}/xmlroff/";
+  sourceRoot = "${src.name}/xmlroff";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index 01b05b5481f5f..73d3157c4cf28 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -33,6 +33,11 @@ with localPython.pkgs; buildPythonApplication rec {
     hash = "sha256-DxjoEkFnY4aSfxVKPpnJLmnjLtZnlM74XXd0K8mcdoY=";
   };
 
+  postPatch = ''
+    # https://github.com/aws/aws-elastic-beanstalk-cli/pull/469
+    substituteInPlace setup.py --replace "scripts=['bin/eb']," ""
+  '';
+
   nativeBuildInputs = [
     pythonRelaxDepsHook
   ];
diff --git a/pkgs/tools/virtualization/mkosi/default.nix b/pkgs/tools/virtualization/mkosi/default.nix
index 345e65d04881c..8fc5376e4c2cb 100644
--- a/pkgs/tools/virtualization/mkosi/default.nix
+++ b/pkgs/tools/virtualization/mkosi/default.nix
@@ -1,6 +1,8 @@
 { lib
 , fetchFromGitHub
 , setuptools
+, setuptools-scm
+, wheel
 , buildPythonApplication
 , pytestCheckHook
 , bubblewrap
@@ -41,9 +43,10 @@ buildPythonApplication rec {
 
   nativeBuildInputs = [
     setuptools
+    setuptools-scm
+    wheel
   ];
 
-
   propagatedBuildInputs = [
     systemdForMkosi
     bubblewrap
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9ac765789580e..d55d5d799cf76 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14767,7 +14767,7 @@ with pkgs;
   volumeicon = callPackage ../tools/audio/volumeicon { };
 
   waf = callPackage ../development/tools/build-managers/waf { };
-  wafHook = callPackage ../development/tools/build-managers/wafHook { };
+  wafHook = callPackage ../development/tools/build-managers/waf/hook.nix { };
 
   waf-tester = callPackage ../tools/security/waf-tester { };
 
@@ -19151,7 +19151,15 @@ with pkgs;
 
   doclifter = callPackage ../development/tools/misc/doclifter { };
 
-  docutils = with python3Packages; toPythonApplication docutils;
+  docutils = with python3Packages; toPythonApplication (
+    docutils.overridePythonAttrs (attrs: rec {
+      version = "0.20.1";
+      src = attrs.src.override {
+        inherit version;
+        hash = "sha256-8IpOJ2w6FYOobc4+NKuj/gTQK7ot1R7RYQYkToqSPjs=";
+      };
+    })
+  );
 
   doctl = callPackage ../development/tools/doctl { };
 
@@ -25604,6 +25612,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
   };
   vulkan-tools-lunarg = callPackage ../tools/graphics/vulkan-tools-lunarg { };
+  vulkan-utility-libraries = callPackage ../development/libraries/vulkan-utility-libraries { };
   vulkan-validation-layers = callPackage ../development/tools/vulkan-validation-layers { };
 
   vxl = callPackage ../development/libraries/vxl { };
@@ -26993,12 +27002,14 @@ with pkgs;
 
   rpcsvc-proto = callPackage ../tools/misc/rpcsvc-proto { };
 
-  libmysqlclient = libmysqlclient_3_2;
+  libmysqlclient = libmysqlclient_3_3;
   libmysqlclient_3_1 = mariadb-connector-c_3_1;
   libmysqlclient_3_2 = mariadb-connector-c_3_2;
-  mariadb-connector-c = mariadb-connector-c_3_2;
+  libmysqlclient_3_3 = mariadb-connector-c_3_3;
+  mariadb-connector-c = mariadb-connector-c_3_3;
   mariadb-connector-c_3_1 = callPackage ../servers/sql/mariadb/connector-c/3_1.nix { };
   mariadb-connector-c_3_2 = callPackage ../servers/sql/mariadb/connector-c/3_2.nix { };
+  mariadb-connector-c_3_3 = callPackage ../servers/sql/mariadb/connector-c/3_3.nix { };
 
   mariadb-galera = callPackage ../servers/sql/mariadb/galera { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b90d9089561ce..7698d05a3685c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8,6 +8,16 @@
 
 self: super: with self; {
 
+  bootstrap = lib.recurseIntoAttrs {
+    flit-core = toPythonModule (callPackage ../development/python-modules/bootstrap/flit-core { });
+    installer = toPythonModule (callPackage ../development/python-modules/bootstrap/installer {
+      inherit (bootstrap) flit-core;
+    });
+    build = toPythonModule (callPackage ../development/python-modules/bootstrap/build {
+      inherit (bootstrap) flit-core installer;
+    });
+  };
+
   bootstrapped-pip = toPythonModule (callPackage ../development/python-modules/bootstrapped-pip { });
 
   setuptools = callPackage ../development/python-modules/setuptools { };
@@ -913,7 +923,9 @@ self: super: with self; {
 
   awkward = callPackage ../development/python-modules/awkward { };
 
-  awkward-cpp = callPackage ../development/python-modules/awkward-cpp { };
+  awkward-cpp = callPackage ../development/python-modules/awkward-cpp {
+    inherit (pkgs) cmake ninja;
+  };
 
   aws-adfs = callPackage ../development/python-modules/aws-adfs { };
 
@@ -2057,6 +2069,8 @@ self: super: with self; {
 
   cmaes = callPackage ../development/python-modules/cmaes { };
 
+  cmake = callPackage ../development/python-modules/cmake { inherit (pkgs) cmake; };
+
   cmarkgfm = callPackage ../development/python-modules/cmarkgfm { };
 
   cmd2 = callPackage ../development/python-modules/cmd2 { };
@@ -5802,7 +5816,9 @@ self: super: with self; {
 
   laspy = callPackage ../development/python-modules/laspy { };
 
-  laszip = callPackage ../development/python-modules/laszip { };
+  laszip = callPackage ../development/python-modules/laszip {
+    inherit (pkgs) cmake ninja;
+  };
 
   latex2mathml = callPackage ../development/python-modules/latex2mathml { };