about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/ledfx/default.nix1
-rw-r--r--pkgs/applications/audio/puddletag/default.nix1
-rw-r--r--pkgs/applications/backup/unifi-protect-backup/default.nix1
-rw-r--r--pkgs/applications/blockchains/polkadot/default.nix3
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix3
-rw-r--r--pkgs/applications/editors/neovim/tests/default.nix20
-rw-r--r--pkgs/applications/editors/neovim/utils.nix24
-rw-r--r--pkgs/applications/editors/neovim/wrapper.nix27
-rw-r--r--pkgs/applications/emulators/wine/base.nix2
-rw-r--r--pkgs/applications/file-managers/browsr/default.nix1
-rw-r--r--pkgs/applications/graphics/ImageMagick/6.x.nix2
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix2
-rw-r--r--pkgs/applications/misc/archivy/default.nix1
-rw-r--r--pkgs/applications/misc/blender/default.nix6
-rw-r--r--pkgs/applications/misc/dbx/default.nix1
-rw-r--r--pkgs/applications/misc/pagefind/default.nix4
-rw-r--r--pkgs/applications/misc/pysentation/default.nix1
-rw-r--r--pkgs/applications/misc/shell-genie/default.nix4
-rw-r--r--pkgs/applications/misc/snagboot/default.nix2
-rw-r--r--pkgs/applications/misc/yubioath-flutter/helper.nix2
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix4
-rw-r--r--pkgs/applications/networking/cluster/tftui/default.nix1
-rw-r--r--pkgs/applications/networking/dyndns/dyndnsc/default.nix1
-rw-r--r--pkgs/applications/networking/errbot/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/pantalaimon/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/teamspeak/client5.nix1
-rw-r--r--pkgs/applications/networking/p2p/pyrosimple/default.nix1
-rw-r--r--pkgs/applications/science/math/sage/sagelib.nix2
-rw-r--r--pkgs/applications/terminal-emulators/rio/default.nix6
-rw-r--r--pkgs/applications/version-management/commitizen/default.nix1
-rw-r--r--pkgs/applications/version-management/git/default.nix4
-rwxr-xr-xpkgs/applications/version-management/git/update.sh2
-rw-r--r--pkgs/applications/version-management/gitless/default.nix1
-rw-r--r--pkgs/applications/version-management/mercurial/default.nix6
-rw-r--r--pkgs/applications/video/animdl/default.nix2
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix1
-rw-r--r--pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh2
-rw-r--r--pkgs/build-support/cc-wrapper/add-hardening.sh6
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix77
-rw-r--r--pkgs/build-support/emacs/melpa.nix24
-rw-r--r--pkgs/build-support/go/module.nix8
-rw-r--r--pkgs/build-support/rust/hooks/maturin-build-hook.sh8
-rw-r--r--pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh5
-rw-r--r--pkgs/build-support/setup-hooks/install-shell-files.sh5
-rw-r--r--pkgs/by-name/ad/ad-miner/package.nix4
-rw-r--r--pkgs/by-name/ai/airlift/package.nix1
-rw-r--r--pkgs/by-name/al/alsa-plugins/package.nix4
-rw-r--r--pkgs/by-name/au/audible-cli/package.nix1
-rw-r--r--pkgs/by-name/au/audiness/package.nix1
-rw-r--r--pkgs/by-name/aw/aws-gate/package.nix1
-rw-r--r--pkgs/by-name/ba/backgroundremover/package.nix2
-rw-r--r--pkgs/by-name/ch/charmcraft/package.nix1
-rw-r--r--pkgs/by-name/cm/cmake/package.nix2
-rw-r--r--pkgs/by-name/co/corrscope/package.nix1
-rw-r--r--pkgs/by-name/co/cosmic-edit/package.nix2
-rw-r--r--pkgs/by-name/co/cosmic-store/package.nix1
-rw-r--r--pkgs/by-name/co/cosmic-term/package.nix1
-rw-r--r--pkgs/by-name/cu/cups-printers/package.nix1
-rw-r--r--pkgs/by-name/do/donpapi/package.nix1
-rw-r--r--pkgs/by-name/do/dooit/package.nix1
-rw-r--r--pkgs/by-name/f2/f2fs-tools/f2fs-tools-cross-fix.patch (renamed from pkgs/tools/filesystems/f2fs-tools/f2fs-tools-cross-fix.patch)0
-rw-r--r--pkgs/by-name/f2/f2fs-tools/package.nix (renamed from pkgs/tools/filesystems/f2fs-tools/default.nix)36
-rw-r--r--pkgs/by-name/gc/gcp-scanner/package.nix1
-rw-r--r--pkgs/by-name/gh/ghunt/package.nix1
-rw-r--r--pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix1
-rw-r--r--pkgs/by-name/he/hekatomb/package.nix1
-rw-r--r--pkgs/by-name/ho/homeassistant-satellite/package.nix1
-rw-r--r--pkgs/by-name/ic/icloudpd/package.nix4
-rw-r--r--pkgs/by-name/ir/irrd/package.nix1
-rw-r--r--pkgs/by-name/ja/jasper/package.nix11
-rw-r--r--pkgs/by-name/ki/kikit/solidpython/default.nix2
-rw-r--r--pkgs/by-name/ko/koodousfinder/package.nix1
-rw-r--r--pkgs/by-name/kr/krbjack/package.nix1
-rw-r--r--pkgs/by-name/li/libcamera/package.nix7
-rw-r--r--pkgs/by-name/ma/malwoverview/package.nix4
-rw-r--r--pkgs/by-name/me/mealie/package.nix1
-rw-r--r--pkgs/by-name/mo/mokuro/package.nix1
-rw-r--r--pkgs/by-name/mo/mov-cli/package.nix4
-rw-r--r--pkgs/by-name/ng/nginx-language-server/package.nix1
-rw-r--r--pkgs/by-name/no/normcap/package.nix1
-rw-r--r--pkgs/by-name/on/onthespot/package.nix1
-rw-r--r--pkgs/by-name/op/open-webui/package.nix1
-rw-r--r--pkgs/by-name/op/opencomposite/package.nix1
-rw-r--r--pkgs/by-name/op/openscad-unstable/package.nix9
-rw-r--r--pkgs/by-name/op/opensplat/package.nix37
-rw-r--r--pkgs/by-name/ot/oterm/package.nix1
-rw-r--r--pkgs/by-name/pa/pacu/package.nix1
-rw-r--r--pkgs/by-name/pr/pre2k/package.nix1
-rw-r--r--pkgs/by-name/pr/pretalx/package.nix1
-rw-r--r--pkgs/by-name/pr/prowler/package.nix4
-rw-r--r--pkgs/by-name/py/pysqlrecon/package.nix1
-rw-r--r--pkgs/by-name/ra/rabbit/package.nix1
-rw-r--r--pkgs/by-name/rc/rclip/package.nix2
-rw-r--r--pkgs/by-name/rd/rdwatool/package.nix1
-rw-r--r--pkgs/by-name/re/rerun/package.nix3
-rw-r--r--pkgs/by-name/re/retool/package.nix1
-rw-r--r--pkgs/by-name/ro/route-graph/package.nix4
-rw-r--r--pkgs/by-name/sh/shell-gpt/package.nix1
-rw-r--r--pkgs/by-name/sm/smassh/package.nix1
-rw-r--r--pkgs/by-name/sn/snapcraft/package.nix1
-rw-r--r--pkgs/by-name/st/streamdeck-ui/package.nix1
-rw-r--r--pkgs/by-name/st/strictdoc/package.nix1
-rw-r--r--pkgs/by-name/su/surrealist/package.nix3
-rw-r--r--pkgs/by-name/tb/tbump/package.nix1
-rw-r--r--pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix3
-rw-r--r--pkgs/by-name/tr/troubadix/package.nix1
-rw-r--r--pkgs/by-name/tu/tunnelgraf/package.nix1
-rw-r--r--pkgs/by-name/tw/twitch-dl/package.nix1
-rw-r--r--pkgs/by-name/un/unsilence/package.nix1
-rw-r--r--pkgs/by-name/up/upiano/package.nix1
-rw-r--r--pkgs/by-name/uw/uwhoisd/package.nix1
-rw-r--r--pkgs/by-name/vu/vunnel/package.nix1
-rw-r--r--pkgs/by-name/wa/waf/package.nix4
-rw-r--r--pkgs/by-name/wi/witnessme/package.nix4
-rw-r--r--pkgs/by-name/ws/wsrepl/package.nix4
-rw-r--r--pkgs/by-name/wt/wtfis/package.nix4
-rw-r--r--pkgs/by-name/wy/wyoming-satellite/package.nix1
-rw-r--r--pkgs/data/fonts/iwona/default.nix3
-rw-r--r--pkgs/data/icons/hicolor-icon-theme/default.nix38
-rw-r--r--pkgs/data/misc/cacert/default.nix4
-rw-r--r--pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix2
-rw-r--r--pkgs/development/compilers/gcc/default.nix5
-rw-r--r--pkgs/development/compilers/go/1.22.nix4
-rw-r--r--pkgs/development/compilers/llvm/17/default.nix8
-rw-r--r--pkgs/development/compilers/llvm/17/llvm/gnu-install-dirs.patch8
-rw-r--r--pkgs/development/compilers/llvm/18/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/common/clang/default.nix26
-rw-r--r--pkgs/development/compilers/llvm/common/compiler-rt/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/common/libcxx/default.nix10
-rw-r--r--pkgs/development/compilers/llvm/common/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/openjdk/21.nix6
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/21.nix6
-rw-r--r--pkgs/development/compilers/rust/1_78.nix1
-rw-r--r--pkgs/development/compilers/rust/binary.nix5
-rwxr-xr-xpkgs/development/compilers/rust/print-hashes.sh1
-rw-r--r--pkgs/development/compilers/rust/rustc.nix14
-rw-r--r--pkgs/development/compilers/swift/wrapper/wrapper.sh2
-rwxr-xr-xpkgs/development/compilers/temurin-bin/generate-sources.py4
-rw-r--r--pkgs/development/compilers/temurin-bin/jdk-darwin-base.nix13
-rw-r--r--pkgs/development/compilers/temurin-bin/jdk-darwin.nix23
-rw-r--r--pkgs/development/compilers/temurin-bin/jdk-linux-base.nix24
-rw-r--r--pkgs/development/compilers/temurin-bin/jdk-linux.nix23
-rw-r--r--pkgs/development/compilers/temurin-bin/sources.json524
-rw-r--r--pkgs/development/compilers/vyper/default.nix2
-rw-r--r--pkgs/development/embedded/platformio/core.nix1
-rw-r--r--pkgs/development/interpreters/lua-5/interpreter.nix2
-rw-r--r--pkgs/development/interpreters/lua-5/tests/default.nix13
-rw-r--r--pkgs/development/interpreters/lua-5/utils.sh83
-rw-r--r--pkgs/development/interpreters/lua-5/wrap.sh44
-rw-r--r--pkgs/development/interpreters/lua-5/wrapper.nix2
-rw-r--r--pkgs/development/interpreters/luajit/default.nix2
-rw-r--r--pkgs/development/interpreters/python/default.nix4
-rw-r--r--pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh9
-rw-r--r--pkgs/development/interpreters/python/mk-python-derivation.nix3
-rw-r--r--pkgs/development/libraries/SDL2/default.nix4
-rw-r--r--pkgs/development/libraries/audio/libopenmpt/default.nix4
-rw-r--r--pkgs/development/libraries/enchant/2.x.nix26
-rw-r--r--pkgs/development/libraries/ffmpeg/5.1.4-CVE-2023-49502.patch26
-rw-r--r--pkgs/development/libraries/ffmpeg/default.nix1
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix109
-rw-r--r--pkgs/development/libraries/fribidi/default.nix4
-rw-r--r--pkgs/development/libraries/glib/default.nix7
-rw-r--r--pkgs/development/libraries/glib/gdb_script.patch23
-rw-r--r--pkgs/development/libraries/glm/default.nix47
-rw-r--r--pkgs/development/libraries/icu/default.nix4
-rw-r--r--pkgs/development/libraries/icu/make-icu.nix10
-rw-r--r--pkgs/development/libraries/libass/default.nix4
-rw-r--r--pkgs/development/libraries/libevent/default.nix4
-rw-r--r--pkgs/development/libraries/libimobiledevice-glue/default.nix17
-rw-r--r--pkgs/development/libraries/libimobiledevice/default.nix30
-rw-r--r--pkgs/development/libraries/libtiff/default.nix10
-rw-r--r--pkgs/development/libraries/libunistring/default.nix3
-rw-r--r--pkgs/development/libraries/liburing/default.nix60
-rw-r--r--pkgs/development/libraries/libva/1.nix2
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/libvdpau/default.nix3
-rw-r--r--pkgs/development/libraries/libvpx/default.nix13
-rw-r--r--pkgs/development/libraries/mesa/common.nix32
-rw-r--r--pkgs/development/libraries/mesa/darwin.nix59
-rw-r--r--pkgs/development/libraries/mesa/default.nix330
-rw-r--r--pkgs/development/libraries/mesa/llvmpipe-hook.sh14
-rw-r--r--pkgs/development/libraries/openssl/default.nix12
-rw-r--r--pkgs/development/libraries/pcre2/default.nix16
-rw-r--r--pkgs/development/libraries/qpdf/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix8
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json4
-rw-r--r--pkgs/development/libraries/re2/default.nix89
-rw-r--r--pkgs/development/libraries/rocksdb/default.nix6
-rw-r--r--pkgs/development/libraries/rocksdb/fix-findliburing.patch29
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix4
-rw-r--r--pkgs/development/libraries/spdlog/default.nix4
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix20
-rw-r--r--pkgs/development/python-modules/aio-geojson-generic-client/default.nix2
-rw-r--r--pkgs/development/python-modules/aiobiketrax/default.nix2
-rw-r--r--pkgs/development/python-modules/aioboto3/default.nix2
-rw-r--r--pkgs/development/python-modules/aiogram/default.nix2
-rw-r--r--pkgs/development/python-modules/aiomisc-pytest/default.nix2
-rw-r--r--pkgs/development/python-modules/aioopenexchangerates/default.nix2
-rw-r--r--pkgs/development/python-modules/aiooss2/default.nix2
-rw-r--r--pkgs/development/python-modules/aiormq/default.nix2
-rw-r--r--pkgs/development/python-modules/aioxmpp/default.nix2
-rw-r--r--pkgs/development/python-modules/airtouch5py/default.nix2
-rw-r--r--pkgs/development/python-modules/albumentations/default.nix2
-rw-r--r--pkgs/development/python-modules/alexapy/default.nix2
-rw-r--r--pkgs/development/python-modules/aliyun-python-sdk-core/default.nix2
-rw-r--r--pkgs/development/python-modules/angr/default.nix2
-rw-r--r--pkgs/development/python-modules/ansible/core.nix3
-rw-r--r--pkgs/development/python-modules/apache-beam/default.nix2
-rw-r--r--pkgs/development/python-modules/appthreat-vulnerability-db/default.nix2
-rw-r--r--pkgs/development/python-modules/argilla/default.nix2
-rw-r--r--pkgs/development/python-modules/arsenic/default.nix2
-rw-r--r--pkgs/development/python-modules/asf-search/default.nix2
-rw-r--r--pkgs/development/python-modules/async-tkinter-loop/default.nix2
-rw-r--r--pkgs/development/python-modules/atomman/default.nix2
-rw-r--r--pkgs/development/python-modules/audio-metadata/default.nix2
-rw-r--r--pkgs/development/python-modules/autarco/default.nix2
-rw-r--r--pkgs/development/python-modules/auth0-python/default.nix2
-rw-r--r--pkgs/development/python-modules/autofaiss/default.nix2
-rw-r--r--pkgs/development/python-modules/aw-core/default.nix2
-rw-r--r--pkgs/development/python-modules/aws-adfs/default.nix2
-rw-r--r--pkgs/development/python-modules/awswrangler/default.nix2
-rw-r--r--pkgs/development/python-modules/axisregistry/default.nix2
-rw-r--r--pkgs/development/python-modules/b2sdk/default.nix2
-rw-r--r--pkgs/development/python-modules/barectf/default.nix2
-rw-r--r--pkgs/development/python-modules/basemap/default.nix2
-rw-r--r--pkgs/development/python-modules/biopandas/default.nix2
-rw-r--r--pkgs/development/python-modules/boiboite-opener-framework/default.nix1
-rw-r--r--pkgs/development/python-modules/bork/default.nix2
-rw-r--r--pkgs/development/python-modules/boto3/default.nix2
-rw-r--r--pkgs/development/python-modules/botocore/default.nix2
-rw-r--r--pkgs/development/python-modules/botorch/default.nix2
-rw-r--r--pkgs/development/python-modules/cachier/default.nix2
-rw-r--r--pkgs/development/python-modules/case/default.nix2
-rw-r--r--pkgs/development/python-modules/censys/default.nix2
-rw-r--r--pkgs/development/python-modules/cffi/default.nix14
-rw-r--r--pkgs/development/python-modules/chromadb/default.nix2
-rw-r--r--pkgs/development/python-modules/cirq-google/default.nix2
-rw-r--r--pkgs/development/python-modules/ciscoconfparse/default.nix2
-rw-r--r--pkgs/development/python-modules/clarifai/default.nix2
-rw-r--r--pkgs/development/python-modules/claripy/default.nix2
-rw-r--r--pkgs/development/python-modules/cleo/default.nix2
-rw-r--r--pkgs/development/python-modules/cli-ui/default.nix2
-rw-r--r--pkgs/development/python-modules/clickhouse-cli/default.nix2
-rw-r--r--pkgs/development/python-modules/cmdstanpy/default.nix2
-rw-r--r--pkgs/development/python-modules/coinmetrics-api-client/default.nix2
-rw-r--r--pkgs/development/python-modules/comicon/default.nix2
-rw-r--r--pkgs/development/python-modules/conda-libmamba-solver/default.nix2
-rw-r--r--pkgs/development/python-modules/conda/default.nix2
-rw-r--r--pkgs/development/python-modules/ctap-keyring-device/default.nix2
-rw-r--r--pkgs/development/python-modules/cyclonedx-python-lib/default.nix2
-rw-r--r--pkgs/development/python-modules/cypherpunkpay/default.nix2
-rw-r--r--pkgs/development/python-modules/dask-awkward/default.nix2
-rw-r--r--pkgs/development/python-modules/databricks-sql-connector/default.nix2
-rw-r--r--pkgs/development/python-modules/dataprep-ml/default.nix2
-rw-r--r--pkgs/development/python-modules/dbt-bigquery/default.nix2
-rw-r--r--pkgs/development/python-modules/dbt-core/default.nix2
-rw-r--r--pkgs/development/python-modules/dbt-redshift/default.nix2
-rw-r--r--pkgs/development/python-modules/dbt-semantic-interfaces/default.nix2
-rw-r--r--pkgs/development/python-modules/deal-solver/default.nix2
-rw-r--r--pkgs/development/python-modules/defusedxml/default.nix23
-rw-r--r--pkgs/development/python-modules/demetriek/default.nix2
-rw-r--r--pkgs/development/python-modules/detectron2/default.nix2
-rw-r--r--pkgs/development/python-modules/devito/default.nix2
-rw-r--r--pkgs/development/python-modules/diffsync/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect/default.nix2
-rw-r--r--pkgs/development/python-modules/distributed/default.nix2
-rw-r--r--pkgs/development/python-modules/django-cacheops/default.nix2
-rw-r--r--pkgs/development/python-modules/django-compressor/default.nix2
-rw-r--r--pkgs/development/python-modules/django-import-export/default.nix2
-rw-r--r--pkgs/development/python-modules/django-oauth-toolkit/default.nix2
-rw-r--r--pkgs/development/python-modules/django-two-factor-auth/default.nix2
-rw-r--r--pkgs/development/python-modules/django-webpush/default.nix2
-rw-r--r--pkgs/development/python-modules/dm-control/default.nix2
-rw-r--r--pkgs/development/python-modules/dploot/default.nix2
-rw-r--r--pkgs/development/python-modules/dropbox/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-azure/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-gs/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-http/default.nix1
-rw-r--r--pkgs/development/python-modules/dvc-s3/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-ssh/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc/default.nix2
-rw-r--r--pkgs/development/python-modules/elastic-apm/default.nix2
-rw-r--r--pkgs/development/python-modules/embedding-reader/default.nix2
-rw-r--r--pkgs/development/python-modules/es-client/default.nix2
-rw-r--r--pkgs/development/python-modules/exceptiongroup/default.nix14
-rw-r--r--pkgs/development/python-modules/explorerscript/default.nix2
-rw-r--r--pkgs/development/python-modules/extract-msg/default.nix2
-rw-r--r--pkgs/development/python-modules/extruct/default.nix1
-rw-r--r--pkgs/development/python-modules/fairseq/default.nix2
-rw-r--r--pkgs/development/python-modules/farm-haystack/default.nix2
-rw-r--r--pkgs/development/python-modules/fastapi/default.nix2
-rw-r--r--pkgs/development/python-modules/fastembed/default.nix2
-rw-r--r--pkgs/development/python-modules/faster-whisper/default.nix2
-rw-r--r--pkgs/development/python-modules/flax/default.nix2
-rw-r--r--pkgs/development/python-modules/flet-runtime/default.nix2
-rw-r--r--pkgs/development/python-modules/flet/default.nix2
-rw-r--r--pkgs/development/python-modules/fontbakery/default.nix2
-rw-r--r--pkgs/development/python-modules/freebox-api/default.nix2
-rw-r--r--pkgs/development/python-modules/freezegun/default.nix12
-rw-r--r--pkgs/development/python-modules/furl/default.nix6
-rw-r--r--pkgs/development/python-modules/furo/default.nix2
-rw-r--r--pkgs/development/python-modules/galois/default.nix2
-rw-r--r--pkgs/development/python-modules/gcs-oauth2-boto-plugin/default.nix1
-rw-r--r--pkgs/development/python-modules/gflanguages/default.nix2
-rw-r--r--pkgs/development/python-modules/gitdb/default.nix2
-rw-r--r--pkgs/development/python-modules/githubkit/default.nix2
-rw-r--r--pkgs/development/python-modules/google-cloud-storage/default.nix2
-rw-r--r--pkgs/development/python-modules/google-generativeai/default.nix2
-rw-r--r--pkgs/development/python-modules/gophish/default.nix2
-rw-r--r--pkgs/development/python-modules/gpsoauth/default.nix2
-rw-r--r--pkgs/development/python-modules/gpustat/default.nix2
-rw-r--r--pkgs/development/python-modules/grad-cam/default.nix2
-rw-r--r--pkgs/development/python-modules/gradio/client.nix2
-rw-r--r--pkgs/development/python-modules/gradio/default.nix2
-rw-r--r--pkgs/development/python-modules/greenlet/default.nix5
-rw-r--r--pkgs/development/python-modules/greenlet/python-3.13-compat.patch313
-rw-r--r--pkgs/development/python-modules/grpcio-channelz/default.nix2
-rw-r--r--pkgs/development/python-modules/grpcio-health-checking/default.nix2
-rw-r--r--pkgs/development/python-modules/grpcio-reflection/default.nix2
-rw-r--r--pkgs/development/python-modules/grpcio-testing/default.nix1
-rw-r--r--pkgs/development/python-modules/ha-mqtt-discoverable/default.nix2
-rw-r--r--pkgs/development/python-modules/hass-nabucasa/default.nix2
-rw-r--r--pkgs/development/python-modules/hdate/default.nix1
-rw-r--r--pkgs/development/python-modules/hdbscan/default.nix2
-rw-r--r--pkgs/development/python-modules/hikari/default.nix2
-rw-r--r--pkgs/development/python-modules/hologram/default.nix2
-rw-r--r--pkgs/development/python-modules/httpbin/default.nix2
-rw-r--r--pkgs/development/python-modules/icalevents/default.nix2
-rw-r--r--pkgs/development/python-modules/instructor/default.nix2
-rw-r--r--pkgs/development/python-modules/intensity-normalization/default.nix2
-rw-r--r--pkgs/development/python-modules/ipwhois/default.nix2
-rw-r--r--pkgs/development/python-modules/jaxtyping/default.nix2
-rw-r--r--pkgs/development/python-modules/jinja2/default.nix9
-rw-r--r--pkgs/development/python-modules/jiwer/default.nix2
-rw-r--r--pkgs/development/python-modules/json-schema-for-humans/default.nix2
-rw-r--r--pkgs/development/python-modules/jsonconversion/default.nix2
-rw-r--r--pkgs/development/python-modules/jsonschema-path/default.nix2
-rw-r--r--pkgs/development/python-modules/jsonschema-spec/default.nix2
-rw-r--r--pkgs/development/python-modules/karton-dashboard/default.nix2
-rw-r--r--pkgs/development/python-modules/kserve/default.nix2
-rw-r--r--pkgs/development/python-modules/kubernetes/default.nix2
-rw-r--r--pkgs/development/python-modules/labelbox/default.nix2
-rw-r--r--pkgs/development/python-modules/labgrid/default.nix2
-rw-r--r--pkgs/development/python-modules/lacuscore/default.nix2
-rw-r--r--pkgs/development/python-modules/langchain-core/default.nix2
-rw-r--r--pkgs/development/python-modules/langfuse/default.nix2
-rw-r--r--pkgs/development/python-modules/langsmith/default.nix3
-rw-r--r--pkgs/development/python-modules/ledgerblue/default.nix2
-rw-r--r--pkgs/development/python-modules/librespot/default.nix2
-rw-r--r--pkgs/development/python-modules/libretranslate/default.nix2
-rw-r--r--pkgs/development/python-modules/linear-operator/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-agent-openai/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-embeddings-google/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-program-openai/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-readers-file/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-readers-llama-parse/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-vector-stores-google/default.nix2
-rw-r--r--pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix2
-rw-r--r--pkgs/development/python-modules/lsassy/default.nix2
-rw-r--r--pkgs/development/python-modules/maison/default.nix2
-rw-r--r--pkgs/development/python-modules/makefun/default.nix6
-rw-r--r--pkgs/development/python-modules/mandown/default.nix2
-rw-r--r--pkgs/development/python-modules/manifest-ml/default.nix2
-rw-r--r--pkgs/development/python-modules/manim-slides/default.nix2
-rw-r--r--pkgs/development/python-modules/manim/default.nix2
-rw-r--r--pkgs/development/python-modules/markdown-it-py/default.nix2
-rw-r--r--pkgs/development/python-modules/material-color-utilities/default.nix2
-rw-r--r--pkgs/development/python-modules/matplotlib/default.nix82
-rw-r--r--pkgs/development/python-modules/meteofrance-api/default.nix2
-rw-r--r--pkgs/development/python-modules/miauth/default.nix2
-rw-r--r--pkgs/development/python-modules/mido/default.nix2
-rw-r--r--pkgs/development/python-modules/minichain/default.nix2
-rw-r--r--pkgs/development/python-modules/mitmproxy/default.nix2
-rw-r--r--pkgs/development/python-modules/mkdocs-jupyter/default.nix2
-rw-r--r--pkgs/development/python-modules/mlflow/default.nix2
-rw-r--r--pkgs/development/python-modules/mobi/default.nix2
-rw-r--r--pkgs/development/python-modules/moddb/default.nix2
-rw-r--r--pkgs/development/python-modules/model-checker/default.nix2
-rw-r--r--pkgs/development/python-modules/moderngl-window/default.nix2
-rw-r--r--pkgs/development/python-modules/molbar/default.nix2
-rw-r--r--pkgs/development/python-modules/molecule/plugins.nix2
-rw-r--r--pkgs/development/python-modules/mpris-server/default.nix2
-rw-r--r--pkgs/development/python-modules/mwcli/default.nix2
-rw-r--r--pkgs/development/python-modules/myjwt/default.nix2
-rw-r--r--pkgs/development/python-modules/mypy-protobuf/default.nix2
-rw-r--r--pkgs/development/python-modules/myst-parser/default.nix2
-rw-r--r--pkgs/development/python-modules/nbdev/default.nix2
-rw-r--r--pkgs/development/python-modules/nbmake/default.nix2
-rw-r--r--pkgs/development/python-modules/nethsm/default.nix2
-rw-r--r--pkgs/development/python-modules/netio/default.nix2
-rw-r--r--pkgs/development/python-modules/niaaml/default.nix2
-rw-r--r--pkgs/development/python-modules/niaclass/default.nix2
-rw-r--r--pkgs/development/python-modules/nipype/default.nix2
-rw-r--r--pkgs/development/python-modules/nitransforms/default.nix2
-rw-r--r--pkgs/development/python-modules/norfair/default.nix2
-rw-r--r--pkgs/development/python-modules/notify-py/default.nix2
-rw-r--r--pkgs/development/python-modules/notus-scanner/default.nix2
-rw-r--r--pkgs/development/python-modules/numba-scipy/default.nix2
-rw-r--r--pkgs/development/python-modules/numpy/1.nix (renamed from pkgs/development/python-modules/numpy/default.nix)0
-rw-r--r--pkgs/development/python-modules/numpy/2.nix180
-rw-r--r--pkgs/development/python-modules/oci/default.nix2
-rw-r--r--pkgs/development/python-modules/odp-amsterdam/default.nix2
-rw-r--r--pkgs/development/python-modules/ollama/default.nix2
-rw-r--r--pkgs/development/python-modules/onnxruntime/default.nix3
-rw-r--r--pkgs/development/python-modules/open-interpreter/default.nix2
-rw-r--r--pkgs/development/python-modules/openai-triton/bin.nix3
-rw-r--r--pkgs/development/python-modules/openai-triton/default.nix2
-rw-r--r--pkgs/development/python-modules/openllm-core/default.nix2
-rw-r--r--pkgs/development/python-modules/openllm/default.nix2
-rw-r--r--pkgs/development/python-modules/opentelemetry-api/default.nix2
-rw-r--r--pkgs/development/python-modules/orange3/default.nix2
-rw-r--r--pkgs/development/python-modules/orjson/default.nix6
-rw-r--r--pkgs/development/python-modules/ormar/default.nix2
-rw-r--r--pkgs/development/python-modules/osqp/default.nix2
-rw-r--r--pkgs/development/python-modules/oss2/default.nix2
-rw-r--r--pkgs/development/python-modules/ossfs/default.nix2
-rw-r--r--pkgs/development/python-modules/paddleocr/default.nix2
-rw-r--r--pkgs/development/python-modules/panel/default.nix2
-rw-r--r--pkgs/development/python-modules/parsedmarc/default.nix2
-rw-r--r--pkgs/development/python-modules/pathy/default.nix2
-rw-r--r--pkgs/development/python-modules/pdb2pqr/default.nix2
-rw-r--r--pkgs/development/python-modules/pdf2docx/default.nix2
-rw-r--r--pkgs/development/python-modules/pelican/default.nix2
-rw-r--r--pkgs/development/python-modules/pikepdf/default.nix4
-rw-r--r--pkgs/development/python-modules/pinecone-client/default.nix2
-rw-r--r--pkgs/development/python-modules/pixel-font-builder/default.nix2
-rw-r--r--pkgs/development/python-modules/pkutils/default.nix2
-rw-r--r--pkgs/development/python-modules/playwright/default.nix2
-rw-r--r--pkgs/development/python-modules/playwrightcapture/default.nix2
-rw-r--r--pkgs/development/python-modules/polyswarm-api/default.nix2
-rw-r--r--pkgs/development/python-modules/ppscore/default.nix2
-rw-r--r--pkgs/development/python-modules/prometrix/default.nix2
-rw-r--r--pkgs/development/python-modules/ptyprocess/default.nix4
-rw-r--r--pkgs/development/python-modules/pwndbg/default.nix2
-rw-r--r--pkgs/development/python-modules/py-pdf-parser/default.nix2
-rw-r--r--pkgs/development/python-modules/pyasn1-modules/default.nix23
-rw-r--r--pkgs/development/python-modules/pyatv/default.nix2
-rw-r--r--pkgs/development/python-modules/pybids/default.nix2
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix9
-rw-r--r--pkgs/development/python-modules/pycardano/default.nix2
-rw-r--r--pkgs/development/python-modules/pycfmodel/default.nix2
-rw-r--r--pkgs/development/python-modules/pycookiecheat/default.nix2
-rw-r--r--pkgs/development/python-modules/pydantic-core/default.nix6
-rw-r--r--pkgs/development/python-modules/pydantic/default.nix21
-rw-r--r--pkgs/development/python-modules/pydicom-seg/default.nix2
-rw-r--r--pkgs/development/python-modules/pydiscovergy/default.nix2
-rw-r--r--pkgs/development/python-modules/pydyf/default.nix4
-rw-r--r--pkgs/development/python-modules/pyefergy/default.nix2
-rw-r--r--pkgs/development/python-modules/pygitguardian/default.nix2
-rw-r--r--pkgs/development/python-modules/pygls/default.nix2
-rw-r--r--pkgs/development/python-modules/pygments/default.nix9
-rw-r--r--pkgs/development/python-modules/pykoplenti/default.nix2
-rw-r--r--pkgs/development/python-modules/pylxd/default.nix2
-rw-r--r--pkgs/development/python-modules/pymilvus/default.nix2
-rw-r--r--pkgs/development/python-modules/pyngo/default.nix2
-rw-r--r--pkgs/development/python-modules/pynitrokey/default.nix2
-rw-r--r--pkgs/development/python-modules/pyopencl/default.nix4
-rw-r--r--pkgs/development/python-modules/pyowm/default.nix2
-rw-r--r--pkgs/development/python-modules/pyquil/default.nix2
-rw-r--r--pkgs/development/python-modules/pysaml2/default.nix2
-rw-r--r--pkgs/development/python-modules/pysigma-backend-insightidr/default.nix2
-rw-r--r--pkgs/development/python-modules/pysigma-backend-opensearch/default.nix2
-rw-r--r--pkgs/development/python-modules/pysigma-backend-qradar/default.nix2
-rw-r--r--pkgs/development/python-modules/pysigma/default.nix2
-rw-r--r--pkgs/development/python-modules/pysilero-vad/default.nix2
-rw-r--r--pkgs/development/python-modules/pysolcast/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-examples/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-golden/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-httpx/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-notebook/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-regressions/default.nix5
-rw-r--r--pkgs/development/python-modules/python-benedict/default.nix2
-rw-r--r--pkgs/development/python-modules/python-fx/default.nix2
-rw-r--r--pkgs/development/python-modules/python-jenkins/default.nix2
-rw-r--r--pkgs/development/python-modules/python-lsp-server/default.nix1
-rw-r--r--pkgs/development/python-modules/python-matter-server/default.nix2
-rw-r--r--pkgs/development/python-modules/python-ndn/default.nix2
-rw-r--r--pkgs/development/python-modules/python-roborock/default.nix2
-rw-r--r--pkgs/development/python-modules/qcs-api-client/default.nix2
-rw-r--r--pkgs/development/python-modules/qudida/default.nix2
-rw-r--r--pkgs/development/python-modules/questionary/default.nix2
-rw-r--r--pkgs/development/python-modules/radios/default.nix2
-rw-r--r--pkgs/development/python-modules/ray/default.nix2
-rw-r--r--pkgs/development/python-modules/redis-om/default.nix2
-rw-r--r--pkgs/development/python-modules/remarshal/default.nix2
-rw-r--r--pkgs/development/python-modules/reptor/default.nix2
-rw-r--r--pkgs/development/python-modules/reqif/default.nix2
-rw-r--r--pkgs/development/python-modules/rich-pixels/default.nix4
-rw-r--r--pkgs/development/python-modules/riscv-config/default.nix2
-rw-r--r--pkgs/development/python-modules/rising/default.nix2
-rw-r--r--pkgs/development/python-modules/rmrl/default.nix2
-rw-r--r--pkgs/development/python-modules/rmscene/default.nix2
-rw-r--r--pkgs/development/python-modules/rnginline/default.nix2
-rw-r--r--pkgs/development/python-modules/roadrecon/default.nix2
-rw-r--r--pkgs/development/python-modules/robomachine/default.nix2
-rw-r--r--pkgs/development/python-modules/roombapy/default.nix2
-rw-r--r--pkgs/development/python-modules/safety-schemas/default.nix2
-rw-r--r--pkgs/development/python-modules/safety/default.nix2
-rw-r--r--pkgs/development/python-modules/sagemaker/default.nix2
-rw-r--r--pkgs/development/python-modules/sarif-tools/default.nix2
-rw-r--r--pkgs/development/python-modules/schema-salad/default.nix1
-rw-r--r--pkgs/development/python-modules/schema/default.nix2
-rw-r--r--pkgs/development/python-modules/scikit-learn/default.nix2
-rw-r--r--pkgs/development/python-modules/sev-snp-measure/default.nix2
-rw-r--r--pkgs/development/python-modules/signalslot/default.nix2
-rw-r--r--pkgs/development/python-modules/sisyphus-control/default.nix2
-rw-r--r--pkgs/development/python-modules/skl2onnx/default.nix2
-rw-r--r--pkgs/development/python-modules/snowflake-connector-python/default.nix2
-rw-r--r--pkgs/development/python-modules/spacy-transformers/default.nix2
-rw-r--r--pkgs/development/python-modules/spacy/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx-prompt/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx-rtd-theme/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix14
-rw-r--r--pkgs/development/python-modules/sphinxawesome-theme/default.nix3
-rw-r--r--pkgs/development/python-modules/spsdk/default.nix2
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/steamship/default.nix2
-rw-r--r--pkgs/development/python-modules/streamlit/default.nix2
-rw-r--r--pkgs/development/python-modules/succulent/default.nix2
-rw-r--r--pkgs/development/python-modules/svg2tikz/default.nix2
-rw-r--r--pkgs/development/python-modules/syncedlyrics/default.nix2
-rw-r--r--pkgs/development/python-modules/synologydsm-api/default.nix2
-rw-r--r--pkgs/development/python-modules/tabcmd/default.nix2
-rw-r--r--pkgs/development/python-modules/tableauserverclient/default.nix2
-rw-r--r--pkgs/development/python-modules/tago/default.nix2
-rw-r--r--pkgs/development/python-modules/tagoio-sdk/default.nix2
-rw-r--r--pkgs/development/python-modules/taskw-ng/default.nix2
-rw-r--r--pkgs/development/python-modules/tbm-utils/default.nix2
-rw-r--r--pkgs/development/python-modules/tensorboard/default.nix2
-rw-r--r--pkgs/development/python-modules/testtools/default.nix2
-rw-r--r--pkgs/development/python-modules/textnets/default.nix2
-rw-r--r--pkgs/development/python-modules/tf-keras/default.nix2
-rw-r--r--pkgs/development/python-modules/tf2onnx/default.nix2
-rw-r--r--pkgs/development/python-modules/thelogrus/default.nix2
-rw-r--r--pkgs/development/python-modules/tilequant/default.nix2
-rw-r--r--pkgs/development/python-modules/tinycss2/default.nix10
-rw-r--r--pkgs/development/python-modules/torch/default.nix2
-rw-r--r--pkgs/development/python-modules/treex/default.nix2
-rw-r--r--pkgs/development/python-modules/tubeup/default.nix2
-rw-r--r--pkgs/development/python-modules/twill/default.nix2
-rw-r--r--pkgs/development/python-modules/twisted/default.nix4
-rw-r--r--pkgs/development/python-modules/txtai/default.nix2
-rw-r--r--pkgs/development/python-modules/typeguard/default.nix16
-rw-r--r--pkgs/development/python-modules/typer-shell/default.nix2
-rw-r--r--pkgs/development/python-modules/typical/default.nix2
-rw-r--r--pkgs/development/python-modules/ufo2ft/default.nix2
-rw-r--r--pkgs/development/python-modules/universal-silabs-flasher/default.nix2
-rw-r--r--pkgs/development/python-modules/uplc/default.nix2
-rw-r--r--pkgs/development/python-modules/vallox-websocket-api/default.nix2
-rw-r--r--pkgs/development/python-modules/vdirsyncer/default.nix2
-rw-r--r--pkgs/development/python-modules/vega/default.nix2
-rw-r--r--pkgs/development/python-modules/vivisect/default.nix2
-rw-r--r--pkgs/development/python-modules/vt-py/default.nix2
-rw-r--r--pkgs/development/python-modules/vulcan-api/default.nix2
-rw-r--r--pkgs/development/python-modules/wandb/default.nix2
-rw-r--r--pkgs/development/python-modules/weasel/default.nix2
-rw-r--r--pkgs/development/python-modules/weasyprint/default.nix6
-rw-r--r--pkgs/development/python-modules/weasyprint/library-paths.patch9
-rw-r--r--pkgs/development/python-modules/weaviate-client/default.nix2
-rw-r--r--pkgs/development/python-modules/weconnect-mqtt/default.nix2
-rw-r--r--pkgs/development/python-modules/wheel-inspect/default.nix2
-rw-r--r--pkgs/development/python-modules/woob/default.nix2
-rw-r--r--pkgs/development/python-modules/xarray-dataclasses/default.nix2
-rw-r--r--pkgs/development/python-modules/xhtml2pdf/default.nix2
-rw-r--r--pkgs/development/python-modules/xiaomi-ble/default.nix2
-rw-r--r--pkgs/development/python-modules/yark/default.nix2
-rw-r--r--pkgs/development/python-modules/ypy-websocket/default.nix2
-rw-r--r--pkgs/development/python-modules/zha/default.nix2
-rw-r--r--pkgs/development/python-modules/zope-interface/default.nix13
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix1
-rw-r--r--pkgs/development/tools/boost-build/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/conan/default.nix1
-rw-r--r--pkgs/development/tools/circup/default.nix1
-rw-r--r--pkgs/development/tools/continuous-integration/buildbot/master.nix2
-rw-r--r--pkgs/development/tools/djlint/default.nix1
-rw-r--r--pkgs/development/tools/documentation/gi-docgen/default.nix4
-rw-r--r--pkgs/development/tools/enochecker-test/default.nix2
-rw-r--r--pkgs/development/tools/fdroidserver/default.nix2
-rw-r--r--pkgs/development/tools/jq/default.nix5
-rw-r--r--pkgs/development/tools/misc/luarocks/default.nix8
-rw-r--r--pkgs/development/tools/prospector/default.nix1
-rw-r--r--pkgs/development/tools/skjold/default.nix1
-rw-r--r--pkgs/development/web/nodejs/nodejs.nix18
-rw-r--r--pkgs/development/web/nodejs/use-correct-env-in-tests.patch24
-rw-r--r--pkgs/development/web/nodejs/v18.nix7
-rw-r--r--pkgs/development/web/nodejs/v20.nix12
-rw-r--r--pkgs/development/web/nodejs/v22.nix7
-rw-r--r--pkgs/games/empty-epsilon/default.nix22
-rw-r--r--pkgs/games/frogatto/engine.nix2
-rw-r--r--pkgs/games/katago/default.nix2
-rw-r--r--pkgs/games/solarus/default.nix4
-rw-r--r--pkgs/misc/drivers/hplip/default.nix2
-rw-r--r--pkgs/misc/flashfocus/default.nix1
-rw-r--r--pkgs/misc/ghostscript/default.nix6
-rw-r--r--pkgs/misc/lilypond/default.nix2
-rw-r--r--pkgs/misc/rich-cli/default.nix1
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix6
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix4
-rw-r--r--pkgs/os-specific/linux/ffado/default.nix4
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix17
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/config.nix19
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--pkgs/os-specific/windows/mingw-w64/default.nix2
-rw-r--r--pkgs/servers/apache-airflow/default.nix1
-rw-r--r--pkgs/servers/apache-airflow/python-package.nix2
-rw-r--r--pkgs/servers/home-assistant/appdaemon.nix1
-rw-r--r--pkgs/servers/home-assistant/default.nix2
-rw-r--r--pkgs/servers/ldap/lldap/default.nix4
-rw-r--r--pkgs/servers/memcached/default.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/dmarc-metrics-exporter/default.nix1
-rw-r--r--pkgs/servers/pinnwand/default.nix1
-rw-r--r--pkgs/stdenv/darwin/default.nix6
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix1
-rw-r--r--pkgs/stdenv/generic/setup.sh82
-rw-r--r--pkgs/stdenv/linux/bootstrap-tools/default.nix7
-rw-r--r--pkgs/tools/X11/xdg-utils/default.nix7
-rw-r--r--pkgs/tools/admin/ansible/doctor.nix1
-rw-r--r--pkgs/tools/admin/ansible/later.nix1
-rw-r--r--pkgs/tools/admin/ansible/lint.nix1
-rw-r--r--pkgs/tools/admin/awscli/default.nix4
-rw-r--r--pkgs/tools/admin/gimme-aws-creds/default.nix1
-rw-r--r--pkgs/tools/admin/turbovnc/default.nix2
-rw-r--r--pkgs/tools/audio/spotdl/default.nix1
-rw-r--r--pkgs/tools/audio/wyoming/faster-whisper.nix1
-rw-r--r--pkgs/tools/audio/wyoming/openwakeword.nix1
-rw-r--r--pkgs/tools/audio/wyoming/piper.nix1
-rw-r--r--pkgs/tools/backup/tarsnapper/default.nix1
-rw-r--r--pkgs/tools/backup/zfs-autobackup/default.nix1
-rw-r--r--pkgs/tools/compression/lz4/default.nix69
-rw-r--r--pkgs/tools/filesystems/rmfuse/default.nix1
-rw-r--r--pkgs/tools/games/steamback/default.nix2
-rw-r--r--pkgs/tools/graphics/asymptote/default.nix4
-rw-r--r--pkgs/tools/graphics/mesa-demos/default.nix8
-rw-r--r--pkgs/tools/graphics/vulkan-cts/default.nix6
-rw-r--r--pkgs/tools/misc/csvs-to-sqlite/default.nix1
-rw-r--r--pkgs/tools/misc/cyclonedx-python/default.nix1
-rw-r--r--pkgs/tools/misc/esphome/default.nix1
-rw-r--r--pkgs/tools/misc/expect/0004-enable-cross-compilation.patch295
-rw-r--r--pkgs/tools/misc/expect/default.nix12
-rw-r--r--pkgs/tools/misc/expect/fix-build-time-run-tcl.patch (renamed from pkgs/tools/misc/expect/fix-cross-compilation.patch)0
-rw-r--r--pkgs/tools/misc/expect/fix-darwin-bsd-clang16.patch (renamed from pkgs/tools/misc/expect/fix-darwin-clang16.patch)13
-rw-r--r--pkgs/tools/misc/expect/freebsd-unversioned.patch14
-rw-r--r--pkgs/tools/misc/nanoemoji/default.nix1
-rw-r--r--pkgs/tools/misc/parquet-tools/default.nix1
-rw-r--r--pkgs/tools/misc/piston-cli/default.nix1
-rw-r--r--pkgs/tools/misc/pricehist/default.nix2
-rw-r--r--pkgs/tools/misc/sqlite3-to-mysql/default.nix1
-rw-r--r--pkgs/tools/misc/yubikey-manager/default.nix1
-rw-r--r--pkgs/tools/networking/burpsuite/default.nix1
-rw-r--r--pkgs/tools/networking/cloud-custodian/default.nix1
-rw-r--r--pkgs/tools/security/amoco/default.nix1
-rw-r--r--pkgs/tools/security/cfripper/default.nix1
-rw-r--r--pkgs/tools/security/coercer/default.nix1
-rw-r--r--pkgs/tools/security/crackmapexec/default.nix1
-rw-r--r--pkgs/tools/security/crackql/default.nix1
-rw-r--r--pkgs/tools/security/enpass/default.nix1
-rw-r--r--pkgs/tools/security/expliot/default.nix1
-rw-r--r--pkgs/tools/security/faraday-agent-dispatcher/default.nix1
-rw-r--r--pkgs/tools/security/gallia/default.nix1
-rw-r--r--pkgs/tools/security/ggshield/default.nix1
-rw-r--r--pkgs/tools/security/ioccheck/default.nix1
-rw-r--r--pkgs/tools/security/knockpy/default.nix1
-rw-r--r--pkgs/tools/security/knowsmore/default.nix1
-rw-r--r--pkgs/tools/security/ldeep/default.nix1
-rw-r--r--pkgs/tools/security/maigret/default.nix1
-rw-r--r--pkgs/tools/security/mitmproxy2swagger/default.nix1
-rw-r--r--pkgs/tools/security/netexec/default.nix1
-rw-r--r--pkgs/tools/security/ospd-openvas/default.nix1
-rw-r--r--pkgs/tools/security/quark-engine/default.nix1
-rw-r--r--pkgs/tools/security/semgrep/default.nix2
-rw-r--r--pkgs/tools/security/tell-me-your-secrets/default.nix1
-rw-r--r--pkgs/tools/security/trueseeing/default.nix1
-rw-r--r--pkgs/tools/security/wapiti/default.nix1
-rw-r--r--pkgs/tools/security/yaralyzer/default.nix1
-rw-r--r--pkgs/tools/system/nvitop/default.nix1
-rw-r--r--pkgs/tools/text/frogmouth/default.nix1
-rw-r--r--pkgs/tools/typesetting/tex/nix/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix2
-rw-r--r--pkgs/tools/virtualization/awsebcli/default.nix1
-rw-r--r--pkgs/top-level/all-packages.nix25
-rw-r--r--pkgs/top-level/java-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix8
-rw-r--r--pkgs/top-level/stage.nix2
686 files changed, 2719 insertions, 2120 deletions
diff --git a/pkgs/applications/audio/ledfx/default.nix b/pkgs/applications/audio/ledfx/default.nix
index f45c7dc3af558..593fd72c6d0ce 100644
--- a/pkgs/applications/audio/ledfx/default.nix
+++ b/pkgs/applications/audio/ledfx/default.nix
@@ -26,7 +26,6 @@ python3.pkgs.buildPythonPackage rec {
     poetry-core
   ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     aiohttp
diff --git a/pkgs/applications/audio/puddletag/default.nix b/pkgs/applications/audio/puddletag/default.nix
index 97ea40d7438b4..09ed89bb2ba21 100644
--- a/pkgs/applications/audio/puddletag/default.nix
+++ b/pkgs/applications/audio/puddletag/default.nix
@@ -45,7 +45,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    python3.pkgs.pythonRelaxDepsHook
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/applications/backup/unifi-protect-backup/default.nix b/pkgs/applications/backup/unifi-protect-backup/default.nix
index 4981d509e236d..fdac36e492f25 100644
--- a/pkgs/applications/backup/unifi-protect-backup/default.nix
+++ b/pkgs/applications/backup/unifi-protect-backup/default.nix
@@ -40,7 +40,6 @@ python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python.pkgs; [
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 6af16ffac8a46..9b18e6d13de18 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -92,8 +92,5 @@ rustPlatform.buildRustPackage rec {
     maintainers = with maintainers; [ akru andresilva FlorianFranzen RaghavSood ];
     # See Iso::from_arch in src/isa/mod.rs in cranelift-codegen-meta.
     platforms = intersectLists platforms.unix (platforms.aarch64 ++ platforms.s390x ++ platforms.riscv64 ++ platforms.x86);
-    # See comment about wasm32-unknown-unknown in rustc.nix.
-    broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-      !stdenv.hostPlatform.gcc.thumb or true;
   };
 }
diff --git a/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix b/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix
index 36576f7c12398..391065ccfb20d 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix
@@ -79,7 +79,8 @@ in {
         lib.nameValuePair ename (
           self.callPackage ({ melpaBuild, fetchurl, ... }@pkgargs:
           melpaBuild {
-            inherit pname ename commit;
+            inherit pname ename;
+            inherit (sourceArgs) commit;
             version = lib.optionalString (version != null)
               (lib.concatStringsSep "." (map toString
                 # Hack: Melpa archives contains versions with parse errors such as [ 4 4 -4 413 ] which should be 4.4-413
diff --git a/pkgs/applications/editors/neovim/tests/default.nix b/pkgs/applications/editors/neovim/tests/default.nix
index b07f517ea474a..c2e6b565de282 100644
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@@ -43,6 +43,14 @@ let
     '';
   };
 
+  nvim-with-luasnip = wrapNeovim2 "-with-lua-packages" (makeNeovimConfig {
+    plugins = [ {
+        plugin = vimPlugins.luasnip;
+
+      }
+    ];
+  });
+
   nvimAutoDisableWrap = makeNeovimConfig { };
 
   wrapNeovim2 = suffix: config:
@@ -281,4 +289,16 @@ rec {
     export HOME=$TMPDIR
     ${nvim_with_opt_plugin}/bin/nvim -i NONE +quit! -e
   '';
+
+  inherit nvim-with-luasnip;
+
+  # check that bringing in one plugin with lua deps makes those deps visible from wrapper
+  # for instance luasnip has a dependency on jsregexp
+  can_require_transitive_deps =
+    runTest nvim-with-luasnip ''
+    export HOME=$TMPDIR
+    cat ${nvim-with-luasnip}/bin/nvim
+    ${nvim-with-luasnip}/bin/nvim -i NONE --cmd "lua require'jsregexp'" -e
+  '';
+
 })
diff --git a/pkgs/applications/editors/neovim/utils.nix b/pkgs/applications/editors/neovim/utils.nix
index 8f9a5b880032c..902d62d9486a0 100644
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@@ -229,12 +229,36 @@ let
         ln -s ${grammar}/parser $out/parser/${name}.so
       '');
 
+  /*
+    Fork of vimUtils.packDir that additionnally generates a propagated-build-inputs-file that
+    can be used by the lua hooks to generate a proper LUA_PATH
+
+    Generates a packpath folder as expected by vim
+       Example:
+       packDir ( {myVimPackage = { start = [ vimPlugins.vim-fugitive ]; opt = []; }; })
+       => "/nix/store/xxxxx-pack-dir"
+  */
+  packDir = packages:
+  let
+    rawPackDir = vimUtils.packDir packages;
+
+  in
+    rawPackDir.override ({
+    postBuild = ''
+      mkdir $out/nix-support
+      for i in $(find -L $out -name propagated-build-inputs ); do
+        cat "$i" >> $out/nix-support/propagated-build-inputs
+      done
+      '';});
+
+
 in
 {
   inherit makeNeovimConfig;
   inherit generateProviderRc;
   inherit legacyWrapper;
   inherit grammarToPlugin;
+  inherit packDir;
 
   inherit buildNeovimPlugin;
   buildNeovimPluginFrom2Nix = lib.warn "buildNeovimPluginFrom2Nix was renamed to buildNeovimPlugin" buildNeovimPlugin;
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index e877f1e1f764a..d86de46c87385 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -13,6 +13,9 @@
 neovim-unwrapped:
 
 let
+  # inherit interpreter from neovim
+  lua = neovim-unwrapped.lua;
+
   wrapper = {
       extraName ? ""
     # should contain all args but the binary. Can be either a string or list
@@ -24,6 +27,8 @@ let
     , withNodeJs ? false
     , withPerl ? false
     , rubyEnv ? null
+
+    # wether to create symlinks in $out/bin/vi(m) -> $out/bin/nvim
     , vimAlias ? false
     , viAlias ? false
 
@@ -45,6 +50,8 @@ let
   stdenv.mkDerivation (finalAttrs:
   let
 
+    finalPackdir = neovimUtils.packDir packpathDirs;
+
     rcContent = ''
       ${luaRcContent}
     '' + lib.optionalString (!isNull neovimRcContent) ''
@@ -57,10 +64,10 @@ let
       # vim accepts a limited number of commands so we join them all
           [
             "--add-flags" ''--cmd "lua ${providerLuaRc}"''
-            # (lib.intersperse "|" hostProviderViml)
-          ] ++ lib.optionals (packpathDirs.myNeovimPackages.start != [] || packpathDirs.myNeovimPackages.opt != []) [
-            "--add-flags" ''--cmd "set packpath^=${vimUtils.packDir packpathDirs}"''
-            "--add-flags" ''--cmd "set rtp^=${vimUtils.packDir packpathDirs}"''
+          ]
+          ++ lib.optionals (packpathDirs.myNeovimPackages.start != [] || packpathDirs.myNeovimPackages.opt != []) [
+            "--add-flags" ''--cmd "set packpath^=${finalPackdir}"''
+            "--add-flags" ''--cmd "set rtp^=${finalPackdir}"''
           ]
           ;
 
@@ -160,7 +167,17 @@ let
       + ''
         rm $out/bin/nvim
         touch $out/rplugin.vim
-        makeWrapper ${lib.escapeShellArgs finalMakeWrapperArgs} ${wrapperArgsStr}
+
+        echo "Looking for lua dependencies..."
+        source ${lua}/nix-support/utils.sh
+
+        _addToLuaPath "${finalPackdir}"
+
+        echo "LUA_PATH towards the end of packdir: $LUA_PATH"
+
+        makeWrapper ${lib.escapeShellArgs finalMakeWrapperArgs} ${wrapperArgsStr} \
+            --prefix LUA_PATH ';' "$LUA_PATH" \
+            --prefix LUA_CPATH ';' "$LUA_CPATH"
       '';
 
     buildPhase = ''
diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index dfc72683d7d3b..54fea4cc901ea 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -176,7 +176,7 @@ lib.optionalAttrs (buildScript != null) { builder = buildScript; }
 
   # https://bugs.winehq.org/show_bug.cgi?id=43530
   # https://github.com/NixOS/nixpkgs/issues/31989
-  hardeningDisable = [ "bindnow" ]
+  hardeningDisable = [ "bindnow" "stackclashprotection" ]
     ++ lib.optional (stdenv.hostPlatform.isDarwin) "fortify"
     ++ lib.optional (supportFlags.mingwSupport) "format";
 
diff --git a/pkgs/applications/file-managers/browsr/default.nix b/pkgs/applications/file-managers/browsr/default.nix
index ba88f782ef657..92895378c355e 100644
--- a/pkgs/applications/file-managers/browsr/default.nix
+++ b/pkgs/applications/file-managers/browsr/default.nix
@@ -18,7 +18,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/graphics/ImageMagick/6.x.nix b/pkgs/applications/graphics/ImageMagick/6.x.nix
index 99810a8d496f4..722363a9b0706 100644
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeatureAs (arch != null) "gcc-arch" arch)
     (lib.withFeature librsvgSupport "rsvg")
     (lib.withFeature liblqr1Support "lqr")
-    (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript}/share/ghostscript/fonts")
+    (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript.fonts}/share/fonts")
     (lib.withFeature ghostscriptSupport "gslib")
   ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
     # due to libxml2 being without DLLs ATM
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 491ef7c1f538c..4a6ad6aefc0d5 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeature librsvgSupport "pango")
     (lib.withFeature liblqr1Support "lqr")
     (lib.withFeature libjxlSupport "jxl")
-    (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript}/share/ghostscript/fonts")
+    (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript.fonts}/share/fonts")
     (lib.withFeature ghostscriptSupport "gslib")
   ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
     # due to libxml2 being without DLLs ATM
diff --git a/pkgs/applications/misc/archivy/default.nix b/pkgs/applications/misc/archivy/default.nix
index c81d4f65d785e..0bb9a89325e54 100644
--- a/pkgs/applications/misc/archivy/default.nix
+++ b/pkgs/applications/misc/archivy/default.nix
@@ -32,7 +32,6 @@ buildPythonApplication rec {
     hash = "sha256-ns1Y0DqqnTAQMEt+oBJ/P2gqKqPsX9P3/Z4561qzuns";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = true;
 
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index e54cae9e56a24..18d76788dadf6 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -341,10 +341,10 @@ stdenv.mkDerivation (finalAttrs: {
       };
 
     tests = {
-      render = runCommand "${finalAttrs.pname}-test" { } ''
+      render = runCommand "${finalAttrs.pname}-test" {
+        nativeBuildInputs = [ mesa.llvmpipeHook ];
+      } ''
         set -euo pipefail
-        export LIBGL_DRIVERS_PATH=${mesa.drivers}/lib/dri
-        export __EGL_VENDOR_LIBRARY_FILENAMES=${mesa.drivers}/share/glvnd/egl_vendor.d/50_mesa.json
         cat <<'PYTHON' > scene-config.py
         import bpy
         bpy.context.scene.eevee.taa_render_samples = 32
diff --git a/pkgs/applications/misc/dbx/default.nix b/pkgs/applications/misc/dbx/default.nix
index 9dc19941a0720..95fd50b1e2411 100644
--- a/pkgs/applications/misc/dbx/default.nix
+++ b/pkgs/applications/misc/dbx/default.nix
@@ -30,7 +30,6 @@ python.pkgs.buildPythonApplication rec {
 
   build-system = with python.pkgs; [ setuptools ];
 
-  nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs =
     with python.pkgs;
diff --git a/pkgs/applications/misc/pagefind/default.nix b/pkgs/applications/misc/pagefind/default.nix
index aa0fb08984edc..2da4e5eb7eb10 100644
--- a/pkgs/applications/misc/pagefind/default.nix
+++ b/pkgs/applications/misc/pagefind/default.nix
@@ -8,7 +8,6 @@
 , gzip
 , nodejs
 , rustc
-, stdenv
 , wasm-bindgen-cli
 , wasm-pack
 }:
@@ -121,9 +120,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ pbsds ];
     platforms = platforms.unix;
-    # See comment about wasm32-unknown-unknown in rustc.nix.
-    broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-      !stdenv.hostPlatform.gcc.thumb or true;
     mainProgram = "pagefind";
   };
 }
diff --git a/pkgs/applications/misc/pysentation/default.nix b/pkgs/applications/misc/pysentation/default.nix
index ad2d9c02e683a..41568d0295b32 100644
--- a/pkgs/applications/misc/pysentation/default.nix
+++ b/pkgs/applications/misc/pysentation/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/applications/misc/shell-genie/default.nix b/pkgs/applications/misc/shell-genie/default.nix
index 728a4aabed381..df4833199d8c0 100644
--- a/pkgs/applications/misc/shell-genie/default.nix
+++ b/pkgs/applications/misc/shell-genie/default.nix
@@ -25,10 +25,6 @@ buildPythonPackage rec {
     poetry-core
   ];
 
-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
-
   dependencies = [
     colorama
     openai
diff --git a/pkgs/applications/misc/snagboot/default.nix b/pkgs/applications/misc/snagboot/default.nix
index 353712d5ba896..11f49d8506b5e 100644
--- a/pkgs/applications/misc/snagboot/default.nix
+++ b/pkgs/applications/misc/snagboot/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, pythonRelaxDepsHook
 , python3
 , snagboot
 , testers
@@ -21,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/applications/misc/yubioath-flutter/helper.nix b/pkgs/applications/misc/yubioath-flutter/helper.nix
index 2fe6bd7904d7e..378981ae84107 100644
--- a/pkgs/applications/misc/yubioath-flutter/helper.nix
+++ b/pkgs/applications/misc/yubioath-flutter/helper.nix
@@ -4,7 +4,6 @@
 , zxing-cpp
 , pillow
 , poetry-core
-, pythonRelaxDepsHook
 
 , src
 , version
@@ -21,7 +20,6 @@ buildPythonApplication {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 3616189374d30..fab1bbdff39e9 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -199,7 +199,7 @@ let
       pciutils protobuf speechd libXdamage at-spi2-core
       pipewire
       libva
-      libdrm wayland mesa.drivers libxkbcommon
+      libdrm wayland libxkbcommon
       curl
       libepoxy
       libffi
@@ -227,7 +227,7 @@ let
       pciutils protobuf speechd libXdamage at-spi2-core
       pipewire
       libva
-      libdrm wayland mesa.drivers libxkbcommon
+      libdrm wayland libxkbcommon
       curl
       libepoxy
       libffi
diff --git a/pkgs/applications/networking/cluster/tftui/default.nix b/pkgs/applications/networking/cluster/tftui/default.nix
index 9af694c683fd9..097476446676c 100644
--- a/pkgs/applications/networking/cluster/tftui/default.nix
+++ b/pkgs/applications/networking/cluster/tftui/default.nix
@@ -24,7 +24,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     makeWrapper
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/networking/dyndns/dyndnsc/default.nix b/pkgs/applications/networking/dyndns/dyndnsc/default.nix
index 930fc34603192..18e5847e67094 100644
--- a/pkgs/applications/networking/dyndns/dyndnsc/default.nix
+++ b/pkgs/applications/networking/dyndns/dyndnsc/default.nix
@@ -24,7 +24,6 @@ python3Packages.buildPythonApplication rec {
 
   build-system = with python3Packages; [ setuptools ];
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   dependencies = with python3Packages; [
     daemonocle
diff --git a/pkgs/applications/networking/errbot/default.nix b/pkgs/applications/networking/errbot/default.nix
index c94bbc8780188..c635c6fefb2a3 100644
--- a/pkgs/applications/networking/errbot/default.nix
+++ b/pkgs/applications/networking/errbot/default.nix
@@ -16,10 +16,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-BmHChLWWnrtg0p4WH8bANwpo+p4RTwjYbXfyPnz6mp8=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   pythonRelaxDeps = true;
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
index f12a51d751913..f5118bb968634 100644
--- a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
@@ -24,7 +24,6 @@ python3Packages.buildPythonApplication rec {
     installShellFiles
   ] ++ (with python3Packages; [
     setuptools
-    pythonRelaxDepsHook
   ]);
 
   pythonRelaxDeps = [
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/client5.nix b/pkgs/applications/networking/instant-messengers/teamspeak/client5.nix
index 86136dbb36d6a..e577aa110fc94 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client5.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client5.nix
@@ -52,7 +52,6 @@ stdenv.mkDerivation rec {
     libnotify
     libpulseaudio
     libxkbcommon
-    mesa.drivers
     nss
     xorg.libX11
     xorg.libXScrnSaver
diff --git a/pkgs/applications/networking/p2p/pyrosimple/default.nix b/pkgs/applications/networking/p2p/pyrosimple/default.nix
index c08f6ae4b64b1..21448538edf65 100644
--- a/pkgs/applications/networking/p2p/pyrosimple/default.nix
+++ b/pkgs/applications/networking/p2p/pyrosimple/default.nix
@@ -27,7 +27,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/science/math/sage/sagelib.nix b/pkgs/applications/science/math/sage/sagelib.nix
index 1552de773d014..f54c6a92300c3 100644
--- a/pkgs/applications/science/math/sage/sagelib.nix
+++ b/pkgs/applications/science/math/sage/sagelib.nix
@@ -6,7 +6,6 @@
 , perl
 , pkg-config
 , sage-setup
-, pythonRelaxDepsHook
 , gd
 , iml
 , libpng
@@ -103,7 +102,6 @@ buildPythonPackage rec {
     pip # needed to query installed packages
     pkg-config
     sage-setup
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/applications/terminal-emulators/rio/default.nix b/pkgs/applications/terminal-emulators/rio/default.nix
index 6b68e6bdc0f5b..48f175e67e7c4 100644
--- a/pkgs/applications/terminal-emulators/rio/default.nix
+++ b/pkgs/applications/terminal-emulators/rio/default.nix
@@ -51,16 +51,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "rio";
-  version = "0.0.39";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     rev = "v${version}";
-    hash = "sha256-pnU2wxgopHMWgJ7JGdO2P/MCfxqCY7MTEE39qtD0XKw=";
+    hash = "sha256-Jp8f8u9CkY+pz6QaoWp6P6+OqsIjhzXH0eeoBiSDR0k=";
   };
 
-  cargoHash = "sha256-GwI2zHX1YcR4pC+qtkDoxx2U+zipbqqxsCI8/XNg2BU=";
+  cargoHash = "sha256-3FirYpHxTRvXgRQACVvmwlaCNTyJ8dLbZ258qv5vbsc=";
 
   nativeBuildInputs = [
     ncurses
diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
index f0cfc626c4fa7..67fef86827439 100644
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -29,7 +29,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
     installShellFiles
   ];
 
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index d7e008d656fde..f0386bd4a273c 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -29,7 +29,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.45.1";
+  version = "2.45.2";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-5k00Co5ieuIs+4vMZRzKC0l88en99SNzVUT/SnMvEr8=";
+    hash = "sha256-Ub/ofrHAL+0UhAUYdTZe6rIpgx0w0M7F2JoU+eQOmts=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/applications/version-management/git/update.sh b/pkgs/applications/version-management/git/update.sh
index 1f70dcff42940..7aa1e90d53b3b 100755
--- a/pkgs/applications/version-management/git/update.sh
+++ b/pkgs/applications/version-management/git/update.sh
@@ -4,7 +4,7 @@
 set -eu -o pipefail
 
 oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion git" | tr -d '"')"
-latestTag="$(git ls-remote --tags --sort="v:refname" https://github.com/git/git.git | grep -v '\{\}' | grep -v '\-rc' | tail -1 | sed 's|^.*/v\(.*\)|\1|')"
+latestTag="$(git ls-remote --tags --sort="v:refname" https://github.com/git/git.git | grep -v '{}' | grep -v '\-rc' | tail -1 | sed 's|^.*/v\(.*\)|\1|')"
 targetVersion="${1:-$latestTag}"
 
 if [ ! "${oldVersion}" = "${targetVersion}" ]; then
diff --git a/pkgs/applications/version-management/gitless/default.nix b/pkgs/applications/version-management/gitless/default.nix
index 8bbb0eee971de..93014402a2ebd 100644
--- a/pkgs/applications/version-management/gitless/default.nix
+++ b/pkgs/applications/version-management/gitless/default.nix
@@ -15,7 +15,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-XDB1i2b1reMCM6i1uK3IzTnsoLXO7jldYtNlYUo1AoQ=";
   };
 
-  nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3.pkgs; [
     pygit2
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 25c2df1ad71be..5057e725010e5 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -23,11 +23,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.6.3";
+    version = "6.7.4";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-911qSnWCOht9cTpJZ+yi9Zb0ZuWPxrwG1yZCky/X4wc=";
+      hash = "sha256-dHCPhzQFwSJy/sEWxt1Shi6O0RwQARx+V19eqBJj6l4=";
     };
 
     format = "other";
@@ -37,7 +37,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-G5tzwoIGOgpVI35rYXDeelnBgTbAiq7BDcXCHQzqSrs=";
+      hash = "sha256-FRa7frX2z9jQGFBXS2TpOUANs0+xwegNETUAQIU0S4o=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
diff --git a/pkgs/applications/video/animdl/default.nix b/pkgs/applications/video/animdl/default.nix
index c8ba0264e36aa..ebe13e8b12e26 100644
--- a/pkgs/applications/video/animdl/default.nix
+++ b/pkgs/applications/video/animdl/default.nix
@@ -2,7 +2,6 @@
   buildPythonApplication,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   anchor-kr,
   anitopy,
   click,
@@ -47,7 +46,6 @@ buildPythonApplication {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
   propagatedBuildInputs = [
     anchor-kr
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 2a1fe1344e205..e7fcf173c6026 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -45,6 +45,7 @@
     "relro"
     "stackprotector"
     "strictoverflow"
+    "zerocallusedregs"
   ] ++ lib.optional (with stdenvNoCC;
     # Musl-based platforms will keep "pie", other platforms will not.
     # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
diff --git a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
index a1d06b9c6b0ae..51bfeb18f58a1 100644
--- a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
+++ b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
@@ -7,5 +7,5 @@ for p in "${params[@]}"; do
 done
 
 if $needsTarget; then
-    extraBefore+=(-target @defaultTarget@ @march@)
+    extraBefore+=(-target @defaultTarget@ @machineFlags@)
 fi
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index ef166e2f50c5e..0dca3b3347e5b 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -32,7 +32,7 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
 fi
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 stackprotector pie pic strictoverflow format trivialautovarinit zerocallusedregs)
+  declare -a allHardeningFlags=(fortify fortify3 stackprotector stackclashprotection pie pic strictoverflow format trivialautovarinit zerocallusedregs)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
@@ -79,6 +79,10 @@ for flag in "${!hardeningEnableMap[@]}"; do
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
       hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
       ;;
+    stackclashprotection)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stack-clash-protection >&2; fi
+      hardeningCFlagsBefore+=('-fstack-clash-protection')
+      ;;
     pie)
       # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 4adc1dcb1f8d8..d842f3fc70909 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -67,6 +67,7 @@ let
     concatMapStrings
     concatStringsSep
     escapeShellArg
+    escapeShellArgs
     getBin
     getDev
     getLib
@@ -234,6 +235,32 @@ let
        then guess
        else null;
 
+  thumb = if targetPlatform.gcc.thumb then "thumb" else "arm";
+  tune = if targetPlatform ? gcc.tune
+         then findBestTuneApproximation targetPlatform.gcc.tune
+         else null;
+
+  # Machine flags. These are necessary to support
+
+  # TODO: We should make a way to support miscellaneous machine
+  # flags and other gcc flags as well.
+
+  machineFlags =
+    # Always add -march based on cpu in triple. Sometimes there is a
+    # discrepency (x86_64 vs. x86-64), so we provide an "arch" arg in
+    # that case.
+    optional (targetPlatform ? gcc.arch && !(targetPlatform.isDarwin && targetPlatform.isAarch64) && isGccArchSupported targetPlatform.gcc.arch) "-march=${targetPlatform.gcc.arch}" ++
+    # TODO: aarch64-darwin has mcpu incompatible with gcc
+    optional (targetPlatform ? gcc.cpu && !(targetPlatform.isDarwin && targetPlatform.isAarch64)) "-mcpu=${targetPlatform.gcc.cpu}" ++
+    # -mfloat-abi only matters on arm32 but we set it here
+    # unconditionally just in case. If the abi specifically sets hard
+    # vs. soft floats we use it here.
+    optional (targetPlatform ? gcc.float-abi) "-mfloat-abi=${targetPlatform.gcc.float-abi}" ++
+    optional (targetPlatform ? gcc.fpu) "-mfpu=${targetPlatform.gcc.fpu}" ++
+    optional (targetPlatform ? gcc.mode) "-mmode=${targetPlatform.gcc.mode}" ++
+    optional (targetPlatform ? gcc.thumb) "-m${thumb}" ++
+    optional (tune != null) "-mtune=${tune}";
+
   defaultHardeningFlags = bintools.defaultHardeningFlags or [];
 
   # if cc.hardeningUnsupportedFlagsByTargetPlatform exists, this is
@@ -610,53 +637,11 @@ stdenvNoCC.mkDerivation {
       export hardening_unsupported_flags="${concatStringsSep " " ccHardeningUnsupportedFlags}"
     ''
 
-    # Machine flags. These are necessary to support
-
-    # TODO: We should make a way to support miscellaneous machine
-    # flags and other gcc flags as well.
-
-    # Always add -march based on cpu in triple. Sometimes there is a
-    # discrepency (x86_64 vs. x86-64), so we provide an "arch" arg in
-    # that case.
-    #
     # For clang, this is handled in add-clang-cc-cflags-before.sh
-
-    # TODO: aarch64-darwin has mcpu incompatible with gcc
-    + optionalString ((targetPlatform ? gcc.arch) && !isClang && !(targetPlatform.isDarwin && targetPlatform.isAarch64) &&
-                      isGccArchSupported targetPlatform.gcc.arch) ''
-      echo "-march=${targetPlatform.gcc.arch}" >> $out/nix-support/cc-cflags-before
-    ''
-
-    # -mcpu is not very useful, except on PowerPC where it is used
-    # instead of march. On all other platforms you should use mtune
-    # and march instead.
-    # TODO: aarch64-darwin has mcpu incompatible with gcc
-    + optionalString ((targetPlatform ? gcc.cpu) && (isClang || !(targetPlatform.isDarwin && targetPlatform.isAarch64))) ''
-      echo "-mcpu=${targetPlatform.gcc.cpu}" >> $out/nix-support/cc-cflags-before
+    + lib.optionalString (!isClang && machineFlags != []) ''
+      printf "%s\n" ${lib.escapeShellArgs machineFlags} >> $out/nix-support/cc-cflags-before
     ''
 
-    # -mfloat-abi only matters on arm32 but we set it here
-    # unconditionally just in case. If the abi specifically sets hard
-    # vs. soft floats we use it here.
-    + optionalString (targetPlatform ? gcc.float-abi) ''
-      echo "-mfloat-abi=${targetPlatform.gcc.float-abi}" >> $out/nix-support/cc-cflags-before
-    ''
-    + optionalString (targetPlatform ? gcc.fpu) ''
-      echo "-mfpu=${targetPlatform.gcc.fpu}" >> $out/nix-support/cc-cflags-before
-    ''
-    + optionalString (targetPlatform ? gcc.mode) ''
-      echo "-mmode=${targetPlatform.gcc.mode}" >> $out/nix-support/cc-cflags-before
-    ''
-    + optionalString (targetPlatform ? gcc.thumb) ''
-      echo "-m${if targetPlatform.gcc.thumb then "thumb" else "arm"}" >> $out/nix-support/cc-cflags-before
-    ''
-    + (let tune = if targetPlatform ? gcc.tune
-                  then findBestTuneApproximation targetPlatform.gcc.tune
-                  else null;
-      in optionalString (tune != null) ''
-      echo "-mtune=${tune}" >> $out/nix-support/cc-cflags-before
-    '')
-
     # TODO: categorize these and figure out a better place for them
     + optionalString targetPlatform.isWindows ''
       hardening_unsupported_flags+=" pic"
@@ -718,9 +703,7 @@ stdenvNoCC.mkDerivation {
     ##
     + optionalString isClang ''
       # Escape twice: once for this script, once for the one it gets substituted into.
-      export march=${escapeShellArg
-        (optionalString (targetPlatform ? gcc.arch)
-          (escapeShellArg "-march=${targetPlatform.gcc.arch}"))}
+      export machineFlags=${escapeShellArg (escapeShellArgs machineFlags)}
       export defaultTarget=${targetPlatform.config}
       substituteAll ${./add-clang-cc-cflags-before.sh} $out/nix-support/add-local-cc-cflags-before.sh
     ''
diff --git a/pkgs/build-support/emacs/melpa.nix b/pkgs/build-support/emacs/melpa.nix
index c8f6567049180..29b3567ec6f40 100644
--- a/pkgs/build-support/emacs/melpa.nix
+++ b/pkgs/build-support/emacs/melpa.nix
@@ -38,6 +38,11 @@ in
     Default: pname
   */
 , ename ? pname
+  /*
+    version: Either a stable version such as "1.2" or an unstable version.
+    An unstable version can use either Nix format (preferred) such as
+    "1.2-unstable-2024-06-01" or MELPA format such as "20240601.1230".
+  */
 , version
   /*
     commit: Optional package history commit.
@@ -71,6 +76,19 @@ genericBuild ({
 
   inherit packageBuild commit ename recipe;
 
+  melpaVersion =
+    let
+      parsed = lib.flip builtins.match version
+        # match <version>-unstable-YYYY-MM-DD format
+        "^.*-unstable-([[:digit:]]{4})-([[:digit:]]{2})-([[:digit:]]{2})$";
+      unstableVersionInNixFormat = parsed != null; # heuristics
+      date = builtins.concatStringsSep "" parsed;
+      time = "0"; # unstable version in nix format lacks this info
+    in
+    if unstableVersionInNixFormat
+    then date + "." + time
+    else version;
+
   preUnpack = ''
     mkdir -p "$NIX_BUILD_TOP/recipes"
     if [ -n "$recipe" ]; then
@@ -96,7 +114,7 @@ genericBuild ({
         -L "$NIX_BUILD_TOP/package-build" \
         -l "$melpa2nix" \
         -f melpa2nix-build-package \
-        $ename $version $commit
+        $ename $melpaVersion $commit
 
     runHook postBuild
     '';
@@ -104,9 +122,9 @@ genericBuild ({
   installPhase = ''
     runHook preInstall
 
-    archive="$NIX_BUILD_TOP/packages/$ename-$version.el"
+    archive="$NIX_BUILD_TOP/packages/$ename-$melpaVersion.el"
     if [ ! -f "$archive" ]; then
-        archive="$NIX_BUILD_TOP/packages/$ename-$version.tar"
+        archive="$NIX_BUILD_TOP/packages/$ename-$melpaVersion.tar"
     fi
 
     emacs --batch -Q \
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index bc28fbf6fc420..a5e722b0ac08e 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -218,8 +218,7 @@ let
       buildGoDir() {
         local cmd="$1" dir="$2"
 
-        . $TMPDIR/buildFlagsArray
-
+        declare -ga buildFlagsArray
         declare -a flags
         flags+=($buildFlags "''${buildFlagsArray[@]}")
         flags+=(''${tags:+-tags=''${tags// /,}})
@@ -258,11 +257,6 @@ let
         buildFlagsArray+=(-x)
       fi
 
-      if [ ''${#buildFlagsArray[@]} -ne 0 ]; then
-        declare -p buildFlagsArray > $TMPDIR/buildFlagsArray
-      else
-        touch $TMPDIR/buildFlagsArray
-      fi
       if [ -z "$enableParallelBuilding" ]; then
           export NIX_BUILD_CORES=1
       fi
diff --git a/pkgs/build-support/rust/hooks/maturin-build-hook.sh b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
index b3cc1ced79647..c1e701425f00d 100644
--- a/pkgs/build-support/rust/hooks/maturin-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
@@ -3,6 +3,9 @@ maturinBuildHook() {
 
     runHook preBuild
 
+    # Put the wheel to dist/ so that regular Python tooling can find it.
+    local dist="$PWD/dist"
+
     if [ ! -z "${buildAndTestSubdir-}" ]; then
         pushd "${buildAndTestSubdir}"
     fi
@@ -16,6 +19,7 @@ maturinBuildHook() {
         --manylinux off \
         --strip \
         --release \
+        --out "$dist" \
         ${maturinBuildFlags-}
     )
 
@@ -23,10 +27,6 @@ maturinBuildHook() {
         popd
     fi
 
-    # Move the wheel to dist/ so that regular Python tooling can find it.
-    mkdir -p dist
-    mv ${cargoRoot:+$cargoRoot/}target/wheels/*.whl dist/
-
     # These are python build hooks and may depend on ./dist
     runHook postBuild
 
diff --git a/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh b/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
index e103fe77d9be7..0b03460eacb65 100644
--- a/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
+++ b/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
@@ -23,10 +23,13 @@ fixDarwinDylibNames() {
     for fn in "$@"; do
         if [ -L "$fn" ]; then continue; fi
         echo "$fn: fixing dylib"
+        set +e
         int_out=$(@targetPrefix@install_name_tool -id "$fn" "${flags[@]}" "$fn" 2>&1)
         result=$?
+        set -e
         if [ "$result" -ne 0 ] &&
-            ! grep "shared library stub file and can't be changed" <<< "$out"
+            ! grep -q -e "shared library stub file and can't be changed" \
+                      -e "is not a Mach-O file" <<< "$int_out"
         then
             echo "$int_out" >&2
             exit "$result"
diff --git a/pkgs/build-support/setup-hooks/install-shell-files.sh b/pkgs/build-support/setup-hooks/install-shell-files.sh
index 194b408b10501..4f4e215da4df2 100644
--- a/pkgs/build-support/setup-hooks/install-shell-files.sh
+++ b/pkgs/build-support/setup-hooks/install-shell-files.sh
@@ -219,6 +219,11 @@ installShellCompletion() {
         else
             install -Dm644 -T "$arg" "$outPath"
         fi || return
+
+        if [ ! -s "$outPath" ]; then
+            echo "installShellCompletion: error: installed shell completion file \`$outPath' does not exist or has zero size" >&2
+            return 1
+        fi
         # Clear the per-path flags
         name=
     done
diff --git a/pkgs/by-name/ad/ad-miner/package.nix b/pkgs/by-name/ad/ad-miner/package.nix
index 4a6d93c2d91c3..30d15264eea4f 100644
--- a/pkgs/by-name/ad/ad-miner/package.nix
+++ b/pkgs/by-name/ad/ad-miner/package.nix
@@ -22,10 +22,6 @@ python3.pkgs.buildPythonApplication rec {
     poetry-core
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   dependencies = with python3.pkgs; [
     neo4j
     numpy
diff --git a/pkgs/by-name/ai/airlift/package.nix b/pkgs/by-name/ai/airlift/package.nix
index afcd1545aa663..1293a70cdb950 100644
--- a/pkgs/by-name/ai/airlift/package.nix
+++ b/pkgs/by-name/ai/airlift/package.nix
@@ -27,7 +27,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     python3.pkgs.poetry-core
-    python3.pkgs.pythonRelaxDepsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/al/alsa-plugins/package.nix b/pkgs/by-name/al/alsa-plugins/package.nix
index ababb767955bb..bba1944f109e2 100644
--- a/pkgs/by-name/al/alsa-plugins/package.nix
+++ b/pkgs/by-name/al/alsa-plugins/package.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-plugins";
-  version = "1.2.7.1";
+  version = "1.2.12";
 
   src = fetchurl {
     url = "mirror://alsa/plugins/${pname}-${version}.tar.bz2";
-    hash = "sha256-jDN4FJVLt8FnRWczpgRhQqKTHxLsy6PsKkrmGKNDJRE=";
+    hash = "sha256-e9ioPTBOji2GoliV2Nyw7wJFqN8y4nGVnNvcavObZvI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/au/audible-cli/package.nix b/pkgs/by-name/au/audible-cli/package.nix
index e9ee1bda75cd9..b0026fef46419 100644
--- a/pkgs/by-name/au/audible-cli/package.nix
+++ b/pkgs/by-name/au/audible-cli/package.nix
@@ -13,7 +13,6 @@ python3Packages.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
     setuptools
   ] ++ [
     installShellFiles
diff --git a/pkgs/by-name/au/audiness/package.nix b/pkgs/by-name/au/audiness/package.nix
index f1f64afb3140f..8ad9d63973414 100644
--- a/pkgs/by-name/au/audiness/package.nix
+++ b/pkgs/by-name/au/audiness/package.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies =
     with python3.pkgs;
diff --git a/pkgs/by-name/aw/aws-gate/package.nix b/pkgs/by-name/aw/aws-gate/package.nix
index cafe14c611bda..1561d1c17a92e 100644
--- a/pkgs/by-name/aw/aws-gate/package.nix
+++ b/pkgs/by-name/aw/aws-gate/package.nix
@@ -27,7 +27,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     installShellFiles
-    python3Packages.pythonRelaxDepsHook
     python3Packages.setuptools
     python3Packages.wheel
   ];
diff --git a/pkgs/by-name/ba/backgroundremover/package.nix b/pkgs/by-name/ba/backgroundremover/package.nix
index 67c2f2eaa6a87..3ee27b6923939 100644
--- a/pkgs/by-name/ba/backgroundremover/package.nix
+++ b/pkgs/by-name/ba/backgroundremover/package.nix
@@ -32,7 +32,7 @@ let
         --replace 'os.path.expanduser(os.path.join("~", ".u2net", model_name + ".pth"))' "os.path.join(\"$models\", model_name + \".pth\")"
     '';
 
-    nativeBuildInputs = [ p.setuptools p.wheel p.pythonRelaxDepsHook ];
+    nativeBuildInputs = [ p.setuptools p.wheel ];
 
     pythonRelaxDeps = [ "pillow" "torchvision" ];
 
diff --git a/pkgs/by-name/ch/charmcraft/package.nix b/pkgs/by-name/ch/charmcraft/package.nix
index c837563a61c8b..9bcd64d876080 100644
--- a/pkgs/by-name/ch/charmcraft/package.nix
+++ b/pkgs/by-name/ch/charmcraft/package.nix
@@ -45,7 +45,6 @@ python3Packages.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index 5c2a9983d6270..168ad47740c82 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
       --subst-var-by libc_dev ${lib.getDev stdenv.cc.libc} \
       --subst-var-by libc_lib ${lib.getLib stdenv.cc.libc}
     # CC_FOR_BUILD and CXX_FOR_BUILD are used to bootstrap cmake
-    configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags"
+    configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags $cmakeFlags"
   '';
 
   # The configuration script is not autoconf-based, although being similar;
diff --git a/pkgs/by-name/co/corrscope/package.nix b/pkgs/by-name/co/corrscope/package.nix
index 8b8607d723a6f..0148ab90eb078 100644
--- a/pkgs/by-name/co/corrscope/package.nix
+++ b/pkgs/by-name/co/corrscope/package.nix
@@ -26,7 +26,6 @@ python3Packages.buildPythonApplication rec {
     wrapQtAppsHook
   ]) ++ (with python3Packages; [
     poetry-core
-    pythonRelaxDepsHook
   ]);
 
   buildInputs = [
diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index 8120fcc61e16c..2fc1f95082d99 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -97,7 +97,7 @@ rustPlatform.buildRustPackage rec {
     wrapProgram "$out/bin/${pname}" \
       --suffix XDG_DATA_DIRS : "${cosmic-icons}/share" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
-        xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrandr vulkan-loader libxkbcommon mesa.drivers wayland
+        xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrandr vulkan-loader libxkbcommon wayland
       ]}
   '';
 
diff --git a/pkgs/by-name/co/cosmic-store/package.nix b/pkgs/by-name/co/cosmic-store/package.nix
index 1a89a00a23014..fb4eb787cb709 100644
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -86,7 +86,6 @@ rustPlatform.buildRustPackage rec {
           xorg.libXrandr
           libxkbcommon
           vulkan-loader
-          mesa.drivers
         ]
       }
   '';
diff --git a/pkgs/by-name/co/cosmic-term/package.nix b/pkgs/by-name/co/cosmic-term/package.nix
index 9a0453e0ee2ed..b2bcf3ebccbce 100644
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -99,7 +99,6 @@ rustPlatform.buildRustPackage rec {
       --suffix XDG_DATA_DIRS : "${cosmic-icons}/share" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
         libxkbcommon
-        mesa.drivers
         vulkan-loader
         xorg.libX11
         xorg.libXcursor
diff --git a/pkgs/by-name/cu/cups-printers/package.nix b/pkgs/by-name/cu/cups-printers/package.nix
index 50af156ff668d..b6e124fef07d6 100644
--- a/pkgs/by-name/cu/cups-printers/package.nix
+++ b/pkgs/by-name/cu/cups-printers/package.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies =
     with python3.pkgs;
diff --git a/pkgs/by-name/do/donpapi/package.nix b/pkgs/by-name/do/donpapi/package.nix
index 1271d67d398f6..c2a777b3dc431 100644
--- a/pkgs/by-name/do/donpapi/package.nix
+++ b/pkgs/by-name/do/donpapi/package.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/do/dooit/package.nix b/pkgs/by-name/do/dooit/package.nix
index b8fae74dd85e6..ea549fff71962 100644
--- a/pkgs/by-name/do/dooit/package.nix
+++ b/pkgs/by-name/do/dooit/package.nix
@@ -20,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/filesystems/f2fs-tools/f2fs-tools-cross-fix.patch b/pkgs/by-name/f2/f2fs-tools/f2fs-tools-cross-fix.patch
index e01a97b0bc3c9..e01a97b0bc3c9 100644
--- a/pkgs/tools/filesystems/f2fs-tools/f2fs-tools-cross-fix.patch
+++ b/pkgs/by-name/f2/f2fs-tools/f2fs-tools-cross-fix.patch
diff --git a/pkgs/tools/filesystems/f2fs-tools/default.nix b/pkgs/by-name/f2/f2fs-tools/package.nix
index 2a913be9fa808..0c91e41da45fe 100644
--- a/pkgs/tools/filesystems/f2fs-tools/default.nix
+++ b/pkgs/by-name/f2/f2fs-tools/package.nix
@@ -1,5 +1,14 @@
-{ lib, stdenv, fetchzip, fetchpatch
-, autoreconfHook, libselinux, libuuid, pkg-config
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchpatch,
+  autoreconfHook,
+  libselinux,
+  libuuid,
+  pkg-config,
+  lz4,
+  lzo,
 }:
 
 stdenv.mkDerivation rec {
@@ -11,8 +20,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-zNG1F//+BTBzlEc6qNVixyuCB6PMZD5Kf8pVK0ePYiA=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libselinux libuuid ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+  buildInputs = [
+    libselinux
+    libuuid
+    lz4
+    lzo
+  ];
 
   patches = [
     ./f2fs-tools-cross-fix.patch
@@ -24,11 +41,14 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs-tools.git/";
     description = "Userland tools for the f2fs filesystem";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ ehmry jagajaga ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      ehmry
+      jagajaga
+    ];
   };
 }
diff --git a/pkgs/by-name/gc/gcp-scanner/package.nix b/pkgs/by-name/gc/gcp-scanner/package.nix
index a577790d16a6e..0e16965f63f01 100644
--- a/pkgs/by-name/gc/gcp-scanner/package.nix
+++ b/pkgs/by-name/gc/gcp-scanner/package.nix
@@ -20,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     setuptools
     setuptools-git-versioning
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/gh/ghunt/package.nix b/pkgs/by-name/gh/ghunt/package.nix
index 8f26785bda8f9..580f3a5e28470 100644
--- a/pkgs/by-name/gh/ghunt/package.nix
+++ b/pkgs/by-name/gh/ghunt/package.nix
@@ -18,7 +18,6 @@ python3.pkgs.buildPythonApplication rec {
   pythonRelaxDeps = true;
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix b/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix
index b3f2528ce2a2c..d9ea3eeb4787f 100644
--- a/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix
+++ b/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix
@@ -20,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [ ha-mqtt-discoverable ];
 
diff --git a/pkgs/by-name/he/hekatomb/package.nix b/pkgs/by-name/he/hekatomb/package.nix
index 1d9df3a032156..0b6e708f65b2d 100644
--- a/pkgs/by-name/he/hekatomb/package.nix
+++ b/pkgs/by-name/he/hekatomb/package.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/ho/homeassistant-satellite/package.nix b/pkgs/by-name/ho/homeassistant-satellite/package.nix
index c5a6026d8ec37..cf69238d8af5c 100644
--- a/pkgs/by-name/ho/homeassistant-satellite/package.nix
+++ b/pkgs/by-name/ho/homeassistant-satellite/package.nix
@@ -16,7 +16,6 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/ic/icloudpd/package.nix b/pkgs/by-name/ic/icloudpd/package.nix
index e345ca65c7adf..ea7386c4e8d83 100644
--- a/pkgs/by-name/ic/icloudpd/package.nix
+++ b/pkgs/by-name/ic/icloudpd/package.nix
@@ -20,10 +20,6 @@ python3Packages.buildPythonApplication rec {
 
   pythonRelaxDeps = true;
 
-  nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
-  ];
-
   propagatedBuildInputs = with python3Packages; [
     wheel
     setuptools
diff --git a/pkgs/by-name/ir/irrd/package.nix b/pkgs/by-name/ir/irrd/package.nix
index ba62bf6e6cc27..b6d323129abd9 100644
--- a/pkgs/by-name/ir/irrd/package.nix
+++ b/pkgs/by-name/ir/irrd/package.nix
@@ -76,7 +76,6 @@ py.pkgs.buildPythonPackage rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/by-name/ja/jasper/package.nix b/pkgs/by-name/ja/jasper/package.nix
index 11a298208f567..29fd8fd5a9e62 100644
--- a/pkgs/by-name/ja/jasper/package.nix
+++ b/pkgs/by-name/ja/jasper/package.nix
@@ -55,6 +55,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  # The value of __STDC_VERSION__ cannot be automatically determined when cross-compiling
+  # https://github.com/jasper-software/jasper/blob/87668487/CMakeLists.txt#L415
+  # workaround taken from
+  # https://github.com/openembedded/meta-openembedded/blob/907b9c0a/meta-oe/recipes-graphics/jasper/jasper_4.1.1.bb#L16
+  preConfigure = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    cmakeFlagsArray+=(-DJAS_STDC_VERSION="$(echo __STDC_VERSION__ | $CXX -E -P -)")
+  '';
+
   meta = {
     homepage = "https://jasper-software.github.io/jasper/";
     description = "Image processing/coding toolkit";
@@ -79,9 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "jasper";
     maintainers = with lib.maintainers; [ AndersonTorres ];
     platforms = lib.platforms.unix;
-    # The value of __STDC_VERSION__ cannot be automatically determined when
-    # cross-compiling.
-    broken = stdenv.buildPlatform != stdenv.hostPlatform;
   };
 })
 # TODO: investigate opengl support
diff --git a/pkgs/by-name/ki/kikit/solidpython/default.nix b/pkgs/by-name/ki/kikit/solidpython/default.nix
index 2244166bbfeac..777f4db9c2bb1 100644
--- a/pkgs/by-name/ki/kikit/solidpython/default.nix
+++ b/pkgs/by-name/ki/kikit/solidpython/default.nix
@@ -2,7 +2,6 @@
 { buildPythonPackage
 , fetchFromGitHub
 , lib
-, pythonRelaxDepsHook
 
 , poetry-core
 , prettytable
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/ko/koodousfinder/package.nix b/pkgs/by-name/ko/koodousfinder/package.nix
index 103863b76ee35..b6602e2c6000e 100644
--- a/pkgs/by-name/ko/koodousfinder/package.nix
+++ b/pkgs/by-name/ko/koodousfinder/package.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     keyring
diff --git a/pkgs/by-name/kr/krbjack/package.nix b/pkgs/by-name/kr/krbjack/package.nix
index a26b55144277c..bd7455cef9a4b 100644
--- a/pkgs/by-name/kr/krbjack/package.nix
+++ b/pkgs/by-name/kr/krbjack/package.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
     poetry-core
   ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     colorama
diff --git a/pkgs/by-name/li/libcamera/package.nix b/pkgs/by-name/li/libcamera/package.nix
index c122f840df32e..6795a5bf5cfd7 100644
--- a/pkgs/by-name/li/libcamera/package.nix
+++ b/pkgs/by-name/li/libcamera/package.nix
@@ -25,18 +25,18 @@
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-x0Im9m9MoACJhQKorMI34YQ+/bd62NdAPc2nWwaJAvM=";
+    hash = "sha256-eCtOtdjpwn0S56ZyRVdG1QCBk1KGPh8YTXD50xev7Bc=";
   };
 
   outputs = [ "out" "dev" ];
 
   postPatch = ''
-    patchShebangs utils/
+    patchShebangs src/py/ utils/
   '';
 
   # libcamera signs the IPA module libraries at install time, but they are then
@@ -81,6 +81,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     python3Packages.jinja2
+    python3Packages.pybind11
     python3Packages.pyyaml
     python3Packages.ply
     python3Packages.sphinx
diff --git a/pkgs/by-name/ma/malwoverview/package.nix b/pkgs/by-name/ma/malwoverview/package.nix
index 4028ae8fac3ce..25426fa688992 100644
--- a/pkgs/by-name/ma/malwoverview/package.nix
+++ b/pkgs/by-name/ma/malwoverview/package.nix
@@ -19,10 +19,6 @@ python3.pkgs.buildPythonApplication rec {
     "pathlib"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   build-system  = with python3.pkgs; [
     setuptools
   ];
diff --git a/pkgs/by-name/me/mealie/package.nix b/pkgs/by-name/me/mealie/package.nix
index 040cf175bb6fa..3cb005e10038e 100644
--- a/pkgs/by-name/me/mealie/package.nix
+++ b/pkgs/by-name/me/mealie/package.nix
@@ -39,7 +39,6 @@ in pythonpkgs.buildPythonPackage rec {
 
   nativeBuildInputs = [
     pythonpkgs.poetry-core
-    pythonpkgs.pythonRelaxDepsHook
     makeWrapper
   ];
 
diff --git a/pkgs/by-name/mo/mokuro/package.nix b/pkgs/by-name/mo/mokuro/package.nix
index 95054f371480b..1fb6ca5443b43 100644
--- a/pkgs/by-name/mo/mokuro/package.nix
+++ b/pkgs/by-name/mo/mokuro/package.nix
@@ -22,7 +22,6 @@ python3Packages.buildPythonApplication rec {
         --replace-fail 'opencv-python' 'opencv'
   '';
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "torchvision" ];
 
diff --git a/pkgs/by-name/mo/mov-cli/package.nix b/pkgs/by-name/mo/mov-cli/package.nix
index 05691e619285a..16244793662ef 100644
--- a/pkgs/by-name/mo/mov-cli/package.nix
+++ b/pkgs/by-name/mo/mov-cli/package.nix
@@ -35,10 +35,6 @@ python3.pkgs.buildPythonPackage {
     tldextract
   ];
 
-  nativeBuildInputs = [
-    python3.pkgs.pythonRelaxDepsHook
-  ];
-
   pythonRelaxDeps = [
     "httpx"
     "tldextract"
diff --git a/pkgs/by-name/ng/nginx-language-server/package.nix b/pkgs/by-name/ng/nginx-language-server/package.nix
index 891d6e4d5cb61..39a5a55f5abd9 100644
--- a/pkgs/by-name/ng/nginx-language-server/package.nix
+++ b/pkgs/by-name/ng/nginx-language-server/package.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/no/normcap/package.nix b/pkgs/by-name/no/normcap/package.nix
index a7c349a7a3566..4eea6dca8af90 100644
--- a/pkgs/by-name/no/normcap/package.nix
+++ b/pkgs/by-name/no/normcap/package.nix
@@ -52,7 +52,6 @@ ps.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    ps.pythonRelaxDepsHook
     ps.hatchling
     ps.babel
   ];
diff --git a/pkgs/by-name/on/onthespot/package.nix b/pkgs/by-name/on/onthespot/package.nix
index 138ac6e94b7c5..696a7e51f78e5 100644
--- a/pkgs/by-name/on/onthespot/package.nix
+++ b/pkgs/by-name/on/onthespot/package.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     copyDesktopItems
-    pythonRelaxDepsHook
     libsForQt5.wrapQtAppsHook
   ];
 
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 1292ff3c27923..4a034130c09ff 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -116,7 +116,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ hatchling ];
 
-  nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
 
   pythonImportsCheck = [ "open_webui" ];
 
diff --git a/pkgs/by-name/op/opencomposite/package.nix b/pkgs/by-name/op/opencomposite/package.nix
index 5607d55a0be6c..d9e6508b0c559 100644
--- a/pkgs/by-name/op/opencomposite/package.nix
+++ b/pkgs/by-name/op/opencomposite/package.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation {
   cmakeFlags = [
     (lib.cmakeBool "USE_SYSTEM_OPENXR" true)
     (lib.cmakeBool "USE_SYSTEM_GLM" true)
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DGLM_ENABLE_EXPERIMENTAL")
     # debug logging macros cause format-security warnings
     (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-Wno-error=format-security")
   ];
diff --git a/pkgs/by-name/op/openscad-unstable/package.nix b/pkgs/by-name/op/openscad-unstable/package.nix
index 1e14580b42bb5..09514490ebf99 100644
--- a/pkgs/by-name/op/openscad-unstable/package.nix
+++ b/pkgs/by-name/op/openscad-unstable/package.nix
@@ -149,11 +149,14 @@ clangStdenv.mkDerivation rec {
     "-DCMAKE_EXE_LINKER_FLAGS=-fuse-ld=lld"
     "-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON"
   ];
+
   doCheck = true;
+
+  nativeCheckInputs = [
+    mesa.llvmpipeHook
+  ];
+
   checkPhase = ''
-    # for running mesa llvmpipe
-    export __EGL_VENDOR_LIBRARY_FILENAMES=${mesa.drivers}/share/glvnd/egl_vendor.d/50_mesa.json
-    export LIBGL_DRIVERS_PATH=${mesa.drivers}/lib:${mesa.drivers}/lib/dri
     # some fontconfig issues cause pdf output to have wrong font
     ctest -j$NIX_BUILD_CORES -E pdfexporttest.\*
   '';
diff --git a/pkgs/by-name/op/opensplat/package.nix b/pkgs/by-name/op/opensplat/package.nix
index cd6052f5369b0..d808a403e7bd8 100644
--- a/pkgs/by-name/op/opensplat/package.nix
+++ b/pkgs/by-name/op/opensplat/package.nix
@@ -4,13 +4,13 @@
   cmake,
   ninja,
   fetchFromGitHub,
-  fetchpatch,
   python3,
   opencv,
   nlohmann_json,
   nanoflann,
   glm,
   cxxopts,
+  nix-update-script,
   config,
   # Upstream has rocm/hip support, too. anyone?
   cudaSupport ? config.cudaSupport,
@@ -18,7 +18,7 @@
   autoAddDriverRunpath,
 }:
 let
-  version = "1.1.2";
+  version = "1.1.3";
   torch = python3.pkgs.torch.override { inherit cudaSupport; };
   # Using a normal stdenv with cuda torch gives
   # ld: /nix/store/k1l7y96gv0nc685cg7i3g43i4icmddzk-python3.11-torch-2.2.1-lib/lib/libc10.so: undefined reference to `std::ios_base_library_init()@GLIBCXX_3.4.32'
@@ -32,27 +32,9 @@ stdenv'.mkDerivation {
     owner = "pierotofy";
     repo = "OpenSplat";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3tk62b5fSf6wzuc5TwkdfAKgUMrw3ZxetCJa2RVMS/s=";
+    hash = "sha256-2NcKb2SWU/vNsnd2KhdU85J60fJPuc44ZxIle/1UT6g=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "install-executables.patch";
-      url = "https://github.com/pierotofy/OpenSplat/commit/b4c4176819b508978583b7ebf66306171807a8e6.patch";
-      hash = "sha256-BUgPMcO3lt3ZEzv24u36k3aTEIoloOhxrCGi1KQ5Epk=";
-    })
-  ];
-
-  postPatch = ''
-    # the two vendored gsplats are so heavily modified they may be considered a fork
-    find vendor ! -name 'gsplat*' -maxdepth 1 -mindepth 1 -exec rm -rf {} +
-    mkdir vendor/{nanoflann,glm}
-    ln -s ${glm}/include/glm vendor/glm/glm
-    ln -s ${nanoflann}/include/nanoflann.hpp vendor/nanoflann/nanoflann.hpp
-    ln -s ${nlohmann_json}/include/nlohmann vendor/json
-    ln -s ${cxxopts}/include/cxxopts.hpp vendor/cxxopts.hpp
-  '';
-
   nativeBuildInputs = [
     cmake
     ninja
@@ -63,6 +45,9 @@ stdenv'.mkDerivation {
 
   buildInputs = [
     nlohmann_json
+    nanoflann
+    glm
+    cxxopts
     torch.cxxdev
     torch
     opencv
@@ -74,15 +59,23 @@ stdenv'.mkDerivation {
 
   cmakeFlags = [
     (lib.cmakeBool "CMAKE_SKIP_RPATH" true)
+    (lib.cmakeFeature "FETCHCONTENT_TRY_FIND_PACKAGE_MODE" "ALWAYS")
   ] ++ lib.optionals cudaSupport [
     (lib.cmakeFeature "GPU_RUNTIME" "CUDA")
     (lib.cmakeFeature "CUDA_TOOLKIT_ROOT_DIR" "${cudaPackages.cudatoolkit}/")
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Production-grade 3D gaussian splatting";
     homepage = "https://github.com/pierotofy/OpenSplat/";
-    license = lib.licenses.mit;
+    license = [
+      # main
+      lib.licenses.agpl3Only
+      # vendored+modified gsplat
+      lib.licenses.asl20
+    ];
     maintainers = [ lib.maintainers.jcaesar ];
     platforms = lib.platforms.linux ++ lib.optionals (!cudaSupport) lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/ot/oterm/package.nix b/pkgs/by-name/ot/oterm/package.nix
index 9651b8d9cf3ba..680a66820d872 100644
--- a/pkgs/by-name/ot/oterm/package.nix
+++ b/pkgs/by-name/ot/oterm/package.nix
@@ -28,7 +28,6 @@ python3Packages.buildPythonApplication rec {
 
   build-system = with python3Packages; [ poetry-core ];
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   dependencies = with python3Packages; [
     aiohttp
diff --git a/pkgs/by-name/pa/pacu/package.nix b/pkgs/by-name/pa/pacu/package.nix
index 46143afdb5e38..5c87d124ee962 100644
--- a/pkgs/by-name/pa/pacu/package.nix
+++ b/pkgs/by-name/pa/pacu/package.nix
@@ -32,7 +32,6 @@ python.pkgs.buildPythonApplication rec {
 
   build-system = with python.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies =
     [ awscli ]
diff --git a/pkgs/by-name/pr/pre2k/package.nix b/pkgs/by-name/pr/pre2k/package.nix
index 4865269b55654..98b763cb011df 100644
--- a/pkgs/by-name/pr/pre2k/package.nix
+++ b/pkgs/by-name/pr/pre2k/package.nix
@@ -24,7 +24,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/pr/pretalx/package.nix b/pkgs/by-name/pr/pretalx/package.nix
index 784976d06eaf8..8e1c213e2b2ad 100644
--- a/pkgs/by-name/pr/pretalx/package.nix
+++ b/pkgs/by-name/pr/pretalx/package.nix
@@ -91,7 +91,6 @@ python.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [
     gettext
   ] ++ (with python.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ]);
 
diff --git a/pkgs/by-name/pr/prowler/package.nix b/pkgs/by-name/pr/prowler/package.nix
index a8c5fb546e79e..066008e08dc7b 100644
--- a/pkgs/by-name/pr/prowler/package.nix
+++ b/pkgs/by-name/pr/prowler/package.nix
@@ -33,10 +33,6 @@ python3.pkgs.buildPythonApplication rec {
     "slack-sdk"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   build-system = with python3.pkgs; [
     poetry-core
   ];
diff --git a/pkgs/by-name/py/pysqlrecon/package.nix b/pkgs/by-name/py/pysqlrecon/package.nix
index e2019c45b1340..d9d8c51bb8285 100644
--- a/pkgs/by-name/py/pysqlrecon/package.nix
+++ b/pkgs/by-name/py/pysqlrecon/package.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/ra/rabbit/package.nix b/pkgs/by-name/ra/rabbit/package.nix
index 66e66fb2c1da1..178a6e2078415 100644
--- a/pkgs/by-name/ra/rabbit/package.nix
+++ b/pkgs/by-name/ra/rabbit/package.nix
@@ -20,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
   build-system = [
     python3.pkgs.setuptools
     python3.pkgs.wheel
-    python3.pkgs.pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/by-name/rc/rclip/package.nix b/pkgs/by-name/rc/rclip/package.nix
index 09790b93cbcc6..076dc1b4b679d 100644
--- a/pkgs/by-name/rc/rclip/package.nix
+++ b/pkgs/by-name/rc/rclip/package.nix
@@ -27,7 +27,7 @@ python3Packages.buildPythonApplication rec {
     tqdm
   ];
 
-  nativeCheckInputs = with python3Packages; [ pytestCheckHook pythonRelaxDepsHook ];
+  nativeCheckInputs = with python3Packages; [ pytestCheckHook ];
 
   pythonRelaxDeps = [ "torch" "torchvision" ];
 
diff --git a/pkgs/by-name/rd/rdwatool/package.nix b/pkgs/by-name/rd/rdwatool/package.nix
index 49459eb39a9e1..7ae9db0bfae76 100644
--- a/pkgs/by-name/rd/rdwatool/package.nix
+++ b/pkgs/by-name/rd/rdwatool/package.nix
@@ -24,7 +24,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 6fedb10cfed12..4d9c8da8041c0 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -126,8 +126,5 @@ rustPlatform.buildRustPackage rec {
     ];
     maintainers = with maintainers; [ SomeoneSerge ];
     mainProgram = "rerun";
-    # See comment about wasm32-unknown-unknown in rustc.nix.
-    broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-      !stdenv.hostPlatform.gcc.thumb or true;
   };
 }
diff --git a/pkgs/by-name/re/retool/package.nix b/pkgs/by-name/re/retool/package.nix
index 84bba4dae2ee6..fda7361ee8b78 100644
--- a/pkgs/by-name/re/retool/package.nix
+++ b/pkgs/by-name/re/retool/package.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     hatchling
-    pythonRelaxDepsHook
     qt6.wrapQtAppsHook
   ];
 
diff --git a/pkgs/by-name/ro/route-graph/package.nix b/pkgs/by-name/ro/route-graph/package.nix
index 36158282f783b..7e6e8d2bd6a62 100644
--- a/pkgs/by-name/ro/route-graph/package.nix
+++ b/pkgs/by-name/ro/route-graph/package.nix
@@ -25,10 +25,6 @@ python3.pkgs.buildPythonApplication rec {
     poetry-core
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   propagatedBuildInputs = [
     graphviz
   ] ++ (with python3.pkgs; [
diff --git a/pkgs/by-name/sh/shell-gpt/package.nix b/pkgs/by-name/sh/shell-gpt/package.nix
index 92f451b24088f..6558c612d84fc 100644
--- a/pkgs/by-name/sh/shell-gpt/package.nix
+++ b/pkgs/by-name/sh/shell-gpt/package.nix
@@ -26,7 +26,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ hatchling ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3.pkgs; [
     click
diff --git a/pkgs/by-name/sm/smassh/package.nix b/pkgs/by-name/sm/smassh/package.nix
index eb82f51399acd..d723be41d2b9b 100644
--- a/pkgs/by-name/sm/smassh/package.nix
+++ b/pkgs/by-name/sm/smassh/package.nix
@@ -19,7 +19,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
index 38d0f47edbaaa..5fd0b80ce6ecd 100644
--- a/pkgs/by-name/sn/snapcraft/package.nix
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -105,7 +105,6 @@ python3Packages.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/st/streamdeck-ui/package.nix b/pkgs/by-name/st/streamdeck-ui/package.nix
index 4af7ad66c7898..1549d2c6e1c9c 100644
--- a/pkgs/by-name/st/streamdeck-ui/package.nix
+++ b/pkgs/by-name/st/streamdeck-ui/package.nix
@@ -40,7 +40,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     python3Packages.poetry-core
-    python3Packages.pythonRelaxDepsHook
     copyDesktopItems
     qt6.wrapQtAppsHook
     wrapGAppsHook3
diff --git a/pkgs/by-name/st/strictdoc/package.nix b/pkgs/by-name/st/strictdoc/package.nix
index 95d11ba10aeef..05575c98ec9a9 100644
--- a/pkgs/by-name/st/strictdoc/package.nix
+++ b/pkgs/by-name/st/strictdoc/package.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     python3.pkgs.hatchling
-    python3.pkgs.pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/su/surrealist/package.nix b/pkgs/by-name/su/surrealist/package.nix
index 53290ea042c73..0c1e0abd1e57b 100644
--- a/pkgs/by-name/su/surrealist/package.nix
+++ b/pkgs/by-name/su/surrealist/package.nix
@@ -166,8 +166,5 @@ in stdenv.mkDerivation (finalAttrs: {
     mainProgram = "surrealist";
     maintainers = with maintainers; [ frankp ];
     platforms = platforms.linux;
-    # See comment about wasm32-unknown-unknown in rustc.nix.
-    broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-      !stdenv.hostPlatform.gcc.thumb or true;
   };
 })
diff --git a/pkgs/by-name/tb/tbump/package.nix b/pkgs/by-name/tb/tbump/package.nix
index 2812dd2f05d0c..1314c1ec6d126 100644
--- a/pkgs/by-name/tb/tbump/package.nix
+++ b/pkgs/by-name/tb/tbump/package.nix
@@ -18,7 +18,6 @@ python3Packages.buildPythonApplication rec {
 
   pythonRelaxDeps = [ "tomlkit" ];
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   build-system = with python3Packages; [ poetry-core ];
 
diff --git a/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix b/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
index c01bc623c9d9d..0ee89e9e037bb 100644
--- a/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
+++ b/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
@@ -78,9 +78,6 @@ let
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [ huantian wackbyte ];
       platforms = lib.platforms.linux;
-      # See comment about wasm32-unknown-unknown in rustc.nix.
-      broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-        !stdenv.hostPlatform.gcc.thumb or true;
     };
   };
 
diff --git a/pkgs/by-name/tr/troubadix/package.nix b/pkgs/by-name/tr/troubadix/package.nix
index 0906dd4becb23..a23d8da4eaf7c 100644
--- a/pkgs/by-name/tr/troubadix/package.nix
+++ b/pkgs/by-name/tr/troubadix/package.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     chardet
diff --git a/pkgs/by-name/tu/tunnelgraf/package.nix b/pkgs/by-name/tu/tunnelgraf/package.nix
index d7f2c77dab0a8..a24ea1b67fc6a 100644
--- a/pkgs/by-name/tu/tunnelgraf/package.nix
+++ b/pkgs/by-name/tu/tunnelgraf/package.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/by-name/tw/twitch-dl/package.nix b/pkgs/by-name/tw/twitch-dl/package.nix
index 81c444ea340fb..b98f88d300602 100644
--- a/pkgs/by-name/tw/twitch-dl/package.nix
+++ b/pkgs/by-name/tw/twitch-dl/package.nix
@@ -24,7 +24,6 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     python3Packages.setuptools
     python3Packages.setuptools-scm
-    python3Packages.pythonRelaxDepsHook
     installShellFiles
     scdoc
   ];
diff --git a/pkgs/by-name/un/unsilence/package.nix b/pkgs/by-name/un/unsilence/package.nix
index c82fe04616b69..76a362f279c33 100644
--- a/pkgs/by-name/un/unsilence/package.nix
+++ b/pkgs/by-name/un/unsilence/package.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonPackage rec {
 
   nativeBuildInputs = with python3Packages; [
     rich
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/up/upiano/package.nix b/pkgs/by-name/up/upiano/package.nix
index 46224f45a9bb3..4ad1456fc96e9 100644
--- a/pkgs/by-name/up/upiano/package.nix
+++ b/pkgs/by-name/up/upiano/package.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/uw/uwhoisd/package.nix b/pkgs/by-name/uw/uwhoisd/package.nix
index 2fb31c23669d3..81080d476e8e3 100644
--- a/pkgs/by-name/uw/uwhoisd/package.nix
+++ b/pkgs/by-name/uw/uwhoisd/package.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/vu/vunnel/package.nix b/pkgs/by-name/vu/vunnel/package.nix
index 9ca3f5d42c334..53df74f8533c7 100644
--- a/pkgs/by-name/vu/vunnel/package.nix
+++ b/pkgs/by-name/vu/vunnel/package.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
     "sqlalchemy"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   build-system = with python3.pkgs; [
     poetry-core
diff --git a/pkgs/by-name/wa/waf/package.nix b/pkgs/by-name/wa/waf/package.nix
index 812c6dd9b8d73..a30c5df8d8511 100644
--- a/pkgs/by-name/wa/waf/package.nix
+++ b/pkgs/by-name/wa/waf/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waf";
-  version = "2.0.27";
+  version = "2.1.1";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "waf-${finalAttrs.version}";
-    hash = "sha256-GeEoD5CHubwR4ndGk7J7czEf0hWtPQr88TqJDPqeK0s=";
+    hash = "sha256-38u8DJ1KLkb7FfeCr+1e5UBE3Qkx1q2FBsm5HDXnunQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wi/witnessme/package.nix b/pkgs/by-name/wi/witnessme/package.nix
index a19a387f3185f..de83d1475360a 100644
--- a/pkgs/by-name/wi/witnessme/package.nix
+++ b/pkgs/by-name/wi/witnessme/package.nix
@@ -28,10 +28,6 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonRelaxDeps = true;
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   build-system = with python3.pkgs; [
     poetry-core
   ];
diff --git a/pkgs/by-name/ws/wsrepl/package.nix b/pkgs/by-name/ws/wsrepl/package.nix
index 9bab0957d5b3a..9557fec2210c6 100644
--- a/pkgs/by-name/ws/wsrepl/package.nix
+++ b/pkgs/by-name/ws/wsrepl/package.nix
@@ -19,10 +19,6 @@ python3.pkgs.buildPythonApplication rec {
     "textual"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
-  ];
-
   build-system = with python3.pkgs; [
     poetry-core
   ];
diff --git a/pkgs/by-name/wt/wtfis/package.nix b/pkgs/by-name/wt/wtfis/package.nix
index ad710bf8f2291..3d8e97ea80f0d 100644
--- a/pkgs/by-name/wt/wtfis/package.nix
+++ b/pkgs/by-name/wt/wtfis/package.nix
@@ -17,10 +17,6 @@ in python3.pkgs.buildPythonApplication {
 
   format = "pyproject";
 
-  nativeBuildInputs = [
-    python3.pkgs.pythonRelaxDepsHook
-  ];
-
   propagatedBuildInputs = [
     python3.pkgs.hatchling
     python3.pkgs.pydantic
diff --git a/pkgs/by-name/wy/wyoming-satellite/package.nix b/pkgs/by-name/wy/wyoming-satellite/package.nix
index cb34afc5b2f1a..f23a5864b452f 100644
--- a/pkgs/by-name/wy/wyoming-satellite/package.nix
+++ b/pkgs/by-name/wy/wyoming-satellite/package.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/data/fonts/iwona/default.nix b/pkgs/data/fonts/iwona/default.nix
index 6a40b20b28e00..6d235d1b2f2b2 100644
--- a/pkgs/data/fonts/iwona/default.nix
+++ b/pkgs/data/fonts/iwona/default.nix
@@ -4,11 +4,12 @@ stdenvNoCC.mkDerivation rec {
   inherit (src) pname version;
 
   src = texlive.pkgs.iwona;
+  dontUnpack = true;
 
   installPhase = ''
     runHook preInstall
 
-    install -Dm644 fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
+    install -Dm644 $src/fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
 
     runHook postInstall
   '';
diff --git a/pkgs/data/icons/hicolor-icon-theme/default.nix b/pkgs/data/icons/hicolor-icon-theme/default.nix
index 096baa49acea9..0d528243a8654 100644
--- a/pkgs/data/icons/hicolor-icon-theme/default.nix
+++ b/pkgs/data/icons/hicolor-icon-theme/default.nix
@@ -1,20 +1,42 @@
-{ lib, stdenvNoCC, fetchurl }:
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitLab,
+  testers,
+  meson,
+  pkg-config,
+  ninja,
+}:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hicolor-icon-theme";
-  version = "0.17";
+  version = "0.18";
 
-  src = fetchurl {
-    url = "https://icon-theme.freedesktop.org/releases/hicolor-icon-theme-${version}.tar.xz";
-    sha256 = "1n59i3al3zx6p90ff0l43gzpzmlqnzm6hf5cryxqrlbi48sq8x1i";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "xdg";
+    repo = "default-icon-theme";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-uoB7u/ok7vMxKDl8pINdnV9VsvmsntBcZuz3Q4zGz7M=";
   };
 
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+  ];
+
   setupHook = ./setup-hook.sh;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Default fallback theme used by implementations of the icon theme specification";
-    homepage = "https://icon-theme.freedesktop.org/releases/";
+    homepage = "https://www.freedesktop.org/wiki/Software/icon-theme/";
+    changelog = "https://gitlab.freedesktop.org/xdg/default-icon-theme/-/blob/${finalAttrs.src.rev}/NEWS";
     platforms = platforms.unix;
     license = licenses.gpl2Only;
+    pkgConfigModules = [ "default-icon-theme" ];
+    maintainers = with maintainers; [ jopejoe1 ];
   };
-}
+})
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index b8b239e4fc589..7a332e8087011 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -20,7 +20,7 @@ let
   blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.98";
+  srcVersion = "3.101";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -37,7 +37,7 @@ let
       owner = "nss-dev";
       repo = "nss";
       rev = "NSS_${lib.replaceStrings ["."] ["_"] version}_RTM";
-      hash = "sha256-0p1HzspxyzhzX46O7ax8tmYiaFEBeqEqEvman4NIiQc=";
+      hash = "sha256-lO+81zYBBFwqcjh4cd/fpiznHZ9rTJpfDW/yF8phYts=";
     };
 
     dontBuild = true;
diff --git a/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix b/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
index e7d18a0d3c0d5..c2dc78787de50 100644
--- a/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
@@ -1,7 +1,6 @@
 { lib
 , fetchPypi
 , buildPythonApplication
-, pythonRelaxDepsHook
 , poetry-core
 , colorama
 , packaging
@@ -28,7 +27,6 @@ buildPythonApplication rec {
     gobject-introspection
     poetry-core
     wrapGAppsNoGuiHook
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index 5e017a21fa1f5..5eb92fd701da9 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -280,7 +280,7 @@ pipe ((callFile ./common/builder.nix {}) ({
 
   libc_dev = stdenv.cc.libc_dev;
 
-  hardeningDisable = [ "format" "pie" ]
+  hardeningDisable = [ "format" "pie" "stackclashprotection" ]
   ++ optionals (is11 && langAda) [ "fortify3" ];
 
   postPatch = optionalString atLeast7 ''
@@ -425,6 +425,9 @@ pipe ((callFile ./common/builder.nix {}) ({
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD langJava version;
     isGNU = true;
     hardeningUnsupportedFlags = optional is48 "stackprotector"
+      ++ optional (
+        (targetPlatform.isAarch64 && !atLeast9) || !atLeast8
+      ) "stackclashprotection"
       ++ optional (!atLeast11) "zerocallusedregs"
       ++ optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
       ++ optionals (langFortran) [ "fortify" "format" ];
diff --git a/pkgs/development/compilers/go/1.22.nix b/pkgs/development/compilers/go/1.22.nix
index d3b8982118aeb..17681b24a31f7 100644
--- a/pkgs/development/compilers/go/1.22.nix
+++ b/pkgs/development/compilers/go/1.22.nix
@@ -48,11 +48,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.22.3";
+  version = "1.22.4";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-gGSO80+QMZPXKlnA3/AZ9fmK4MmqE63gsOy/+ZGnb2g=";
+    hash = "sha256-/tcgZ45yinyjC6jR3tHKr+J9FgKPqwIyuLqOIgCPt4Q=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/llvm/17/default.nix b/pkgs/development/compilers/llvm/17/default.nix
index af0d648c4fd01..c11a9a1b0009f 100644
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ b/pkgs/development/compilers/llvm/17/default.nix
@@ -133,6 +133,14 @@ in let
         # It's not clear to me why this isn't an issue for LLVM developers running
         # on macOS (nothing about this _seems_ nix specific)..
         ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
+
+        # resolves https://github.com/llvm/llvm-project/issues/75168
+        (fetchpatch {
+          name = "fix-fzero-call-used-regs.patch";
+          url = "https://github.com/llvm/llvm-project/commit/f800c1f3b207e7bcdc8b4c7192928d9a078242a0.patch";
+          stripLen = 1;
+          hash = "sha256-e8YKrMy2rGcSJGC6er2V66cOnAnI+u1/yImkvsRsmg8=";
+        })
       ];
       pollyPatches = [
         ./llvm/gnu-install-dirs-polly.patch
diff --git a/pkgs/development/compilers/llvm/17/llvm/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/17/llvm/gnu-install-dirs.patch
index e2122ebf603d9..eb9f6098d1c9a 100644
--- a/pkgs/development/compilers/llvm/17/llvm/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/17/llvm/gnu-install-dirs.patch
@@ -72,8 +72,8 @@ index 230620c37027..dd16cab1835e 100644
 +    # As noted in the differential above, an alternative solution is to have
 +    # all rdeps of nixpkgs' LLVM (that use the AddLLVM.cmake machinery) set
 +    # `CMAKE_INSTALL_RPATH`.
-+    set(_build_rpath "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
-+    set(_install_rpath "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
++    set(_build_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
++    set(_install_rpath ${extra_libdir})
      if(${CMAKE_SYSTEM_NAME} MATCHES "(FreeBSD|DragonFly)")
        set_property(TARGET ${name} APPEND_STRING PROPERTY
                     LINK_FLAGS " -Wl,-z,origin ")
@@ -86,10 +86,10 @@ index 891c9e6d618c..8d963f3b0069 100644
  
    if( APPLE )
 -    set(ocaml_rpath "@executable_path/../../../lib${LLVM_LIBDIR_SUFFIX}")
-+    set(ocaml_rpath "@executable_path/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
++    set(ocaml_rpath "${LLVM_LIBRARY_DIR}")
    elseif( UNIX )
 -    set(ocaml_rpath "\\$ORIGIN/../../../lib${LLVM_LIBDIR_SUFFIX}")
-+    set(ocaml_rpath "\\$ORIGIN/../../../${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
++    set(ocaml_rpath "${LLVM_LIBRARY_DIR}")
    endif()
    list(APPEND ocaml_flags "-ldopt" "-Wl,-rpath,${ocaml_rpath}")
  
diff --git a/pkgs/development/compilers/llvm/18/default.nix b/pkgs/development/compilers/llvm/18/default.nix
index 4ef9728708385..4fc256510dcc3 100644
--- a/pkgs/development/compilers/llvm/18/default.nix
+++ b/pkgs/development/compilers/llvm/18/default.nix
@@ -26,7 +26,7 @@
   #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
   #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
   # }
-, officialRelease ? { version = "18.1.7"; sha256 = "sha256-qBL/1zh2YFabiPAyHehvzDSDfnwnCvyH6nY/pzG757A="; }
+, officialRelease ? { version = "18.1.8"; sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE="; }
   # i.e.:
   # {
   #   version = /* i.e. "15.0.0" */;
diff --git a/pkgs/development/compilers/llvm/common/clang/default.nix b/pkgs/development/compilers/llvm/common/clang/default.nix
index e597ec4d604b1..4c6f7581d15fb 100644
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@@ -136,16 +136,26 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-    } // (lib.optionalAttrs (lib.versionAtLeast release_version "15") {
-      hardeningUnsupportedFlags = [
-        "fortify3"
-      ];
       hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
-        lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs"
+        [ "fortify3" ]
+        ++ lib.optional (
+          (lib.versionOlder release_version "11")
+          || (targetPlatform.isAarch64 && (lib.versionOlder release_version "18.1"))
+          || (targetPlatform.isFreeBSD && (lib.versionOlder release_version "15"))
+          || !(targetPlatform.isLinux || targetPlatform.isFreeBSD)
+          || !(
+            targetPlatform.isx86
+            || targetPlatform.isPower64
+            || targetPlatform.isS390x
+            || targetPlatform.isAarch64
+          )
+        ) "stackclashprotection"
+        ++ lib.optional (
+          (lib.versionOlder release_version "15")
+          || !(targetPlatform.isx86_64 || targetPlatform.isAarch64)
+        ) "zerocallusedregs"
         ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []);
-    }) // (lib.optionalAttrs (lib.versionOlder release_version "15") {
-      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
-    });
+    };
 
     meta = llvm_meta // {
       homepage = "https://clang.llvm.org/";
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
index 23a966ce238f6..67f9661cf7438 100644
--- a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
@@ -142,7 +142,7 @@ stdenv.mkDerivation ({
   '' + (if stdenv.hostPlatform.isFreeBSD then
     # As per above, but in FreeBSD assert is a macro and simply allowing it to be implicitly declared causes Issues!!!!!
     ''
-    substituteInPlace lib/builtins/clear_cache.c lib/builtins/cpu_model.c \
+    substituteInPlace lib/builtins/clear_cache.c lib/builtins/cpu_model${lib.optionalString (lib.versionAtLeast version "18") "/x86"}.c \
       --replace "#include <assert.h>" "#define assert(e) ((e)?(void)0:__assert(__FUNCTION__,__FILE__,__LINE__,#e))"
     '' else ''
     substituteInPlace lib/builtins/clear_cache.c \
diff --git a/pkgs/development/compilers/llvm/common/libcxx/default.nix b/pkgs/development/compilers/llvm/common/libcxx/default.nix
index b2c23f35f0a18..38813766897e4 100644
--- a/pkgs/development/compilers/llvm/common/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/common/libcxx/default.nix
@@ -13,16 +13,12 @@
 , python3
 , fixDarwinDylibNames
 , version
-, cxxabi ? null
-, libcxxrt
+, freebsd
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then freebsd.libcxxrt else null
 , libunwind
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
-# note: our setup using libcxxabi instead of libcxxrt on FreeBSD diverges from
-# normal FreeBSD. This may cause issues with binary patching down the line.
-# If this becomes an issue, try adding as symlink libcxxrt.so -> libc++abi.so
-
 # external cxxabi is not supported on Darwin as the build will not link libcxx
 # properly and not re-export the cxxabi symbols into libcxx
 # https://github.com/NixOS/nixpkgs/issues/166205
@@ -93,6 +89,8 @@ let
     "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
   ] ++ lib.optionals (!enableShared) [
     "-DLIBCXX_ENABLE_SHARED=OFF"
+  ] ++ lib.optionals (cxxabi != null && cxxabi.libName == "cxxrt") [
+    "-DLIBCXX_ENABLE_NEW_DELETE_DEFINITIONS=ON"
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/compilers/llvm/common/llvm/default.nix b/pkgs/development/compilers/llvm/common/llvm/default.nix
index 89ea8f6e7a564..f780c87d0e4b1 100644
--- a/pkgs/development/compilers/llvm/common/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -313,7 +313,7 @@ stdenv.mkDerivation (rec {
     )
   '';
 
-  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
+  # E.g. Mesa uses the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
   cmakeBuildType = if debugVersion then "Debug" else "Release";
diff --git a/pkgs/development/compilers/openjdk/21.nix b/pkgs/development/compilers/openjdk/21.nix
index 623ac281acf7f..160b3da4c8eee 100644
--- a/pkgs/development/compilers/openjdk/21.nix
+++ b/pkgs/development/compilers/openjdk/21.nix
@@ -14,8 +14,8 @@
 let
   version = {
     feature = "21";
-    interim = "";
-    build = "35";
+    interim = ".0.3";
+    build = "9";
   };
 
   # when building a headless jdk, also bootstrap it with a headless jdk
@@ -29,7 +29,7 @@ let
       owner = "openjdk";
       repo = "jdk${version.feature}u";
       rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      hash = "sha256-fA8nRWBuTL87S8mwapmNfCPPQoI2aKHjbHJ6PDN3khs=";
+      hash = "sha256-zRN16lrc5gtDlTVIQJRRx103w/VbRkatCLeEc9AXWPE=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
diff --git a/pkgs/development/compilers/openjdk/openjfx/21.nix b/pkgs/development/compilers/openjdk/openjfx/21.nix
index d4092a99f363c..ee262eb8b950b 100644
--- a/pkgs/development/compilers/openjdk/openjfx/21.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/21.nix
@@ -7,7 +7,7 @@
 
 let
   major = "21";
-  update = "";
+  update = ".0.3";
   build = "-ga";
   repover = "${major}${update}${build}";
   gradle_ = (gradle_7.override {
@@ -30,9 +30,9 @@ let
 
     src = fetchFromGitHub {
       owner = "openjdk";
-      repo = "jfx";
+      repo = "jfx21u";
       rev = repover;
-      hash = "sha256-deNAGfnA6gwcAa64l0AWdkX+vJd3ZOfIgAifSl+/m+s=";
+      hash = "sha256-7z0GIbkQwG9mXY9dssaicqaKpMo3FkNEpyAvkswoQQ4=";
     };
 
     buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 ];
diff --git a/pkgs/development/compilers/rust/1_78.nix b/pkgs/development/compilers/rust/1_78.nix
index 3ce368e8d99fb..d81e964fb7458 100644
--- a/pkgs/development/compilers/rust/1_78.nix
+++ b/pkgs/development/compilers/rust/1_78.nix
@@ -49,6 +49,7 @@ import ./default.nix {
     aarch64-apple-darwin = "415bb2bc198feb0f2d8329e33c57d0890bbd57977d1ae48b17f6c7e1f632eaa7";
     powerpc64le-unknown-linux-gnu = "79582acb339bd2d79fef095b977049049ffa04616011f1af1793fb8e98194b19";
     riscv64gc-unknown-linux-gnu = "300fe4861e2d1f6e4c4f5e36ae7997beca8a979343a7f661237ab78a37a54648";
+    x86_64-unknown-freebsd = "72f49040fc2ed4492cddfaef3b4a9cb28d008f9f5ce5cac50802a5fca910f58c";
   };
 
   selectRustPackage = pkgs: pkgs.rust_1_78;
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index d1df1c542e982..10e944515df76 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -35,7 +35,8 @@ rec {
 
     nativeBuildInputs = lib.optional (!stdenv.isDarwin) autoPatchelfHook;
     buildInputs = [ bash ]
-      ++ lib.optionals (!stdenv.isDarwin) [ gcc.cc.lib zlib ]
+      ++ lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) gcc.cc.lib
+      ++ lib.optional (!stdenv.isDarwin) zlib
       ++ lib.optional stdenv.isDarwin Security;
 
     postPatch = ''
@@ -81,7 +82,7 @@ rec {
     nativeBuildInputs = [ makeWrapper ]
       ++ lib.optional (!stdenv.isDarwin) autoPatchelfHook;
     buildInputs = [ bash ]
-      ++ lib.optional (!stdenv.isDarwin) gcc.cc.lib
+      ++ lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) gcc.cc.lib
       ++ lib.optional stdenv.isDarwin Security;
 
     postPatch = ''
diff --git a/pkgs/development/compilers/rust/print-hashes.sh b/pkgs/development/compilers/rust/print-hashes.sh
index ebf8d900bb3b5..54c15406df670 100755
--- a/pkgs/development/compilers/rust/print-hashes.sh
+++ b/pkgs/development/compilers/rust/print-hashes.sh
@@ -19,6 +19,7 @@ PLATFORMS=(
   aarch64-apple-darwin
   powerpc64le-unknown-linux-gnu
   riscv64gc-unknown-linux-gnu
+  x86_64-unknown-freebsd
 )
 BASEURL=https://static.rust-lang.org/dist
 VERSION=${1:-}
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index e00ba329ccdc4..1a7e22363acb1 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -58,8 +58,11 @@ in stdenv.mkDerivation (finalAttrs: {
 
   NIX_LDFLAGS = toString (
        # when linking stage1 libstd: cc: undefined reference to `__cxa_begin_catch'
-       optional (stdenv.isLinux && !withBundledLLVM) "--push-state --as-needed -lstdc++ --pop-state"
+       # This doesn't apply to cross-building for FreeBSD because the host
+       # uses libstdc++, but the target (used for building std) uses libc++
+       optional (stdenv.isLinux && !withBundledLLVM && !stdenv.targetPlatform.isFreeBSD) "--push-state --as-needed -lstdc++ --pop-state"
     ++ optional (stdenv.isDarwin && !withBundledLLVM) "-lc++ -lc++abi"
+    ++ optional stdenv.isFreeBSD "-rpath ${llvmPackages.libunwind}/lib"
     ++ optional stdenv.isDarwin "-rpath ${llvmSharedForHost}/lib");
 
   # Increase codegen units to introduce parallelism within the compiler.
@@ -103,9 +106,7 @@ in stdenv.mkDerivation (finalAttrs: {
       stdenv.targetPlatform.rust.rustcTargetSpec
 
     # Other targets that don't need any extra dependencies to build.
-    # Temporarily broken if some global compiler flags are set:
-    # https://github.com/NixOS/nixpkgs/pull/317273
-    ] ++ optionals (!fastCross && !lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] && stdenv.hostPlatform.gcc.thumb or true) [
+    ] ++ optionals (!fastCross) [
       "wasm32-unknown-unknown"
 
     # (build!=target): When cross-building a compiler we need to add
@@ -220,6 +221,11 @@ in stdenv.mkDerivation (finalAttrs: {
     [source.vendored-sources]
     directory = "vendor"
     EOF
+  '' + lib.optionalString (stdenv.isFreeBSD) ''
+    # lzma-sys bundles an old version of xz that doesn't build
+    # on modern FreeBSD, use the system one instead
+    substituteInPlace src/bootstrap/src/core/build_steps/tool.rs \
+        --replace 'cargo.env("LZMA_API_STATIC", "1");' ' '
   '';
 
   # rustc unfortunately needs cmake to compile llvm-rt but doesn't
diff --git a/pkgs/development/compilers/swift/wrapper/wrapper.sh b/pkgs/development/compilers/swift/wrapper/wrapper.sh
index 5836dea397874..5cd5d8da88195 100644
--- a/pkgs/development/compilers/swift/wrapper/wrapper.sh
+++ b/pkgs/development/compilers/swift/wrapper/wrapper.sh
@@ -252,7 +252,7 @@ for ((i=0; i < ${#extraBefore[@]}; i++));do
         # TODO: Assumes macOS.
         extraBefore[i]="${extraBefore[i]/-apple-darwin/-apple-macosx${MACOSX_DEPLOYMENT_TARGET:-11.0}}"
         ;;
-    -march=*)
+    -march=*|-mcpu=*|-mfloat-abi=*|-mfpu=*|-mmode=*|-mthumb|-marm|-mtune=*)
         [[ i -gt 0 && ${extraBefore[i-1]} == -Xcc ]] && continue
         extraBefore=(
             "${extraBefore[@]:0:i}"
diff --git a/pkgs/development/compilers/temurin-bin/generate-sources.py b/pkgs/development/compilers/temurin-bin/generate-sources.py
index bb60d6903df12..befb24422936b 100755
--- a/pkgs/development/compilers/temurin-bin/generate-sources.py
+++ b/pkgs/development/compilers/temurin-bin/generate-sources.py
@@ -6,10 +6,10 @@ import re
 import requests
 import sys
 
-feature_versions = (8, 11, 16, 17, 18, 19, 20, 21)
+feature_versions = (8, 11, 16, 17, 18, 19, 20, 21, 22)
 oses = ("mac", "linux", "alpine-linux")
 types = ("jre", "jdk")
-impls = ("hotspot")
+impls = ("hotspot",)
 
 arch_to_nixos = {
     "x64": ("x86_64",),
diff --git a/pkgs/development/compilers/temurin-bin/jdk-darwin-base.nix b/pkgs/development/compilers/temurin-bin/jdk-darwin-base.nix
index 8f6831a7907c8..886c92ba2e382 100644
--- a/pkgs/development/compilers/temurin-bin/jdk-darwin-base.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-darwin-base.nix
@@ -1,11 +1,12 @@
 { name-prefix ? "temurin"
 , brand-name ? "Eclipse Temurin"
 , sourcePerArch
-, knownVulnerabilities ? []
+, knownVulnerabilities ? [ ]
 }:
 
 { swingSupport ? true # not used for now
-, lib, stdenv
+, lib
+, stdenv
 , fetchurl
 , setJavaClassPath
 }:
@@ -17,7 +18,8 @@ let
     (arch: builtins.elem arch validCpuTypes)
     (builtins.attrNames sourcePerArch);
   result = stdenv.mkDerivation {
-    pname = if sourcePerArch.packageType == "jdk"
+    pname =
+      if sourcePerArch.packageType == "jdk"
       then "${name-prefix}-bin"
       else "${name-prefix}-${sourcePerArch.packageType}-bin";
     version =
@@ -66,10 +68,11 @@ let
       license = licenses.gpl2Classpath;
       sourceProvenance = with sourceTypes; [ binaryNativeCode binaryBytecode ];
       description = "${brand-name}, prebuilt OpenJDK binary";
-      platforms = builtins.map (arch: arch + "-darwin") providedCpuTypes;  # some inherit jre.meta.platforms
+      platforms = builtins.map (arch: arch + "-darwin") providedCpuTypes; # some inherit jre.meta.platforms
       maintainers = with maintainers; [ taku0 ];
       inherit knownVulnerabilities;
       mainProgram = "java";
     };
   };
-in result
+in
+result
diff --git a/pkgs/development/compilers/temurin-bin/jdk-darwin.nix b/pkgs/development/compilers/temurin-bin/jdk-darwin.nix
index 5122b6ed72945..622d1629dbb56 100644
--- a/pkgs/development/compilers/temurin-bin/jdk-darwin.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-darwin.nix
@@ -2,27 +2,34 @@
 
 let
   sources = (lib.importJSON ./sources.json).hotspot.mac;
-  common = opts: callPackage (import ./jdk-darwin-base.nix opts) {};
+  common = opts: callPackage (import ./jdk-darwin-base.nix opts) { };
+
+  EOL = [ "This JDK version has reached End of Life." ];
 in
 {
   jdk-8 = common { sourcePerArch = sources.jdk.openjdk8; };
   jre-8 = common { sourcePerArch = sources.jre.openjdk8; };
+
   jdk-11 = common { sourcePerArch = sources.jdk.openjdk11; };
   jre-11 = common { sourcePerArch = sources.jre.openjdk11; };
-  jdk-16 = common { sourcePerArch = sources.jdk.openjdk16; };
+
+  jdk-16 = common { sourcePerArch = sources.jdk.openjdk16; knownVulnerabilities = EOL; };
 
   jdk-17 = common { sourcePerArch = sources.jdk.openjdk17; };
   jre-17 = common { sourcePerArch = sources.jre.openjdk17; };
 
-  jdk-18 = common { sourcePerArch = sources.jdk.openjdk18; };
-  jre-18 = common { sourcePerArch = sources.jre.openjdk18; };
+  jdk-18 = common { sourcePerArch = sources.jdk.openjdk18; knownVulnerabilities = EOL; };
+  jre-18 = common { sourcePerArch = sources.jre.openjdk18; knownVulnerabilities = EOL; };
 
-  jdk-19 = common { sourcePerArch = sources.jdk.openjdk19; };
-  jre-19 = common { sourcePerArch = sources.jre.openjdk19; };
+  jdk-19 = common { sourcePerArch = sources.jdk.openjdk19; knownVulnerabilities = EOL; };
+  jre-19 = common { sourcePerArch = sources.jre.openjdk19; knownVulnerabilities = EOL; };
 
-  jdk-20 = common { sourcePerArch = sources.jdk.openjdk20; };
-  jre-20 = common { sourcePerArch = sources.jre.openjdk20; };
+  jdk-20 = common { sourcePerArch = sources.jdk.openjdk20; knownVulnerabilities = EOL; };
+  jre-20 = common { sourcePerArch = sources.jre.openjdk20; knownVulnerabilities = EOL; };
 
   jdk-21 = common { sourcePerArch = sources.jdk.openjdk21; };
   jre-21 = common { sourcePerArch = sources.jre.openjdk21; };
+
+  jdk-22 = common { sourcePerArch = sources.jdk.openjdk22; };
+  jre-22 = common { sourcePerArch = sources.jre.openjdk22; };
 }
diff --git a/pkgs/development/compilers/temurin-bin/jdk-linux-base.nix b/pkgs/development/compilers/temurin-bin/jdk-linux-base.nix
index ba56518e15a62..9da96aee8d5aa 100644
--- a/pkgs/development/compilers/temurin-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-linux-base.nix
@@ -1,7 +1,7 @@
 { name-prefix ? "temurin"
 , brand-name ? "Eclipse Temurin"
 , sourcePerArch
-, knownVulnerabilities ? []
+, knownVulnerabilities ? [ ]
 }:
 
 { stdenv
@@ -10,18 +10,18 @@
 , autoPatchelfHook
 , makeWrapper
 , setJavaClassPath
-# minimum dependencies
+  # minimum dependencies
 , alsa-lib
 , fontconfig
 , freetype
 , libffi
 , xorg
 , zlib
-# runtime dependencies
+  # runtime dependencies
 , cups
-# runtime dependencies for GTK+ Look and Feel
-# TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
-# which should be fixable, this is a no-rebuild workaround for GHC.
+  # runtime dependencies for GTK+ Look and Feel
+  # TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
+  # which should be fixable, this is a no-rebuild workaround for GHC.
 , gtkSupport ? !stdenv.targetPlatform.isGhcjs
 , cairo
 , glib
@@ -33,7 +33,9 @@ let
   runtimeDependencies = [
     cups
   ] ++ lib.optionals gtkSupport [
-    cairo glib gtk3
+    cairo
+    glib
+    gtk3
   ];
   runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
   validCpuTypes = builtins.attrNames lib.systems.parse.cpuTypes;
@@ -41,7 +43,8 @@ let
     (arch: builtins.elem arch validCpuTypes)
     (builtins.attrNames sourcePerArch);
   result = stdenv.mkDerivation {
-    pname = if sourcePerArch.packageType == "jdk"
+    pname =
+      if sourcePerArch.packageType == "jdk"
       then "${name-prefix}-bin"
       else "${name-prefix}-${sourcePerArch.packageType}-bin";
 
@@ -123,10 +126,11 @@ let
       license = licenses.gpl2Classpath;
       sourceProvenance = with sourceTypes; [ binaryNativeCode binaryBytecode ];
       description = "${brand-name}, prebuilt OpenJDK binary";
-      platforms = builtins.map (arch: arch + "-linux") providedCpuTypes;  # some inherit jre.meta.platforms
+      platforms = builtins.map (arch: arch + "-linux") providedCpuTypes; # some inherit jre.meta.platforms
       maintainers = with maintainers; [ taku0 ];
       inherit knownVulnerabilities;
       mainProgram = "java";
     };
   };
-in result
+in
+result
diff --git a/pkgs/development/compilers/temurin-bin/jdk-linux.nix b/pkgs/development/compilers/temurin-bin/jdk-linux.nix
index 87a00a373916f..2a38e3472d532 100644
--- a/pkgs/development/compilers/temurin-bin/jdk-linux.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-linux.nix
@@ -3,27 +3,34 @@
 let
   variant = if stdenv.hostPlatform.isMusl then "alpine-linux" else "linux";
   sources = (lib.importJSON ./sources.json).hotspot.${variant};
-  common = opts: callPackage (import ./jdk-linux-base.nix opts) {};
+  common = opts: callPackage (import ./jdk-linux-base.nix opts) { };
+
+  EOL = [ "This JDK version has reached End of Life." ];
 in
 {
   jdk-8 = common { sourcePerArch = sources.jdk.openjdk8; };
   jre-8 = common { sourcePerArch = sources.jre.openjdk8; };
+
   jdk-11 = common { sourcePerArch = sources.jdk.openjdk11; };
   jre-11 = common { sourcePerArch = sources.jre.openjdk11; };
-  jdk-16 = common { sourcePerArch = sources.jdk.openjdk16; };
+
+  jdk-16 = common { sourcePerArch = sources.jdk.openjdk16; knownVulnerabilities = EOL; };
 
   jdk-17 = common { sourcePerArch = sources.jdk.openjdk17; };
   jre-17 = common { sourcePerArch = sources.jre.openjdk17; };
 
-  jdk-18 = common { sourcePerArch = sources.jdk.openjdk18; };
-  jre-18 = common { sourcePerArch = sources.jre.openjdk18; };
+  jdk-18 = common { sourcePerArch = sources.jdk.openjdk18; knownVulnerabilities = EOL; };
+  jre-18 = common { sourcePerArch = sources.jre.openjdk18; knownVulnerabilities = EOL; };
 
-  jdk-19 = common { sourcePerArch = sources.jdk.openjdk19; };
-  jre-19 = common { sourcePerArch = sources.jre.openjdk19; };
+  jdk-19 = common { sourcePerArch = sources.jdk.openjdk19; knownVulnerabilities = EOL; };
+  jre-19 = common { sourcePerArch = sources.jre.openjdk19; knownVulnerabilities = EOL; };
 
-  jdk-20 = common { sourcePerArch = sources.jdk.openjdk20; };
-  jre-20 = common { sourcePerArch = sources.jre.openjdk20; };
+  jdk-20 = common { sourcePerArch = sources.jdk.openjdk20; knownVulnerabilities = EOL; };
+  jre-20 = common { sourcePerArch = sources.jre.openjdk20; knownVulnerabilities = EOL; };
 
   jdk-21 = common { sourcePerArch = sources.jdk.openjdk21; };
   jre-21 = common { sourcePerArch = sources.jre.openjdk21; };
+
+  jdk-22 = common { sourcePerArch = sources.jdk.openjdk22; };
+  jre-22 = common { sourcePerArch = sources.jre.openjdk22; };
 }
diff --git a/pkgs/development/compilers/temurin-bin/sources.json b/pkgs/development/compilers/temurin-bin/sources.json
index 00a0e72997ecc..fe24b9f5199c1 100644
--- a/pkgs/development/compilers/temurin-bin/sources.json
+++ b/pkgs/development/compilers/temurin-bin/sources.json
@@ -7,9 +7,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "d5e2235d3707526f7c9ba3f0dc194e60d5dec33eceff2a2dcf9d874464cc0e9e",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_x64_alpine-linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "b45c467be52fe11ffd9bf69b3a035068134b305053874de4f3b3c5e5e1419659",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_x64_alpine-linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk16": {
@@ -27,9 +27,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "c2a571a56e5bd3f30956b17b048880078c7801ed9e8754af6d1e38b9176059a9",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_alpine-linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "839326b5b4b3e4ac2edc3b685c8ab550f9b6d267eddf966323c801cb21e3e018",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_x64_alpine-linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -64,28 +64,44 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "77006c0a753808c2a6662007906eb6eb230f2fb6eb9d201a39cc46113e68f82c",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_aarch64_alpine-linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "0f68a9122054149861f6ce9d1b1c176bbe30dd76b36b74c916ba897c12e9d970",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_aarch64_alpine-linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "8e861638bf6b08c6d5837de6dc929930550928ec5fcc81b9fa7e8296afd0f9c0",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_x64_alpine-linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "86a7b47c9277f2fd063ec910616b3676d86553ab7d23aa3bd365e51a57be1dc5",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_aarch64_alpine-linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "422f23f5109056cacb9227247bebf8532e2dc3c9d505e71637ba610569d6b3ff",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_alpine-linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "d226e44b3513942db855df9a8737d848f64069848970d4cfd35ee3c38f2525c1",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_x64_alpine-linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "5",
-            "sha256": "6cf2d4925c387c4cdc0bf2e71de3690527141b5244695d0b3109ce83a8512235",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jdk_x64_alpine-linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "409091665e5f8cf678938bbbc0d377122ef8bad7b1c97a0f809da054db956e51",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_x64_alpine-linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       },
@@ -95,9 +111,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "6a3d1759bdf91433411d37ca2ad1505a7f214c1401797834e9884165c2457368",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_x64_alpine-linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "6972a6251bc88d6fbb64a188557cf165f1c415ded550d2a280bbcbc4272caff1",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_x64_alpine-linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk17": {
@@ -105,9 +121,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "70e5d108f51ae7c7b2435d063652df058723e303a18b4f72f17f75c5320052d3",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_alpine-linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "b5dffd0be08c464d9c3903e2947508c1a5c21804ea1cff5556991a2a47d617d8",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_x64_alpine-linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -142,28 +158,44 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "2898ea1ddf6f70f09b09cf99d928f6d4c862f78f81104f5dce3e44a832b8444a",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_aarch64_alpine-linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "54e8618da373258654fe788d509f087d3612de9e080eb6831601069dbc8a4b2b",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_aarch64_alpine-linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "b3e7170deab11a7089fe8e14f9f398424fd86db085f745dad212f6cfc4121df6",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_x64_alpine-linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "6cac56dde6793d887deea101cfff283dc5f285e1118c21cbd1c4cb69f1072e55",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_aarch64_alpine-linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "a8fcc43927664ba191c9a77d1013f1f32fec1acc22fe6f0c29d687221f2cc95d",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_alpine-linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "e7c26ad00e3ded356b8c4b20b184ccf5bd63ccdccabde8d4a892389f178f1d5b",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_x64_alpine-linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "5",
-            "sha256": "7040d865493f13204194c5a1add63e22516b1fa4481264baa6a5b2614a275a0e",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jre_x64_alpine-linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "c82962d7378d1fd415db594fce6ec047939e9fab5301fa4407cd7faea9ea7e31",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_x64_alpine-linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       }
@@ -173,35 +205,35 @@
         "openjdk11": {
           "aarch64": {
             "build": "9",
-            "sha256": "8c3146035b99c55ab26a2982f4b9abd2bf600582361cf9c732539f713d271faf",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "e00476a7be3c4adfa9b3d55d30768967fd246a8352e518894e183fa444d4d3ce",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "armv6l": {
-            "build": "1",
-            "sha256": "e83674aee238ebb5f359b9395b3c5e3fad5b645846095494662802d2f0fd01c9",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jdk_arm_linux_hotspot_11.0.20.1_1.tar.gz",
-            "version": "11.0.20"
+            "build": "9",
+            "sha256": "8077edc07a57d846c3d11286a7caf05ed6ca6d6c1234bf0e03611f18e187f075",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_arm_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "armv7l": {
-            "build": "1",
-            "sha256": "e83674aee238ebb5f359b9395b3c5e3fad5b645846095494662802d2f0fd01c9",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jdk_arm_linux_hotspot_11.0.20.1_1.tar.gz",
-            "version": "11.0.20"
+            "build": "9",
+            "sha256": "8077edc07a57d846c3d11286a7caf05ed6ca6d6c1234bf0e03611f18e187f075",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_arm_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "packageType": "jdk",
           "powerpc64le": {
             "build": "9",
-            "sha256": "262ff98d6d88a7c7cc522cb4ec4129491a0eb04f5b17dcca0da57cfcdcf3830d",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "f56068bb64c6bf858894f75c2bc261f54db32932422eb07527f36ae40046e9a0",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "60ea98daa09834fdd3162ca91ddc8d92a155ab3121204f6f643176ee0c2d0d5e",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_x64_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "23e47ea7a3015be3240f21185fd902adebdcf76530757c9b482c7eb5bd3417c2",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_x64_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk16": {
@@ -241,35 +273,35 @@
         "openjdk17": {
           "aarch64": {
             "build": "9",
-            "sha256": "e2c5e26f8572544b201bc22a9b28f2b1a3147ab69be111cea07c7f52af252e75",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "a900acf3ae56b000afc35468a083b6d6fd695abec87a8abdb02743d5c72f6d6d",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "armv6l": {
-            "build": "1",
-            "sha256": "b1f1d8b7fcb159a0a8029b6c3106d1d16207cecbb2047f9a4be2a64d29897da5",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.8.1%2B1/OpenJDK17U-jdk_arm_linux_hotspot_17.0.8.1_1.tar.gz",
-            "version": "17.0.8"
+            "build": "9",
+            "sha256": "9b5c375ed7ce654083c6c1137d8daadebaf8657650576115f0deafab00d0f1d7",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_arm_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "armv7l": {
-            "build": "1",
-            "sha256": "b1f1d8b7fcb159a0a8029b6c3106d1d16207cecbb2047f9a4be2a64d29897da5",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.8.1%2B1/OpenJDK17U-jdk_arm_linux_hotspot_17.0.8.1_1.tar.gz",
-            "version": "17.0.8"
+            "build": "9",
+            "sha256": "9b5c375ed7ce654083c6c1137d8daadebaf8657650576115f0deafab00d0f1d7",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_arm_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "packageType": "jdk",
           "powerpc64le": {
             "build": "9",
-            "sha256": "3ae4b254d5b720f94f986481e787fbd67f0667571140ba2e2ae5020ceddbc826",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "44bdd662c3b832cfe0b808362866b8d7a700dd60e6e39716dee97211d35c230f",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "7b175dbe0d6e3c9c23b6ed96449b018308d8fc94a5ecd9c0df8b8bc376c3c18a",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "aa7fb6bb342319d227a838af5c363bfa1b4a670c209372f9e6585bd79da6220c",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_x64_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -364,58 +396,80 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "e184dc29a6712c1f78754ab36fb48866583665fa345324f1a79e569c064f95e9",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "7d3ab0e8eba95bd682cfda8041c6cb6fa21e09d0d9131316fd7c96c78969de31",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jdk",
+          "powerpc64le": {
+            "build": "9",
+            "sha256": "9a1079d7f0fc72951fdc9a0029e49a15f6ba114683aee626f882ee2c761f1d57",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "fffa52c22d797b715a962e6c8d11ec7d79b90dd819b5bc51d62137ea4b22a340",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_x64_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "d8488fa1e4e8c1e318cef4c0fc3842a7f15a4cf52b27054663bb94471f54b3fa",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_aarch64_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jdk",
           "powerpc64le": {
-            "build": "12",
-            "sha256": "9574828ef3d735a25404ced82e09bf20e1614f7d6403956002de9cfbfcb8638f",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "4113606ba65044a3cbd7678e1c0d41881d24a2441c8ab8b658b4ac58da624de5",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_ppc64le_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "1a6fa8abda4c5caed915cfbeeb176e7fbd12eb6b222f26e290ee45808b529aa1",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "e59c6bf801cc023a1ea78eceb5e6756277f1564cd0a421ea984efe6cb96cfcf8",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_x64_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
           "aarch64": {
             "build": "8",
-            "sha256": "70636c2fa4927913e9e869d471607a99d3a521c1fa3f3687b889c2acba67c493",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jdk_aarch64_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "3504d748a93f23cac8c060bd33231bd51e90dcb620f38dadc6239b6cd2a5011c",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_aarch64_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "armv6l": {
-            "build": "5",
-            "sha256": "5d805ff157f272acf0f7d192f21af4a3b68c840333ca95568e4e07142efc369d",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jdk_arm_linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "be4aff6fa7bf6515f16f93dcaf9fdc61853fe1ef0d25b08a1bb1cf6e3d047391",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_arm_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "armv7l": {
-            "build": "5",
-            "sha256": "5d805ff157f272acf0f7d192f21af4a3b68c840333ca95568e4e07142efc369d",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jdk_arm_linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "be4aff6fa7bf6515f16f93dcaf9fdc61853fe1ef0d25b08a1bb1cf6e3d047391",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_arm_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "packageType": "jdk",
           "powerpc64le": {
             "build": "8",
-            "sha256": "9d9813d2840360ffdbc449c45e71124e8170c31a3b6cce9151fbb31352064406",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jdk_ppc64le_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "6b7ed7996788075e182dd33349288346240fbce540e50fd77aecfc309a5ada19",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_ppc64le_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "8",
-            "sha256": "15d091e22aa0cad12a241acff8c1634e7228b9740f8d19634250aa6fe0c19a33",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jdk_x64_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "b9884a96f78543276a6399c3eb8c2fd8a80e6b432ea50e87d3d12d495d1d2808",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_x64_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       },
@@ -423,69 +477,69 @@
         "openjdk11": {
           "aarch64": {
             "build": "9",
-            "sha256": "8dc527e5c5da62f80ad3b6a2cd7b1789f745b1d90d5e83faba45f7a1d0b6cab8",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "7290ace47a030d89ea023c28e7aa555c9da72b4194f73b39ec9d058011bf06dd",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "armv6l": {
-            "build": "1",
-            "sha256": "2fc1cc935897312c0bc2515b2e7ea1fa3b267e77305a1b51a8c3917d92af380f",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jre_arm_linux_hotspot_11.0.20.1_1.tar.gz",
-            "version": "11.0.20"
+            "build": "9",
+            "sha256": "025f994549708f7291ce3b0fa7c41f7e78ec3af3eae3f85fffe9c5fa4a54889f",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_arm_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "armv7l": {
-            "build": "1",
-            "sha256": "2fc1cc935897312c0bc2515b2e7ea1fa3b267e77305a1b51a8c3917d92af380f",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jre_arm_linux_hotspot_11.0.20.1_1.tar.gz",
-            "version": "11.0.20"
+            "build": "9",
+            "sha256": "025f994549708f7291ce3b0fa7c41f7e78ec3af3eae3f85fffe9c5fa4a54889f",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_arm_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "packageType": "jre",
           "powerpc64le": {
             "build": "9",
-            "sha256": "286e37ce06316185377eea847d2aa9f1523b9f1428684e59e772f2f6055e89b9",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_ppc64le_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "3b3fbd324620fd914bd8462e292124493fcf846fd69195c4b9a231131dc68d5f",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_ppc64le_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "156861bb901ef18759e05f6f008595220c7d1318a46758531b957b0c950ef2c3",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_x64_linux_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "786a72296189ba8e43999532aa73730d87ec1fce558eb3c4e98b611b423375e3",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_x64_linux_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk17": {
           "aarch64": {
             "build": "9",
-            "sha256": "05b192f81ed478178ba953a2a779b67fc5a810acadb633ad69f8c4412399edb8",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "ccfa23c25790475c84df983cc5f729b94c04d9ea9863912deb15c6266782cf16",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "armv6l": {
-            "build": "1",
-            "sha256": "8af898c5d356f0b2cee2db67ff9c8e7a8e738c0f6b3a61c383150b3168b9ea58",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.8.1%2B1/OpenJDK17U-jre_arm_linux_hotspot_17.0.8.1_1.tar.gz",
-            "version": "17.0.8"
+            "build": "9",
+            "sha256": "2e06401aa3aa7a825d73a6af8e9462449b1a86e7705b793dc8ec90423b602ee2",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_arm_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "armv7l": {
-            "build": "1",
-            "sha256": "8af898c5d356f0b2cee2db67ff9c8e7a8e738c0f6b3a61c383150b3168b9ea58",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.8.1%2B1/OpenJDK17U-jre_arm_linux_hotspot_17.0.8.1_1.tar.gz",
-            "version": "17.0.8"
+            "build": "9",
+            "sha256": "2e06401aa3aa7a825d73a6af8e9462449b1a86e7705b793dc8ec90423b602ee2",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_arm_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "packageType": "jre",
           "powerpc64le": {
             "build": "9",
-            "sha256": "79c85ecf1320c67b828310167e1ced62e402bc86a5d47ca9cc7bfa3b708cb07a",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_ppc64le_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "884b5cb817e50010b4d0a3252afb6a80db18995af19bbd16a37348b2c37949bc",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_ppc64le_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "c37f729200b572884b8f8e157852c739be728d61d9a1da0f920104876d324733",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "bcb1b7b8ad68c93093f09b591b7cb17161d39891f7d29d33a586f5a328603707",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_x64_linux_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -580,58 +634,80 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "4582c4cc0c6d498ba7a23fdb0a5179c9d9c0d7a26f2ee8610468d5c2954fcf2f",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "c7c31bc6f5ab4c4b6f4559e11c2fa9541ae6757ab8da6dd85c29163913bd9238",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jre",
+          "powerpc64le": {
+            "build": "9",
+            "sha256": "aa628c6accc9d075b7b0f2bff6487f8ca0b8f057af31842a85fc8b363e1e10f3",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_ppc64le_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "f1af100c4afca2035f446967323230150cfe5872b5a664d98c86963e5c066e0d",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_x64_linux_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "8e5996a2bbae2da9797cff5a62cb2080965e08fd66de24673b29a8e481ec769e",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_aarch64_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jre",
           "powerpc64le": {
-            "build": "12",
-            "sha256": "05cc9b7bfbe246c27d307783b3d5095797be747184b168018ae3f7cc55608db2",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_ppc64le_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "7df4a10fab324181a6c9e8b1e2a45042b8d30490f0fdb937a536f6cd17c907ef",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_ppc64le_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "277f4084bee875f127a978253cfbaad09c08df597feaf5ccc82d2206962279a3",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_linux_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "154dbc7975cf765c59bdaa1e693d6c8b009635c9a182d6d6d9f0cfbec5317b4c",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_x64_linux_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
           "aarch64": {
             "build": "8",
-            "sha256": "37b997f12cd572da979283fccafec9ba903041a209605b50fcb46cc34f1a9917",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jre_aarch64_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "17550a6a4ddf71ac81ba8f276467bc58f036c123c0f1bafcafd69f70e3e49cf5",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_aarch64_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "armv6l": {
-            "build": "5",
-            "sha256": "b92fb3972372b5d1f9fb51815def903105722b747f680b7ecf2ba2ba863ab156",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jre_arm_linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "1a6b470ac83b241223447a1e6cb55c4a8f78af0146b9387e9842625041226654",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_arm_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "armv7l": {
-            "build": "5",
-            "sha256": "b92fb3972372b5d1f9fb51815def903105722b747f680b7ecf2ba2ba863ab156",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u382-b05/OpenJDK8U-jre_arm_linux_hotspot_8u382b05.tar.gz",
-            "version": "8.0.382"
+            "build": "8",
+            "sha256": "1a6b470ac83b241223447a1e6cb55c4a8f78af0146b9387e9842625041226654",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_arm_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "packageType": "jre",
           "powerpc64le": {
             "build": "8",
-            "sha256": "0ecb0aeb54fb9d3c9e1a7ea411490127e8e298d93219fafc4dd6051a5b74671f",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jre_ppc64le_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "d3157230c01b320e47ad6df650e83b15f8f76294d0df9f1c03867d07fe2883c9",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_ppc64le_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "8",
-            "sha256": "91d31027da0d985be3549714389593d9e0da3da5057d87e3831c7c538b9a2a0f",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jre_x64_linux_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "a8d994332a2ff15d48bf04405c3b2f6bd331a928dd96639b15e62891f7172363",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_x64_linux_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       }
@@ -641,17 +717,17 @@
         "openjdk11": {
           "aarch64": {
             "build": "9",
-            "sha256": "3be236f2cf9612cd38cd6b7cfa4b8eef642a88beab0cd37c6ccf1766d755b4cc",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_aarch64_mac_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "49122443bdeab2c9f468bd400f58f85a9ea462846faa79084fd6fd786d9b492d",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_aarch64_mac_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "39e30e333d01f70765f0fdc57332bc2c5ae101392bcc315ef06f472d80d8e2d7",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jdk_x64_mac_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "4dbd21d9a0311d321f5886eda50c3086026ed61d02e1a85f7b8c2e9ad557bf03",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_x64_mac_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk16": {
@@ -667,17 +743,17 @@
         "openjdk17": {
           "aarch64": {
             "build": "9",
-            "sha256": "823777266415347983bbd87ccd8136537242ff27e62f307b7e8521494c665f0d",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_aarch64_mac_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "09a162c58dd801f7cfacd87e99703ed11fb439adc71cfa14ceb2d3194eaca01c",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_aarch64_mac_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "c69b37ea72136df49ce54972408803584b49b2c91b0fbc876d7125e963c7db37",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jdk_x64_mac_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "f8b96724618f4df557c47f11048d1084e98ed3eb87f0dbd5b84f768a80c3348e",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jdk_x64_mac_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -730,18 +806,34 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "0d29257c9bcb5f20f5c4643ef9437f36b10376863eddaf6248d09093796c6b30",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_aarch64_mac_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "b6be6a9568be83695ec6b7cb977f4902f7be47d74494c290bc2a5c3c951e254f",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_aarch64_mac_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "f777103aab94330d14a29bd99f3a26d60abbab8e2c375cec9602746096721a7c",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jdk_x64_mac_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "80d6fa75e87280202ae7660139870fe50f07fca9dc6c4fbd3f2837cbd70ec902",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_aarch64_mac_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "35f3cbc86d7ff0a01facefd741d5cfb675867e0a5ec137f62ba071d2511a45c9",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jdk_x64_mac_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "9445952d4487451af024a9a3f56373df76fbd928d9ff9186988aa27be2e4f10c",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jdk_x64_mac_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
@@ -749,9 +841,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "8",
-            "sha256": "d152f5b2ed8473ee0eb29c7ee134958d75ea86c8ccbafb5ee04a5545dd76108f",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jdk_x64_mac_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "fd62491f7634c1cbed7557d6b21db7ef4818fbc0e63e678110d9d92cbea4ad8c",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_x64_mac_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       },
@@ -759,33 +851,33 @@
         "openjdk11": {
           "aarch64": {
             "build": "9",
-            "sha256": "bcac3231195a95cac397a35410bfa3f0945ec03e5194e7b0c1d0e785a48f8b76",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_aarch64_mac_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "8ecc59f0bda845717cecbc6025c4c7fcc26d6ffe48824b8f7a5db024216c5fb4",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_aarch64_mac_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "43d29affe994a09de31bf2fb6f8ab6d6792ba4267b9a2feacaa1f6e042481b9b",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.21%2B9/OpenJDK11U-jre_x64_mac_hotspot_11.0.21_9.tar.gz",
-            "version": "11.0.21"
+            "sha256": "9855769dddc3f3b5a1fb530ce953025b1f7b3fac861628849b417676b1310b1f",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jre_x64_mac_hotspot_11.0.23_9.tar.gz",
+            "version": "11.0.23"
           }
         },
         "openjdk17": {
           "aarch64": {
             "build": "9",
-            "sha256": "89831d03b7cd9922bd178f1a9c8544a36c54d52295366db4e6628454b01acaef",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_aarch64_mac_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "003d3e0a65a2f0633b8bfed42be133724b490acb323c174c708d3a446d5fc660",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_aarch64_mac_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "ba214f2217dc134e94432085cff4fc5a97e964ffc211d343725fd535f3cd98a0",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.9%2B9/OpenJDK17U-jre_x64_mac_hotspot_17.0.9_9.tar.gz",
-            "version": "17.0.9"
+            "sha256": "232c40bebd6ddbb673862e86e7e6e09bcfe399e5a53c8a6b77bf1ceab8edefd0",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.11%2B9/OpenJDK17U-jre_x64_mac_hotspot_17.0.11_9.tar.gz",
+            "version": "17.0.11"
           }
         },
         "openjdk18": {
@@ -838,18 +930,34 @@
         },
         "openjdk21": {
           "aarch64": {
-            "build": "12",
-            "sha256": "bc384961d3a866198b1055a80fdff7fb6946aa6823b3ce624cc8c3125a26bed5",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_aarch64_mac_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "9",
+            "sha256": "8df56361b834c4681ef304ae9dc8406ce3d79c8572d2d6c2fefcbea55be7d86b",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_aarch64_mac_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "d7fc89c196ed03deb8a98f6599e1b2e78859ec8ec752142549cd3710f3e1a025",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.3%2B9/OpenJDK21U-jre_x64_mac_hotspot_21.0.3_9.tar.gz",
+            "version": "21.0.3"
+          }
+        },
+        "openjdk22": {
+          "aarch64": {
+            "build": "8",
+            "sha256": "73a8a0270534db7b4760399f41c573fd1cff5f86f4e68b08988afee0df814889",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_aarch64_mac_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "12",
-            "sha256": "c21a2648ec21bc4701acfb6b7a1fd90aca001db1efb8454e2980d4c8dcd9e310",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.1%2B12/OpenJDK21U-jre_x64_mac_hotspot_21.0.1_12.tar.gz",
-            "version": "21.0.1"
+            "build": "8",
+            "sha256": "d21e84edc1d7cc58fc04bcd9a214b71bf85e8ea348f8659197be3383afcb2b9a",
+            "url": "https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.1%2B8/OpenJDK22U-jre_x64_mac_hotspot_22.0.1_8.tar.gz",
+            "version": "22.0.1"
           }
         },
         "openjdk8": {
@@ -857,9 +965,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "8",
-            "sha256": "f1f15920ed299e10c789aef6274d88d45eb21b72f9a7b0d246a352107e344e6a",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u392-b08/OpenJDK8U-jre_x64_mac_hotspot_8u392b08.tar.gz",
-            "version": "8.0.392"
+            "sha256": "1237e4f4238211d9137eec838e5d7cabdc9d93d41001cf41f6de3a4eb90884ef",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jre_x64_mac_hotspot_8u412b08.tar.gz",
+            "version": "8.0.412"
           }
         }
       }
diff --git a/pkgs/development/compilers/vyper/default.nix b/pkgs/development/compilers/vyper/default.nix
index 078cb7dac9252..b0a8b02ae49ab 100644
--- a/pkgs/development/compilers/vyper/default.nix
+++ b/pkgs/development/compilers/vyper/default.nix
@@ -9,7 +9,6 @@
 , pycryptodome
 , pytest-runner
 , pythonOlder
-, pythonRelaxDepsHook
 , recommonmark
 , setuptools-scm
 , sphinx
@@ -50,7 +49,6 @@ buildPythonPackage rec {
     # ever since https://github.com/vyperlang/vyper/pull/2816
     git
 
-    pythonRelaxDepsHook
     pytest-runner
     setuptools-scm
   ];
diff --git a/pkgs/development/embedded/platformio/core.nix b/pkgs/development/embedded/platformio/core.nix
index 9013f39ad4244..d5229e5c81aef 100644
--- a/pkgs/development/embedded/platformio/core.nix
+++ b/pkgs/development/embedded/platformio/core.nix
@@ -50,7 +50,6 @@ with python3Packages; buildPythonApplication rec {
 
   nativeBuildInputs = [
     installShellFiles
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index 7775fa5c84939..497307d57b3f3 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs:
   LuaCPathSearchPaths = luaPackages.luaLib.luaCPathList;
   setupHook = builtins.toFile "lua-setup-hook" ''
       source @out@/nix-support/utils.sh
-      addEnvHooks "$hostOffset" addToLuaPath
+      addEnvHooks "$hostOffset" luaEnvHook
       '';
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/interpreters/lua-5/tests/default.nix b/pkgs/development/interpreters/lua-5/tests/default.nix
index c95d11aefc967..768f07cb84003 100644
--- a/pkgs/development/interpreters/lua-5/tests/default.nix
+++ b/pkgs/development/interpreters/lua-5/tests/default.nix
@@ -96,4 +96,17 @@ in
 
       touch $out
     '');
+
+
+    /*
+    Check that a lua package's propagatedBuildInputs end up in LUA_PATH
+    */
+    checkPropagatedBuildInputs = pkgs.runCommandLocal "test-${lua.name}-setup-hook" ({
+      # lua-curl is a propagatedBuildInput of rest-nvim has
+      buildInputs = [ lua.pkgs.rest-nvim ];
+    }) (''
+      ${lua}/bin/lua -e "require'cURL'"
+      touch $out
+    '');
+
 })
diff --git a/pkgs/development/interpreters/lua-5/utils.sh b/pkgs/development/interpreters/lua-5/utils.sh
index 5491f8f7ad2d5..2365af08dc9cb 100644
--- a/pkgs/development/interpreters/lua-5/utils.sh
+++ b/pkgs/development/interpreters/lua-5/utils.sh
@@ -1,4 +1,8 @@
-#!/bin/sh
+#!/bin/bash
+
+declare -gA luaPathsSeen=()
+
+# shellcheck disable=SC2164,SC2041
 nix_print() {
   if [ ${NIX_DEBUG:-0} -ge $1 ]; then
     echo "$2"
@@ -33,13 +37,53 @@ addToLuaSearchPathWithCustomDelimiter() {
   shopt -u globstar
 }
 
+# used in setup Hooks to load LUA_PATH and LUA_CPATH
+# luaEnvHook
+luaEnvHook() {
+    _addToLuaPath "$1"
+}
+
 addToLuaPath() {
   local dir="$1"
 
+  if [ ! -d "$dir" ]; then
+    nix_debug "$dir not a directory abort"
+    return 0
+  fi
+  cd "$dir"
+  for pattern in @luapathsearchpaths@; do
+    addToLuaSearchPathWithCustomDelimiter LUA_PATH "$PWD/$pattern"
+  done
+
+  # LUA_CPATH
+  for pattern in @luacpathsearchpaths@; do
+    addToLuaSearchPathWithCustomDelimiter LUA_CPATH "$PWD/$pattern"
+  done
+  cd - >/dev/null
+}
+
+
+_addToLuaPath() {
+  local dir="$1"
+
+  echo "_addToLuaPath called for dir $dir"
+
   if [[ ! -d "$dir" ]]; then
     nix_debug "$dir not a directory abort"
     return 0
   fi
+
+# set -x
+  # if [ -n "${pythonPathsSeen[$dir]}" ]; then return; fi
+  if [[ -n "${luaPathsSeen[$dir]:-}" ]]; then
+  # if [ -n "${luaPathsSeen[$dir]}" ]; then
+    echo "$dir already parsed"
+    return
+  fi
+
+  luaPathsSeen["$dir"]=true
+
+  # shellcheck disable=SC2164
   cd "$dir"
   for pattern in @luapathsearchpaths@; do
     addToLuaSearchPathWithCustomDelimiter LUA_PATH "$PWD/$pattern"
@@ -49,6 +93,43 @@ addToLuaPath() {
   for pattern in @luacpathsearchpaths@; do
     addToLuaSearchPathWithCustomDelimiter LUA_CPATH "$PWD/$pattern"
   done
+
   cd - >/dev/null
+
+  addToSearchPath program_PATH "$dir"/bin
+
+  # Inspect the propagated inputs (if they exist) and recur on them.
+  local prop="$dir/nix-support/propagated-build-inputs"
+  if [ -e "$prop" ]; then
+    local new_path
+    for new_path in $(cat $prop); do
+        echo "newpath: $new_path"
+        _addToLuaPath "$new_path"
+    done
+  fi
+
 }
 
+# Builds environment variables like LUA_PATH and PATH walking through closure
+# of dependencies.
+buildLuaPath() {
+  local luaPath="$1"
+  local path
+
+  echo "BUILD_LUA_PATH"
+
+#   # set -x
+#   # Create an empty table of paths (see doc on loadFromPropagatedInputs
+#   # for how this is used). Build up the program_PATH and program_LUA_PATH
+#   # variables.
+  # declare -gA luaPathsSeen=()
+#   # shellcheck disable=SC2034
+  program_PATH=
+  luaPathsSeen["@lua@"]=1
+#   addToSearchPath program_PATH @lua@/bin
+  for path in $luaPath; do
+    _addToLuaPath "$path"
+  done
+}
+
+
diff --git a/pkgs/development/interpreters/lua-5/wrap.sh b/pkgs/development/interpreters/lua-5/wrap.sh
index 7d59cf6095775..f6868e6faac56 100644
--- a/pkgs/development/interpreters/lua-5/wrap.sh
+++ b/pkgs/development/interpreters/lua-5/wrap.sh
@@ -9,24 +9,6 @@ wrapLuaPrograms() {
   wrapLuaProgramsIn "$out/bin" "$out $luaPath"
 }
 
-# Builds environment variables like LUA_PATH and PATH walking through closure
-# of dependencies.
-buildLuaPath() {
-  local luaPath="$1"
-  local path
-
-  # Create an empty table of paths (see doc on loadFromPropagatedInputs
-  # for how this is used). Build up the program_PATH and program_LUA_PATH
-  # variables.
-  declare -A luaPathsSeen=()
-  program_PATH=
-  luaPathsSeen["@lua@"]=1
-  addToSearchPath program_PATH @lua@/bin
-  for path in $luaPath; do
-    addToLuaPath "$path"
-  done
-}
-
 # with an executable shell script which will set some environment variables
 # and then call into the original binary (which has been given a .wrapped suffix).
 # luaPath is a list of directories
@@ -47,7 +29,6 @@ wrapLuaProgramsIn() {
   # Find all regular files in the output directory that are executable.
   find "$dir" -type f -perm -0100 -print0 | while read -d "" f; do
     # Rewrite "#! .../env lua" to "#! /nix/store/.../lua".
-    # Strip suffix, like "3" or "2.7m" -- we don't have any choice on which
     # Lua to use besides one with this hook anyway.
     if head -n1 "$f" | grep -q '#!.*/env.*\(lua\)'; then
       sed -i "$f" -e "1 s^.*/env[ ]*\(lua\)[^ ]*^#! @executable@^"
@@ -73,28 +54,3 @@ wrapLuaProgramsIn() {
 
   done
 }
-
-# Adds the lib and bin directories to the LUA_PATH and PATH variables,
-# respectively. Recurses on any paths declared in
-# `propagated-native-build-inputs`, while avoiding duplicating paths by
-# flagging the directories it has visited in `luaPathsSeen`.
-loadFromPropagatedInputs() {
-  local dir="$1"
-  # Stop if we've already visited here.
-  if [ -n "${luaPathsSeen[$dir]}" ]; then
-    return
-  fi
-  luaPathsSeen[$dir]=1
-
-  addToLuaPath "$dir"
-  addToSearchPath program_PATH $dir/bin
-
-  # Inspect the propagated inputs (if they exist) and recur on them.
-  local prop="$dir/nix-support/propagated-native-build-inputs"
-  if [ -e "$prop" ]; then
-    local new_path
-    for new_path in $(cat $prop); do
-      loadFromPropagatedInputs "$new_path"
-    done
-  fi
-}
diff --git a/pkgs/development/interpreters/lua-5/wrapper.nix b/pkgs/development/interpreters/lua-5/wrapper.nix
index 07ea75605c0f9..6eb94b60360bb 100644
--- a/pkgs/development/interpreters/lua-5/wrapper.nix
+++ b/pkgs/development/interpreters/lua-5/wrapper.nix
@@ -30,7 +30,7 @@ let
       fi
       mkdir -p "$out/bin"
 
-      addToLuaPath "$out"
+      buildLuaPath "$out"
 
       # take every binary from lua packages and put them into the env
       for path in ${lib.concatStringsSep " " paths}; do
diff --git a/pkgs/development/interpreters/luajit/default.nix b/pkgs/development/interpreters/luajit/default.nix
index 3b98e8c790148..25f3332b2602a 100644
--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   setupHook = builtins.toFile "lua-setup-hook" ''
       source @out@/nix-support/utils.sh
-      addEnvHooks "$hostOffset" addToLuaPath
+      addEnvHooks "$hostOffset" luaEnvHook
       '';
 
   # copied from python
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index fde8913d5158a..7bd03ba494874 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -79,10 +79,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "12";
-      patch = "3";
+      patch = "4";
       suffix = "";
     };
-    hash = "sha256-Vr/vH9/BIhzmcg5DpmHj60F4XdkUzplpjYx4lq9L2qE=";
+    hash = "sha256-9tQZpth0OrJnAIAbSQjSbZfouYbhT5XeMbMt4rDnlVQ=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
index 7172ac4985451..b65d6e745247e 100644
--- a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
@@ -6,8 +6,13 @@ pythonImportsCheckPhase () {
 
     if [ -n "$pythonImportsCheck" ]; then
         echo "Check whether the following modules can be imported: $pythonImportsCheck"
-        export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"
-        ( cd $out && eval "@pythonCheckInterpreter@ -c 'import os; import importlib; list(map(lambda mod: importlib.import_module(mod), os.environ[\"pythonImportsCheck\"].split()))'" )
+        pythonImportsCheckOutput=$out
+        if [ -n "$python" ]; then
+            echo "Using python specific output \$python for imports check"
+            pythonImportsCheckOutput=$python
+        fi
+        export PYTHONPATH="$pythonImportsCheckOutput/@pythonSitePackages@:$PYTHONPATH"
+        ( cd $pythonImportsCheckOutput && eval "@pythonCheckInterpreter@ -c 'import os; import importlib; list(map(lambda mod: importlib.import_module(mod), os.environ[\"pythonImportsCheck\"].split()))'" )
     fi
 }
 
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index 4c45d9603be82..ea93a5cfe719a 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -17,6 +17,7 @@
 , pythonImportsCheckHook
 , pythonNamespacesHook
 , pythonOutputDistHook
+, pythonRelaxDepsHook
 , pythonRemoveBinBytecodeHook
 , pythonRemoveTestsDirHook
 , pythonRuntimeDepsCheckHook
@@ -252,6 +253,8 @@ let
       #    because the hook that checks for conflicts uses setuptools.
       #
       pythonCatchConflictsHook
+    ] ++ optionals (attrs ? pythonRelaxDeps || attrs ? pythonRemoveDeps) [
+      pythonRelaxDepsHook
     ] ++ optionals removeBinBytecode [
       pythonRemoveBinBytecodeHook
     ] ++ optionals (hasSuffix "zip" (attrs.src.name or "")) [
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 91903c9f68516..816afa176754d 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -58,13 +58,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2";
-  version = "2.30.3";
+  version = "2.30.4";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-ycY/AkWulV3vAu/+vKw+j/b6jTZWjqKjIgjRwqNHFl8=";
+    hash = "sha256-RhqbmS+mPVlXlo4/jrqPqtyGzvfaPTozlUEeAjHUBoA=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index 0f4c3509244d8..8e32ae89502b8 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.7.7";
+  version = "0.7.8";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    hash = "sha256-WMaiiXISaCim9ljghK7nqo+L/bdaC9DjRcf/Km2e8Iw=";
+    hash = "sha256-h3eMgEaiJsbL+xFPTI4+J8Eht7PczOXLfeRYmSUCdMw=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index 2fa7aec062f36..69cab2ca5b61c 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -9,8 +9,18 @@
 , hspell
 , nuspell
 , unittest-cpp
+
+, withHspell ? true
+, withAspell ? true
+, withHunspell ? true
+, withNuspell ? true
+, withAppleSpell ? stdenv.isDarwin
+
+, Cocoa
 }:
 
+assert withAppleSpell -> stdenv.isDarwin;
+
 stdenv.mkDerivation rec {
   pname = "enchant";
   version = "2.6.9";
@@ -31,8 +41,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib
+  ] ++ lib.optionals withHunspell [
     hunspell
+  ] ++ lib.optionals withNuspell [
     nuspell
+  ] ++ lib.optionals withAppleSpell [
+    Cocoa
   ];
 
   checkInputs = [
@@ -40,8 +54,9 @@ stdenv.mkDerivation rec {
   ];
 
   # libtool puts these to .la files
-  propagatedBuildInputs = [
+  propagatedBuildInputs = lib.optionals withHspell [
     hspell
+  ] ++ lib.optionals withAspell [
     aspell
   ];
 
@@ -51,10 +66,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-relocatable" # needed for tests
-    "--with-aspell"
-    "--with-hspell"
-    "--with-hunspell"
-    "--with-nuspell"
+    (lib.withFeature withAspell "aspell")
+    (lib.withFeature withHspell "hspell")
+    (lib.withFeature withHunspell "hunspell")
+    (lib.withFeature withNuspell "nuspell")
+    (lib.withFeature withAppleSpell "applespell")
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/ffmpeg/5.1.4-CVE-2023-49502.patch b/pkgs/development/libraries/ffmpeg/5.1.4-CVE-2023-49502.patch
new file mode 100644
index 0000000000000..ca8b8b4d15bdb
--- /dev/null
+++ b/pkgs/development/libraries/ffmpeg/5.1.4-CVE-2023-49502.patch
@@ -0,0 +1,26 @@
+Based on upstream 737ede405b11a37fdd61d19cf25df296a0cb0b75, with cuda and
+vulkan implementations removed, bwdif adjusted to apply to 5.1.4
+
+diff --git a/libavfilter/vf_bwdif.c b/libavfilter/vf_bwdif.c
+index 65c617ebb3..35c864f71e 100644
+--- a/libavfilter/vf_bwdif.c
++++ b/libavfilter/vf_bwdif.c
+@@ -333,13 +333,14 @@ static int config_props(AVFilterLink *link)
+     if(yadif->mode&1)
+         link->frame_rate = av_mul_q(link->src->inputs[0]->frame_rate, (AVRational){2,1});
+ 
+-    if (link->w < 3 || link->h < 4) {
+-        av_log(ctx, AV_LOG_ERROR, "Video of less than 3 columns or 4 lines is not supported\n");
++    yadif->csp = av_pix_fmt_desc_get(link->format);
++    yadif->filter = filter;
++
++    if (AV_CEIL_RSHIFT(link->w, yadif->csp->log2_chroma_w) < 3 || AV_CEIL_RSHIFT(link->h, yadif->csp->log2_chroma_h) < 4) {
++        av_log(ctx, AV_LOG_ERROR, "Video with planes less than 3 columns or 4 lines is not supported\n");
+         return AVERROR(EINVAL);
+     }
+ 
+-    yadif->csp = av_pix_fmt_desc_get(link->format);
+-    yadif->filter = filter;
+     if (yadif->csp->comp[0].depth > 8) {
+         s->filter_intra = filter_intra_16bit;
+         s->filter_line  = filter_line_c_16bit;
diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index 5bd9171275bee..88b5564ecba41 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -12,6 +12,7 @@ let
           CoreImage
           VideoToolbox
           ;
+        inherit (darwin) xcode;
       }
       // (initArgs // { inherit ffmpegVariant; })
     );
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 7496cb4de0e76..39c507b294ddf 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -73,6 +73,7 @@
 , withJxl ? withFullDeps && lib.versionAtLeast version "5" # JPEG XL de/encoding
 , withLadspa ? withFullDeps # LADSPA audio filtering
 , withLzma ? withHeadlessDeps # xz-utils
+, withMetal ? false # Unfree and requires manual downloading of files
 , withMfx ? withFullDeps && (with stdenv.hostPlatform; isLinux && !isAarch) # Hardware acceleration via intel-media-sdk/libmfx
 , withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
 , withMp3lame ? withHeadlessDeps # LAME MP3 encoder
@@ -317,6 +318,7 @@
 , AVFoundation
 , CoreImage
 , VideoToolbox
+, xcode # unfree contains metalcc and metallib
 /*
  *  Testing
  */
@@ -395,22 +397,22 @@ stdenv.mkDerivation (finalAttrs: {
       --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
   '';
 
-  patches = map (patch: fetchpatch2 patch) ([ ]
+  patches = []
     ++ optionals (versionOlder version "5") [
-      {
+      (fetchpatch2 {
         name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/031f1561cd286596cdb374da32f8aa816ce3b135";
         hash = "sha256-agJgzIzrBTQBAypuCmGXXFo7vw6Iodw5Ny5O5QCKCn8=";
-      }
-      {
+      })
+      (fetchpatch2 {
         # Backport fix for binutils-2.41.
         name = "binutils-2.41.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/effadce6c756247ea8bae32dc13bb3e6f464f0eb";
         hash = "sha256-vLSltvZVMcQ0CnkU0A29x6fJSywE8/aU+Mp9os8DZYY=";
-      }
+      })
       # The upstream patch isn’t for ffmpeg 4, but it will apply with a few tweaks.
       # Fixes a crash when built with clang 16 due to UB in ff_seek_frame_binary.
-      {
+      (fetchpatch2 {
         name = "utils-fix_crash_in_ff_seek_frame_binary.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/ab792634197e364ca1bb194f9abe36836e42f12d";
         hash = "sha256-vqqVACjbCcGL9Qvmg1QArSKqVmOqr8BEr+OxTBDt6mA=";
@@ -419,60 +421,96 @@ stdenv.mkDerivation (finalAttrs: {
             --replace libavformat/seek.c libavformat/utils.c \
             --replace 'const AVInputFormat *const ' 'const AVInputFormat *'
         '';
-      }
+      })
     ]
-    ++ (lib.optionals (lib.versionAtLeast version "5" && lib.versionOlder version "6") [
-      {
+    ++ optionals (lib.versionAtLeast version "5" && lib.versionOlder version "6") [
+      (fetchpatch2 {
         name = "fix_build_failure_due_to_libjxl_version_to_new";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/75b1a555a70c178a9166629e43ec2f6250219eb2";
         hash = "sha256-+2kzfPJf5piim+DqEgDuVEEX5HLwRsxq0dWONJ4ACrU=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "5.x-CVE-2024-31585.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/8711cea3841fc385cccb1e7255176479e865cd4d";
         hash = "sha256-WT+ly/l04yM/tRVbhkESA3sDDjwvtd/Cg2y8tQo4ApI=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "CVE-2024-31582.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/99debe5f823f45a482e1dc08de35879aa9c74bd2";
         hash = "sha256-+CQ9FXR6Vr/AmsbXFiCUXZcxKj1s8nInEdke/Oc/kUA=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "CVE-2024-31578.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/3bb00c0a420c3ce83c6fafee30270d69622ccad7";
         hash = "sha256-oZMZysBA+/gwaGEM1yvI+8wCadXWE7qLRL6Emap3b8Q=";
-      }
-    ])
-    ++ (lib.optionals (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2") [
-      { # this can be removed post 6.1
+      })
+      ./5.1.4-CVE-2023-49502.patch
+      (fetchpatch2 {
+        name = "CVE-2023-50008.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/5f87a68cf70dafeab2fb89b42e41a4c29053b89b";
+        hash = "sha256-sqUUSOPTPLwu2h8GbAw4SfEf+0oWioz52BcpW1n4v3Y=";
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-51793.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/8b8b4bdef311f88c0075a06a25320187aff00bf2";
+        hash = "sha256-e7oGyOfUXuA8XK3vfygNtFlHpHl92O2KSLAo50sNJ5o=";
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-51796.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/e01a55c5283b82667dad347331816a5e20869ce9";
+        hash = "sha256-m4rq+UFG3nXdgOJ3S6XcruMZ+CPw+twmy2HFv3cnvJc=";
+      })
+    ]
+    ++ optionals (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2") [
+      (fetchpatch2 { # this can be removed post 6.1
         name = "fix_build_failure_due_to_PropertyKey_EncoderID";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";
         hash = "sha256-sxRXKKgUak5vsQTiV7ge8vp+N22CdTIvuczNgVRP72c=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "fix_vulkan_av1";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/e06ce6d2b45edac4a2df04f304e18d4727417d24";
         hash = "sha256-73mlX1rdJrguw7OXaSItfHtI7gflDrFj+7SepVvvUIg=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "CVE-2024-31582.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/99debe5f823f45a482e1dc08de35879aa9c74bd2";
         hash = "sha256-+CQ9FXR6Vr/AmsbXFiCUXZcxKj1s8nInEdke/Oc/kUA=";
-      }
-      {
+      })
+      (fetchpatch2 {
         name = "CVE-2024-31578.patch";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/3bb00c0a420c3ce83c6fafee30270d69622ccad7";
         hash = "sha256-oZMZysBA+/gwaGEM1yvI+8wCadXWE7qLRL6Emap3b8Q=";
-      }
-    ])
-    ++ (lib.optionals (lib.versionAtLeast version "7.0" && lib.versionOlder version "7.0.1") [
-      {
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-49501.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/4adb93dff05dd947878c67784d98c9a4e13b57a7";
+        hash = "sha256-7cwktto3fPMDGvCZCVtB01X8Q9S/4V4bDLUICSNfGgw=";
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-49502.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/737ede405b11a37fdd61d19cf25df296a0cb0b75";
+        hash = "sha256-mpSJwR9TX5ENjjCKvzuM/9e1Aj/AOiQW0+72oOMl9v8=";
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-50007.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/b1942734c7cbcdc9034034373abcc9ecb9644c47";
+        hash = "sha256-v0hNcqBtm8GCGAU9UbRUCE0slodOjZCHrkS8e4TrVcQ=";
+      })
+      (fetchpatch2 {
+        name = "CVE-2023-50008.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/5f87a68cf70dafeab2fb89b42e41a4c29053b89b";
+        hash = "sha256-sqUUSOPTPLwu2h8GbAw4SfEf+0oWioz52BcpW1n4v3Y=";
+      })
+    ]
+    ++ optionals (lib.versionAtLeast version "7.0" && lib.versionOlder version "7.0.1") [
+      (fetchpatch2 {
         # Will likely be obsolete in >7.0
         name = "fate_avoid_dependency_on_samples";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/7b7b7819bd21cc92ac07f6696b0e7f26fa8f9834";
         hash = "sha256-TKI289XqtG86Sj9s7mVYvmkjAuRXeK+2cYYEDkg6u6I=";
-      }
-    ]));
+      })
+    ];
 
   configurePlatforms = [];
   setOutputFlags = false; # Only accepts some of them
@@ -605,6 +643,9 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ [
     (enableFeature withLadspa "ladspa")
     (enableFeature withLzma "lzma")
+  ] ++ optionals (versionAtLeast version "5.0") [
+    (enableFeature withMetal "metal")
+  ] ++ [
     (enableFeature withMfx "libmfx")
     (enableFeature withModplug "libmodplug")
     (enableFeature withMp3lame "libmp3lame")
@@ -689,6 +730,9 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ optionals stdenv.cc.isClang [
     "--cc=clang"
     "--cxx=clang++"
+  ] ++ optionals withMetal [
+    "--metalcc=${xcode}/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/metal"
+    "--metallib=${xcode}/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/metallib"
   ];
 
   # ffmpeg embeds the configureFlags verbatim in its binaries and because we
@@ -697,7 +741,8 @@ stdenv.mkDerivation (finalAttrs: {
   # such references except for data.
   postConfigure = let
     toStrip = map placeholder (lib.remove "data" finalAttrs.outputs) # We want to keep references to the data dir.
-      ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) buildPackages.stdenv.cc;
+      ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) buildPackages.stdenv.cc
+      ++ lib.optional withMetal xcode;
   in
     "remove-references-to ${lib.concatStringsSep " " (map (o: "-t ${o}") toStrip)} config.h";
 
diff --git a/pkgs/development/libraries/fribidi/default.nix b/pkgs/development/libraries/fribidi/default.nix
index d23cd352360bc..768c2185a1581 100644
--- a/pkgs/development/libraries/fribidi/default.nix
+++ b/pkgs/development/libraries/fribidi/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fribidi";
-  version = "1.0.13";
+  version = "1.0.14";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   # NOTE: Only URL tarball has "Have pre-generated man pages: true", which works-around upstream usage of some rare ancient `c2man` fossil application.
   src = fetchurl {
     url = with finalAttrs; "https://github.com/fribidi/fribidi/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-f6FsgMgb1iL3sZjTE1baE5zDGKY/x3YSF69BMJA/VKI=";
+    sha256 = "sha256-dq4gSnAnZSrDmBufpYF8CDuiMRQ0AoTFjnVrJZzSJZo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index a60ba9fae6bfd..7fffaa236e556 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -124,6 +124,12 @@ stdenv.mkDerivation (finalAttrs: {
     # 3. Tools for desktop environment that cannot go to $bin due to $out depending on them ($out)
     #    * gio-launch-desktop
     ./split-dev-programs.patch
+
+    # Tell Meson to install gdb scripts next to the lib
+    # GDB only looks there and in ${gdb}/share/gdb/auto-load,
+    # and by default meson installs in to $out/share/gdb/auto-load
+    # which does not help
+    ./gdb_script.patch
   ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
@@ -221,6 +227,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     moveToOutput "share/glib-2.0" "$dev"
+    moveToOutput "share/glib-2.0/gdb" "$out"
     substituteInPlace "$dev/bin/gdbus-codegen" --replace "$out" "$dev"
     sed -i "$dev/bin/glib-gettextize" -e "s|^gettext_dir=.*|gettext_dir=$dev/share/glib-2.0/gettext|"
 
diff --git a/pkgs/development/libraries/glib/gdb_script.patch b/pkgs/development/libraries/glib/gdb_script.patch
new file mode 100644
index 0000000000000..c1e5d22e085b1
--- /dev/null
+++ b/pkgs/development/libraries/glib/gdb_script.patch
@@ -0,0 +1,23 @@
+diff --git a/glib/meson.build b/glib/meson.build
+index b2dd569e1..b013991a1 100644
+--- a/glib/meson.build
++++ b/glib/meson.build
+@@ -541,7 +540,7 @@ configure_file(
+   input: 'libglib-gdb.py.in',
+   output: 'libglib-2.0.so.@0@-gdb.py'.format(library_version),
+   configuration: gdb_conf,
+-  install_dir: gdb_install_dir,
++  install_dir: glib_libdir,
+   install_tag: 'devel',
+   install: gdb_install,
+ )
+diff --git a/gobject/meson.build b/gobject/meson.build
+@@ -185,7 +184,7 @@ configure_file(
+   input: 'libgobject-gdb.py.in',
+   output: 'libgobject-2.0.so.@0@-gdb.py'.format(library_version),
+   configuration: gdb_conf,
+-  install_dir: gdb_install_dir,
++  install_dir: glib_libdir,
+   install_tag: 'devel',
+   install: gdb_install,
+ )
diff --git a/pkgs/development/libraries/glm/default.nix b/pkgs/development/libraries/glm/default.nix
index 417d70d621b69..3894db5ab9c81 100644
--- a/pkgs/development/libraries/glm/default.nix
+++ b/pkgs/development/libraries/glm/default.nix
@@ -1,61 +1,40 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.9.9.8";
+  version = "1.0.1";
   pname = "glm";
 
   src = fetchFromGitHub {
     owner = "g-truc";
     repo = pname;
     rev = version;
-    sha256 = "sha256-F//+3L5Ozrw6s7t4LrcUmO7sN30ZSESdrPAYX57zgr8=";
+    sha256 = "sha256-GnGyzNRpzuguc3yYbEFtYLvG+KiCtRAktiN+NvbOICE=";
   };
 
-  # (https://github.com/g-truc/glm/pull/986 wasn't enough, and -Werror is used)
-  # (https://github.com/g-truc/glm/pull/1055 neither)
-  patches = [
-    (fetchpatch {
-      name = "glm-0.9.9.8-clang.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/glm/files/glm-0.9.9.8-clang.patch?id=79476d4b145a4a6b0cbc0e73a6cefb5d584bf8fa";
-      hash = "sha256-D8O+qofnGUEaH5nQGdNddwHyr5FhPQa/lOup4z4SFgY=";
-    })
-  ];
-
   outputs = [ "out" "doc" ];
 
   nativeBuildInputs = [ cmake ];
 
-  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102823
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") "-fno-ipa-modref";
+  env.NIX_CFLAGS_COMPILE =
+    # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102823
+    if (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") then "-fno-ipa-modref"
+    # Fix compilation errors on darwin
+    else if (stdenv.cc.isClang) then "-Wno-error"
+    else "";
 
   cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=OFF"
-    "-DBUILD_STATIC_LIBS=OFF"
-    "-DGLM_TEST_ENABLE=${if doCheck then "ON" else "OFF"}"
+    (lib.cmakeBool "BUILD_SHARED_LIBS" false)
+    (lib.cmakeBool "BUILD_STATIC_LIBS" false)
+    (lib.cmakeBool "GLM_TEST_ENABLE" doCheck)
   ];
 
   doCheck = true;
 
-  installPhase = ''
-    runHook preInstall
-
-    # Install header-only library
-    mkdir -p $out/include
-    cp -rv ../glm $out/include
-    rm $out/include/glm/CMakeLists.txt
-    rm $out/include/glm/detail/*.cpp
-
-    # Install CMake files
-    mkdir -p $out/lib
-    cp -rv ../cmake $out/lib
-    substituteInPlace $out/lib/cmake/glm/glmConfig.cmake \
-        --replace 'GLM_INCLUDE_DIRS ''${_IMPORT_PREFIX}' "GLM_INCLUDE_DIRS $out/include"
-
+  postInstall = ''
     # Install pkg-config file
     mkdir -p $out/lib/pkgconfig
     substituteAll ${./glm.pc.in} $out/lib/pkgconfig/glm.pc
@@ -64,8 +43,6 @@ stdenv.mkDerivation rec {
     mkdir -p $doc/share/doc/glm
     cp -rv ../doc/api $doc/share/doc/glm/html
     cp -v ../doc/manual.pdf $doc/share/doc/glm
-
-    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/icu/default.nix b/pkgs/development/libraries/icu/default.nix
index bf595108baaf6..0d30500f34524 100644
--- a/pkgs/development/libraries/icu/default.nix
+++ b/pkgs/development/libraries/icu/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, lib, fetchurl, fetchpatch, fixDarwinDylibNames, testers, buildPackages }:
+{ stdenv, lib, fetchurl, fetchpatch, fixDarwinDylibNames, testers, buildPackages, updateAutotoolsGnuConfigScriptsHook }:
 
 let
   make-icu = (import ./make-icu.nix) {
-    inherit stdenv lib buildPackages fetchurl fixDarwinDylibNames testers;
+    inherit stdenv lib buildPackages fetchurl fixDarwinDylibNames testers updateAutotoolsGnuConfigScriptsHook;
   };
 in
 {
diff --git a/pkgs/development/libraries/icu/make-icu.nix b/pkgs/development/libraries/icu/make-icu.nix
index 3e65e80ef7c4d..575f184c163fb 100644
--- a/pkgs/development/libraries/icu/make-icu.nix
+++ b/pkgs/development/libraries/icu/make-icu.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPackages, fetchurl, fixDarwinDylibNames, testers }:
+{ stdenv, lib, buildPackages, fetchurl, fixDarwinDylibNames, testers, updateAutotoolsGnuConfigScriptsHook }:
 
 { version, hash, patches ? [], patchFlags ? [], withStatic ? stdenv.hostPlatform.isStatic }:
 
@@ -64,9 +64,11 @@ let
     outputs = [ "out" "dev" ] ++ lib.optional withStatic "static";
     outputBin = "dev";
 
-    # FIXME: This fixes dylib references in the dylibs themselves, but
-    # not in the programs in $out/bin.
-    nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+    nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ] ++
+      # FIXME: This fixes dylib references in the dylibs themselves, but
+      # not in the programs in $out/bin.
+      lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
 
     # remove dependency on bootstrap-tools in early stdenv build
     postInstall = lib.optionalString withStatic ''
diff --git a/pkgs/development/libraries/libass/default.nix b/pkgs/development/libraries/libass/default.nix
index ad94f55ccb6df..cf8f4c85e0c61 100644
--- a/pkgs/development/libraries/libass/default.nix
+++ b/pkgs/development/libraries/libass/default.nix
@@ -11,11 +11,11 @@ assert fontconfigSupport -> fontconfig != null;
 
 stdenv.mkDerivation rec {
   pname = "libass";
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchurl {
     url = "https://github.com/libass/libass/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8NoLv7pHbBauPhz9hiJW0wkVkR96uqGxbOYu5lMZJ4Q=";
+    sha256 = "sha256-6CYbUdZrqTP+mSSMb92HZ+2WxaflNjyDmSxzWiwvv3Q=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libevent/default.nix b/pkgs/development/libraries/libevent/default.nix
index ff9784064432e..983395f33b4b6 100644
--- a/pkgs/development/libraries/libevent/default.nix
+++ b/pkgs/development/libraries/libevent/default.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, fetchurl, findutils, fixDarwinDylibNames
+, updateAutotoolsGnuConfigScriptsHook
 , sslSupport ? true, openssl
 , fetchpatch
 }:
@@ -36,7 +37,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional sslSupport "openssl"
     ;
 
-  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
   buildInputs = lib.optional sslSupport openssl
     ++ lib.optional stdenv.isCygwin findutils;
diff --git a/pkgs/development/libraries/libimobiledevice-glue/default.nix b/pkgs/development/libraries/libimobiledevice-glue/default.nix
index f85c559593d16..13a2e83d04735 100644
--- a/pkgs/development/libraries/libimobiledevice-glue/default.nix
+++ b/pkgs/development/libraries/libimobiledevice-glue/default.nix
@@ -4,21 +4,24 @@
 , autoreconfHook
 , pkg-config
 , libplist
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "libimobiledevice-glue";
-  version = "1.2.0";
-
-  outputs = [ "out" "dev" ];
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
     repo = pname;
     rev = version;
-    hash = "sha256-Rfs1i1Tt8uf3WfR+cDlF4L75nFHg9VypjMhHt0TgkyQ=";
+    hash = "sha256-+poCrn2YHeH8RQCfWDdnlmJB4Nf+unWUVwn7YwILHIs=";
   };
 
+  preAutoreconf = ''
+    export RELEASE_VERSION=${version}
+  '';
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
@@ -28,9 +31,9 @@ stdenv.mkDerivation rec {
     libplist
   ];
 
-  preAutoreconf = ''
-    export RELEASE_VERSION=${version}
-  '';
+  outputs = [ "out" "dev" ];
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     homepage = "https://github.com/libimobiledevice/libimobiledevice-glue";
diff --git a/pkgs/development/libraries/libimobiledevice/default.nix b/pkgs/development/libraries/libimobiledevice/default.nix
index 59ee89c95422a..f995ac8836115 100644
--- a/pkgs/development/libraries/libimobiledevice/default.nix
+++ b/pkgs/development/libraries/libimobiledevice/default.nix
@@ -12,30 +12,25 @@
 , libimobiledevice-glue
 , SystemConfiguration
 , CoreFoundation
+, unstableGitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "libimobiledevice";
-  version = "1.3.0+date=2023-04-30";
-
-  outputs = [ "out" "dev" ];
+  version = "1.3.0-unstable-2024-05-20";
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
     repo = pname;
-    rev = "860ffb707af3af94467d2ece4ad258dda957c6cd";
-    hash = "sha256-mIsB+EaGJlGMOpz3OLrs0nAmhOY1BwMs83saFBaejwc=";
+    rev = "9ccc52222c287b35e41625cc282fb882544676c6";
+    hash = "sha256-pNvtDGUlifp10V59Kah4q87TvLrcptrCJURHo+Y+hs4=";
   };
 
-  patches = [
-    # Pull upstream fix for clang-16 and upcoming gcc-14 support:
-    #   https://github.com/libimobiledevice/libimobiledevice/pull/1444
-    (fetchpatch {
-      name = "usleep-decl.patch";
-      url = "https://github.com/libimobiledevice/libimobiledevice/commit/db623184c0aa09c27697f5a2e81025db223075d5.patch";
-      hash = "sha256-TgdgBkEDXzQDSgJxcZc+pZncfmBVXarhHOByGFs6p0Q=";
-    })
-  ];
+  preAutoreconf = ''
+    export RELEASE_VERSION=${version}
+  '';
+
+  configureFlags = [ "--without-cython" ];
 
   nativeBuildInputs = [
     autoreconfHook
@@ -54,11 +49,10 @@ stdenv.mkDerivation rec {
     CoreFoundation
   ];
 
-  preAutoreconf = ''
-    export RELEASE_VERSION=${version}
-  '';
 
-  configureFlags = [ "--without-cython" ];
+  outputs = [ "out" "dev" ];
+
+  passthru.updateScript = unstableGitUpdater { };
 
   meta = with lib; {
     homepage = "https://github.com/libimobiledevice/libimobiledevice";
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index f1e5c7da1803d..b66c8c288bc8b 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchpatch
 , nix-update-script
 
 , autoreconfHook
@@ -43,6 +44,15 @@ stdenv.mkDerivation (finalAttrs: {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
+    # Fix static linking of `libtiff` via `pkg-config` not working
+    # because `libtiff` does not declare `Lerc` dependency.
+    # nixpkgs has `lerc` >= 4 which provides a `.pc` file.
+    # TODO: Close when https://gitlab.com/libtiff/libtiff/-/merge_requests/633 is merged and available
+    (fetchpatch {
+      name = "libtiff-4.pc-Fix-Requires.private-missing-Lerc.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/ea882c3c240c14a897b9be38d815cc1893aafa59.patch";
+      hash = "sha256-C0xA3k1sgKmGJjEnyG9UxhXqYBYShKUDQsyjhbEDJbQ=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 51eb5558d626b..e865873c2851b 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, libiconv }:
+{ fetchurl, lib, stdenv, libiconv, updateAutotoolsGnuConfigScriptsHook }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
   propagatedBuildInputs = lib.optional (!stdenv.isLinux) libiconv;
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
   configureFlags = [
     "--with-libiconv-prefix=${libiconv}"
diff --git a/pkgs/development/libraries/liburing/default.nix b/pkgs/development/libraries/liburing/default.nix
index a42aab3d59e8c..95df981d02e7d 100644
--- a/pkgs/development/libraries/liburing/default.nix
+++ b/pkgs/development/libraries/liburing/default.nix
@@ -1,44 +1,66 @@
-{ lib, stdenv, fetchgit }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
 
 stdenv.mkDerivation rec {
   pname = "liburing";
-  version = "2.5";
+  version = "2.6";
 
-  src = fetchgit {
-    url    = "http://git.kernel.dk/${pname}";
-    rev    = "liburing-${version}";
-    sha256 = "sha256-hPyEZ0P1rfos53OCNd2OYFiqmv6TgpWaj5/xPLccCvM=";
+  src = fetchFromGitHub {
+    owner = "axboe";
+    repo = "liburing";
+    rev = "refs/tags/liburing-${version}";
+    hash = "sha256-UOhnFT4UKZmPchKxew3vYeKH2oETDVylE1RmJ2hnLq0=";
   };
 
   separateDebugInfo = true;
   enableParallelBuilding = true;
   # Upstream's configure script is not autoconf generated, but a hand written one.
   setOutputFlags = false;
+  dontDisableStatic = true;
+  dontAddStaticConfigureFlags = true;
   configureFlags = [
     "--includedir=${placeholder "dev"}/include"
     "--mandir=${placeholder "man"}/share/man"
   ];
 
+  # mysterious link failure
+  hardeningDisable = [ "trivialautovarinit" ];
+
   # Doesn't recognize platform flags
-  configurePlatforms = [];
+  configurePlatforms = [ ];
 
-  outputs = [ "out" "bin" "dev" "man" ];
+  outputs = [
+    "out"
+    "bin"
+    "dev"
+    "man"
+  ];
 
   postInstall = ''
-    # Copy the examples into $bin. Most reverse dependency of this package should
-    # reference only the $out output
-    mkdir -p $bin/bin
-    cp ./examples/io_uring-cp examples/io_uring-test $bin/bin
-    cp ./examples/link-cp $bin/bin/io_uring-link-cp
-  '' + lib.optionalString stdenv.hostPlatform.isGnu ''
-    cp ./examples/ucontext-cp $bin/bin/io_uring-ucontext-cp
+    # Always builds both static and dynamic libraries, so we need to remove the
+    # libraries that don't match stdenv type.
+    rm $out/lib/liburing*${
+      if stdenv.hostPlatform.isStatic then ".so*" else ".a"
+    }
+
+    # Copy the examples into $bin. Most reverse dependency of
+    # this package should reference only the $out output
+    for file in $(find ./examples -executable -type f); do
+      install -Dm555 -t "$bin/bin" "$file"
+    done
   '';
 
   meta = with lib; {
     description = "Userspace library for the Linux io_uring API";
-    homepage    = "https://git.kernel.dk/cgit/liburing/";
-    license     = licenses.lgpl21;
-    platforms   = platforms.linux;
-    maintainers = with maintainers; [ thoughtpolice nickcao ];
+    homepage = "https://github.com/axboe/liburing";
+    license = licenses.lgpl21;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [
+      thoughtpolice
+      nickcao
+    ];
   };
 }
diff --git a/pkgs/development/libraries/libva/1.nix b/pkgs/development/libraries/libva/1.nix
index 63be647f015a7..1a9c7309e5424 100644
--- a/pkgs/development/libraries/libva/1.nix
+++ b/pkgs/development/libraries/libva/1.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   # TODO: share libs between minimal and !minimal - perhaps just symlink them
 
   # Add FHS paths for non-NixOS applications.
-  configureFlags = [ "--with-drivers-path=${mesa.drivers.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri" ]
+  configureFlags = lib.optionals stdenv.isLinux [ "--with-drivers-path=${mesa.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri" ]
     ++ lib.optionals (!minimal) [ "--enable-glx" ];
 
   installFlags = [ "dummy_drv_video_ladir=$(out)/lib/dri" ];
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index eceba4ac8ebf0..aad42d7e51f80 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -33,9 +33,9 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [ libdrm ]
     ++ lib.optionals (!minimal) [ libX11 libXext libXfixes wayland libffi libGL ];
 
-  mesonFlags = [
+  mesonFlags = lib.optionals stdenv.isLinux [
     # Add FHS and Debian paths for non-NixOS applications
-    "-Ddriverdir=${mesa.drivers.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri:/usr/lib/x86_64-linux-gnu/dri:/usr/lib/i386-linux-gnu/dri"
+    "-Ddriverdir=${mesa.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri:/usr/lib/x86_64-linux-gnu/dri:/usr/lib/i386-linux-gnu/dri"
   ];
 
   passthru.tests = {
diff --git a/pkgs/development/libraries/libvdpau/default.nix b/pkgs/development/libraries/libvdpau/default.nix
index 906a3c59234a3..8c1c3b7c5e9cd 100644
--- a/pkgs/development/libraries/libvdpau/default.nix
+++ b/pkgs/development/libraries/libvdpau/default.nix
@@ -17,8 +17,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ xorg.libX11 ];
 
-  mesonFlags = lib.optionals stdenv.isLinux
-    [ "-Dmoduledir=${mesa.drivers.driverLink}/lib/vdpau" ];
+  mesonFlags = lib.optionals stdenv.isLinux [ "-Dmoduledir=${mesa.driverLink}/lib/vdpau" ];
 
   NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lX11";
 
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index 5f5fc710d14dc..f028a1ca73339 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -36,6 +36,10 @@
 , experimentalSpatialSvcSupport ? false # Spatial scalable video coding
 , experimentalFpMbStatsSupport ? false
 , experimentalEmulateHardwareSupport ? false
+
+# for passthru.tests
+, ffmpeg
+, gst_all_1
 }:
 
 let
@@ -89,13 +93,13 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "webmproject";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-duU1exUg7JiKCtZfNxyb/y40hxsXeTIMShf9YounTWA=";
+    hash = "sha256-Pfg7g4y/dqn2VKDQU1LnTJQSj1Tont9/8Je6ShDb2GQ=";
   };
 
   postPatch = ''
@@ -198,6 +202,11 @@ stdenv.mkDerivation rec {
 
   postInstall = ''moveToOutput bin "$bin" '';
 
+  passthru.tests = {
+    inherit (gst_all_1) gst-plugins-good;
+    ffmpeg = ffmpeg.override { withVpx = true; };
+  };
+
   meta = with lib; {
     description = "WebM VP8/VP9 codec SDK";
     homepage    = "https://www.webmproject.org/";
diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
new file mode 100644
index 0000000000000..daabdb0c27c3d
--- /dev/null
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -0,0 +1,32 @@
+{ lib, fetchurl }:
+rec {
+  pname = "mesa";
+  version = "24.1.1";
+
+  src = fetchurl {
+    urls = [
+      "https://archive.mesa3d.org/mesa-${version}.tar.xz"
+      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
+    ];
+    hash = "sha256-ADiCbG9+iNkLTOb3GRkvpYyn3t9O3KoRdM972SDvieo=";
+  };
+
+  meta = {
+    description = "Open source 3D graphics library";
+    longDescription = ''
+      The Mesa project began as an open-source implementation of the OpenGL
+      specification - a system for rendering interactive 3D graphics. Over the
+      years the project has grown to implement more graphics APIs, including
+      OpenGL ES (versions 1, 2, 3), OpenCL, OpenMAX, VDPAU, VA API, XvMC, and
+      Vulkan.  A variety of device drivers allows the Mesa libraries to be used
+      in many different environments ranging from software emulation to
+      complete hardware acceleration for modern GPUs.
+    '';
+    homepage = "https://www.mesa3d.org/";
+    changelog = "https://www.mesa3d.org/relnotes/${version}.html";
+    license = with lib.licenses; [ mit ]; # X11 variant, in most files
+    platforms = lib.platforms.mesaPlatforms;
+    badPlatforms = []; # Load bearing for libGL meta on Darwin.
+    maintainers = with lib.maintainers; [ primeos vcunat ]; # Help is welcome :)
+  };
+}
diff --git a/pkgs/development/libraries/mesa/darwin.nix b/pkgs/development/libraries/mesa/darwin.nix
new file mode 100644
index 0000000000000..8d292939f047d
--- /dev/null
+++ b/pkgs/development/libraries/mesa/darwin.nix
@@ -0,0 +1,59 @@
+# The Darwin build of Mesa is different enough that we just give it an entire separate expression.
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bison,
+  flex,
+  meson,
+  ninja,
+  pkg-config,
+  python3Packages,
+  Xplugin,
+  xorg,
+  zlib,
+}:
+let
+  common = import ./common.nix { inherit lib fetchurl; };
+in stdenv.mkDerivation {
+  inherit (common) pname version src meta;
+
+  patches = [
+    # Reorder things to make it build on Darwin again
+    # Submitted upstream: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/29592
+    # FIXME: remove when merged or otherwise addressed
+    ./darwin.patch
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    bison
+    flex
+    meson
+    ninja
+    pkg-config
+    python3Packages.python
+    python3Packages.mako
+  ];
+
+  buildInputs = [
+    Xplugin
+    xorg.libX11
+    xorg.libXext
+    xorg.libXfixes
+    zlib
+  ];
+
+  mesonAutoFeatures = "disabled";
+
+  mesonFlags = [
+    "--sysconfdir=/etc"
+    "--datadir=${placeholder "out"}/share"
+    (lib.mesonEnable "glvnd" false)
+    (lib.mesonEnable "shared-glapi" true)
+  ];
+
+  # Don't need this on Darwin.
+  passthru.llvmpipeHook = null;
+}
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index af5baf1bc3a5f..54329fe550c40 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,6 +1,4 @@
 { lib
-, OpenGL
-, Xplugin
 , bison
 , buildPackages
 , directx-headers
@@ -42,19 +40,9 @@
 , xcbutilkeysyms
 , xorg
 , zstd
-, withValgrind ?
-  lib.meta.availableOn stdenv.hostPlatform valgrind-light
-  && !valgrind-light.meta.broken
-, withLibunwind ? lib.meta.availableOn stdenv.hostPlatform libunwind
-, enableGalliumNine ? stdenv.isLinux
-, enableOSMesa ? stdenv.isLinux
-, enableOpenCL ? stdenv.isLinux && stdenv.isx86_64
-, enableTeflon ? stdenv.isLinux && stdenv.isAarch64  # currently only supports aarch64 SoCs, may change in the future
 , enablePatentEncumberedCodecs ? true
 
-, galliumDrivers ?
-  if stdenv.isLinux
-  then [
+, galliumDrivers ? [
     "d3d12" # WSL emulated GPU (aka Dozen)
     "iris" # new Intel (Broadwell+)
     "kmsro" # special "render only" driver for GPUs without a display controller
@@ -79,10 +67,7 @@
     "crocus" # Intel legacy, x86 only
     "i915" # Intel extra legacy, x86 only
   ]
-  else [ "auto" ]
-, vulkanDrivers ?
-  if stdenv.isLinux
-  then [
+, vulkanDrivers ? [
     "amd" # AMD (aka RADV)
     "intel" # new Intel (aka ANV)
     "microsoft-experimental" # WSL virtualized GPU (aka DZN/Dozen)
@@ -100,32 +85,20 @@
   ] ++ lib.optionals stdenv.hostPlatform.isx86 [
     "intel_hasvk" # Intel Haswell/Broadwell, "legacy" Vulkan driver (https://www.phoronix.com/news/Intel-HasVK-Drop-Dead-Code)
   ]
-  else [ "auto" ]
-, eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
-, vulkanLayers ? lib.optionals (!stdenv.isDarwin) [ # No Vulkan support on Darwin
-  "device-select"
-  "overlay"
-  "intel-nullhw"
-]
+, eglPlatforms ? [ "x11" "wayland" ]
+, vulkanLayers ? [
+    "device-select"
+    "overlay"
+    "intel-nullhw"
+  ]
+, mesa
+, makeSetupHook
 }:
 
 # When updating this package, please verify at least these build (assuming x86_64-linux):
 # nix build .#mesa .#pkgsi686Linux.mesa .#pkgsCross.aarch64-multiplatform.mesa .#pkgsMusl.mesa
 
 let
-  version = "24.1.1";
-  hash = "sha256-ADiCbG9+iNkLTOb3GRkvpYyn3t9O3KoRdM972SDvieo=";
-
-  # Release calendar: https://www.mesa3d.org/release-calendar.html
-  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  branch = lib.versions.major version;
-
-  withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
-
-  haveWayland = lib.elem "wayland" eglPlatforms;
-  haveZink = lib.elem "zink" galliumDrivers;
-  haveDozen = (lib.elem "d3d12" galliumDrivers) || (lib.elem "microsoft-experimental" vulkanDrivers);
-
   rustDeps = [
     {
       pname = "paste";
@@ -162,28 +135,13 @@ let
   copyRustDeps = lib.concatStringsSep "\n" (builtins.map copyRustDep rustDeps);
 
   needNativeCLC = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-self = stdenv.mkDerivation {
-  pname = "mesa";
-  inherit version;
-
-  src = fetchurl {
-    urls = [
-      "https://archive.mesa3d.org/mesa-${version}.tar.xz"
-      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
-      "ftp://ftp.freedesktop.org/pub/mesa/mesa-${version}.tar.xz"
-      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
-      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
-    ];
-    inherit hash;
-  };
+
+  common = import ./common.nix { inherit lib fetchurl; };
+in stdenv.mkDerivation {
+  inherit (common) pname version src meta;
 
   patches = [
     ./opencl.patch
-  ] ++ lib.optionals stdenv.isDarwin [
-    # Reorder things to make it build on Darwin again
-    # Submitted upstream: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/29592
-    # FIXME: remove when merged or otherwise addressed
-    ./darwin.patch
   ];
 
   postPatch = ''
@@ -201,16 +159,7 @@ self = stdenv.mkDerivation {
   '';
 
   outputs = [
-    "out" "dev" "drivers"
-  ] ++ lib.optionals enableOSMesa [
-    "osmesa"
-  ] ++ lib.optionals stdenv.isLinux [
-    "driversdev"
-  ] ++ lib.optionals enableTeflon [
-    "teflon"
-  ] ++ lib.optionals enableOpenCL [
-    "opencl"
-  ] ++ lib.optionals haveDozen [
+    "out" "dev" "drivers" "driversdev" "opencl" "teflon" "osmesa"
     # the Dozen drivers depend on libspirv2dxil, but link it statically, and
     # libspirv2dxil itself is pretty chonky, so relocate it to its own output in
     # case anything wants to use it at some point
@@ -228,69 +177,49 @@ self = stdenv.mkDerivation {
 
   mesonFlags = [
     "--sysconfdir=/etc"
-    "--datadir=${placeholder "drivers"}/share" # Vendor files
-
-    # Don't build in debug mode
-    # https://gitlab.freedesktop.org/mesa/mesa/blob/master/docs/meson.html#L327
-    (lib.mesonBool "b_ndebug" true)
-
-    (lib.mesonOption "dri-search-path" "${libglvnd.driverLink}/lib/dri")
+    "--datadir=${placeholder "drivers"}/share"
 
+    # What to build
     (lib.mesonOption "platforms" (lib.concatStringsSep "," eglPlatforms))
     (lib.mesonOption "gallium-drivers" (lib.concatStringsSep "," galliumDrivers))
     (lib.mesonOption "vulkan-drivers" (lib.concatStringsSep "," vulkanDrivers))
+    (lib.mesonOption "vulkan-layers" (builtins.concatStringsSep "," vulkanLayers))
 
+    # Make sure we know where to find all the drivers
     (lib.mesonOption "dri-drivers-path" "${placeholder "drivers"}/lib/dri")
     (lib.mesonOption "vdpau-libs-path" "${placeholder "drivers"}/lib/vdpau")
     (lib.mesonOption "omx-libs-path" "${placeholder "drivers"}/lib/bellagio")
     (lib.mesonOption "va-libs-path" "${placeholder "drivers"}/lib/dri")
     (lib.mesonOption "d3d-drivers-path" "${placeholder "drivers"}/lib/d3d")
 
-    (lib.mesonBool "gallium-nine" enableGalliumNine) # Direct3D in Wine
-    (lib.mesonBool "osmesa" enableOSMesa) # used by wine
-    (lib.mesonBool "teflon" enableTeflon) # TensorFlow frontend
-    (lib.mesonEnable "microsoft-clc" false) # Only relevant on Windows (OpenCL 1.2 API on top of D3D12)
-
-    # To enable non-mesa gbm backends to be found (e.g. Nvidia)
+    # Set search paths for non-Mesa drivers (e.g. Nvidia)
+    (lib.mesonOption "dri-search-path" "${libglvnd.driverLink}/lib/dri")
     (lib.mesonOption "gbm-backends-path" "${libglvnd.driverLink}/lib/gbm:${placeholder "out"}/lib/gbm")
 
-    # meson auto_features enables these features, but we do not want them
-    (lib.mesonEnable "android-libbacktrace" false)
-  ] ++ lib.optionals stdenv.isLinux [
+    # Enable glvnd for dynamic libGL dispatch
     (lib.mesonEnable "glvnd" true)
+
+    (lib.mesonBool "gallium-nine" true) # Direct3D in Wine
+    (lib.mesonBool "osmesa" true) # used by wine
+    (lib.mesonBool "teflon" true) # TensorFlow frontend
+
+    # Enable Intel RT stuff when available
     (lib.mesonBool "install-intel-clc" true)
     (lib.mesonEnable "intel-rt" stdenv.isx86_64)
     (lib.mesonOption "clang-libdir" "${llvmPackages.clang-unwrapped.lib}/lib")
-  ] ++ lib.optionals stdenv.isDarwin [
-    # Disable features that are explicitly unsupported on the platform
-    (lib.mesonEnable "gbm" false)
-    (lib.mesonEnable "xlib-lease" false)
-    (lib.mesonEnable "egl" false)
-    (lib.mesonEnable "gallium-vdpau" false)
-    (lib.mesonEnable "gallium-va" false)
-    (lib.mesonEnable "gallium-xa" false)
-    (lib.mesonEnable "lmsensors" false)
-    # Don’t build with glvnd support to make sure Mesa builds libGL on Darwin
-    (lib.mesonEnable "glvnd" false)
-    # This gets enabled by mesonAutoFeatures and fails on aarch64-darwin,
-    # which makes no sense because Darwin has neither Intel nor RT, but OK
-    (lib.mesonEnable "intel-rt" false)
-  ] ++ lib.optionals enableOpenCL [
+
     # Clover, old OpenCL frontend
     (lib.mesonOption "gallium-opencl" "icd")
     (lib.mesonBool "opencl-spirv" true)
 
     # Rusticl, new OpenCL frontend
     (lib.mesonBool "gallium-rusticl" true)
-  ] ++ lib.optionals (!withValgrind) [
-    (lib.mesonEnable "valgrind" false)
-  ] ++ lib.optionals (!withLibunwind) [
-    (lib.mesonEnable "libunwind" false)
-  ]
-  ++ lib.optionals enablePatentEncumberedCodecs [
+
+    # meson auto_features enables this, but we do not want it
+    (lib.mesonEnable "android-libbacktrace" false)
+    (lib.mesonEnable "microsoft-clc" false) # Only relevant on Windows (OpenCL 1.2 API on top of D3D12)
+  ] ++ lib.optionals enablePatentEncumberedCodecs [
     (lib.mesonOption "video-codecs" "all")
-  ] ++ lib.optionals (vulkanLayers != []) [
-    (lib.mesonOption "vulkan-layers" (builtins.concatStringsSep "," vulkanLayers))
   ] ++ lib.optionals needNativeCLC [
     (lib.mesonOption "intel-clc" "system")
   ];
@@ -298,61 +227,45 @@ self = stdenv.mkDerivation {
   strictDeps = true;
 
   buildInputs = with xorg; [
+    directx-headers
+    elfutils
     expat
     glslang
     libffi
     libglvnd
+    libomxil-bellagio
+    libpthreadstubs
+    libunwind
+    libva-minimal
     libvdpau
-    llvmPackages.libllvm
-    openssl
-    zstd
-  ] ++ (with xorg; [
     libX11
+    libxcb
     libXext
     libXfixes
     libXrandr
+    libxshmfence
     libXt
     libXvMC
-    libpthreadstubs
-    libxcb
-    libxshmfence
-    xcbutilkeysyms
-    xorgproto
-  ]) ++ lib.optionals withLibunwind [
-    libunwind
-  ] ++ [
-    python3Packages.python # for shebang
-  ] ++ lib.optionals haveWayland [
-    wayland
-    wayland-protocols
-  ] ++ lib.optionals stdenv.isLinux [
-    libomxil-bellagio
-    libva-minimal
+    llvmPackages.clang
     llvmPackages.clang-unwrapped
     llvmPackages.libclc
+    llvmPackages.libllvm
     lm_sensors
+    openssl
+    python3Packages.python # for shebang
     spirv-llvm-translator
     udev
-  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
-    elfutils
-  ] ++ lib.optionals enableOpenCL [
-    llvmPackages.clang
-  ] ++ lib.optionals withValgrind [
     valgrind-light
-  ] ++ lib.optionals haveZink [
     vulkan-loader
-  ] ++ lib.optionals haveDozen [
-    directx-headers
+    wayland
+    wayland-protocols
+    xcbutilkeysyms
+    xorgproto
+    zstd
   ];
 
   depsBuildBuild = [
     pkg-config
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    # Adding this unconditionally makes x86_64-darwin pick up an older
-    # toolchain, as we explicitly call Mesa with 11.0 stdenv, but buildPackages
-    # is still 10.something, and Mesa can't build with that.
-    # FIXME: figure this out, or figure out how to get rid of Mesa on Darwin,
-    # whichever is easier.
     buildPackages.stdenv.cc
   ];
 
@@ -374,7 +287,6 @@ self = stdenv.mkDerivation {
     rust-bindgen
     rust-cbindgen
     rustPlatform.bindgenHook
-  ] ++ lib.optionals haveWayland [
     wayland-scanner
   ] ++ lib.optionals needNativeCLC [
     buildPackages.mesa.driversdev
@@ -384,74 +296,52 @@ self = stdenv.mkDerivation {
     buildPackages.mesa.driversdev
   ];
 
-  propagatedBuildInputs = (with xorg; [
+  propagatedBuildInputs = with xorg; [
     libXdamage
     libXxf86vm
-  ]) ++ lib.optionals withLibdrm [
     libdrm
-  ] ++ lib.optionals stdenv.isDarwin [
-    OpenGL
-    Xplugin
   ];
 
   doCheck = false;
 
   postInstall = ''
-    # Some installs don't have any drivers so this directory is never created.
-    mkdir -p $drivers $osmesa
-  '' + lib.optionalString stdenv.isLinux ''
-    mkdir -p $drivers/lib
-
-    if [ -n "$(shopt -s nullglob; echo "$out/lib/libxatracker"*)" -o -n "$(shopt -s nullglob; echo "$out/lib/libvulkan_"*)" ]; then
-      # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
-      mv -t $drivers/lib       \
-        $out/lib/libpowervr_rogue* \
-        $out/lib/libxatracker* \
-        $out/lib/libvulkan_*
-    fi
-
-    if [ -n "$(shopt -s nullglob; echo "$out"/lib/lib*_mesa*)" ]; then
-      # Move other drivers to a separate output
-      mv -t $drivers/lib $out/lib/lib*_mesa*
-    fi
-
-    # Update search path used by glvnd
+    # Move driver-related bits to $drivers
+    moveToOutput "lib/lib*_mesa*" $drivers
+    moveToOutput "lib/libpowervr_rogue*" $drivers
+    moveToOutput "lib/libxatracker*" $drivers
+    moveToOutput "lib/libvulkan_*" $drivers
+
+    # Update search path used by glvnd (it's pointing to $out but drivers are in $drivers)
     for js in $drivers/share/glvnd/egl_vendor.d/*.json; do
-      substituteInPlace "$js" --replace '"libEGL_' '"'"$drivers/lib/libEGL_"
+      substituteInPlace "$js" --replace-fail '"libEGL_' '"'"$drivers/lib/libEGL_"
     done
 
-    # Update search path used by Vulkan (it's pointing to $out but
-    # drivers are in $drivers)
+    # And same for Vulkan
     for js in $drivers/share/vulkan/icd.d/*.json; do
-      substituteInPlace "$js" --replace "$out" "$drivers"
+      substituteInPlace "$js" --replace-fail "$out" "$drivers"
     done
-  '' + lib.optionalString enableOpenCL ''
-    # Move OpenCL stuff
-    mkdir -p $opencl/lib
-    mv -t "$opencl/lib/"     \
-      $out/lib/gallium-pipe   \
-      $out/lib/lib*OpenCL*
-
-    # We construct our own .icd files that contain absolute paths.
-    mkdir -p $opencl/etc/OpenCL/vendors/
-    echo $opencl/lib/libMesaOpenCL.so > $opencl/etc/OpenCL/vendors/mesa.icd
-    echo $opencl/lib/libRusticlOpenCL.so > $opencl/etc/OpenCL/vendors/rusticl.icd
-  '' + lib.optionalString enableOSMesa ''
-    # move libOSMesa to $osmesa, as it's relatively big
-    mkdir -p $osmesa/lib
-    mv -t $osmesa/lib/ $out/lib/libOSMesa*
-  '' + lib.optionalString (vulkanLayers != []) ''
-    mv -t $drivers/lib $out/lib/libVkLayer*
+
+    # Move Vulkan layers to $drivers and update manifests
+    moveToOutput "lib/libVkLayer*" $drivers
     for js in $drivers/share/vulkan/{im,ex}plicit_layer.d/*.json; do
       substituteInPlace "$js" --replace '"libVkLayer_' '"'"$drivers/lib/libVkLayer_"
     done
-  '' + lib.optionalString haveDozen ''
-    mkdir -p $spirv2dxil/{bin,lib}
-    mv -t $spirv2dxil/lib $out/lib/libspirv_to_dxil*
-    mv -t $spirv2dxil/bin $out/bin/spirv2dxil
+
+    # Construct our own .icd files that contain absolute paths.
+    mkdir -p $opencl/etc/OpenCL/vendors/
+    echo $opencl/lib/libMesaOpenCL.so > $opencl/etc/OpenCL/vendors/mesa.icd
+    echo $opencl/lib/libRusticlOpenCL.so > $opencl/etc/OpenCL/vendors/rusticl.icd
+
+    moveToOutput bin/intel_clc $driversdev
+    moveToOutput lib/gallium-pipe $opencl
+    moveToOutput "lib/lib*OpenCL*" $opencl
+    moveToOutput "lib/libOSMesa*" $osmesa
+    moveToOutput bin/spirv2dxil $spirv2dxil
+    moveToOutput "lib/libspirv_to_dxil*" $spirv2dxil
+    moveToOutput lib/libteflon.so $teflon
   '';
 
-  postFixup = lib.optionalString stdenv.isLinux ''
+  postFixup = ''
     # set the default search path for DRI drivers; used e.g. by X server
     for pc in lib/pkgconfig/{dri,d3d}.pc; do
       [ -f "$dev/$pc" ] && substituteInPlace "$dev/$pc" --replace "$drivers" "${libglvnd.driverLink}"
@@ -471,8 +361,6 @@ self = stdenv.mkDerivation {
       fi
     done
 
-    moveToOutput bin/intel_clc $driversdev
-
     # Don't depend on build python
     patchShebangs --host --update $out/bin/*
 
@@ -486,59 +374,31 @@ self = stdenv.mkDerivation {
         patchelf --set-rpath "$(patchelf --print-rpath $lib):$drivers/lib" "$lib"
       fi
     done
-    # add RPATH here so Zink can find libvulkan.so
-    ${lib.optionalString haveZink ''
-      patchelf --add-rpath ${vulkan-loader}/lib $drivers/lib/dri/zink_dri.so
-    ''}
 
-    ${lib.optionalString enableTeflon ''
-      moveToOutput lib/libteflon.so $teflon
-    ''}
+    # add RPATH here so Zink can find libvulkan.so
+    patchelf --add-rpath ${vulkan-loader}/lib $drivers/lib/dri/zink_dri.so
   '';
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals stdenv.isDarwin [
-      "-fno-common"
-    ] ++ lib.optionals enableOpenCL [
-      "-UPIPE_SEARCH_DIR"
-      "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
+  env.NIX_CFLAGS_COMPILE = toString ([
+    "-UPIPE_SEARCH_DIR"
+    "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
   ]);
 
   passthru = {
     inherit (libglvnd) driverLink;
     inherit llvmPackages;
 
-    libdrm = if withLibdrm then libdrm else null;
-
-    tests = lib.optionalAttrs stdenv.isLinux {
-      devDoesNotDependOnLLVM = stdenv.mkDerivation {
-        name = "mesa-dev-does-not-depend-on-llvm";
-        buildCommand = ''
-          echo ${self.dev} >>$out
-        '';
-        disallowedRequisites = [ llvmPackages.llvm self.drivers ];
-      };
+    tests.devDoesNotDependOnLLVM = stdenv.mkDerivation {
+      name = "mesa-dev-does-not-depend-on-llvm";
+      buildCommand = ''
+        echo ${mesa.dev} >>$out
+      '';
+      disallowedRequisites = [ llvmPackages.llvm mesa.drivers ];
     };
-  };
 
-  meta = {
-    description = "Open source 3D graphics library";
-    longDescription = ''
-      The Mesa project began as an open-source implementation of the OpenGL
-      specification - a system for rendering interactive 3D graphics. Over the
-      years the project has grown to implement more graphics APIs, including
-      OpenGL ES (versions 1, 2, 3), OpenCL, OpenMAX, VDPAU, VA API, XvMC, and
-      Vulkan.  A variety of device drivers allows the Mesa libraries to be used
-      in many different environments ranging from software emulation to
-      complete hardware acceleration for modern GPUs.
-    '';
-    homepage = "https://www.mesa3d.org/";
-    changelog = "https://www.mesa3d.org/relnotes/${version}.html";
-    license = with lib.licenses; [ mit ]; # X11 variant, in most files
-    platforms = lib.platforms.mesaPlatforms;
-    badPlatforms = []; # Load bearing for libGL meta on Darwin.
-    maintainers = with lib.maintainers; [ primeos vcunat ]; # Help is welcome :)
+    llvmpipeHook = makeSetupHook {
+      name = "llvmpipe-hook";
+      substitutions.drivers = mesa.drivers;
+    } ./llvmpipe-hook.sh;
   };
-};
-
-in self
+}
diff --git a/pkgs/development/libraries/mesa/llvmpipe-hook.sh b/pkgs/development/libraries/mesa/llvmpipe-hook.sh
new file mode 100644
index 0000000000000..6217182b15e89
--- /dev/null
+++ b/pkgs/development/libraries/mesa/llvmpipe-hook.sh
@@ -0,0 +1,14 @@
+# shellcheck shell=bash
+
+# https://docs.mesa3d.org/envvars.html
+export LIBGL_ALWAYS_SOFTWARE=true
+export LIBGL_DRIVERS_PATH=@drivers@/lib/dri
+
+# https://github.com/NVIDIA/libglvnd/blob/master/src/EGL/icd_enumeration.md
+export __EGL_VENDOR_LIBRARY_FILENAMES=@drivers@/share/glvnd/egl_vendor.d/50_mesa.json
+
+# https://github.com/KhronosGroup/Vulkan-Loader/blob/main/docs/LoaderInterfaceArchitecture.md
+# glob because the filenames contain an architecture suffix
+# echo is needed to force-expand the glob
+VK_DRIVER_FILES="$(echo @drivers@/share/vulkan/icd.d/lvp_icd.*.json)"
+export VK_DRIVER_FILES
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 361756f94ea90..8e1371ebfd5f8 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -267,8 +267,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.13";
-    hash = "sha256-iFJXU/edO+wn0vp8ZqoLkrOqlJja/ZPXz6SzeAza4xM=";
+    version = "3.0.14";
+    hash = "sha256-7soDXU3U6E/CWEbZUtpil0hK+gZQpvhMaC453zpBI8o=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
@@ -290,8 +290,8 @@ in {
   };
 
   openssl_3_2 = common {
-    version = "3.2.1";
-    hash = "sha256-g8cyn+UshQZ3115dCwyiRTCbl+jsvP3B39xKufrDWzk=";
+    version = "3.2.2";
+    hash = "sha256-GXFJwY2enyksQ/BACsq6EuX1LKz+BQ89GZJ36nOOwuc=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
@@ -313,8 +313,8 @@ in {
   };
 
   openssl_3_3 = common {
-    version = "3.3.0";
-    hash = "sha256-U+ZrBDMipgar8Ah+dpmg4DOjf6E/65dC3zXDozsY+wI=";
+    version = "3.3.1";
+    hash = "sha256-d3zVlihMiDN1oqehG/XSeG/FQTJV76sgxQ1v/m0CC34=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 3450f910effef..a61a13590d165 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -7,30 +7,20 @@
 
 stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.43";
+  version = "10.44";
 
   src = fetchurl {
     url = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${version}/pcre2-${version}.tar.bz2";
-    hash = "sha256-4qU5hP8LB9/bWuRIa7ubIcyo598kNAlsyb8bcow1C8s=";
+    hash = "sha256-008C4RPPcZOh6/J3DTrFJwiNSF1OBH7RDl0hfG713pY=";
   };
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
-  postPatch = ''
-    # Fix jit autodetection:
-    #   https://github.com/PCRE2Project/pcre2/pull/396
-    # Applying manually to avoid fetchpatch and autoreconfHook.
-    # TODO: remove once 10.44 is released
-    substituteInPlace configure --replace-fail \
-      '#include "src/sljit/sljitConfigInternal.h"' \
-      '#include "src/sljit/sljitConfigCPU.h"'
-  '';
-
   configureFlags = [
     "--enable-pcre2-16"
     "--enable-pcre2-32"
     # only enable jit on supported platforms which excludes Apple Silicon, see https://github.com/zherczeg/sljit/issues/51
-    "--enable-jit=${if stdenv.hostPlatform.isS390x || stdenv.hostPlatform.isLoongArch64 then "no" else "auto"}"
+    "--enable-jit=${if stdenv.hostPlatform.isS390x then "no" else "auto"}"
   ]
   # fix pcre jit in systemd units that set MemoryDenyWriteExecute=true like gitea
   ++ lib.optional withJitSealloc "--enable-jit-sealloc";
diff --git a/pkgs/development/libraries/qpdf/default.nix b/pkgs/development/libraries/qpdf/default.nix
index ab6078c619f5a..3c7cadfe954e1 100644
--- a/pkgs/development/libraries/qpdf/default.nix
+++ b/pkgs/development/libraries/qpdf/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qpdf";
-  version = "11.9.0";
+  version = "11.9.1";
 
   src = fetchFromGitHub {
     owner = "qpdf";
     repo = "qpdf";
     rev = "v${version}";
-    hash = "sha256-HD7+2TBDLBIt+VaPO5WgnDjNZOj8naltFmYdYzOIn+4=";
+    hash = "sha256-DhrOKjUPgNo61db8av0OTfM8mCNebQocQWtTWdt002s=";
   };
 
   nativeBuildInputs = [ cmake perl ];
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index b1308159eb688..c3ba9c94dc659 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -36,14 +36,6 @@ let
       ./qtbase.patch.d/0012-qtbase-tbd-frameworks.patch
 
       ./qtbase.patch.d/0014-aarch64-darwin.patch
-
-      # Fix typo that breaks build on Darwin
-      # FIXME: remove this once merged upstream
-      # See: https://invent.kde.org/qt/qt/qtbase/-/merge_requests/325
-      (fetchpatch {
-        url = "https://invent.kde.org/qt/qt/qtbase/-/commit/e84c0df50f51c61aa49b47823582b0f8de406e3d.patch";
-        hash = "sha256-d1RIY03E71aMzOOVtcIaMeariki/72QRekUne6P2D3M=";
-      })
     ] ++ [
       ./qtbase.patch.d/0003-qtbase-mkspecs.patch
       ./qtbase.patch.d/0004-qtbase-replace-libdir.patch
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index f3281a17170ee..96c3621307c6a 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "0e1ff2f06ddac7c32c5a5e0b65e402c9332e56f8",
-    "sha256": "1pfby0ilkikq8802diaslnkxw8qzbp4r0f80v696wfynn973mhdd"
+    "rev": "2b9835f5c9bcfe3105b60a8dd33c1db7d8611378",
+    "sha256": "1yms1r42yps06bg8gjbzb5y7x03ks11vg97s2j7r1aplp7kjf7wm"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index 2310ce33ea4f3..09d2f7539f15a 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -1,61 +1,61 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, ninja
-, chromium
-, grpc
-, haskellPackages
-, mercurial
-, python3Packages
-, abseil-cpp
+{
+  abseil-cpp,
+  chromium,
+  cmake,
+  fetchFromGitHub,
+  gbenchmark,
+  grpc,
+  gtest,
+  haskellPackages,
+  icu,
+  lib,
+  mercurial,
+  ninja,
+  python3Packages,
+  stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "re2";
-  version = "2024-05-01";
+  version = "2024-06-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
-    rev = version;
-    hash = "sha256-p4MdHjTk0SQsBPVkEy+EceAN/QTyzBDe7Pd1hJwOs3A=";
+    rev = finalAttrs.version;
+    hash = "sha256-iQETsjdIFcYM5I/W8ytvV3z/4va6TaZ/+KkSjb8CtF0=";
   };
 
-  outputs = [ "out" "dev" ];
+  outputs = [
+    "out"
+    "dev"
+  ];
 
-  nativeBuildInputs = [ cmake ninja ];
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
 
-  propagatedBuildInputs = [ abseil-cpp ];
+  buildInputs = lib.optionals finalAttrs.doCheck [
+    gbenchmark
+    gtest
+  ];
 
-  postPatch = ''
-    substituteInPlace re2Config.cmake.in \
-      --replace "\''${PACKAGE_PREFIX_DIR}/" ""
-  '';
+  propagatedBuildInputs = [
+    abseil-cpp
+    icu
+  ];
 
-  # Needed for case-insensitive filesystems (i.e. MacOS) because a file named
-  # BUILD already exists.
-  cmakeBuildDir = "build_dir";
-
-  cmakeFlags = lib.optional (!stdenv.hostPlatform.isStatic) "-DBUILD_SHARED_LIBS:BOOL=ON";
-
-  # This installs a pkg-config definition.
-  postInstall = ''
-    pushd "$src"
-    make common-install prefix="$dev" SED_INPLACE="sed -i"
-    popd
-  '';
+  cmakeFlags = [
+    (lib.cmakeBool "RE2_BUILD_TESTING" finalAttrs.doCheck)
+    (lib.cmakeBool "RE2_USE_ICU" true)
+  ] ++ lib.optional (!stdenv.hostPlatform.isStatic) (lib.cmakeBool "BUILD_SHARED_LIBS" true);
 
   doCheck = true;
 
   passthru.tests = {
-    inherit
-      chromium
-      grpc
-      mercurial;
-    inherit (python3Packages)
-      fb-re2
-      google-re2;
+    inherit chromium grpc mercurial;
+    inherit (python3Packages) fb-re2 google-re2;
     haskell-re2 = haskellPackages.re2;
   };
 
@@ -68,7 +68,10 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.bsd3;
     homepage = "https://github.com/google/re2";
-    maintainers = with maintainers; [ azahi networkexception ];
+    maintainers = with maintainers; [
+      azahi
+      networkexception
+    ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index af52b6a9fa7c7..9f662a8b14791 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -11,6 +11,8 @@
 , windows
 , enableJemalloc ? false
 , jemalloc
+, enableLiburing ? true
+, liburing
 , enableShared ? !stdenv.hostPlatform.isStatic
 , sse42Support ? stdenv.hostPlatform.sse4_2Support
 }:
@@ -26,11 +28,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Zifn5Gu/4h6TaEqSaWQ2mFdryeAarqbHWW3fKUGGFac=";
   };
 
+  patches = [ ./fix-findliburing.patch ];
+
   nativeBuildInputs = [ cmake ninja ];
 
   propagatedBuildInputs = [ bzip2 lz4 snappy zlib zstd ];
 
   buildInputs = lib.optional enableJemalloc jemalloc
+    ++ lib.optional enableLiburing liburing
     ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64_pthreads;
 
   outputs = [
@@ -45,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     "-DPORTABLE=1"
     "-DWITH_JEMALLOC=${if enableJemalloc then "1" else "0"}"
+    "-DWITH_LIBURING=${if enableLiburing then "1" else "0"}"
     "-DWITH_JNI=0"
     "-DWITH_BENCHMARK_TOOLS=0"
     "-DWITH_TESTS=1"
diff --git a/pkgs/development/libraries/rocksdb/fix-findliburing.patch b/pkgs/development/libraries/rocksdb/fix-findliburing.patch
new file mode 100644
index 0000000000000..c546577813ceb
--- /dev/null
+++ b/pkgs/development/libraries/rocksdb/fix-findliburing.patch
@@ -0,0 +1,29 @@
+From 23432b7958ecea64b49ba680767ea5dc696768c9 Mon Sep 17 00:00:00 2001
+From: Benjamin Lee <benjamin@computer.surgery>
+Date: Sun, 26 May 2024 17:17:01 -0700
+Subject: [PATCH] fix findliburing
+
+`find_package(... NAMES lib*)` is basically always wrong. The previous
+code was just hardcoding the static library path to work around the fact
+that this doesn't work. This breaks the build when only dynamic liburing
+builds are available.
+---
+ cmake/modules/Finduring.cmake | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/cmake/modules/Finduring.cmake b/cmake/modules/Finduring.cmake
+index 8cb14cb27..87f2df474 100644
+--- a/cmake/modules/Finduring.cmake
++++ b/cmake/modules/Finduring.cmake
+@@ -7,7 +7,7 @@
+ find_path(uring_INCLUDE_DIR
+   NAMES liburing.h)
+ find_library(uring_LIBRARIES
+-  NAMES liburing.a liburing)
++  NAMES uring)
+ 
+ include(FindPackageHandleStandardArgs)
+ find_package_handle_standard_args(uring
+-- 
+2.44.0
+
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 842bc3af9834a..e36c92d60b67b 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -181,6 +181,10 @@ stdenv.mkDerivation rec {
     "strictoverflow"
     # don't interfere with dynamic target detection
     "relro" "bindnow"
+  ] ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+    # "__builtin_clear_padding not supported for variable length aggregates"
+    # in aarch64-specific code
+    "trivialautovarinit"
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/spdlog/default.nix b/pkgs/development/libraries/spdlog/default.nix
index f9255e3df5950..6aa91db83549a 100644
--- a/pkgs/development/libraries/spdlog/default.nix
+++ b/pkgs/development/libraries/spdlog/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spdlog";
-  version = "1.13.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "gabime";
     repo  = "spdlog";
     rev   = "v${version}";
-    hash  = "sha256-3n8BnjZ7uMH8quoiT60yTU7poyOtoEmzNMOLa1+r7X0=";
+    hash  = "sha256-F7khXbMilbh5b+eKnzcB0fPPWQqUHqAYPWJb83OnUKQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 2c44bf7f7f83b..ce1084d128892 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1963,16 +1963,16 @@ buildLuarocksPackage {
 luarocks = callPackage({ buildLuarocksPackage, fetchFromGitHub, fetchurl }:
 buildLuarocksPackage {
   pname = "luarocks";
-  version = "3.11.0-1";
+  version = "3.11.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luarocks-3.11.0-1.rockspec";
-    sha256 = "0pi55445dskpw6nhrq52589h4v39fsf23c0kp8d4zg2qaf6y2n38";
+    url    = "mirror://luarocks/luarocks-3.11.1-1.rockspec";
+    sha256 = "sha256-di00mD8txN7rjaVpvxzNbnQsAh6H16zUtJZapH7U4HU=";
   }).outPath;
   src = fetchFromGitHub {
     owner = "luarocks";
     repo = "luarocks";
-    rev = "v3.11.0";
-    hash = "sha256-mSwwBuLWoMT38iYaV/BTdDmmBz4heTRJzxBHC0Vrvc4=";
+    rev = "v3.11.1";
+    hash = "sha256-GglygI8HP+aDFEuucOkjQ2Pgfv4+jW+og+2vL3KoZCQ=";
   };
 
 
@@ -2345,14 +2345,14 @@ buildLuarocksPackage {
 luv = callPackage({ buildLuarocksPackage, cmake, fetchurl, luaOlder }:
 buildLuarocksPackage {
   pname = "luv";
-  version = "1.44.2-1";
+  version = "1.48.0-2";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luv-1.44.2-1.rockspec";
-    sha256 = "07jwi50i16rv7sj914k1q3l9dy9wldbw2skmsdrzlkc57mqvg348";
+    url    = "mirror://luarocks/luv-1.48.0-2.rockspec";
+    sha256 = "0353bjn9z90a1hd7rksdfrd9fbdd31hbvdaxr1fb0fh0bc1cpy94";
   }).outPath;
   src = fetchurl {
-    url    = "https://github.com/luvit/luv/releases/download/1.44.2-1/luv-1.44.2-1.tar.gz";
-    sha256 = "0c2wkszxw6gwa4l6g1d2zzh660j13lif6c7a910vq7zn8jycgd9y";
+    url    = "https://github.com/luvit/luv/releases/download/1.48.0-2/luv-1.48.0-2.tar.gz";
+    sha256 = "2c3a1ddfebb4f6550293a40ee789f7122e97647eede51511f57203de48c03b7a";
   };
 
   disabled = luaOlder "5.1";
diff --git a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
index e8c1606433dba..c47ea3e7cf576 100644
--- a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
@@ -9,7 +9,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   setuptools,
 }:
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/aiobiketrax/default.nix b/pkgs/development/python-modules/aiobiketrax/default.nix
index 88b070a510492..b07dda7f5171b 100644
--- a/pkgs/development/python-modules/aiobiketrax/default.nix
+++ b/pkgs/development/python-modules/aiobiketrax/default.nix
@@ -10,7 +10,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/aioboto3/default.nix b/pkgs/development/python-modules/aioboto3/default.nix
index 96a7cc9c4d741..592e8087349fc 100644
--- a/pkgs/development/python-modules/aioboto3/default.nix
+++ b/pkgs/development/python-modules/aioboto3/default.nix
@@ -13,7 +13,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -34,7 +33,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "aiobotocore" ];
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index e100d822d50c6..3ff68b141240a 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -20,7 +20,6 @@
   pytest-lazy-fixture,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   redis,
 }:
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   build-system = [ hatchling ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "pydantic" ];
 
diff --git a/pkgs/development/python-modules/aiomisc-pytest/default.nix b/pkgs/development/python-modules/aiomisc-pytest/default.nix
index 01230505b2b62..ebbc22e37a22e 100644
--- a/pkgs/development/python-modules/aiomisc-pytest/default.nix
+++ b/pkgs/development/python-modules/aiomisc-pytest/default.nix
@@ -6,7 +6,6 @@
   poetry-core,
   pytest,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "pytest" ];
 
diff --git a/pkgs/development/python-modules/aioopenexchangerates/default.nix b/pkgs/development/python-modules/aioopenexchangerates/default.nix
index 8f098bb091a8a..d27196d3f6b54 100644
--- a/pkgs/development/python-modules/aioopenexchangerates/default.nix
+++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix
@@ -9,7 +9,6 @@
   pytest-aiohttp,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/aiooss2/default.nix b/pkgs/development/python-modules/aiooss2/default.nix
index 7bdd692ac2d6e..7d1e235949e70 100644
--- a/pkgs/development/python-modules/aiooss2/default.nix
+++ b/pkgs/development/python-modules/aiooss2/default.nix
@@ -8,7 +8,6 @@
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   setuptools-scm,
@@ -38,7 +37,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/aiormq/default.nix b/pkgs/development/python-modules/aiormq/default.nix
index 773477e62c727..7dd16b1f48113 100644
--- a/pkgs/development/python-modules/aiormq/default.nix
+++ b/pkgs/development/python-modules/aiormq/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytestCheckHook,
   pamqp,
   yarl,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pamqp" ];
diff --git a/pkgs/development/python-modules/aioxmpp/default.nix b/pkgs/development/python-modules/aioxmpp/default.nix
index 9e770ae06522c..e753cb6c63dcf 100644
--- a/pkgs/development/python-modules/aioxmpp/default.nix
+++ b/pkgs/development/python-modules/aioxmpp/default.nix
@@ -14,7 +14,6 @@
   pytestCheckHook,
   pythonAtLeast,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   setuptools,
   sortedcollections,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiosasl
diff --git a/pkgs/development/python-modules/airtouch5py/default.nix b/pkgs/development/python-modules/airtouch5py/default.nix
index f474e23457863..3665bb159a104 100644
--- a/pkgs/development/python-modules/airtouch5py/default.nix
+++ b/pkgs/development/python-modules/airtouch5py/default.nix
@@ -6,7 +6,6 @@
 
   # build-system
   poetry-core,
-  pythonRelaxDepsHook,
 
   # dependencies
   bitarray,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   };
 
   build-system = [ poetry-core ];
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "crc" ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/albumentations/default.nix b/pkgs/development/python-modules/albumentations/default.nix
index b17e1c055c5f2..aa7c736ac138d 100644
--- a/pkgs/development/python-modules/albumentations/default.nix
+++ b/pkgs/development/python-modules/albumentations/default.nix
@@ -13,7 +13,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   torch,
   torchvision,
   typing-extensions,
@@ -33,7 +32,6 @@ buildPythonPackage rec {
     hash = "sha256-7t1+22zzFtkZaAyOo6xjk+MXT9N44PmQ/NRRfvLeRVk=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [
     "opencv-python"
diff --git a/pkgs/development/python-modules/alexapy/default.nix b/pkgs/development/python-modules/alexapy/default.nix
index fcc0bd1c46f6b..af10ae03468e8 100644
--- a/pkgs/development/python-modules/alexapy/default.nix
+++ b/pkgs/development/python-modules/alexapy/default.nix
@@ -12,7 +12,6 @@
   poetry-core,
   pyotp,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   simplejson,
   yarl,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aliyun-python-sdk-core/default.nix b/pkgs/development/python-modules/aliyun-python-sdk-core/default.nix
index 57323e4b189d5..b722dac05fc88 100644
--- a/pkgs/development/python-modules/aliyun-python-sdk-core/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-core/default.nix
@@ -5,7 +5,6 @@
   fetchPypi,
   jmespath,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     cryptography
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index dd46ec463f7bf..b79a3fb37511d 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -23,7 +23,6 @@
   pycparser,
   pyformlang,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyvex,
   rich,
   rpyc,
@@ -52,7 +51,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "capstone" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/ansible/core.nix b/pkgs/development/python-modules/ansible/core.nix
index 0a2103efc9c62..8caf7e1e6274c 100644
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   installShellFiles,
   docutils,
   ansible,
@@ -51,7 +50,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     installShellFiles
     docutils
-  ] ++ lib.optionals (pythonOlder "3.10") [ pythonRelaxDepsHook ];
+  ];
 
   propagatedBuildInputs =
     [
diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix
index 0854275c395f5..c14ce6a2d8212 100644
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@@ -33,7 +33,6 @@
   pytestCheckHook,
   python,
   python-dateutil,
-  pythonRelaxDepsHook,
   pytz,
   pyyaml,
   regex,
@@ -96,7 +95,6 @@ buildPythonPackage rec {
     cython
     grpcio-tools
     mypy-protobuf
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index 67ed8ef74b595..6132f4e87e33c 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -10,7 +10,6 @@
   packageurl-python,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   semver,
   setuptools,
   tabulate,
@@ -42,7 +41,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     appdirs
diff --git a/pkgs/development/python-modules/argilla/default.nix b/pkgs/development/python-modules/argilla/default.nix
index 2d2e25a83ed5f..f41661269ea4c 100644
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@@ -41,7 +41,6 @@
   python-jose,
   python-multipart,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   rich,
   schedule,
@@ -90,7 +89,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     httpx
diff --git a/pkgs/development/python-modules/arsenic/default.nix b/pkgs/development/python-modules/arsenic/default.nix
index 2d742f943f79c..8d7ab341c9d2b 100644
--- a/pkgs/development/python-modules/arsenic/default.nix
+++ b/pkgs/development/python-modules/arsenic/default.nix
@@ -7,7 +7,6 @@
   fetchpatch,
   packaging,
   poetry-core,
-  pythonRelaxDepsHook,
   pythonOlder,
   structlog,
 }:
@@ -43,7 +42,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "structlog" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ poetry-core ];
 
diff --git a/pkgs/development/python-modules/asf-search/default.nix b/pkgs/development/python-modules/asf-search/default.nix
index f4e06bb8af8da..d1bb4084f4930 100644
--- a/pkgs/development/python-modules/asf-search/default.nix
+++ b/pkgs/development/python-modules/asf-search/default.nix
@@ -9,7 +9,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   remotezip,
   requests-mock,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools-scm ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     dateparser
diff --git a/pkgs/development/python-modules/async-tkinter-loop/default.nix b/pkgs/development/python-modules/async-tkinter-loop/default.nix
index 0119dbd96be6a..a620c95843cc4 100644
--- a/pkgs/development/python-modules/async-tkinter-loop/default.nix
+++ b/pkgs/development/python-modules/async-tkinter-loop/default.nix
@@ -6,7 +6,6 @@
   poetry-core,
   tkinter,
   typing-extensions,
-  pythonRelaxDepsHook,
   pytestCheckHook,
 }:
 
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     poetry-core
   ];
 
diff --git a/pkgs/development/python-modules/atomman/default.nix b/pkgs/development/python-modules/atomman/default.nix
index 8a04f3e8f9ab3..6728f39269ecf 100644
--- a/pkgs/development/python-modules/atomman/default.nix
+++ b/pkgs/development/python-modules/atomman/default.nix
@@ -20,7 +20,6 @@
   toolz,
   wheel,
   xmltodict,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage {
@@ -37,7 +36,6 @@ buildPythonPackage {
     hash = "sha256-WfB+OY61IPprT6OCVHl8VA60p7lLVkRGuyYX+nm7bbA=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     setuptools
diff --git a/pkgs/development/python-modules/audio-metadata/default.nix b/pkgs/development/python-modules/audio-metadata/default.nix
index e9be3715ec311..40b47f61016aa 100644
--- a/pkgs/development/python-modules/audio-metadata/default.nix
+++ b/pkgs/development/python-modules/audio-metadata/default.nix
@@ -10,7 +10,6 @@
   poetry-core,
   pprintpp,
   pythonOlder,
-  pythonRelaxDepsHook,
   tbm-utils,
 }:
 
@@ -44,7 +43,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     attrs
diff --git a/pkgs/development/python-modules/autarco/default.nix b/pkgs/development/python-modules/autarco/default.nix
index b843f023dc606..72ad0c41fc767 100644
--- a/pkgs/development/python-modules/autarco/default.nix
+++ b/pkgs/development/python-modules/autarco/default.nix
@@ -10,7 +10,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   syrupy,
   yarl,
 }:
@@ -40,7 +39,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index ae2692cd697fb..69d4fdedfd2a7 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -13,7 +13,6 @@
   pyopenssl,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   urllib3,
 }:
@@ -35,7 +34,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/autofaiss/default.nix b/pkgs/development/python-modules/autofaiss/default.nix
index e5d117e6cc293..02dd9c071d7f2 100644
--- a/pkgs/development/python-modules/autofaiss/default.nix
+++ b/pkgs/development/python-modules/autofaiss/default.nix
@@ -9,7 +9,6 @@
   numpy,
   pyarrow,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
 }:
 
@@ -27,7 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-pey3wrW7CDLMiPPKnmYrcSJqGuy6ecA2SE9m3Jtt6DU=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [
     # The `dataclasses` packages is a python2-only backport, unnecessary in
diff --git a/pkgs/development/python-modules/aw-core/default.nix b/pkgs/development/python-modules/aw-core/default.nix
index e7410409c4be4..84b13c6f100de 100644
--- a/pkgs/development/python-modules/aw-core/default.nix
+++ b/pkgs/development/python-modules/aw-core/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   poetry-core,
   jsonschema,
   peewee,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aws-adfs/default.nix b/pkgs/development/python-modules/aws-adfs/default.nix
index 30198118f22bb..46fa7927eb8ac 100644
--- a/pkgs/development/python-modules/aws-adfs/default.nix
+++ b/pkgs/development/python-modules/aws-adfs/default.nix
@@ -12,7 +12,6 @@
   pyopenssl,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   requests-kerberos,
   toml,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "configparser" ];
diff --git a/pkgs/development/python-modules/awswrangler/default.nix b/pkgs/development/python-modules/awswrangler/default.nix
index a9ac6a814c601..879afe4392f00 100644
--- a/pkgs/development/python-modules/awswrangler/default.nix
+++ b/pkgs/development/python-modules/awswrangler/default.nix
@@ -20,7 +20,6 @@
   pyparsing,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   redshift-connector,
   requests-aws4auth,
 }:
@@ -43,7 +42,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     boto3
diff --git a/pkgs/development/python-modules/axisregistry/default.nix b/pkgs/development/python-modules/axisregistry/default.nix
index 9b509c2adca27..453f1c27f8bd0 100644
--- a/pkgs/development/python-modules/axisregistry/default.nix
+++ b/pkgs/development/python-modules/axisregistry/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   fonttools,
   protobuf,
-  pythonRelaxDepsHook,
   pytestCheckHook,
   setuptools-scm,
 }:
@@ -24,7 +23,6 @@ buildPythonPackage rec {
     protobuf
   ];
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/b2sdk/default.nix b/pkgs/development/python-modules/b2sdk/default.nix
index aa53bbe3ddc06..87358d7305c20 100644
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@@ -13,7 +13,6 @@
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   tqdm,
   typing-extensions,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ pdm-backend ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [ "setuptools" ];
 
diff --git a/pkgs/development/python-modules/barectf/default.nix b/pkgs/development/python-modules/barectf/default.nix
index e56367d85fa15..532228c31e4f5 100644
--- a/pkgs/development/python-modules/barectf/default.nix
+++ b/pkgs/development/python-modules/barectf/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   poetry-core,
   pytest7CheckHook,
-  pythonRelaxDepsHook,
   setuptools,
   jsonschema,
   pyyaml,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/basemap/default.nix b/pkgs/development/python-modules/basemap/default.nix
index ecc9b0bae69e6..74759f2a0d980 100644
--- a/pkgs/development/python-modules/basemap/default.nix
+++ b/pkgs/development/python-modules/basemap/default.nix
@@ -12,7 +12,6 @@
   pyproj,
   pyshp,
   python,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     cython
     geos
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/biopandas/default.nix b/pkgs/development/python-modules/biopandas/default.nix
index b947164f1d882..29e609b9b43c3 100644
--- a/pkgs/development/python-modules/biopandas/default.nix
+++ b/pkgs/development/python-modules/biopandas/default.nix
@@ -9,7 +9,6 @@
   pandas,
   pynose,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -24,7 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-1c78baBBsDyvAWrNx5mZI/Q75wyXv0DAwAdWm3EwX/I=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "looseversion" ];
 
diff --git a/pkgs/development/python-modules/boiboite-opener-framework/default.nix b/pkgs/development/python-modules/boiboite-opener-framework/default.nix
index b86989bbbd71d..d9936a7593e90 100644
--- a/pkgs/development/python-modules/boiboite-opener-framework/default.nix
+++ b/pkgs/development/python-modules/boiboite-opener-framework/default.nix
@@ -5,7 +5,6 @@
   packaging,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   scapy,
   setuptools,
 }:
diff --git a/pkgs/development/python-modules/bork/default.nix b/pkgs/development/python-modules/bork/default.nix
index b48ff6603f337..c0404e566de6c 100644
--- a/pkgs/development/python-modules/bork/default.nix
+++ b/pkgs/development/python-modules/bork/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   build,
   coloredlogs,
@@ -29,7 +28,6 @@ buildPythonPackage rec {
   };
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 274f742015207..e6accaddef6e0 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -7,7 +7,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   s3transfer,
   setuptools,
 }:
@@ -27,7 +26,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 3c71ca2f6b1b9..c009309a596b4 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -8,7 +8,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   urllib3,
 }:
@@ -28,7 +27,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "urllib3" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/botorch/default.nix b/pkgs/development/python-modules/botorch/default.nix
index e35cb5261f7b6..808ddd7e18c51 100644
--- a/pkgs/development/python-modules/botorch/default.nix
+++ b/pkgs/development/python-modules/botorch/default.nix
@@ -12,7 +12,6 @@
   torch,
   scipy,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -28,7 +27,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     wheel
diff --git a/pkgs/development/python-modules/cachier/default.nix b/pkgs/development/python-modules/cachier/default.nix
index 189ae9d281960..dac7bb71f2362 100644
--- a/pkgs/development/python-modules/cachier/default.nix
+++ b/pkgs/development/python-modules/cachier/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   setuptools,
   watchdog,
   portalocker,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
   pythonRemoveDeps = [ "setuptools" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/case/default.nix b/pkgs/development/python-modules/case/default.nix
index 3271bd8e0179b..8cf5ad07a64b2 100644
--- a/pkgs/development/python-modules/case/default.nix
+++ b/pkgs/development/python-modules/case/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   pynose,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   six,
 }:
@@ -23,7 +22,6 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/censys/default.nix b/pkgs/development/python-modules/censys/default.nix
index a741b914c1616..460ac35b5351e 100644
--- a/pkgs/development/python-modules/censys/default.nix
+++ b/pkgs/development/python-modules/censys/default.nix
@@ -10,7 +10,6 @@
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   requests-mock,
   responses,
@@ -38,7 +37,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index 7d03ab82c7bca..ba0e67c9bc7cb 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   isPyPy,
   fetchPypi,
+  fetchpatch2,
   setuptools,
   pytestCheckHook,
   libffi,
@@ -38,6 +39,19 @@ else
         # deemed safe to trust in cffi.
         #
         ./darwin-use-libffi-closures.diff
+
+        (fetchpatch2 {
+          # https://github.com/python-cffi/cffi/pull/34
+          name = "python-3.13-compat-1.patch";
+          url = "https://github.com/python-cffi/cffi/commit/49127c6929bfc7186fbfd3819dd5e058ad888de4.patch";
+          hash = "sha256-RbspsjwDf4uwJxMqG0JZGvipd7/JqXJ2uVB7PO4Qcms=";
+        })
+        (fetchpatch2 {
+          # https://github.com/python-cffi/cffi/pull/24
+          name = "python-3.13-compat-2.patch";
+          url = "https://github.com/python-cffi/cffi/commit/14723b0bbd127790c450945099db31018d80fa83.patch";
+          hash = "sha256-H5rFgRRTr27l5S6REo8+7dmPDQW7WXhP4f4DGZjdi+s=";
+        })
       ]
       ++ lib.optionals (stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc) "13") [
         # -Wnull-pointer-subtraction is enabled with -Wextra. Suppress it to allow the following tests
diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 976d2fb9a9cf0..e7360bf181857 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -32,7 +32,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   rustc,
@@ -74,7 +73,6 @@ buildPythonPackage rec {
     cargo
     pkg-config
     protobuf
-    pythonRelaxDepsHook
     rustc
     rustPlatform.cargoSetupHook
     setuptools
diff --git a/pkgs/development/python-modules/cirq-google/default.nix b/pkgs/development/python-modules/cirq-google/default.nix
index e8e0366b78d96..b7b70b00afed4 100644
--- a/pkgs/development/python-modules/cirq-google/default.nix
+++ b/pkgs/development/python-modules/cirq-google/default.nix
@@ -5,7 +5,6 @@
   google-api-core,
   protobuf,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -17,7 +16,6 @@ buildPythonPackage rec {
   sourceRoot = "${src.name}/${pname}";
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/ciscoconfparse/default.nix b/pkgs/development/python-modules/ciscoconfparse/default.nix
index 991153a573aec..1643c6acfa473 100644
--- a/pkgs/development/python-modules/ciscoconfparse/default.nix
+++ b/pkgs/development/python-modules/ciscoconfparse/default.nix
@@ -9,7 +9,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   toml,
 }:
 
@@ -43,7 +42,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/clarifai/default.nix b/pkgs/development/python-modules/clarifai/default.nix
index 3130098a6ccaf..de7423922262a 100644
--- a/pkgs/development/python-modules/clarifai/default.nix
+++ b/pkgs/development/python-modules/clarifai/default.nix
@@ -13,7 +13,6 @@
   pypdf,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   rich,
   schema,
@@ -43,7 +42,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     clarifai-grpc
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index e520483a17869..8df58d8a2ad93 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -7,7 +7,6 @@
   pysmt,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   z3-solver,
 }:
@@ -30,7 +29,6 @@ buildPythonPackage rec {
   pythonRemoveDeps = [ "z3-solver" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/cleo/default.nix b/pkgs/development/python-modules/cleo/default.nix
index e29989fdb8668..be805228302a7 100644
--- a/pkgs/development/python-modules/cleo/default.nix
+++ b/pkgs/development/python-modules/cleo/default.nix
@@ -6,7 +6,6 @@
   poetry-core,
   pytest-mock,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   rapidfuzz,
 }:
 
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "rapidfuzz" ];
diff --git a/pkgs/development/python-modules/cli-ui/default.nix b/pkgs/development/python-modules/cli-ui/default.nix
index 88f152a6fc599..ecd30ce3fc079 100644
--- a/pkgs/development/python-modules/cli-ui/default.nix
+++ b/pkgs/development/python-modules/cli-ui/default.nix
@@ -3,7 +3,6 @@
   python3Packages,
   fetchPypi,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
   poetry-core,
   colorama,
@@ -24,7 +23,6 @@ python3Packages.buildPythonPackage rec {
 
   pythonRelaxDeps = [ "tabulate" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ poetry-core ];
 
diff --git a/pkgs/development/python-modules/clickhouse-cli/default.nix b/pkgs/development/python-modules/clickhouse-cli/default.nix
index b444e17fbde4f..15a700f684e1c 100644
--- a/pkgs/development/python-modules/clickhouse-cli/default.nix
+++ b/pkgs/development/python-modules/clickhouse-cli/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools,
   click,
   prompt-toolkit,
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/cmdstanpy/default.nix b/pkgs/development/python-modules/cmdstanpy/default.nix
index 49ac02e6e92eb..63e88085b5827 100644
--- a/pkgs/development/python-modules/cmdstanpy/default.nix
+++ b/pkgs/development/python-modules/cmdstanpy/default.nix
@@ -5,7 +5,6 @@
   fetchpatch,
   substituteAll,
   cmdstan,
-  pythonRelaxDepsHook,
   setuptools,
   pandas,
   numpy,
@@ -47,7 +46,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/coinmetrics-api-client/default.nix b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
index b7c9ef2a68d1e..fe5bf7716e40c 100644
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@@ -9,7 +9,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   tqdm,
   typer,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/comicon/default.nix b/pkgs/development/python-modules/comicon/default.nix
index 932d6810ea3fb..d42304712ef3d 100644
--- a/pkgs/development/python-modules/comicon/default.nix
+++ b/pkgs/development/python-modules/comicon/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   pythonOlder,
   ebooklib,
   lxml,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pypdf" ];
diff --git a/pkgs/development/python-modules/conda-libmamba-solver/default.nix b/pkgs/development/python-modules/conda-libmamba-solver/default.nix
index aff927bfc6a86..4c99fc866c5da 100644
--- a/pkgs/development/python-modules/conda-libmamba-solver/default.nix
+++ b/pkgs/development/python-modules/conda-libmamba-solver/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   fetchFromGitHub,
   libmambapy,
   hatchling,
@@ -21,7 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-vsUYrDVNMKHd3mlaAFYCP4uPQ9HxeKsose5O8InaMcE=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     hatchling
diff --git a/pkgs/development/python-modules/conda/default.nix b/pkgs/development/python-modules/conda/default.nix
index adebce0b23771..b6b551ebb9454 100644
--- a/pkgs/development/python-modules/conda/default.nix
+++ b/pkgs/development/python-modules/conda/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   hostPlatform,
   fetchFromGitHub,
   # build dependencies
@@ -38,7 +37,6 @@ buildPythonPackage rec {
     hash = "sha256-LdoBlR5EFYd2mQIjOgp1MH3w6osfRfurPq+N5Y1iaFw=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     hatchling
diff --git a/pkgs/development/python-modules/ctap-keyring-device/default.nix b/pkgs/development/python-modules/ctap-keyring-device/default.nix
index 656e5f04456c4..a18241658b01e 100644
--- a/pkgs/development/python-modules/ctap-keyring-device/default.nix
+++ b/pkgs/development/python-modules/ctap-keyring-device/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools-scm,
   # install requirements
   fido2,
@@ -40,7 +39,6 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
index 30629ee89e91d..4de730f1ff996 100644
--- a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
+++ b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
@@ -9,7 +9,6 @@
   lxml,
   packageurl-python,
   py-serializable,
-  pythonRelaxDepsHook,
   poetry-core,
   pytestCheckHook,
   pythonOlder,
@@ -38,7 +37,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     importlib-metadata
diff --git a/pkgs/development/python-modules/cypherpunkpay/default.nix b/pkgs/development/python-modules/cypherpunkpay/default.nix
index cb4233883d371..8228274ee1712 100644
--- a/pkgs/development/python-modules/cypherpunkpay/default.nix
+++ b/pkgs/development/python-modules/cypherpunkpay/default.nix
@@ -16,7 +16,6 @@
   pysocks,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   tzlocal,
   waitress,
@@ -50,7 +49,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dask-awkward/default.nix b/pkgs/development/python-modules/dask-awkward/default.nix
index 99bf5858bf680..09d4749c09786 100644
--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@@ -14,7 +14,6 @@
   pyarrow,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   typing-extensions,
   uproot,
 }:
@@ -38,7 +37,6 @@ buildPythonPackage rec {
   build-system = [
     hatch-vcs
     hatchling
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/databricks-sql-connector/default.nix b/pkgs/development/python-modules/databricks-sql-connector/default.nix
index fdbee91fdae4d..585083162211c 100644
--- a/pkgs/development/python-modules/databricks-sql-connector/default.nix
+++ b/pkgs/development/python-modules/databricks-sql-connector/default.nix
@@ -12,7 +12,6 @@
   pyarrow,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   sqlalchemy,
   thrift,
 }:
@@ -38,7 +37,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dataprep-ml/default.nix b/pkgs/development/python-modules/dataprep-ml/default.nix
index a8e24c9bc2a17..df952df2bd0a6 100644
--- a/pkgs/development/python-modules/dataprep-ml/default.nix
+++ b/pkgs/development/python-modules/dataprep-ml/default.nix
@@ -12,7 +12,6 @@
   pydateinfer,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   scipy,
   symlinkJoin,
   type-infer,
@@ -44,7 +43,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dbt-bigquery/default.nix b/pkgs/development/python-modules/dbt-bigquery/default.nix
index 6de783f936a6d..94aa0495d8ac6 100644
--- a/pkgs/development/python-modules/dbt-bigquery/default.nix
+++ b/pkgs/development/python-modules/dbt-bigquery/default.nix
@@ -9,7 +9,6 @@
   google-cloud-storage,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   urllib3,
 }:
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "agate" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/dbt-core/default.nix b/pkgs/development/python-modules/dbt-core/default.nix
index 2de11c94934d5..41e5a956d8de2 100644
--- a/pkgs/development/python-modules/dbt-core/default.nix
+++ b/pkgs/development/python-modules/dbt-core/default.nix
@@ -21,7 +21,6 @@
   protobuf,
   python3,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   pyyaml,
   requests,
@@ -59,7 +58,6 @@ buildPythonPackage rec {
   ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/dbt-redshift/default.nix b/pkgs/development/python-modules/dbt-redshift/default.nix
index b30c787a93246..af412d0f6269c 100644
--- a/pkgs/development/python-modules/dbt-redshift/default.nix
+++ b/pkgs/development/python-modules/dbt-redshift/default.nix
@@ -8,7 +8,6 @@
   fetchFromGitHub,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   redshift-connector,
   setuptools,
 }:
@@ -32,7 +31,6 @@ buildPythonPackage rec {
     "redshift-connector"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
index 1abaa554e9a24..73dc410324a95 100644
--- a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
+++ b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
@@ -6,7 +6,6 @@
   dbt-postgres,
   fetchFromGitHub,
   hatchling,
-  pythonRelaxDepsHook,
   hypothesis,
   importlib-metadata,
   jinja2,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   build-system = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/deal-solver/default.nix b/pkgs/development/python-modules/deal-solver/default.nix
index 4657d0f21d9ae..8acefba226a8b 100644
--- a/pkgs/development/python-modules/deal-solver/default.nix
+++ b/pkgs/development/python-modules/deal-solver/default.nix
@@ -8,7 +8,6 @@
   astroid,
   pytestCheckHook,
   hypothesis,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     flit-core
-    pythonRelaxDepsHook
   ];
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail
diff --git a/pkgs/development/python-modules/defusedxml/default.nix b/pkgs/development/python-modules/defusedxml/default.nix
index ee23d66e59d7c..ce997d1fcb820 100644
--- a/pkgs/development/python-modules/defusedxml/default.nix
+++ b/pkgs/development/python-modules/defusedxml/default.nix
@@ -1,27 +1,38 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  setuptools,
+  lxml,
   python,
 }:
 
 buildPythonPackage rec {
   pname = "defusedxml";
-  version = "0.7.1";
-  format = "setuptools";
+  version = "0.8.0rc2";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69";
+  src = fetchFromGitHub {
+    owner = "tiran";
+    repo = "defusedxml";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-X88A5V9uXP3wJQ+olK6pZJT66LP2uCXLK8goa5bPARA=";
   };
 
+  build-system = [ setuptools ] ;
+
+  nativeCheckInputs = [ lxml ];
+
   checkPhase = ''
+    runHook preCheck
     ${python.interpreter} tests.py
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "defusedxml" ];
 
   meta = with lib; {
+    changelog = "https://github.com/tiran/defusedxml/blob/v${version}/CHANGES.txt";
     description = "Python module to defuse XML issues";
     homepage = "https://github.com/tiran/defusedxml";
     license = licenses.psfl;
diff --git a/pkgs/development/python-modules/demetriek/default.nix b/pkgs/development/python-modules/demetriek/default.nix
index b51e463c67f05..2a9a466c9ab06 100644
--- a/pkgs/development/python-modules/demetriek/default.nix
+++ b/pkgs/development/python-modules/demetriek/default.nix
@@ -12,7 +12,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   yarl,
 }:
 
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/detectron2/default.nix b/pkgs/development/python-modules/detectron2/default.nix
index 944ff80850cfe..2247b4581a4d2 100644
--- a/pkgs/development/python-modules/detectron2/default.nix
+++ b/pkgs/development/python-modules/detectron2/default.nix
@@ -3,7 +3,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   ninja,
   which,
   # build inputs
@@ -72,7 +71,6 @@ buildPythonPackage {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     ninja
     which
   ];
diff --git a/pkgs/development/python-modules/devito/default.nix b/pkgs/development/python-modules/devito/default.nix
index 6a414f9cabb9b..50e1b0dd5868c 100644
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@@ -19,7 +19,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   scipy,
   sympy,
 }:
@@ -47,7 +46,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = true;
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     anytree
diff --git a/pkgs/development/python-modules/diffsync/default.nix b/pkgs/development/python-modules/diffsync/default.nix
index f5ffb2dfbd065..28ea4eb3a9f52 100644
--- a/pkgs/development/python-modules/diffsync/default.nix
+++ b/pkgs/development/python-modules/diffsync/default.nix
@@ -6,7 +6,6 @@
   packaging,
   poetry-core,
   pydantic,
-  pythonRelaxDepsHook,
   redis,
   structlog,
 }:
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/dissect/default.nix b/pkgs/development/python-modules/dissect/default.nix
index 73f022e97eaa1..7102f03e869ab 100644
--- a/pkgs/development/python-modules/dissect/default.nix
+++ b/pkgs/development/python-modules/dissect/default.nix
@@ -30,7 +30,6 @@
   dissect-xfs,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   setuptools-scm,
 }:
@@ -56,7 +55,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     dissect-archive
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index 0d5da20cccfbe..bf632a771e646 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -11,7 +11,6 @@
   packaging,
   psutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   setuptools,
   setuptools-scm,
@@ -45,7 +44,6 @@ buildPythonPackage rec {
   '';
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     versioneer
diff --git a/pkgs/development/python-modules/django-cacheops/default.nix b/pkgs/development/python-modules/django-cacheops/default.nix
index f7f15c540a999..85b44d4523a94 100644
--- a/pkgs/development/python-modules/django-cacheops/default.nix
+++ b/pkgs/development/python-modules/django-cacheops/default.nix
@@ -3,7 +3,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   django,
   funcy,
   redis,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
     hash = "sha256-d6N8c9f6z8cpk2XtZqEr56SH3XRd2GwdM8ouv9OzKHg=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "funcy" ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-compressor/default.nix b/pkgs/development/python-modules/django-compressor/default.nix
index 086987f4dabcf..0331316b93630 100644
--- a/pkgs/development/python-modules/django-compressor/default.nix
+++ b/pkgs/development/python-modules/django-compressor/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/django-import-export/default.nix b/pkgs/development/python-modules/django-import-export/default.nix
index fd4be9238aaf6..6fab78af7c848 100644
--- a/pkgs/development/python-modules/django-import-export/default.nix
+++ b/pkgs/development/python-modules/django-import-export/default.nix
@@ -8,7 +8,6 @@
   psycopg2,
   python,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   setuptools-scm,
   tablib,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools-scm ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     diff-match-patch
diff --git a/pkgs/development/python-modules/django-oauth-toolkit/default.nix b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
index fdde98dd5ee5f..139a0d022c159 100644
--- a/pkgs/development/python-modules/django-oauth-toolkit/default.nix
+++ b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # propagates
   django,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
     requests
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "django" ];
 
   DJANGO_SETTINGS_MODULE = "tests.settings";
diff --git a/pkgs/development/python-modules/django-two-factor-auth/default.nix b/pkgs/development/python-modules/django-two-factor-auth/default.nix
index f14b4a0d0c853..718d2206700b4 100644
--- a/pkgs/development/python-modules/django-two-factor-auth/default.nix
+++ b/pkgs/development/python-modules/django-two-factor-auth/default.nix
@@ -9,7 +9,6 @@
   phonenumbers,
   pydantic,
   pythonOlder,
-  pythonRelaxDepsHook,
   qrcode,
   setuptools-scm,
   twilio,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/django-webpush/default.nix b/pkgs/development/python-modules/django-webpush/default.nix
index 25d406e348c4b..0c9b0ac657878 100644
--- a/pkgs/development/python-modules/django-webpush/default.nix
+++ b/pkgs/development/python-modules/django-webpush/default.nix
@@ -4,7 +4,6 @@
   django,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   pywebpush,
   setuptools-scm,
 }:
@@ -26,7 +25,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pywebpush" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/dm-control/default.nix b/pkgs/development/python-modules/dm-control/default.nix
index 25a375bf7eb6f..af8c7bdbee7f8 100644
--- a/pkgs/development/python-modules/dm-control/default.nix
+++ b/pkgs/development/python-modules/dm-control/default.nix
@@ -6,7 +6,6 @@
   absl-py,
   mujoco,
   pyparsing,
-  pythonRelaxDepsHook,
   setuptools,
   wheel,
   dm-env,
@@ -46,7 +45,6 @@ buildPythonPackage rec {
     absl-py
     mujoco
     pyparsing
-    pythonRelaxDepsHook
     setuptools
     wheel
   ];
diff --git a/pkgs/development/python-modules/dploot/default.nix b/pkgs/development/python-modules/dploot/default.nix
index 4104ec2ac44b0..4cb0a90c0f0f4 100644
--- a/pkgs/development/python-modules/dploot/default.nix
+++ b/pkgs/development/python-modules/dploot/default.nix
@@ -8,7 +8,6 @@
   poetry-core,
   pyasn1,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -29,7 +28,6 @@ buildPythonPackage rec {
     "pyasn1"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ poetry-core ];
 
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 4e3683fc485b4..73a551a5c278a 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -12,7 +12,6 @@
   pytestCheckHook,
   sphinxHook,
   sphinx-rtd-theme,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -60,7 +59,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     sphinxHook
     sphinx-rtd-theme
-    pythonRelaxDepsHook
   ];
 
   # Version 12.0.0 re-introduced Python 2 support and set some very restrictive version bounds
diff --git a/pkgs/development/python-modules/dvc-azure/default.nix b/pkgs/development/python-modules/dvc-azure/default.nix
index f212889f2085b..7aada9f9e75ac 100644
--- a/pkgs/development/python-modules/dvc-azure/default.nix
+++ b/pkgs/development/python-modules/dvc-azure/default.nix
@@ -6,7 +6,6 @@
   dvc-objects,
   fetchPypi,
   knack,
-  pythonRelaxDepsHook,
   setuptools-scm,
 }:
 
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc-gs/default.nix b/pkgs/development/python-modules/dvc-gs/default.nix
index 235c6a8e5f8ef..f457d2e1d3e82 100644
--- a/pkgs/development/python-modules/dvc-gs/default.nix
+++ b/pkgs/development/python-modules/dvc-gs/default.nix
@@ -4,7 +4,6 @@
   dvc-objects,
   fetchPypi,
   gcsfs,
-  pythonRelaxDepsHook,
   setuptools-scm,
 }:
 
@@ -23,7 +22,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc-http/default.nix b/pkgs/development/python-modules/dvc-http/default.nix
index e9eb01b5379e6..ddd707736ae42 100644
--- a/pkgs/development/python-modules/dvc-http/default.nix
+++ b/pkgs/development/python-modules/dvc-http/default.nix
@@ -7,7 +7,6 @@
   fsspec,
   funcy,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools-scm,
 }:
 
diff --git a/pkgs/development/python-modules/dvc-s3/default.nix b/pkgs/development/python-modules/dvc-s3/default.nix
index e6a18d59f272a..ac82bc8f78674 100644
--- a/pkgs/development/python-modules/dvc-s3/default.nix
+++ b/pkgs/development/python-modules/dvc-s3/default.nix
@@ -6,7 +6,6 @@
   dvc-objects,
   fetchPypi,
   flatten-dict,
-  pythonRelaxDepsHook,
   s3fs,
   setuptools-scm,
 }:
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc-ssh/default.nix b/pkgs/development/python-modules/dvc-ssh/default.nix
index cba3ae243d174..3578e1b572ebe 100644
--- a/pkgs/development/python-modules/dvc-ssh/default.nix
+++ b/pkgs/development/python-modules/dvc-ssh/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   dvc-objects,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools-scm,
   sshfs,
 }:
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc/default.nix b/pkgs/development/python-modules/dvc/default.nix
index f9190e727a1da..571d5f3455216 100644
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@@ -36,7 +36,6 @@
   pygtrie,
   pyparsing,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   rich,
   ruamel-yaml,
@@ -84,7 +83,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools-scm ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies =
     [
diff --git a/pkgs/development/python-modules/elastic-apm/default.nix b/pkgs/development/python-modules/elastic-apm/default.nix
index 93fd450edfa4b..113898825f5dc 100644
--- a/pkgs/development/python-modules/elastic-apm/default.nix
+++ b/pkgs/development/python-modules/elastic-apm/default.nix
@@ -19,7 +19,6 @@
   pytest-random-order,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   sanic,
   sanic-testing,
   setuptools,
@@ -49,7 +48,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/embedding-reader/default.nix b/pkgs/development/python-modules/embedding-reader/default.nix
index c49f6026d7e44..0f4d3c54a34b9 100644
--- a/pkgs/development/python-modules/embedding-reader/default.nix
+++ b/pkgs/development/python-modules/embedding-reader/default.nix
@@ -7,7 +7,6 @@
   pandas,
   pyarrow,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -22,7 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-paN6rAyH3L7qCfWPr5kXo9Xl57gRMhdcDnoyLJ7II2w=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "pyarrow" ];
 
diff --git a/pkgs/development/python-modules/es-client/default.nix b/pkgs/development/python-modules/es-client/default.nix
index 3204da1d5a977..994f23980e51b 100644
--- a/pkgs/development/python-modules/es-client/default.nix
+++ b/pkgs/development/python-modules/es-client/default.nix
@@ -12,7 +12,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   six,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   build-system = [ hatchling ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     certifi
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index cb1577e1ed4fb..7dc9c78852ea1 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "agronholm";
     repo = "exceptiongroup";
     rev = version;
-    hash = "sha256-iGeaRVJeFAWfJpwr7N4kST7d8YxpX3WgDqQemlR0cLU=";
+    hash = "sha256-87HmZsbsoV7QPHux50sYsFY2RaIc3627dH3WAwqXfQU=";
   };
 
   nativeBuildInputs = [ flit-scm ];
@@ -28,16 +28,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  disabledTests =
-    if pythonAtLeast "3.12" then
-      [
-        # https://github.com/agronholm/exceptiongroup/issues/116
-        "test_deep_split"
-        "test_deep_subgroup"
-      ]
-    else
-      null;
-
   pythonImportsCheck = [ "exceptiongroup" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/explorerscript/default.nix b/pkgs/development/python-modules/explorerscript/default.nix
index 9bc49b2ee6823..391881204e29a 100644
--- a/pkgs/development/python-modules/explorerscript/default.nix
+++ b/pkgs/development/python-modules/explorerscript/default.nix
@@ -7,7 +7,6 @@
   igraph,
   pygments,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     antlr4
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/extract-msg/default.nix b/pkgs/development/python-modules/extract-msg/default.nix
index c687ef3272f7b..27faad2695cae 100644
--- a/pkgs/development/python-modules/extract-msg/default.nix
+++ b/pkgs/development/python-modules/extract-msg/default.nix
@@ -8,7 +8,6 @@
   olefile,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   red-black-tree-mod,
   rtfde,
   setuptools,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
   ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/extruct/default.nix b/pkgs/development/python-modules/extruct/default.nix
index f44f9443add94..f7ede71841122 100644
--- a/pkgs/development/python-modules/extruct/default.nix
+++ b/pkgs/development/python-modules/extruct/default.nix
@@ -10,7 +10,6 @@
   pyrdfa3,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   rdflib,
   setuptools,
   six,
diff --git a/pkgs/development/python-modules/fairseq/default.nix b/pkgs/development/python-modules/fairseq/default.nix
index e0634af26f201..5cea23e2bda6a 100644
--- a/pkgs/development/python-modules/fairseq/default.nix
+++ b/pkgs/development/python-modules/fairseq/default.nix
@@ -7,7 +7,6 @@
 
   # Native build inputs
   cython,
-  pythonRelaxDepsHook,
   which,
 
   # Propagated build inputs
@@ -53,7 +52,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cython
-    pythonRelaxDepsHook
     which
   ];
 
diff --git a/pkgs/development/python-modules/farm-haystack/default.nix b/pkgs/development/python-modules/farm-haystack/default.nix
index 14c563918964c..fa5ce3148003c 100644
--- a/pkgs/development/python-modules/farm-haystack/default.nix
+++ b/pkgs/development/python-modules/farm-haystack/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   hatchling,
   boilerpy3,
   events,
@@ -104,7 +103,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index a39604d71497b..0b1b6c550dfef 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   # build-system
   hatchling,
@@ -53,7 +52,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/fastembed/default.nix b/pkgs/development/python-modules/fastembed/default.nix
index 005e514ff3c23..b986eb9782992 100644
--- a/pkgs/development/python-modules/fastembed/default.nix
+++ b/pkgs/development/python-modules/fastembed/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # build-system
   poetry-core,
@@ -39,7 +38,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     huggingface-hub
diff --git a/pkgs/development/python-modules/faster-whisper/default.nix b/pkgs/development/python-modules/faster-whisper/default.nix
index f36b90cbb3ff6..0160b772b7c87 100644
--- a/pkgs/development/python-modules/faster-whisper/default.nix
+++ b/pkgs/development/python-modules/faster-whisper/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "tokenizers" ];
diff --git a/pkgs/development/python-modules/flax/default.nix b/pkgs/development/python-modules/flax/default.nix
index 7c443368bd41f..6587ca7d3b67b 100644
--- a/pkgs/development/python-modules/flax/default.nix
+++ b/pkgs/development/python-modules/flax/default.nix
@@ -15,7 +15,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   rich,
   setuptools-scm,
@@ -40,7 +39,6 @@ buildPythonPackage rec {
 
   build-system = [
     jaxlib
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/flet-runtime/default.nix b/pkgs/development/python-modules/flet-runtime/default.nix
index 323e93e43ee15..d9679fdc4f45f 100644
--- a/pkgs/development/python-modules/flet-runtime/default.nix
+++ b/pkgs/development/python-modules/flet-runtime/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   flet-client-flutter,
   poetry-core,
-  pythonRelaxDepsHook,
   flet-core,
   httpx,
   oauthlib,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "httpx" ];
diff --git a/pkgs/development/python-modules/flet/default.nix b/pkgs/development/python-modules/flet/default.nix
index 9f4ed972ed27a..314d0a72c7767 100644
--- a/pkgs/development/python-modules/flet/default.nix
+++ b/pkgs/development/python-modules/flet/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   flet-client-flutter,
-  pythonRelaxDepsHook,
 
   # build-system
   poetry-core,
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/fontbakery/default.nix b/pkgs/development/python-modules/fontbakery/default.nix
index d985755364193..242de86685a5d 100644
--- a/pkgs/development/python-modules/fontbakery/default.nix
+++ b/pkgs/development/python-modules/fontbakery/default.nix
@@ -29,7 +29,6 @@
   protobuf,
   pytestCheckHook,
   pytest-xdist,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   requests-mock,
@@ -96,7 +95,6 @@ buildPythonPackage rec {
   ];
   nativeBuildInputs = [
     installShellFiles
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/freebox-api/default.nix b/pkgs/development/python-modules/freebox-api/default.nix
index a5fa4fe5746f0..ec5df36417374 100644
--- a/pkgs/development/python-modules/freebox-api/default.nix
+++ b/pkgs/development/python-modules/freebox-api/default.nix
@@ -6,7 +6,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   urllib3,
 }:
 
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "urllib3" ];
diff --git a/pkgs/development/python-modules/freezegun/default.nix b/pkgs/development/python-modules/freezegun/default.nix
index ab170e3ee9165..cc15733d053b6 100644
--- a/pkgs/development/python-modules/freezegun/default.nix
+++ b/pkgs/development/python-modules/freezegun/default.nix
@@ -4,20 +4,21 @@
   fetchPypi,
   pytestCheckHook,
   python-dateutil,
+  pythonAtLeast,
   pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "freezegun";
-  version = "1.4.0";
+  version = "1.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EJObC6D/Wtrs87BqXC9zBx2WeOUHxertsjx2HVasd0s=";
+    hash = "sha256-sp3t/NptXo4IPOcbK1QnU61Iz+xEA3s/x5cC4pgKiek=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -26,6 +27,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.13") [
+    # https://github.com/spulec/freezegun/issues/547
+    "test_method_decorator_works_on_unittest_kwarg_frozen_time"
+    "test_method_decorator_works_on_unittest_kwarg_frozen_time_with_func"
+    "test_method_decorator_works_on_unittest_kwarg_hello"
+  ];
+
   pythonImportsCheck = [ "freezegun" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/furl/default.nix b/pkgs/development/python-modules/furl/default.nix
index fb9e9b6206633..4b4f81d1a2aad 100644
--- a/pkgs/development/python-modules/furl/default.nix
+++ b/pkgs/development/python-modules/furl/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  pythonAtLeast,
   flake8,
   orderedmultidict,
   pytestCheckHook,
@@ -35,6 +36,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # AssertionError: assert '//////path' == '////path'
+    "test_odd_urls"
+  ];
+
   pythonImportsCheck = [ "furl" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/furo/default.nix b/pkgs/development/python-modules/furo/default.nix
index 190f54481679c..f88e6bebb0227 100644
--- a/pkgs/development/python-modules/furo/default.nix
+++ b/pkgs/development/python-modules/furo/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
-  pythonRelaxDepsHook,
   sphinx,
   beautifulsoup4,
   sphinx-basic-ng,
@@ -23,7 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-NUi+LO9Foy+M3AJy1BX8s+X6ag603f4h3z7PH+RaE88=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "sphinx" ];
 
diff --git a/pkgs/development/python-modules/galois/default.nix b/pkgs/development/python-modules/galois/default.nix
index 331785dd9e201..819e4d7e6c071 100644
--- a/pkgs/development/python-modules/galois/default.nix
+++ b/pkgs/development/python-modules/galois/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   setuptools-scm,
   pythonOlder,
-  pythonRelaxDepsHook,
   fetchFromGitHub,
   pytestCheckHook,
   pytest-xdist,
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gcs-oauth2-boto-plugin/default.nix b/pkgs/development/python-modules/gcs-oauth2-boto-plugin/default.nix
index 9d93efe8897dc..87f9e361feaae 100644
--- a/pkgs/development/python-modules/gcs-oauth2-boto-plugin/default.nix
+++ b/pkgs/development/python-modules/gcs-oauth2-boto-plugin/default.nix
@@ -11,7 +11,6 @@
   pyopenssl,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   retry-decorator,
   rsa,
   six,
diff --git a/pkgs/development/python-modules/gflanguages/default.nix b/pkgs/development/python-modules/gflanguages/default.nix
index 5f0976661fcc8..0d7ce6908c80e 100644
--- a/pkgs/development/python-modules/gflanguages/default.nix
+++ b/pkgs/development/python-modules/gflanguages/default.nix
@@ -5,7 +5,6 @@
   protobuf,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   setuptools-scm,
   uharfbuzz,
@@ -39,7 +38,6 @@ buildPythonPackage rec {
   dependencies = [ protobuf ];
 
   nativeCheckInputs = [
-    pythonRelaxDepsHook
     pytestCheckHook
     uharfbuzz
     youseedee
diff --git a/pkgs/development/python-modules/gitdb/default.nix b/pkgs/development/python-modules/gitdb/default.nix
index 838e0679c74c8..422b7b52c3c56 100644
--- a/pkgs/development/python-modules/gitdb/default.nix
+++ b/pkgs/development/python-modules/gitdb/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   smmap,
 }:
@@ -23,7 +22,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "smmap" ];
diff --git a/pkgs/development/python-modules/githubkit/default.nix b/pkgs/development/python-modules/githubkit/default.nix
index fe14c80356ae0..b60a541d45ebd 100644
--- a/pkgs/development/python-modules/githubkit/default.nix
+++ b/pkgs/development/python-modules/githubkit/default.nix
@@ -11,7 +11,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   typing-extensions,
 }:
 
@@ -38,7 +37,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     hishel
diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index b3f0d3d558303..652f7735e0c5c 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -12,7 +12,6 @@
   protobuf,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
 }:
@@ -30,7 +29,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/google-generativeai/default.nix b/pkgs/development/python-modules/google-generativeai/default.nix
index 13f9386eb135c..e24b153c37465 100644
--- a/pkgs/development/python-modules/google-generativeai/default.nix
+++ b/pkgs/development/python-modules/google-generativeai/default.nix
@@ -9,7 +9,6 @@
   protobuf,
   pydantic,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   tqdm,
   typing-extensions,
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     google-ai-generativelanguage
diff --git a/pkgs/development/python-modules/gophish/default.nix b/pkgs/development/python-modules/gophish/default.nix
index 8a7d8c90d487c..48b4e880e5fcf 100644
--- a/pkgs/development/python-modules/gophish/default.nix
+++ b/pkgs/development/python-modules/gophish/default.nix
@@ -10,7 +10,6 @@
   pyparsing,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   six,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     appdirs
diff --git a/pkgs/development/python-modules/gpsoauth/default.nix b/pkgs/development/python-modules/gpsoauth/default.nix
index 28d364c2650d9..d40d2f3c61747 100644
--- a/pkgs/development/python-modules/gpsoauth/default.nix
+++ b/pkgs/development/python-modules/gpsoauth/default.nix
@@ -5,7 +5,6 @@
   poetry-core,
   pycryptodomex,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     poetry-core
   ];
 
diff --git a/pkgs/development/python-modules/gpustat/default.nix b/pkgs/development/python-modules/gpustat/default.nix
index c7a920a07f1a9..d3a06d7f89003 100644
--- a/pkgs/development/python-modules/gpustat/default.nix
+++ b/pkgs/development/python-modules/gpustat/default.nix
@@ -8,7 +8,6 @@
   psutil,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools-scm,
 }:
 
@@ -27,7 +26,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "nvidia-ml-py" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/grad-cam/default.nix b/pkgs/development/python-modules/grad-cam/default.nix
index 8e2c61075d98b..e632650a40a63 100644
--- a/pkgs/development/python-modules/grad-cam/default.nix
+++ b/pkgs/development/python-modules/grad-cam/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools,
   matplotlib,
   numpy,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/gradio/client.nix b/pkgs/development/python-modules/gradio/client.nix
index 768e5e3f99565..1c7a51dd2aa81 100644
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   nix-update-script,
   pythonOlder,
-  pythonRelaxDepsHook,
   # pyproject
   hatchling,
   hatch-requirements-txt,
@@ -58,7 +57,6 @@ buildPythonPackage rec {
     hatchling
     hatch-requirements-txt
     hatch-fancy-pypi-readme
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 4d028da04e493..5cc026cd3f2a4 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   writeShellScriptBin,
   gradio,
 
@@ -91,7 +90,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     hatchling
     hatch-requirements-txt
     hatch-fancy-pypi-readme
diff --git a/pkgs/development/python-modules/greenlet/default.nix b/pkgs/development/python-modules/greenlet/default.nix
index 5c41e88455418..2ea828cd4174d 100644
--- a/pkgs/development/python-modules/greenlet/default.nix
+++ b/pkgs/development/python-modules/greenlet/default.nix
@@ -24,6 +24,11 @@ let
       hash = "sha256-QzdEQjUyWVVM4zWZ2otpLVqpb4l21WfUut8mM3H75JE=";
     };
 
+    patches = [
+      # https://github.com/python-greenlet/greenlet/pull/396
+      ./python-3.13-compat.patch
+    ];
+
     nativeBuildInputs = [ setuptools ];
 
     # tests in passthru, infinite recursion via objgraph/graphviz
diff --git a/pkgs/development/python-modules/greenlet/python-3.13-compat.patch b/pkgs/development/python-modules/greenlet/python-3.13-compat.patch
new file mode 100644
index 0000000000000..9f5488b831d32
--- /dev/null
+++ b/pkgs/development/python-modules/greenlet/python-3.13-compat.patch
@@ -0,0 +1,313 @@
+Port of https://github.com/python-greenlet/greenlet/pull/396
+
+From 94979488f841fcb41bd2bd3b80b5c0b011af4c94 Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Wed, 14 Feb 2024 16:37:42 +0100
+Subject: [PATCH 1/5] Fix #392: Port to Python 3.13
+
+* Replace C_RECURSION_LIMIT with Py_C_RECURSION_LIMIT.
+* Add Py_C_RECURSION_LIMIT for Python 3.12 and older.
+* Disable GREENLET_USE_CFRAME on Python 3.13.
+* Define Py_BUILD_CORE to include pycore_frame.h.
+---
+ src/greenlet/TPythonState.cpp            | 10 +++++++---
+ src/greenlet/greenlet_cpython_compat.hpp | 13 +++++++++++--
+ src/greenlet/greenlet_greenlet.hpp       |  1 +
+ 3 files changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/src/greenlet/TPythonState.cpp b/src/greenlet/TPythonState.cpp
+index 465d4174..c0dbf703 100644
+--- a/src/greenlet/TPythonState.cpp
++++ b/src/greenlet/TPythonState.cpp
+@@ -130,11 +130,13 @@ void PythonState::operator<<(const PyThreadState *const tstate) noexcept
+ #if GREENLET_PY311
+   #if GREENLET_PY312
+     this->py_recursion_depth = tstate->py_recursion_limit - tstate->py_recursion_remaining;
+-    this->c_recursion_depth = C_RECURSION_LIMIT - tstate->c_recursion_remaining;
++    this->c_recursion_depth = Py_C_RECURSION_LIMIT - tstate->c_recursion_remaining;
+   #else // not 312
+     this->recursion_depth = tstate->recursion_limit - tstate->recursion_remaining;
+   #endif // GREENLET_PY312
++  #if GREENLET_USE_CFRAME
+     this->current_frame = tstate->cframe->current_frame;
++  #endif
+     this->datastack_chunk = tstate->datastack_chunk;
+     this->datastack_top = tstate->datastack_top;
+     this->datastack_limit = tstate->datastack_limit;
+@@ -199,12 +201,14 @@ void PythonState::operator>>(PyThreadState *const tstate) noexcept
+ #if GREENLET_PY311
+   #if GREENLET_PY312
+     tstate->py_recursion_remaining = tstate->py_recursion_limit - this->py_recursion_depth;
+-    tstate->c_recursion_remaining = C_RECURSION_LIMIT - this->c_recursion_depth;
++    tstate->c_recursion_remaining = Py_C_RECURSION_LIMIT - this->c_recursion_depth;
+     this->unexpose_frames();
+   #else // \/ 3.11
+     tstate->recursion_remaining = tstate->recursion_limit - this->recursion_depth;
+   #endif // GREENLET_PY312
++  #if GREENLET_USE_CFRAME
+     tstate->cframe->current_frame = this->current_frame;
++  #endif
+     tstate->datastack_chunk = this->datastack_chunk;
+     tstate->datastack_top = this->datastack_top;
+     tstate->datastack_limit = this->datastack_limit;
+@@ -238,7 +242,7 @@ void PythonState::set_initial_state(const PyThreadState* const tstate) noexcept
+ #if GREENLET_PY312
+     this->py_recursion_depth = tstate->py_recursion_limit - tstate->py_recursion_remaining;
+     // XXX: TODO: Comment from a reviewer:
+-    //     Should this be ``C_RECURSION_LIMIT - tstate->c_recursion_remaining``?
++    //     Should this be ``Py_C_RECURSION_LIMIT - tstate->c_recursion_remaining``?
+     // But to me it looks more like that might not be the right
+     // initialization either?
+     this->c_recursion_depth = tstate->py_recursion_limit - tstate->py_recursion_remaining;
+diff --git a/src/greenlet/greenlet_cpython_compat.hpp b/src/greenlet/greenlet_cpython_compat.hpp
+index cdc1617f..c0fb94c5 100644
+--- a/src/greenlet/greenlet_cpython_compat.hpp
++++ b/src/greenlet/greenlet_cpython_compat.hpp
+@@ -12,19 +12,24 @@
+ 
+ #if PY_VERSION_HEX >= 0x30A00B1
+ #    define GREENLET_PY310 1
++#else
++#    define GREENLET_PY310 0
++#endif
++
+ /*
+ Python 3.10 beta 1 changed tstate->use_tracing to a nested cframe member.
+ See https://github.com/python/cpython/pull/25276
+ We have to save and restore this as well.
++
++Python 3.13 removed PyThreadState.cframe (GH-108035).
+ */
++#if GREENLET_PY310 && PY_VERSION_HEX < 0x30D0000
+ #    define GREENLET_USE_CFRAME 1
+ #else
+ #    define GREENLET_USE_CFRAME 0
+-#    define GREENLET_PY310 0
+ #endif
+ 
+ 
+-
+ #if PY_VERSION_HEX >= 0x30B00A4
+ /*
+ Greenlet won't compile on anything older than Python 3.11 alpha 4 (see
+@@ -124,4 +129,8 @@ static inline void PyThreadState_LeaveTracing(PyThreadState *tstate)
+ }
+ #endif
+ 
++#if !defined(Py_C_RECURSION_LIMIT) && defined(C_RECURSION_LIMIT)
++#  define Py_C_RECURSION_LIMIT C_RECURSION_LIMIT
++#endif
++
+ #endif /* GREENLET_CPYTHON_COMPAT_H */
+diff --git a/src/greenlet/greenlet_greenlet.hpp b/src/greenlet/greenlet_greenlet.hpp
+index d52ce1fd..6da6841f 100644
+--- a/src/greenlet/greenlet_greenlet.hpp
++++ b/src/greenlet/greenlet_greenlet.hpp
+@@ -23,6 +23,7 @@ using greenlet::refs::BorrowedGreenlet;
+ #endif
+ 
+ #if GREENLET_PY312
++#  define Py_BUILD_CORE
+ #  include "internal/pycore_frame.h"
+ #endif
+ 
+
+From 00611d7567d09869973fe314f60575674cc877d8 Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Mon, 3 Jun 2024 10:55:14 +0200
+Subject: [PATCH 3/5] Support delete_later
+
+---
+ src/greenlet/TPythonState.cpp            | 14 ++++++++++++--
+ src/greenlet/greenlet.cpp                |  4 ++++
+ src/greenlet/greenlet_cpython_compat.hpp |  6 ++++++
+ src/greenlet/greenlet_greenlet.hpp       |  4 ++++
+ 4 files changed, 26 insertions(+), 2 deletions(-)
+
+diff --git a/src/greenlet/TPythonState.cpp b/src/greenlet/TPythonState.cpp
+index c0dbf703..bfb40cac 100644
+--- a/src/greenlet/TPythonState.cpp
++++ b/src/greenlet/TPythonState.cpp
+@@ -18,7 +18,11 @@ PythonState::PythonState()
+ #else
+     ,recursion_depth(0)
+ #endif
++#if GREENLET_PY313
++    ,delete_later(nullptr)
++#else
+     ,trash_delete_nesting(0)
++#endif
+ #if GREENLET_PY311
+     ,current_frame(nullptr)
+     ,datastack_chunk(nullptr)
+@@ -145,7 +149,9 @@ void PythonState::operator<<(const PyThreadState *const tstate) noexcept
+     Py_XDECREF(frame);  // PyThreadState_GetFrame gives us a new
+                         // reference.
+     this->_top_frame.steal(frame);
+-  #if GREENLET_PY312
++  #if GREENLET_PY313
++    this->delete_later = Py_XNewRef(tstate->delete_later);
++  #elif GREENLET_PY312
+     this->trash_delete_nesting = tstate->trash.delete_nesting;
+   #else // not 312
+     this->trash_delete_nesting = tstate->trash_delete_nesting;
+@@ -213,7 +219,11 @@ void PythonState::operator>>(PyThreadState *const tstate) noexcept
+     tstate->datastack_top = this->datastack_top;
+     tstate->datastack_limit = this->datastack_limit;
+     this->_top_frame.relinquish_ownership();
+-  #if GREENLET_PY312
++  #if GREENLET_PY313
++    Py_XDECREF(tstate->delete_later);
++    tstate->delete_later = this->delete_later;
++    Py_CLEAR(this->delete_later);
++  #elif GREENLET_PY312
+     tstate->trash.delete_nesting = this->trash_delete_nesting;
+   #else // not 3.12
+     tstate->trash_delete_nesting = this->trash_delete_nesting;
+diff --git a/src/greenlet/greenlet.cpp b/src/greenlet/greenlet.cpp
+index 5a9818e8..dfc748a8 100644
+--- a/src/greenlet/greenlet.cpp
++++ b/src/greenlet/greenlet.cpp
+@@ -1328,6 +1328,7 @@ mod_enable_optional_cleanup(PyObject* UNUSED(module), PyObject* flag)
+     Py_RETURN_NONE;
+ }
+ 
++#if !GREENLET_PY313
+ PyDoc_STRVAR(mod_get_tstate_trash_delete_nesting_doc,
+              "get_tstate_trash_delete_nesting() -> Integer\n"
+              "\n"
+@@ -1343,6 +1344,7 @@ mod_get_tstate_trash_delete_nesting(PyObject* UNUSED(module))
+     return PyLong_FromLong(tstate->trash_delete_nesting);
+ #endif
+ }
++#endif
+ 
+ static PyMethodDef GreenMethods[] = {
+     {"getcurrent",
+@@ -1356,7 +1358,9 @@ static PyMethodDef GreenMethods[] = {
+     {"get_total_main_greenlets", (PyCFunction)mod_get_total_main_greenlets, METH_NOARGS, mod_get_total_main_greenlets_doc},
+     {"get_clocks_used_doing_optional_cleanup", (PyCFunction)mod_get_clocks_used_doing_optional_cleanup, METH_NOARGS, mod_get_clocks_used_doing_optional_cleanup_doc},
+     {"enable_optional_cleanup", (PyCFunction)mod_enable_optional_cleanup, METH_O, mod_enable_optional_cleanup_doc},
++#if !GREENLET_PY313
+     {"get_tstate_trash_delete_nesting", (PyCFunction)mod_get_tstate_trash_delete_nesting, METH_NOARGS, mod_get_tstate_trash_delete_nesting_doc},
++#endif
+     {NULL, NULL} /* Sentinel */
+ };
+ 
+diff --git a/src/greenlet/greenlet_cpython_compat.hpp b/src/greenlet/greenlet_cpython_compat.hpp
+index c0fb94c5..ce5fd882 100644
+--- a/src/greenlet/greenlet_cpython_compat.hpp
++++ b/src/greenlet/greenlet_cpython_compat.hpp
+@@ -55,6 +55,12 @@ Greenlet won't compile on anything older than Python 3.11 alpha 4 (see
+ #    define GREENLET_PY312 0
+ #endif
+ 
++#if PY_VERSION_HEX >= 0x30D0000
++#    define GREENLET_PY313 1
++#else
++#    define GREENLET_PY313 0
++#endif
++
+ #ifndef Py_SET_REFCNT
+ /* Py_REFCNT and Py_SIZE macros are converted to functions
+ https://bugs.python.org/issue39573 */
+diff --git a/src/greenlet/greenlet_greenlet.hpp b/src/greenlet/greenlet_greenlet.hpp
+index 6da6841f..fbfdfbfc 100644
+--- a/src/greenlet/greenlet_greenlet.hpp
++++ b/src/greenlet/greenlet_greenlet.hpp
+@@ -111,7 +111,11 @@ namespace greenlet
+ #else
+         int recursion_depth;
+ #endif
++#if GREENLET_PY313
++        PyObject *delete_later;
++#else
+         int trash_delete_nesting;
++#endif
+ #if GREENLET_PY311
+         _PyInterpreterFrame* current_frame;
+         _PyStackChunk* datastack_chunk;
+
+From b65558ec962d3d81ae09787ebca8686d233e2a4c Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Wed, 5 Jun 2024 12:04:21 +0200
+Subject: [PATCH 4/5] Fix current_frame
+
+---
+ src/greenlet/TPythonState.cpp | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/src/greenlet/TPythonState.cpp b/src/greenlet/TPythonState.cpp
+index bfb40cac..82eb34f0 100644
+--- a/src/greenlet/TPythonState.cpp
++++ b/src/greenlet/TPythonState.cpp
+@@ -138,7 +138,9 @@ void PythonState::operator<<(const PyThreadState *const tstate) noexcept
+   #else // not 312
+     this->recursion_depth = tstate->recursion_limit - tstate->recursion_remaining;
+   #endif // GREENLET_PY312
+-  #if GREENLET_USE_CFRAME
++  #if GREENLET_PY313
++    this->current_frame = tstate->current_frame;
++  #elif GREENLET_USE_CFRAME
+     this->current_frame = tstate->cframe->current_frame;
+   #endif
+     this->datastack_chunk = tstate->datastack_chunk;
+@@ -212,7 +214,9 @@ void PythonState::operator>>(PyThreadState *const tstate) noexcept
+   #else // \/ 3.11
+     tstate->recursion_remaining = tstate->recursion_limit - this->recursion_depth;
+   #endif // GREENLET_PY312
+-  #if GREENLET_USE_CFRAME
++  #if GREENLET_PY313
++    tstate->current_frame = this->current_frame;
++  #elif GREENLET_USE_CFRAME
+     tstate->cframe->current_frame = this->current_frame;
+   #endif
+     tstate->datastack_chunk = this->datastack_chunk;
+
+From b7cfc1748766cac351fe5fca32fa7c8cacdea2ae Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Wed, 5 Jun 2024 12:17:28 +0200
+Subject: [PATCH 5/5] Update tests
+
+---
+ src/greenlet/tests/test_greenlet.py       | 4 +++-
+ src/greenlet/tests/test_greenlet_trash.py | 9 +++++++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/greenlet/tests/test_greenlet.py b/src/greenlet/tests/test_greenlet.py
+index 51849cd6..259707ae 100644
+--- a/src/greenlet/tests/test_greenlet.py
++++ b/src/greenlet/tests/test_greenlet.py
+@@ -471,7 +471,9 @@ def creator():
+         # Unfortunately, this doesn't actually clear the references, they're in the
+         # fast local array.
+         if not wait_for_cleanup:
+-            result[0].gr_frame.f_locals.clear()
++            # f_locals has no clear method in Python 3.13
++            if hasattr(result[0].gr_frame.f_locals, 'clear'):
++                result[0].gr_frame.f_locals.clear()
+         else:
+             self.assertIsNone(result[0].gr_frame)
+ 
+diff --git a/src/greenlet/tests/test_greenlet_trash.py b/src/greenlet/tests/test_greenlet_trash.py
+index 8d9716e9..2bce8fd0 100644
+--- a/src/greenlet/tests/test_greenlet_trash.py
++++ b/src/greenlet/tests/test_greenlet_trash.py
+@@ -29,8 +29,17 @@
+ 
+ import unittest
+ 
++try:
++    from greenlet._greenlet import get_tstate_trash_delete_nesting
++except ImportError:
++    get_tstate_trash_delete_nesting = None
++
++
+ class TestTrashCanReEnter(unittest.TestCase):
+ 
++    # Python 3.13 has not "trash delete nesting" anymore (but "delete later")
++    @unittest.skipIf(get_tstate_trash_delete_nesting is None,
++                     'need get_tstate_trash_delete_nesting()')
+     def test_it(self):
+         # Try several times to trigger it, because it isn't 100%
+         # reliable.
diff --git a/pkgs/development/python-modules/grpcio-channelz/default.nix b/pkgs/development/python-modules/grpcio-channelz/default.nix
index 9291bd5f14e03..3cbe396683af8 100644
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   fetchPypi,
   grpcio,
   protobuf,
@@ -17,7 +16,6 @@ buildPythonPackage rec {
     hash = "sha256-bkrCxD12skXF9m2Y9SPbCHhrGGEoplXubyCjCn5o5Pk=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "grpcio" ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index c71c63fce021b..bd6c1420787e0 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   fetchPypi,
   grpcio,
   protobuf,
@@ -22,7 +21,6 @@ buildPythonPackage rec {
     protobuf
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "grpcio" ];
 
   pythonImportsCheck = [ "grpc_health" ];
diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index 4699a09a33430..fbd55ab239217 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   grpcio,
   protobuf,
 }:
@@ -17,7 +16,6 @@ buildPythonPackage rec {
     hash = "sha256-LdRIBtaNAAZjZSm9pXMBKxmkIoFHjC0FHNquu5HiUWw=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "grpcio" ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index 263e57ed8f3a4..ac4201c23a0f1 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -5,7 +5,6 @@
   grpcio,
   protobuf,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
diff --git a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
index 40c61f8a7dc99..32024f892556b 100644
--- a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
+++ b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
@@ -8,7 +8,6 @@
   pyaml,
   pydantic,
   pythonOlder,
-  pythonRelaxDepsHook,
   thelogrus,
 }:
 
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     gitlike-commands
diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index 8b9f883ce54c7..62ccb7ef91d02 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -14,7 +14,6 @@
   pytest-timeout,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   snitun,
   syrupy,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "acme" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/hdate/default.nix b/pkgs/development/python-modules/hdate/default.nix
index 214aa83fbbc06..0c70c51250e99 100644
--- a/pkgs/development/python-modules/hdate/default.nix
+++ b/pkgs/development/python-modules/hdate/default.nix
@@ -30,7 +30,6 @@ buildPythonPackage rec {
 
   build-system = [
     pdm-backend
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/hdbscan/default.nix b/pkgs/development/python-modules/hdbscan/default.nix
index 77b3f348d001e..9db9ac5f37d2d 100644
--- a/pkgs/development/python-modules/hdbscan/default.nix
+++ b/pkgs/development/python-modules/hdbscan/default.nix
@@ -9,7 +9,6 @@
   fetchPypi,
   joblib,
   six,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [ "cython" ];
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     cython
   ];
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hikari/default.nix b/pkgs/development/python-modules/hikari/default.nix
index 5b538536c9848..dd93357e5375b 100644
--- a/pkgs/development/python-modules/hikari/default.nix
+++ b/pkgs/development/python-modules/hikari/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytest-runner,
   aiohttp,
   attrs,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
     '';
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/hologram/default.nix b/pkgs/development/python-modules/hologram/default.nix
index 17e7b62e1f638..bedeb1f17dfbb 100644
--- a/pkgs/development/python-modules/hologram/default.nix
+++ b/pkgs/development/python-modules/hologram/default.nix
@@ -6,7 +6,6 @@
   jsonschema,
   pytestCheckHook,
   python-dateutil,
-  pythonRelaxDepsHook,
   setuptools,
   wheel,
 }:
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     wheel
   ];
diff --git a/pkgs/development/python-modules/httpbin/default.nix b/pkgs/development/python-modules/httpbin/default.nix
index 869077cdd6e60..a4e867d981716 100644
--- a/pkgs/development/python-modules/httpbin/default.nix
+++ b/pkgs/development/python-modules/httpbin/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "greenlet" ];
diff --git a/pkgs/development/python-modules/icalevents/default.nix b/pkgs/development/python-modules/icalevents/default.nix
index 26c62a1233e17..7cbffd265e8f2 100644
--- a/pkgs/development/python-modules/icalevents/default.nix
+++ b/pkgs/development/python-modules/icalevents/default.nix
@@ -5,7 +5,6 @@
   pythonOlder,
   pytestCheckHook,
   poetry-core,
-  pythonRelaxDepsHook,
   datetime,
   httplib2,
   icalendar,
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/instructor/default.nix b/pkgs/development/python-modules/instructor/default.nix
index bb36e7a8abf21..0583c19083e26 100644
--- a/pkgs/development/python-modules/instructor/default.nix
+++ b/pkgs/development/python-modules/instructor/default.nix
@@ -15,7 +15,6 @@
   diskcache,
   redis,
   pythonOlder,
-  pythonRelaxDepsHook,
   rich,
   tenacity,
   typer,
@@ -42,7 +41,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/intensity-normalization/default.nix b/pkgs/development/python-modules/intensity-normalization/default.nix
index a6f697ef8c286..f6c38f32cad61 100644
--- a/pkgs/development/python-modules/intensity-normalization/default.nix
+++ b/pkgs/development/python-modules/intensity-normalization/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   pythonOlder,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   matplotlib,
   nibabel,
   numpy,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
     substituteInPlace setup.cfg --replace "pytest-runner" ""
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "nibabel" ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ipwhois/default.nix b/pkgs/development/python-modules/ipwhois/default.nix
index 43495abeb0524..bd69e5ccd5147 100644
--- a/pkgs/development/python-modules/ipwhois/default.nix
+++ b/pkgs/development/python-modules/ipwhois/default.nix
@@ -9,7 +9,6 @@
   libredirect,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -41,7 +40,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "dnspython" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/jaxtyping/default.nix b/pkgs/development/python-modules/jaxtyping/default.nix
index 298ae13d50822..d8548ce27ae54 100644
--- a/pkgs/development/python-modules/jaxtyping/default.nix
+++ b/pkgs/development/python-modules/jaxtyping/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   hatchling,
-  pythonRelaxDepsHook,
   numpy,
   typeguard,
   typing-extensions,
@@ -35,7 +34,6 @@ let
 
     nativeBuildInputs = [
       hatchling
-      pythonRelaxDepsHook
     ];
 
     propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index ba8f7048c5b6b..da220641dbe21 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   python,
+  pythonAtLeast,
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
@@ -44,6 +45,14 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ] ++ passthru.optional-dependencies.i18n;
 
+  disabledTests = lib.optionals (pythonAtLeast "3.13") [
+    # https://github.com/pallets/jinja/issues/1900
+    "test_custom_async_iteratable_filter"
+    "test_first"
+    "test_loop_errors"
+    "test_package_zip_list"
+  ];
+
   passthru.doc = stdenv.mkDerivation {
     # Forge look and feel of multi-output derivation as best as we can.
     #
diff --git a/pkgs/development/python-modules/jiwer/default.nix b/pkgs/development/python-modules/jiwer/default.nix
index 6d4fb7d8c971b..0d200572a7e27 100644
--- a/pkgs/development/python-modules/jiwer/default.nix
+++ b/pkgs/development/python-modules/jiwer/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   rapidfuzz,
   click,
   pythonOlder,
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/json-schema-for-humans/default.nix b/pkgs/development/python-modules/json-schema-for-humans/default.nix
index 6b976adc6b1ed..7d6912cc4a0f5 100644
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@@ -12,7 +12,6 @@
   pygments,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   pyyaml,
   requests,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     click
diff --git a/pkgs/development/python-modules/jsonconversion/default.nix b/pkgs/development/python-modules/jsonconversion/default.nix
index dc4e89d9fa993..ac068b224edcd 100644
--- a/pkgs/development/python-modules/jsonconversion/default.nix
+++ b/pkgs/development/python-modules/jsonconversion/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   pytestCheckHook,
   pdm-backend,
   numpy,
@@ -23,7 +22,6 @@ buildPythonPackage rec {
 
   build-system = [
     pdm-backend
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/jsonschema-path/default.nix b/pkgs/development/python-modules/jsonschema-path/default.nix
index 467c162ca5458..153c584047a96 100644
--- a/pkgs/development/python-modules/jsonschema-path/default.nix
+++ b/pkgs/development/python-modules/jsonschema-path/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   pathable,
   pyyaml,
   referencing,
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "referencing" ];
diff --git a/pkgs/development/python-modules/jsonschema-spec/default.nix b/pkgs/development/python-modules/jsonschema-spec/default.nix
index f79283fa51605..f424b6db46493 100644
--- a/pkgs/development/python-modules/jsonschema-spec/default.nix
+++ b/pkgs/development/python-modules/jsonschema-spec/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   # build
   poetry-core,
@@ -42,7 +41,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "referencing" ];
diff --git a/pkgs/development/python-modules/karton-dashboard/default.nix b/pkgs/development/python-modules/karton-dashboard/default.nix
index 96fba596da1ff..efbff71a3795c 100644
--- a/pkgs/development/python-modules/karton-dashboard/default.nix
+++ b/pkgs/development/python-modules/karton-dashboard/default.nix
@@ -8,7 +8,6 @@
   networkx,
   prometheus-client,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -32,7 +31,6 @@ buildPythonPackage rec {
     "prometheus-client"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     flask
diff --git a/pkgs/development/python-modules/kserve/default.nix b/pkgs/development/python-modules/kserve/default.nix
index 567467c7bf473..b8877b7a6462d 100644
--- a/pkgs/development/python-modules/kserve/default.nix
+++ b/pkgs/development/python-modules/kserve/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   deprecation,
   poetry-core,
-  pythonRelaxDepsHook,
   async-timeout,
   cloudevents,
   fastapi,
@@ -56,7 +55,6 @@ buildPythonPackage rec {
     poetry-core
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     async-timeout
diff --git a/pkgs/development/python-modules/kubernetes/default.nix b/pkgs/development/python-modules/kubernetes/default.nix
index 4f5eacab9d193..441eab61b2109 100644
--- a/pkgs/development/python-modules/kubernetes/default.nix
+++ b/pkgs/development/python-modules/kubernetes/default.nix
@@ -10,7 +10,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   requests-oauthlib,
@@ -42,7 +41,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "urllib3" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/labelbox/default.nix b/pkgs/development/python-modules/labelbox/default.nix
index 082ee58cbac36..7d44ac1bab703 100644
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@@ -16,7 +16,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   shapely,
@@ -49,7 +48,6 @@ buildPythonPackage rec {
       --replace-fail "pytest_plugins" "_pytest_plugins"
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "python-dateutil" ];
 
diff --git a/pkgs/development/python-modules/labgrid/default.nix b/pkgs/development/python-modules/labgrid/default.nix
index d677d59d2365b..6f67dad9bb686 100644
--- a/pkgs/development/python-modules/labgrid/default.nix
+++ b/pkgs/development/python-modules/labgrid/default.nix
@@ -15,7 +15,6 @@
   pytestCheckHook,
   pytest-dependency,
   pytest-mock,
-  pythonRelaxDepsHook,
   pyudev,
   pyusb,
   pyyaml,
@@ -38,7 +37,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     wheel
diff --git a/pkgs/development/python-modules/lacuscore/default.nix b/pkgs/development/python-modules/lacuscore/default.nix
index 37e1e76001b65..46bd61a18af58 100644
--- a/pkgs/development/python-modules/lacuscore/default.nix
+++ b/pkgs/development/python-modules/lacuscore/default.nix
@@ -10,7 +10,6 @@
   pythonOlder,
   redis,
   requests,
-  pythonRelaxDepsHook,
   sphinx,
   ua-parser,
 }:
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     async-timeout
diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index 954ddd477f4ae..880e38f22d0a1 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -15,7 +15,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   syrupy,
   tenacity,
@@ -45,7 +44,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     jsonpatch
diff --git a/pkgs/development/python-modules/langfuse/default.nix b/pkgs/development/python-modules/langfuse/default.nix
index ceff4e3ba26e3..812012cbdd348 100644
--- a/pkgs/development/python-modules/langfuse/default.nix
+++ b/pkgs/development/python-modules/langfuse/default.nix
@@ -11,7 +11,6 @@
   packaging,
   poetry-core,
   pydantic,
-  pythonRelaxDepsHook,
   wrapt,
 }:
 
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "packaging" ];
 
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index d86c96eb87ade..e1f9dfa32e042 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -16,7 +16,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   uvicorn,
 }:
@@ -41,8 +40,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-
   dependencies = [
     orjson
     pydantic
diff --git a/pkgs/development/python-modules/ledgerblue/default.nix b/pkgs/development/python-modules/ledgerblue/default.nix
index 0a1f6841d3909..5010d81530326 100644
--- a/pkgs/development/python-modules/ledgerblue/default.nix
+++ b/pkgs/development/python-modules/ledgerblue/default.nix
@@ -16,7 +16,6 @@
   python-gnupg,
   python-u2flib-host,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   setuptools-scm,
   websocket-client,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
   build-system = [
     setuptools
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "protobuf" ];
diff --git a/pkgs/development/python-modules/librespot/default.nix b/pkgs/development/python-modules/librespot/default.nix
index 7e6d2edb253bf..e2e98bc1e6edb 100644
--- a/pkgs/development/python-modules/librespot/default.nix
+++ b/pkgs/development/python-modules/librespot/default.nix
@@ -7,7 +7,6 @@
   pycryptodomex,
   pyogg,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   requests,
   websocket-client,
   zeroconf,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = true;
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     defusedxml
diff --git a/pkgs/development/python-modules/libretranslate/default.nix b/pkgs/development/python-modules/libretranslate/default.nix
index cc1e27a8db568..eae30cc7407d9 100644
--- a/pkgs/development/python-modules/libretranslate/default.nix
+++ b/pkgs/development/python-modules/libretranslate/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   pytestCheckHook,
   hatchling,
   argostranslate,
@@ -43,7 +42,6 @@ buildPythonPackage rec {
 
   build-system = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/linear-operator/default.nix b/pkgs/development/python-modules/linear-operator/default.nix
index 918a439c62799..ab402c37aa79b 100644
--- a/pkgs/development/python-modules/linear-operator/default.nix
+++ b/pkgs/development/python-modules/linear-operator/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   jaxtyping,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   scipy,
   setuptools,
   setuptools-scm,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     wheel
diff --git a/pkgs/development/python-modules/llama-index-agent-openai/default.nix b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
index 7cd5fb8241c94..6073a4e60427b 100644
--- a/pkgs/development/python-modules/llama-index-agent-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
@@ -6,7 +6,6 @@
   llama-index-llms-openai,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
index 3bd7ddbef4601..05558eb389421 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
@@ -6,7 +6,6 @@
   llama-index-core,
   poetry-core,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
 }:
 
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     google-generativeai
diff --git a/pkgs/development/python-modules/llama-index-embeddings-google/default.nix b/pkgs/development/python-modules/llama-index-embeddings-google/default.nix
index 87ed37e9601da..f848acf1fd42f 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-google/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-google/default.nix
@@ -6,7 +6,6 @@
   llama-index-core,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     google-generativeai
diff --git a/pkgs/development/python-modules/llama-index-program-openai/default.nix b/pkgs/development/python-modules/llama-index-program-openai/default.nix
index c3c181855218a..e542c0f8a4e63 100644
--- a/pkgs/development/python-modules/llama-index-program-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-program-openai/default.nix
@@ -7,7 +7,6 @@
   llama-index-llms-openai,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     llama-index-agent-openai
diff --git a/pkgs/development/python-modules/llama-index-readers-file/default.nix b/pkgs/development/python-modules/llama-index-readers-file/default.nix
index 95045b4d31546..4e96733d29b70 100644
--- a/pkgs/development/python-modules/llama-index-readers-file/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-file/default.nix
@@ -8,7 +8,6 @@
   pymupdf,
   pypdf,
   pythonOlder,
-  pythonRelaxDepsHook,
   striprtf,
 }:
 
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     beautifulsoup4
diff --git a/pkgs/development/python-modules/llama-index-readers-llama-parse/default.nix b/pkgs/development/python-modules/llama-index-readers-llama-parse/default.nix
index 1db6422158833..575c703b795f3 100644
--- a/pkgs/development/python-modules/llama-index-readers-llama-parse/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-llama-parse/default.nix
@@ -6,7 +6,6 @@
   llama-parse,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-google/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-google/default.nix
index 47a74e8a97100..fcf3e0fa9742c 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-google/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-google/default.nix
@@ -6,7 +6,6 @@
   llama-index-core,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
index 63e8b5d9992d0..078e7a7b3d597 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
@@ -7,7 +7,6 @@
   pgvector,
   poetry-core,
   psycopg2,
-  pythonRelaxDepsHook,
   pythonOlder,
 }:
 
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/lsassy/default.nix b/pkgs/development/python-modules/lsassy/default.nix
index 8123a9967e22c..27bfd2092388e 100644
--- a/pkgs/development/python-modules/lsassy/default.nix
+++ b/pkgs/development/python-modules/lsassy/default.nix
@@ -7,7 +7,6 @@
   poetry-core,
   pypykatz,
   pythonOlder,
-  pythonRelaxDepsHook,
   rich,
 }:
 
@@ -31,7 +30,6 @@ buildPythonPackage rec {
     "rich"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ poetry-core ];
 
diff --git a/pkgs/development/python-modules/maison/default.nix b/pkgs/development/python-modules/maison/default.nix
index c37ce359ef90f..4b94862ce3324 100644
--- a/pkgs/development/python-modules/maison/default.nix
+++ b/pkgs/development/python-modules/maison/default.nix
@@ -7,7 +7,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   toml,
 }:
 
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/makefun/default.nix b/pkgs/development/python-modules/makefun/default.nix
index ab3428b502e6a..ece4f85008c67 100644
--- a/pkgs/development/python-modules/makefun/default.nix
+++ b/pkgs/development/python-modules/makefun/default.nix
@@ -2,6 +2,7 @@
   lib,
   fetchPypi,
   buildPythonPackage,
+  pythonAtLeast,
 
   # build-system
   setuptools,
@@ -33,6 +34,11 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/smarie/python-makefun/issues/102
+    "test_args_order_and_kind"
+  ];
+
   pythonImportsCheck = [ "makefun" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/mandown/default.nix b/pkgs/development/python-modules/mandown/default.nix
index 1b7361b952ffb..988537b384433 100644
--- a/pkgs/development/python-modules/mandown/default.nix
+++ b/pkgs/development/python-modules/mandown/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   beautifulsoup4,
   comicon,
   feedparser,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/manifest-ml/default.nix b/pkgs/development/python-modules/manifest-ml/default.nix
index 8b1dcaf5a090a..7eeec2a60fee1 100644
--- a/pkgs/development/python-modules/manifest-ml/default.nix
+++ b/pkgs/development/python-modules/manifest-ml/default.nix
@@ -12,7 +12,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   redis,
   requests,
   sentence-transformers,
@@ -46,7 +45,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pydantic" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/manim-slides/default.nix b/pkgs/development/python-modules/manim-slides/default.nix
index b8b236238ab53..bea3fde4407e4 100644
--- a/pkgs/development/python-modules/manim-slides/default.nix
+++ b/pkgs/development/python-modules/manim-slides/default.nix
@@ -5,7 +5,6 @@
   pythonOlder,
 
   hatchling,
-  pythonRelaxDepsHook,
   manim,
   ffmpeg,
 
@@ -49,7 +48,6 @@ buildPythonPackage rec {
 
   build-system = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [ "opencv-python" ];
diff --git a/pkgs/development/python-modules/manim/default.nix b/pkgs/development/python-modules/manim/default.nix
index 69aee1f41c3df..545f9df3c5a54 100644
--- a/pkgs/development/python-modules/manim/default.nix
+++ b/pkgs/development/python-modules/manim/default.nix
@@ -6,7 +6,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   cairo,
   ffmpeg,
@@ -191,7 +190,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/markdown-it-py/default.nix b/pkgs/development/python-modules/markdown-it-py/default.nix
index f64d415aa76b9..1754ec45b76e7 100644
--- a/pkgs/development/python-modules/markdown-it-py/default.nix
+++ b/pkgs/development/python-modules/markdown-it-py/default.nix
@@ -21,7 +21,6 @@
   stdenv,
   pytest-regressions,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
 }:
 
@@ -43,7 +42,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "linkify-it-py" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     flit-core
   ];
 
diff --git a/pkgs/development/python-modules/material-color-utilities/default.nix b/pkgs/development/python-modules/material-color-utilities/default.nix
index 527d86a6bbde5..527726401f82b 100644
--- a/pkgs/development/python-modules/material-color-utilities/default.nix
+++ b/pkgs/development/python-modules/material-color-utilities/default.nix
@@ -3,7 +3,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   pillow,
   regex,
 }:
@@ -17,7 +16,6 @@ buildPythonPackage rec {
     sha256 = "sha256-PG8C585wWViFRHve83z3b9NijHyV+iGY2BdMJpyVH64=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "Pillow" ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index c0efd43bdcad1..b82880c3694a4 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchPypi,
-  writeText,
   buildPythonPackage,
   isPyPy,
   pythonOlder,
@@ -11,12 +10,22 @@
   certifi,
   pkg-config,
   pybind11,
-  setuptools,
+  meson-python,
   setuptools-scm,
+  pytestCheckHook,
+  python,
+  matplotlib,
+  fetchurl,
 
   # native libraries
   ffmpeg-headless,
   freetype,
+  # By default, almost all tests fail due to the fact we use our version of
+  # freetype. We still define use this argument to define the overriden
+  # derivation `matplotlib.passthru.tests.withoutOutdatedFreetype` - which
+  # builds matplotlib with the freetype version they default to, with which all
+  # tests should pass.
+  doCheck ? false,
   qhull,
 
   # propagates
@@ -80,7 +89,7 @@ let
 in
 
 buildPythonPackage rec {
-  version = "3.8.4";
+  version = "3.9.0";
   pname = "matplotlib";
   pyproject = true;
 
@@ -88,7 +97,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iqw5fV6ewViWDjHDgcX/xS3dUr2aR3F+KmlAOBZ9/+o=";
+    hash = "sha256-5tKepsGeNLMPt9iLcIH4aaAwFPZv4G1izHfVpuqI7Xo=";
   };
 
   env.XDG_RUNTIME_DIR = "/tmp";
@@ -100,21 +109,16 @@ buildPythonPackage rec {
   # With the following patch we just hard-code these paths into the install
   # script.
   postPatch =
-    let
-      tcl_tk_cache = ''"${tk}/lib", "${tcl}/lib", "${lib.strings.substring 0 3 tk.version}"'';
-    in
     ''
       substituteInPlace pyproject.toml \
         --replace-fail '"numpy>=2.0.0rc1,<2.3",' ""
-    ''
-    + lib.optionalString enableTk ''
-      sed -i '/self.tcl_tk_cache = None/s|None|${tcl_tk_cache}|' setupext.py
+      patchShebangs tools
     ''
     + lib.optionalString (stdenv.isLinux && interactive) ''
       # fix paths to libraries in dlopen calls (headless detection)
-      substituteInPlace src/_c_internal_utils.c \
-        --replace libX11.so.6 ${libX11}/lib/libX11.so.6 \
-        --replace libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
+      substituteInPlace src/_c_internal_utils.cpp \
+        --replace-fail libX11.so.6 ${libX11}/lib/libX11.so.6 \
+        --replace-fail libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
     '';
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals enableGtk3 [ gobject-introspection ];
@@ -144,7 +148,7 @@ buildPythonPackage rec {
     certifi
     numpy
     pybind11
-    setuptools
+    meson-python
     setuptools-scm
   ];
 
@@ -171,29 +175,45 @@ buildPythonPackage rec {
     ++ lib.optionals enableNbagg [ ipykernel ]
     ++ lib.optionals enableTk [ tkinter ];
 
-  passthru.config = {
-    directories = {
-      basedirlist = ".";
-    };
-    libs = {
-      system_freetype = true;
-      system_qhull = true;
-      # LTO not working in darwin stdenv, see #19312
-      enable_lto = !stdenv.isDarwin;
-    };
+  mesonFlags = lib.mapAttrsToList lib.mesonBool {
+    system-freetype = true;
+    system-qhull = true;
+    # Otherwise GNU's `ar` binary fails to put symbols from libagg into the
+    # matplotlib shared objects. See:
+    # -https://github.com/matplotlib/matplotlib/issues/28260#issuecomment-2146243663
+    # -https://github.com/matplotlib/matplotlib/issues/28357#issuecomment-2155350739
+    b_lto = false;
   };
 
   passthru.tests = {
     inherit sage;
+    withOutdatedFreetype = matplotlib.override {
+      doCheck = true;
+      freetype = freetype.overrideAttrs (_: {
+        src = fetchurl {
+          url = "https://download.savannah.gnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz";
+          sha256 = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
+        };
+        patches = [ ];
+      });
+    };
   };
 
-  env.MPLSETUPCFG = writeText "mplsetup.cfg" (lib.generators.toINI { } passthru.config);
-
-  # Encountering a ModuleNotFoundError, as describved and investigated at:
-  # https://github.com/NixOS/nixpkgs/issues/255262 . It could be that some of
-  # which may fail due to a freetype version that doesn't match the freetype
-  # version used by upstream.
-  doCheck = false;
+  pythonImportsCheck = [ "matplotlib" ];
+  inherit doCheck;
+  nativeCheckInputs = [ pytestCheckHook ];
+  preCheck = ''
+    # https://matplotlib.org/devdocs/devel/testing.html#obtain-the-reference-images
+    find lib -name baseline_images -printf '%P\n' | while read p; do
+      cp -r lib/"$p" $out/${python.sitePackages}/"$p"
+    done
+    # Tests will fail without these files as well
+    cp \
+      lib/matplotlib/tests/{mpltest.ttf,cmr10.pfb,Courier10PitchBT-Bold.pfb} \
+      $out/${python.sitePackages}/matplotlib/tests/
+    # https://github.com/NixOS/nixpkgs/issues/255262
+    cd $out
+  '';
 
   meta = with lib; {
     description = "Python plotting library, making publication quality plots";
diff --git a/pkgs/development/python-modules/meteofrance-api/default.nix b/pkgs/development/python-modules/meteofrance-api/default.nix
index 3b1d5e2b95b55..89cdc0735ea5c 100644
--- a/pkgs/development/python-modules/meteofrance-api/default.nix
+++ b/pkgs/development/python-modules/meteofrance-api/default.nix
@@ -5,7 +5,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   requests,
   requests-mock,
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "urllib3" ];
diff --git a/pkgs/development/python-modules/miauth/default.nix b/pkgs/development/python-modules/miauth/default.nix
index 7ebf4124dcc41..775a836375fcf 100644
--- a/pkgs/development/python-modules/miauth/default.nix
+++ b/pkgs/development/python-modules/miauth/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "cryptography" ];
diff --git a/pkgs/development/python-modules/mido/default.nix b/pkgs/development/python-modules/mido/default.nix
index 90ed0fb4cf485..270604f782ea8 100644
--- a/pkgs/development/python-modules/mido/default.nix
+++ b/pkgs/development/python-modules/mido/default.nix
@@ -8,7 +8,6 @@
   # build-system
   setuptools,
   setuptools-scm,
-  pythonRelaxDepsHook,
 
   # dependencies
   packaging,
@@ -49,7 +48,6 @@ buildPythonPackage rec {
   build-system = [
     setuptools
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "packaging" ];
diff --git a/pkgs/development/python-modules/minichain/default.nix b/pkgs/development/python-modules/minichain/default.nix
index 61792c468925a..5109a0136bde8 100644
--- a/pkgs/development/python-modules/minichain/default.nix
+++ b/pkgs/development/python-modules/minichain/default.nix
@@ -9,7 +9,6 @@
   openai,
   pytestCheckHook,
   pythonAtLeast,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -32,7 +31,6 @@ buildPythonPackage rec {
     substituteInPlace ./minichain/__init__.py --replace "from .gradio import GradioConf, show" ""
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [
     # Only used in the examples:
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 0a6864daea63b..032ad1ca8f474 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   buildPythonPackage,
   pythonOlder,
-  pythonRelaxDepsHook,
   # Mitmproxy requirements
   aioquic,
   asgiref,
@@ -58,7 +57,6 @@ buildPythonPackage rec {
     hash = "sha256-rIyRY1FolbdoaI4OgFG7D2/mot8NiRHalgittPzledw=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [
     "aioquic"
diff --git a/pkgs/development/python-modules/mkdocs-jupyter/default.nix b/pkgs/development/python-modules/mkdocs-jupyter/default.nix
index 9573329d6b593..49e6102ec30a4 100644
--- a/pkgs/development/python-modules/mkdocs-jupyter/default.nix
+++ b/pkgs/development/python-modules/mkdocs-jupyter/default.nix
@@ -11,7 +11,6 @@
   pygments,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index 7ee9df1c26a7e..1cfec0073a698 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -23,7 +23,6 @@
   protobuf,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyarrow,
   pytz,
   pyyaml,
@@ -53,7 +52,6 @@ buildPythonPackage rec {
   # This seems quite unprincipled especially with tests not being enabled,
   # but not mlflow has a 'skinny' install option which does not require `shap`.
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
   pythonRemoveDeps = [ "shap" ];
diff --git a/pkgs/development/python-modules/mobi/default.nix b/pkgs/development/python-modules/mobi/default.nix
index c4f3af961ca31..82065268cfeb5 100644
--- a/pkgs/development/python-modules/mobi/default.nix
+++ b/pkgs/development/python-modules/mobi/default.nix
@@ -5,7 +5,6 @@
   loguru,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/moddb/default.nix b/pkgs/development/python-modules/moddb/default.nix
index 2846ef2d7a317..17af65e37a206 100644
--- a/pkgs/development/python-modules/moddb/default.nix
+++ b/pkgs/development/python-modules/moddb/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   beautifulsoup4,
   pyrate-limiter,
   requests,
@@ -21,7 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-2t5QQAmSLOrdNCl0XdsFPdP2UF10/qq69DovqeQ1Vt8=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     beautifulsoup4
diff --git a/pkgs/development/python-modules/model-checker/default.nix b/pkgs/development/python-modules/model-checker/default.nix
index a525adad59471..e8472d3233e5e 100644
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@@ -5,7 +5,6 @@
   setuptools,
   pythonOlder,
   z3-solver,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [ z3-solver ];
 
diff --git a/pkgs/development/python-modules/moderngl-window/default.nix b/pkgs/development/python-modules/moderngl-window/default.nix
index 90e07d12178d9..8042df62a5f9f 100644
--- a/pkgs/development/python-modules/moderngl-window/default.nix
+++ b/pkgs/development/python-modules/moderngl-window/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   setuptools,
   glfw,
   moderngl,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pillow" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/molbar/default.nix b/pkgs/development/python-modules/molbar/default.nix
index ada2c6cfb5350..f69bfb6f17c25 100644
--- a/pkgs/development/python-modules/molbar/default.nix
+++ b/pkgs/development/python-modules/molbar/default.nix
@@ -1,6 +1,5 @@
 { buildPythonPackage
 , python
-, pythonRelaxDepsHook
 , lib
 , gfortran
 , fetchgit
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     gfortran
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "networkx" ];
diff --git a/pkgs/development/python-modules/molecule/plugins.nix b/pkgs/development/python-modules/molecule/plugins.nix
index 8b7c5b8ffba5e..b87c3b121b546 100644
--- a/pkgs/development/python-modules/molecule/plugins.nix
+++ b/pkgs/development/python-modules/molecule/plugins.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools-scm,
   python-vagrant,
   docker,
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   pythonRemoveDeps = [ "molecule" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/mpris-server/default.nix b/pkgs/development/python-modules/mpris-server/default.nix
index 611ac8a2f864a..06383416d96ca 100644
--- a/pkgs/development/python-modules/mpris-server/default.nix
+++ b/pkgs/development/python-modules/mpris-server/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   fetchPypi,
   emoji,
   pydbus,
@@ -21,7 +20,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/mwcli/default.nix b/pkgs/development/python-modules/mwcli/default.nix
index 613a52bd8a675..adcc5ab1e34cc 100644
--- a/pkgs/development/python-modules/mwcli/default.nix
+++ b/pkgs/development/python-modules/mwcli/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   docopt,
   para,
 }:
@@ -20,7 +19,6 @@ buildPythonPackage rec {
   # Prevent circular dependency
   pythonRemoveDeps = [ "mwxml" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     docopt
diff --git a/pkgs/development/python-modules/myjwt/default.nix b/pkgs/development/python-modules/myjwt/default.nix
index 9f58f93f60ca6..e7c80a4801679 100644
--- a/pkgs/development/python-modules/myjwt/default.nix
+++ b/pkgs/development/python-modules/myjwt/default.nix
@@ -13,7 +13,6 @@
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   questionary,
   requests,
   requests-mock,
@@ -46,7 +45,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/mypy-protobuf/default.nix b/pkgs/development/python-modules/mypy-protobuf/default.nix
index 73e0a331799ad..0dca10652ac61 100644
--- a/pkgs/development/python-modules/mypy-protobuf/default.nix
+++ b/pkgs/development/python-modules/mypy-protobuf/default.nix
@@ -7,7 +7,6 @@
   protobuf,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   testers,
   types-protobuf,
@@ -25,7 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-AvJC6zQJ9miJ8rGjqlg1bsTZCc3Q+TEVYi6ecDZuyjw=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "protobuf" ];
 
diff --git a/pkgs/development/python-modules/myst-parser/default.nix b/pkgs/development/python-modules/myst-parser/default.nix
index bbf92943bf53b..7daa728c0c339 100644
--- a/pkgs/development/python-modules/myst-parser/default.nix
+++ b/pkgs/development/python-modules/myst-parser/default.nix
@@ -18,7 +18,6 @@
   pytest-regressions,
   sphinx-pytest,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -45,7 +44,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     flit-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nbdev/default.nix b/pkgs/development/python-modules/nbdev/default.nix
index e46087b9e5241..dc60601b7e6c1 100644
--- a/pkgs/development/python-modules/nbdev/default.nix
+++ b/pkgs/development/python-modules/nbdev/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools,
   ipywidgets,
   fastcore,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-MntVdZ6LazdFCm+h5FaTxvzEwCtoJjrW/EJPTt2fdnU=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "ipywidgets" ];
 
diff --git a/pkgs/development/python-modules/nbmake/default.nix b/pkgs/development/python-modules/nbmake/default.nix
index bb050d9b89afb..4c6d46e6d4706 100644
--- a/pkgs/development/python-modules/nbmake/default.nix
+++ b/pkgs/development/python-modules/nbmake/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   setuptools,
   wheel,
   ipykernel,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
     setuptools
     wheel
   ];
diff --git a/pkgs/development/python-modules/nethsm/default.nix b/pkgs/development/python-modules/nethsm/default.nix
index 5285d609d747a..77d25a7a1b1de 100644
--- a/pkgs/development/python-modules/nethsm/default.nix
+++ b/pkgs/development/python-modules/nethsm/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   flit-core,
   certifi,
   cryptography,
@@ -35,7 +34,6 @@ buildPythonPackage {
 
   nativeBuildInputs = [
     flit-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/netio/default.nix b/pkgs/development/python-modules/netio/default.nix
index bf33aa47ddc1d..305b177b82455 100644
--- a/pkgs/development/python-modules/netio/default.nix
+++ b/pkgs/development/python-modules/netio/default.nix
@@ -5,7 +5,6 @@
   poetry-core,
   pyopenssl,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pyopenssl" ];
diff --git a/pkgs/development/python-modules/niaaml/default.nix b/pkgs/development/python-modules/niaaml/default.nix
index 88bcb450fbf53..f3fe61fcb2d08 100644
--- a/pkgs/development/python-modules/niaaml/default.nix
+++ b/pkgs/development/python-modules/niaaml/default.nix
@@ -8,7 +8,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   scikit-learn,
   toml-adapt,
 }:
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
     toml-adapt
   ];
 
diff --git a/pkgs/development/python-modules/niaclass/default.nix b/pkgs/development/python-modules/niaclass/default.nix
index b4fa278bfa011..b9ba6558b78dc 100644
--- a/pkgs/development/python-modules/niaclass/default.nix
+++ b/pkgs/development/python-modules/niaclass/default.nix
@@ -8,7 +8,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   scikit-learn,
   toml-adapt,
 }:
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
     toml-adapt
   ];
 
diff --git a/pkgs/development/python-modules/nipype/default.nix b/pkgs/development/python-modules/nipype/default.nix
index c592b35c076b6..5ac5192eeb19d 100644
--- a/pkgs/development/python-modules/nipype/default.nix
+++ b/pkgs/development/python-modules/nipype/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   # python dependencies
   click,
   python-dateutil,
@@ -58,7 +57,6 @@ buildPythonPackage rec {
       --replace "/usr/bin/env bash" "${bash}/bin/bash"
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "traits" ];
 
diff --git a/pkgs/development/python-modules/nitransforms/default.nix b/pkgs/development/python-modules/nitransforms/default.nix
index 2729f23eab357..51f499d6ab17c 100644
--- a/pkgs/development/python-modules/nitransforms/default.nix
+++ b/pkgs/development/python-modules/nitransforms/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   h5py,
   nibabel,
   numpy,
@@ -23,7 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-Lty4aPzSlwRJSqCXeIVICF+gudYqto1OS4cVZyrB2nY=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   buildInputs = [
     setuptools-scm
     toml
diff --git a/pkgs/development/python-modules/norfair/default.nix b/pkgs/development/python-modules/norfair/default.nix
index 11afdd9533d06..c3c50cd13334d 100644
--- a/pkgs/development/python-modules/norfair/default.nix
+++ b/pkgs/development/python-modules/norfair/default.nix
@@ -11,7 +11,6 @@
   motmetrics,
   opencv4,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "rich" ];
diff --git a/pkgs/development/python-modules/notify-py/default.nix b/pkgs/development/python-modules/notify-py/default.nix
index a0c0b0b96aed4..87c3ae0ed27bd 100644
--- a/pkgs/development/python-modules/notify-py/default.nix
+++ b/pkgs/development/python-modules/notify-py/default.nix
@@ -9,7 +9,6 @@
   libnotify,
   which,
   poetry-core,
-  pythonRelaxDepsHook,
   jeepney,
   loguru,
   pytest,
@@ -50,7 +49,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "loguru" ];
diff --git a/pkgs/development/python-modules/notus-scanner/default.nix b/pkgs/development/python-modules/notus-scanner/default.nix
index 9d402201dcce9..afe74c20e94e4 100644
--- a/pkgs/development/python-modules/notus-scanner/default.nix
+++ b/pkgs/development/python-modules/notus-scanner/default.nix
@@ -8,7 +8,6 @@
   pytestCheckHook,
   python-gnupg,
   pythonOlder,
-  pythonRelaxDepsHook,
   sentry-sdk,
   tomli,
 }:
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     paho-mqtt
diff --git a/pkgs/development/python-modules/numba-scipy/default.nix b/pkgs/development/python-modules/numba-scipy/default.nix
index 0eae5c9a9b98e..c31f77f8517e4 100644
--- a/pkgs/development/python-modules/numba-scipy/default.nix
+++ b/pkgs/development/python-modules/numba-scipy/default.nix
@@ -7,7 +7,6 @@
   numba,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    pythonRelaxDepsHook
   ];
   pythonRelaxDeps = [
     "scipy"
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/1.nix
index f20bd095cf97f..f20bd095cf97f 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/1.nix
diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
new file mode 100644
index 0000000000000..6b52b7acec733
--- /dev/null
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -0,0 +1,180 @@
+{
+  lib,
+  stdenv,
+  fetchPypi,
+  python,
+  pythonAtLeast,
+  pythonOlder,
+  buildPythonPackage,
+  writeTextFile,
+
+  # build-system
+  cython,
+  gfortran,
+  meson-python,
+  mesonEmulatorHook,
+  pkg-config,
+  xcbuild,
+
+  # native dependencies
+  blas,
+  lapack,
+
+  # Reverse dependency
+  sage,
+
+  # tests
+  hypothesis,
+  pytest-xdist,
+  pytestCheckHook,
+  setuptools,
+  typing-extensions,
+}:
+
+assert (!blas.isILP64) && (!lapack.isILP64);
+
+let
+  cfg = writeTextFile {
+    name = "site.cfg";
+    text = lib.generators.toINI { } {
+      ${blas.implementation} = {
+        include_dirs = "${lib.getDev blas}/include:${lib.getDev lapack}/include";
+        library_dirs = "${blas}/lib:${lapack}/lib";
+        runtime_library_dirs = "${blas}/lib:${lapack}/lib";
+        libraries = "lapack,lapacke,blas,cblas";
+      };
+      lapack = {
+        include_dirs = "${lib.getDev lapack}/include";
+        library_dirs = "${lapack}/lib";
+        runtime_library_dirs = "${lapack}/lib";
+      };
+      blas = {
+        include_dirs = "${lib.getDev blas}/include";
+        library_dirs = "${blas}/lib";
+        runtime_library_dirs = "${blas}/lib";
+      };
+    };
+  };
+in
+buildPythonPackage rec {
+  pname = "numpy";
+  version = "2.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "tar.gz";
+    hash = "sha256-z10cnmg3+K+fkra9PobVE83BH2D9YhhcxJ7H0aujSGQ=";
+  };
+
+  patches = lib.optionals python.hasDistutilsCxxPatch [
+    # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
+    # Patching of numpy.distutils is needed to prevent it from undoing the
+    # patch to distutils.
+    ./numpy-distutils-C++.patch
+  ];
+
+  postPatch = ''
+    # remove needless reference to full Python path stored in built wheel
+    substituteInPlace numpy/meson.build \
+      --replace-fail 'py.full_path()' "'python'"
+  '';
+
+  build-system =
+    [
+      cython
+      gfortran
+      meson-python
+      pkg-config
+    ]
+    ++ lib.optionals stdenv.isDarwin [ xcbuild.xcrun ]
+    ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
+
+  # we default openblas to build with 64 threads
+  # if a machine has more than 64 threads, it will segfault
+  # see https://github.com/OpenMathLib/OpenBLAS/issues/2993
+  preConfigure = ''
+    sed -i 's/-faltivec//' numpy/distutils/system_info.py
+    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
+  '';
+
+  # HACK: copy mesonEmulatorHook's flags to the variable used by meson-python
+  postConfigure = ''
+    mesonFlags="$mesonFlags ''${mesonFlagsArray[@]}"
+  '';
+
+  buildInputs = [
+    blas
+    lapack
+  ];
+
+  preBuild = ''
+    ln -s ${cfg} site.cfg
+  '';
+
+  enableParallelBuilding = true;
+
+  nativeCheckInputs = [
+    hypothesis
+    pytestCheckHook
+    pytest-xdist
+    setuptools
+    typing-extensions
+  ];
+
+  preCheck = ''
+    pushd $out
+  '';
+
+  postCheck = ''
+    popd
+  '';
+
+  # https://github.com/numpy/numpy/blob/a277f6210739c11028f281b8495faf7da298dbef/numpy/_pytesttester.py#L180
+  pytestFlagsArray = [
+    "-m"
+    "not\\ slow" # fast test suite
+  ];
+
+  disabledTests =
+    lib.optionals (pythonAtLeast "3.13") [
+      # https://github.com/numpy/numpy/issues/26713
+      "test_iter_refcount"
+    ]
+    ++ lib.optionals stdenv.isAarch32 [
+      # https://github.com/numpy/numpy/issues/24548
+      "test_impossible_feature_enable" # AssertionError: Failed to generate error
+      "test_features" # AssertionError: Failure Detection
+      "test_new_policy" # AssertionError: assert False
+      "test_identityless_reduction_huge_array" # ValueError: Maximum allowed dimension exceeded
+      "test_unary_spurious_fpexception" # AssertionError: Got warnings: [<warnings.WarningMessage object at 0xd1197430>]
+      "test_int" # AssertionError: selectedintkind(19): expected 16 but got -1
+      "test_real" # AssertionError: selectedrealkind(16): expected 10 but got -1
+      "test_quad_precision" # AssertionError: selectedrealkind(32): expected 16 but got -1
+      "test_big_arrays" # ValueError: array is too big; `arr.size * arr.dtype.itemsize` is larger tha...
+      "test_multinomial_pvals_float32" # Failed: DID NOT RAISE <class 'ValueError'>
+    ]
+    ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+      # AssertionError: (np.int64(0), np.longdouble('9.9999999999999994515e-21'), np.longdouble('3.9696755572509052902e+20'), 'arctanh')
+      "test_loss_of_precision"
+    ];
+
+  passthru = {
+    # just for backwards compatibility
+    blas = blas.provider;
+    blasImplementation = blas.implementation;
+    inherit cfg;
+    tests = {
+      inherit sage;
+    };
+  };
+
+  meta = {
+    changelog = "https://github.com/numpy/numpy/releases/tag/v${version}";
+    description = "Scientific tools for Python";
+    homepage = "https://numpy.org/";
+    license = lib.licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/python-modules/oci/default.nix b/pkgs/development/python-modules/oci/default.nix
index e9b5287193362..42f713ba0c3f7 100644
--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@@ -8,7 +8,6 @@
   pyopenssl,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   setuptools,
 }:
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/odp-amsterdam/default.nix b/pkgs/development/python-modules/odp-amsterdam/default.nix
index 4b66456a416d4..aa9f39a40c56c 100644
--- a/pkgs/development/python-modules/odp-amsterdam/default.nix
+++ b/pkgs/development/python-modules/odp-amsterdam/default.nix
@@ -5,7 +5,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   pythonOlder,
   pytest-asyncio,
   pytestCheckHook,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pytz" ];
diff --git a/pkgs/development/python-modules/ollama/default.nix b/pkgs/development/python-modules/ollama/default.nix
index fcfe041922622..33433bc17ac91 100644
--- a/pkgs/development/python-modules/ollama/default.nix
+++ b/pkgs/development/python-modules/ollama/default.nix
@@ -9,7 +9,6 @@
   pytest-httpserver,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [ httpx ];
 
diff --git a/pkgs/development/python-modules/onnxruntime/default.nix b/pkgs/development/python-modules/onnxruntime/default.nix
index 612e76354a00e..b7475fd5b4800 100644
--- a/pkgs/development/python-modules/onnxruntime/default.nix
+++ b/pkgs/development/python-modules/onnxruntime/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   autoPatchelfHook,
-  pythonRelaxDepsHook,
   onnxruntime,
   coloredlogs,
   numpy,
@@ -36,7 +35,7 @@ buildPythonPackage {
     chmod +w dist
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ] ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
 
   # This project requires fairly large dependencies such as sympy which we really don't always need.
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/open-interpreter/default.nix b/pkgs/development/python-modules/open-interpreter/default.nix
index 726a312b38e23..0fd3600d5d3e7 100644
--- a/pkgs/development/python-modules/open-interpreter/default.nix
+++ b/pkgs/development/python-modules/open-interpreter/default.nix
@@ -3,7 +3,6 @@
   fetchFromGitHub,
   buildPythonPackage,
   pythonOlder,
-  pythonRelaxDepsHook,
   poetry-core,
 
   appdirs,
@@ -50,7 +49,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openai-triton/bin.nix b/pkgs/development/python-modules/openai-triton/bin.nix
index ef95ac07244ae..bdf722bbc0fca 100644
--- a/pkgs/development/python-modules/openai-triton/bin.nix
+++ b/pkgs/development/python-modules/openai-triton/bin.nix
@@ -13,7 +13,6 @@
   autoPatchelfHook,
   filelock,
   lit,
-  pythonRelaxDepsHook,
   zlib,
 }:
 
@@ -34,13 +33,13 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [
     "cmake"
+    # torch and triton refer to each other so this hook is included to mitigate that.
     "torch"
   ];
 
   buildInputs = [ zlib ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook # torch and triton refer to each other so this hook is included to mitigate that.
     autoPatchelfHook
   ];
 
diff --git a/pkgs/development/python-modules/openai-triton/default.nix b/pkgs/development/python-modules/openai-triton/default.nix
index 1b4d713311ee1..051e844ff56f4 100644
--- a/pkgs/development/python-modules/openai-triton/default.nix
+++ b/pkgs/development/python-modules/openai-triton/default.nix
@@ -7,7 +7,6 @@
   addOpenGLRunpath,
   setuptools,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   cmake,
   ninja,
   pybind11,
@@ -59,7 +58,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
     # pytestCheckHook # Requires torch (circular dependency) and probably needs GPUs:
     cmake
     ninja
diff --git a/pkgs/development/python-modules/openllm-core/default.nix b/pkgs/development/python-modules/openllm-core/default.nix
index 928a47a43d755..42079dc38d93b 100644
--- a/pkgs/development/python-modules/openllm-core/default.nix
+++ b/pkgs/development/python-modules/openllm-core/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   accelerate,
   attrs,
   bitsandbytes,
@@ -39,7 +38,6 @@ buildPythonPackage rec {
 
   sourceRoot = "${src.name}/openllm-core";
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   postPatch = ''
     substituteInPlace pyproject.toml \
diff --git a/pkgs/development/python-modules/openllm/default.nix b/pkgs/development/python-modules/openllm/default.nix
index 6ed4db129e582..5d5af060d8465 100644
--- a/pkgs/development/python-modules/openllm/default.nix
+++ b/pkgs/development/python-modules/openllm/default.nix
@@ -6,7 +6,6 @@
   hatchling,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   accelerate,
   bentoml,
   bitsandbytes,
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   sourceRoot = "${src.name}/openllm-python";
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [
     # remove cuda-python as it has an unfree license
diff --git a/pkgs/development/python-modules/opentelemetry-api/default.nix b/pkgs/development/python-modules/opentelemetry-api/default.nix
index 8116626b94d87..acf55063b29e1 100644
--- a/pkgs/development/python-modules/opentelemetry-api/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-api/default.nix
@@ -9,7 +9,6 @@
   opentelemetry-test-utils,
   setuptools,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   writeScript,
 }:
 
@@ -31,7 +30,6 @@ let
 
     sourceRoot = "${src.name}/opentelemetry-api";
 
-    nativeBuildInputs = [ pythonRelaxDepsHook ];
 
     build-system = [ hatchling ];
 
diff --git a/pkgs/development/python-modules/orange3/default.nix b/pkgs/development/python-modules/orange3/default.nix
index e59e2a5dfaad4..a8095c729897d 100644
--- a/pkgs/development/python-modules/orange3/default.nix
+++ b/pkgs/development/python-modules/orange3/default.nix
@@ -6,7 +6,6 @@
   buildPythonPackage,
   chardet,
   copyDesktopItems,
-  pythonRelaxDepsHook,
   cython,
   catboost,
   xgboost,
@@ -74,7 +73,6 @@ let
 
     nativeBuildInputs = [
       copyDesktopItems
-      pythonRelaxDepsHook
       oldest-supported-numpy
       cython
       qt5.wrapQtAppsHook
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index 5bb2acb5dfd8c..c1d58c0a1c546 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.10.3";
+  version = "3.10.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,13 +40,13 @@ buildPythonPackage rec {
     owner = "ijl";
     repo = "orjson";
     rev = "refs/tags/${version}";
-    hash = "sha256-bK6wA8P/IXEbiuJAx7psd0nUUKjR1jX4scFfJr1MBAk=";
+    hash = "sha256-Q2zi3mNgCFrg7Ucana0+lmR9C9kkuUidEJj8GneR2W4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-ilGq+/gPSuNwURUWy2ZxInzmUv+PxYMxd8esxrMpr2o=";
+    hash = "sha256-yhLKw4BhdIHgcu4iVlXQlHk/8J+3NK6LlmSWbm/5y4Q=";
   };
 
   maturinBuildFlags = [ "--interpreter ${python.executable}" ];
diff --git a/pkgs/development/python-modules/ormar/default.nix b/pkgs/development/python-modules/ormar/default.nix
index 2400ed2b223f3..6139be3daa335 100644
--- a/pkgs/development/python-modules/ormar/default.nix
+++ b/pkgs/development/python-modules/ormar/default.nix
@@ -21,7 +21,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   sqlalchemy,
   typing-extensions,
 }:
@@ -48,7 +47,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs =
diff --git a/pkgs/development/python-modules/osqp/default.nix b/pkgs/development/python-modules/osqp/default.nix
index 5a47de2578467..d3dbb48df72ff 100644
--- a/pkgs/development/python-modules/osqp/default.nix
+++ b/pkgs/development/python-modules/osqp/default.nix
@@ -9,7 +9,6 @@
   oldest-supported-numpy,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   qdldl,
   scipy,
   setuptools-scm,
@@ -33,7 +32,6 @@ buildPythonPackage rec {
     cmake
     oldest-supported-numpy
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "scipy" ];
diff --git a/pkgs/development/python-modules/oss2/default.nix b/pkgs/development/python-modules/oss2/default.nix
index 79c0b50e22350..374f526b57f54 100644
--- a/pkgs/development/python-modules/oss2/default.nix
+++ b/pkgs/development/python-modules/oss2/default.nix
@@ -10,7 +10,6 @@
   pycryptodome,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   six,
 }:
@@ -29,7 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-jDSXPVyy8XvPgsGZXsdfavFPptq28pCwr9C63OZvNrY=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     requests
diff --git a/pkgs/development/python-modules/ossfs/default.nix b/pkgs/development/python-modules/ossfs/default.nix
index 833b22995af5c..940f5a20b3429 100644
--- a/pkgs/development/python-modules/ossfs/default.nix
+++ b/pkgs/development/python-modules/ossfs/default.nix
@@ -6,7 +6,6 @@
   fsspec,
   oss2,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools-scm,
 }:
 
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/paddleocr/default.nix b/pkgs/development/python-modules/paddleocr/default.nix
index c263fce2c649f..6edec759e5d04 100644
--- a/pkgs/development/python-modules/paddleocr/default.nix
+++ b/pkgs/development/python-modules/paddleocr/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   fetchFromGitHub,
   attrdict,
   beautifulsoup4,
@@ -55,7 +54,6 @@ buildPythonPackage {
     ./remove-import-imaug.patch
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   # trying to relax only pymupdf makes the whole build fail
   pythonRelaxDeps = true;
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/panel/default.nix b/pkgs/development/python-modules/panel/default.nix
index ddf9e6d69f6d8..f034d572b3b6c 100644
--- a/pkgs/development/python-modules/panel/default.nix
+++ b/pkgs/development/python-modules/panel/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   bleach,
   bokeh,
   param,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
     python = "py3";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "bokeh" ];
 
diff --git a/pkgs/development/python-modules/parsedmarc/default.nix b/pkgs/development/python-modules/parsedmarc/default.nix
index 6b3044636fee7..0aa992f132ca2 100644
--- a/pkgs/development/python-modules/parsedmarc/default.nix
+++ b/pkgs/development/python-modules/parsedmarc/default.nix
@@ -28,7 +28,6 @@
   opensearch-py,
   publicsuffixlist,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   tqdm,
   xmltodict,
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pathy/default.nix b/pkgs/development/python-modules/pathy/default.nix
index 07e55245b3857..3e384c62a98a3 100644
--- a/pkgs/development/python-modules/pathy/default.nix
+++ b/pkgs/development/python-modules/pathy/default.nix
@@ -6,7 +6,6 @@
   pathlib-abc,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   smart-open,
   typer,
@@ -24,7 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-uz0OawuL92709jxxkeluCvLtZcj9tfoXSI+ch55jcG0=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "smart-open" ];
 
diff --git a/pkgs/development/python-modules/pdb2pqr/default.nix b/pkgs/development/python-modules/pdb2pqr/default.nix
index da3e3e0c2f06b..e082eab102bae 100644
--- a/pkgs/development/python-modules/pdb2pqr/default.nix
+++ b/pkgs/development/python-modules/pdb2pqr/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   mmcif-pdbx,
   numpy,
   propka,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-He301TJ1bzWub0DZ6Ro/Xc+JMtJBbyygVpWjPY6RMbA=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "docutils" ];
 
diff --git a/pkgs/development/python-modules/pdf2docx/default.nix b/pkgs/development/python-modules/pdf2docx/default.nix
index e8a3f7e416342..af91594808b5f 100644
--- a/pkgs/development/python-modules/pdf2docx/default.nix
+++ b/pkgs/development/python-modules/pdf2docx/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   python,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   imagemagick,
   pip,
   pytestCheckHook,
@@ -33,7 +32,6 @@ buildPythonPackage {
 
   nativeBuildInputs = [
     pip
-    pythonRelaxDepsHook
     imagemagick
   ];
 
diff --git a/pkgs/development/python-modules/pelican/default.nix b/pkgs/development/python-modules/pelican/default.nix
index 93bde3408deab..1c31b4356160c 100644
--- a/pkgs/development/python-modules/pelican/default.nix
+++ b/pkgs/development/python-modules/pelican/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   # build-system
   pdm-backend,
@@ -61,7 +60,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     pdm-backend
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "unidecode" ];
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index c327e2e6df345..9883af306238c 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "8.14.0";
+  version = "8.15.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-3ORvbhO3eLu/NIE0Lwdf93QtUHUmyMf7LmdMBJpkYIg=";
+    hash = "sha256-YyrGqcLRhCEWaJ6duUMpQMj1kx27t9EilhZ3tll8nbY=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pinecone-client/default.nix b/pkgs/development/python-modules/pinecone-client/default.nix
index 52acaacfb62ab..fdc9c4ad5e6cc 100644
--- a/pkgs/development/python-modules/pinecone-client/default.nix
+++ b/pkgs/development/python-modules/pinecone-client/default.nix
@@ -8,7 +8,6 @@
   poetry-core,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   setuptools,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "urllib3" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     setuptools
diff --git a/pkgs/development/python-modules/pixel-font-builder/default.nix b/pkgs/development/python-modules/pixel-font-builder/default.nix
index 7033179d7370b..156cff2a6eab1 100644
--- a/pkgs/development/python-modules/pixel-font-builder/default.nix
+++ b/pkgs/development/python-modules/pixel-font-builder/default.nix
@@ -12,7 +12,6 @@
   fonttools,
   pypng,
   pcffont,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "fonttools" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     hatch-vcs
diff --git a/pkgs/development/python-modules/pkutils/default.nix b/pkgs/development/python-modules/pkutils/default.nix
index a1f87f55e35a3..724e991ee143d 100644
--- a/pkgs/development/python-modules/pkutils/default.nix
+++ b/pkgs/development/python-modules/pkutils/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   nose3,
   pythonOlder,
-  pythonRelaxDepsHook,
   semver,
 }:
 
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "semver" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [ semver ];
 
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index cdbe9b143c2d2..416596eab9ae6 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -12,7 +12,6 @@
   setuptools,
   setuptools-scm,
   playwright-driver,
-  pythonRelaxDepsHook,
 }:
 
 let
@@ -72,7 +71,6 @@ buildPythonPackage rec {
     git
     setuptools-scm
     setuptools
-    pythonRelaxDepsHook
   ] ++ lib.optionals stdenv.isLinux [ auditwheel ];
 
   pythonRelaxDeps = [ "pyee" ];
diff --git a/pkgs/development/python-modules/playwrightcapture/default.nix b/pkgs/development/python-modules/playwrightcapture/default.nix
index e8d6af86ca19f..439743042d1ef 100644
--- a/pkgs/development/python-modules/playwrightcapture/default.nix
+++ b/pkgs/development/python-modules/playwrightcapture/default.nix
@@ -12,7 +12,6 @@
   puremagic,
   pydub,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   requests,
   setuptools,
@@ -44,7 +43,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/polyswarm-api/default.nix b/pkgs/development/python-modules/polyswarm-api/default.nix
index 64aa9d27933ba..cf514b8535115 100644
--- a/pkgs/development/python-modules/polyswarm-api/default.nix
+++ b/pkgs/development/python-modules/polyswarm-api/default.nix
@@ -7,7 +7,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   responses,
   setuptools,
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [ "future" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/ppscore/default.nix b/pkgs/development/python-modules/ppscore/default.nix
index f523ffce1c82d..544681c2c704d 100644
--- a/pkgs/development/python-modules/ppscore/default.nix
+++ b/pkgs/development/python-modules/ppscore/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   setuptools,
   pandas,
   pytestCheckHook,
@@ -25,7 +24,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/prometrix/default.nix b/pkgs/development/python-modules/prometrix/default.nix
index 850ee8e55be63..52e0621136c7e 100644
--- a/pkgs/development/python-modules/prometrix/default.nix
+++ b/pkgs/development/python-modules/prometrix/default.nix
@@ -11,7 +11,6 @@
   poetry-core,
   prometheus-api-client,
   pydantic,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     boto3
diff --git a/pkgs/development/python-modules/ptyprocess/default.nix b/pkgs/development/python-modules/ptyprocess/default.nix
index e707086e259cb..0cc11d0910a02 100644
--- a/pkgs/development/python-modules/ptyprocess/default.nix
+++ b/pkgs/development/python-modules/ptyprocess/default.nix
@@ -26,6 +26,10 @@ buildPythonPackage rec {
       url = "https://github.com/pexpect/ptyprocess/commit/40c1ccf3432a6787be1801ced721540e34c6cd87.patch";
       hash = "sha256-IemngBqBq3QRCmVscWtsuXHiFgvTOJIIB9SyAvsqHd0=";
     })
+    (fetchpatch {
+      url = "https://github.com/pexpect/ptyprocess/commit/a44312974bd9084aa568d2e18ce5b2a7e0e45983.patch";
+      hash = "sha256-DEO4FbzKNAXADYocSQhhwjQTGGu9V5pqd38u1sWhpOI=";
+    })
   ];
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/pwndbg/default.nix b/pkgs/development/python-modules/pwndbg/default.nix
index 8862184d9cf77..e4b77db14eab7 100644
--- a/pkgs/development/python-modules/pwndbg/default.nix
+++ b/pkgs/development/python-modules/pwndbg/default.nix
@@ -19,7 +19,6 @@
   unicorn,
   gdb-pt-dump,
   poetry-core,
-  pythonRelaxDepsHook,
 }:
 let
   # The newest gdb-pt-dump is incompatible with pwndbg 2024.02.14.
@@ -52,7 +51,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
   pythonRelaxDeps = true;
 
diff --git a/pkgs/development/python-modules/py-pdf-parser/default.nix b/pkgs/development/python-modules/py-pdf-parser/default.nix
index 2cc04d82a445f..84d2e77d45af6 100644
--- a/pkgs/development/python-modules/py-pdf-parser/default.nix
+++ b/pkgs/development/python-modules/py-pdf-parser/default.nix
@@ -5,7 +5,6 @@
   fetchPypi,
   pdfminer-six,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   wand,
 }:
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyasn1-modules/default.nix b/pkgs/development/python-modules/pyasn1-modules/default.nix
index ed555556f84fb..7c7b4b3600704 100644
--- a/pkgs/development/python-modules/pyasn1-modules/default.nix
+++ b/pkgs/development/python-modules/pyasn1-modules/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pyasn1,
   pytestCheckHook,
   pythonOlder,
@@ -9,29 +10,31 @@
 
 buildPythonPackage rec {
   pname = "pyasn1-modules";
-  version = "0.3.0";
-  format = "setuptools";
+  version = "0.4.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pyasn1";
-    repo = pname;
+    repo = "pyasn1-modules";
     rev = "refs/tags/v${version}";
-    hash = "sha256-AAS1VuppCIxgswpLSHFAc6q9cyJBLpdDuU9D1KU13vg=";
+    hash = "sha256-UJycVfj08+3zjHPji5Qlh3yqeS30dEwu1pyrN1yo1Vc=";
   };
 
-  propagatedBuildInputs = [ pyasn1 ];
+  build-system = [ setuptools ];
+
+  dependencies = [ pyasn1 ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "pyasn1_modules" ];
 
-  meta = with lib; {
+  meta = {
     description = "Collection of ASN.1-based protocols modules";
-    homepage = "https://github.com/pyasn1/pyasn1-modules";
+    homepage = "https://pyasn1.readthedocs.io";
     changelog = "https://github.com/pyasn1/pyasn1-modules/releases/tag/v${version}";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pyatv/default.nix b/pkgs/development/python-modules/pyatv/default.nix
index 054eec8fe72e0..10667bc2f4f23 100644
--- a/pkgs/development/python-modules/pyatv/default.nix
+++ b/pkgs/development/python-modules/pyatv/default.nix
@@ -18,7 +18,6 @@
   pytest-httpserver,
   pytest-timeout,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonAtLeast,
   pythonOlder,
   requests,
@@ -64,7 +63,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/pybids/default.nix b/pkgs/development/python-modules/pybids/default.nix
index df3af23c98f76..86c52795c3ab4 100644
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@@ -14,7 +14,6 @@
   sqlalchemy,
   pytestCheckHook,
   versioneer,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     versioneer
   ] ++ versioneer.optional-dependencies.toml;
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 408544f424052..b0b7661607127 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
+  fetchpatch2,
   cmake,
   ninja,
   setuptools,
@@ -60,6 +61,14 @@ buildPythonPackage rec {
     hash = "sha256-DVkI5NxM5uME9m3PFYVpJOOa2j+yjL6AJn76fCTv2nE=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/pybind/pybind11/pull/5127
+      url = "https://github.com/pybind/pybind11/commit/540bef2d2c9fb54fa7c1474ee1af959ce90f2b32.patch";
+      hash = "sha256-0ZWlH/5kQ3An/tu6ulOXO2k32asATrr1mlI4nGjIqaI=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "timeout=300" ""
diff --git a/pkgs/development/python-modules/pycardano/default.nix b/pkgs/development/python-modules/pycardano/default.nix
index 010a030693cb9..cc1f79c9b2c54 100644
--- a/pkgs/development/python-modules/pycardano/default.nix
+++ b/pkgs/development/python-modules/pycardano/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   # Python deps
   blockfrost-python,
   cachetools,
@@ -45,7 +44,6 @@ buildPythonPackage rec {
     hash = "sha256-LP/W8IC2del476fGFq10VMWwMrbAoCCcZOngA8unBM0=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     blockfrost-python
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index a2798e8199e6f..e16ec8a669ab6 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -6,7 +6,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [ pydantic ];
 
diff --git a/pkgs/development/python-modules/pycookiecheat/default.nix b/pkgs/development/python-modules/pycookiecheat/default.nix
index 3a1c3efdf3cd7..c90aee856a3c2 100644
--- a/pkgs/development/python-modules/pycookiecheat/default.nix
+++ b/pkgs/development/python-modules/pycookiecheat/default.nix
@@ -7,7 +7,6 @@
   keyring,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   playwright,
   setuptools,
   setuptools-scm,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     cryptography
diff --git a/pkgs/development/python-modules/pydantic-core/default.nix b/pkgs/development/python-modules/pydantic-core/default.nix
index cc9854b46853d..b0a84ed3fbdbe 100644
--- a/pkgs/development/python-modules/pydantic-core/default.nix
+++ b/pkgs/development/python-modules/pydantic-core/default.nix
@@ -18,14 +18,14 @@
 let
   pydantic-core = buildPythonPackage rec {
     pname = "pydantic-core";
-    version = "2.16.3";
+    version = "2.18.4";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "pydantic";
       repo = "pydantic-core";
       rev = "refs/tags/v${version}";
-      hash = "sha256-RXytujvx/23Z24TWpvnHdjJ4/dXqjs5uiavUmukaD9A=";
+      hash = "sha256-wt6HG2jQU09Zxhxhzb49HvNnxahfSk2xvNApVZkqqbw=";
     };
 
     patches = [ ./01-remove-benchmark-flags.patch ];
@@ -33,7 +33,7 @@ let
     cargoDeps = rustPlatform.fetchCargoTarball {
       inherit src;
       name = "${pname}-${version}";
-      hash = "sha256-wj9u6s/3E3EWfQydkLrwHbJBvm8DwcGCoQQpSw1+q7U=";
+      hash = "sha256-m0xP4fIFgInkUeAy4HqfTKHEiqmWpYO8CgKzxg+WXiU=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index e9d181b65789c..f47c028ac54c0 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "2.6.3";
+  version = "2.7.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -38,18 +38,9 @@ buildPythonPackage rec {
     owner = "pydantic";
     repo = "pydantic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-neTdG/IcXopCmevzFY5/XDlhPHmOb6dhyAnzaobmeG8=";
+    hash = "sha256-S4FZUnOsKC8J0xyTeXhMmCACCma+VfCSmrE6sYAnpok=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/pydantic/pydantic/pull/8678
-      name = "fix-pytest8-compatibility.patch";
-      url = "https://github.com/pydantic/pydantic/commit/825a6920e177a3b65836c13c7f37d82b810ce482.patch";
-      hash = "sha256-Dap5DtDzHw0jS/QUo5CRI9sLDJ719GRyC4ZNDWEdzus=";
-    })
-  ];
-
   buildInputs = lib.optionals (pythonOlder "3.9") [ libxcrypt ];
 
   build-system = [
@@ -81,10 +72,10 @@ buildPythonPackage rec {
   preCheck = ''
     export HOME=$(mktemp -d)
     substituteInPlace pyproject.toml \
-      --replace "'--benchmark-columns', 'min,mean,stddev,outliers,rounds,iterations'," "" \
-      --replace "'--benchmark-group-by', 'group'," "" \
-      --replace "'--benchmark-warmup', 'on'," "" \
-      --replace "'--benchmark-disable'," ""
+      --replace-fail "'--benchmark-columns', 'min,mean,stddev,outliers,rounds,iterations'," "" \
+      --replace-fail "'--benchmark-group-by', 'group'," "" \
+      --replace-fail "'--benchmark-warmup', 'on'," "" \
+      --replace-fail "'--benchmark-disable'," ""
   '';
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/pydicom-seg/default.nix b/pkgs/development/python-modules/pydicom-seg/default.nix
index ecab789fa2a9d..9f06d7b44dd07 100644
--- a/pkgs/development/python-modules/pydicom-seg/default.nix
+++ b/pkgs/development/python-modules/pydicom-seg/default.nix
@@ -5,7 +5,6 @@
   fetchpatch,
   pythonOlder,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   poetry-core,
   jsonschema,
   numpy,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pydiscovergy/default.nix b/pkgs/development/python-modules/pydiscovergy/default.nix
index 44f9cfc7c2590..919eec4fae1f8 100644
--- a/pkgs/development/python-modules/pydiscovergy/default.nix
+++ b/pkgs/development/python-modules/pydiscovergy/default.nix
@@ -11,7 +11,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   respx,
 }:
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     authlib
diff --git a/pkgs/development/python-modules/pydyf/default.nix b/pkgs/development/python-modules/pydyf/default.nix
index 218a3f35f8474..d39f36b39e9e3 100644
--- a/pkgs/development/python-modules/pydyf/default.nix
+++ b/pkgs/development/python-modules/pydyf/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pydyf";
-  version = "0.9.0";
+  version = "0.10.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1bJE6PwkEZznvV1R6i1nc8D/iKqBWX21VrxEDGuIBhA=";
+    hash = "sha256-NXGUWT769h17SKuXw9WXIhFJNJZ8PfPXh4ym3SWwTDA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyefergy/default.nix b/pkgs/development/python-modules/pyefergy/default.nix
index 2370bd7e62780..47e4e41e624fe 100644
--- a/pkgs/development/python-modules/pyefergy/default.nix
+++ b/pkgs/development/python-modules/pyefergy/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   poetry-core,
   poetry-dynamic-versioning,
-  pythonRelaxDepsHook,
   iso4217,
   pythonOlder,
   pytz,
@@ -28,7 +27,6 @@ buildPythonPackage rec {
   build-system = [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/pygitguardian/default.nix b/pkgs/development/python-modules/pygitguardian/default.nix
index 2310bfb1f77df..ff07c7253b296 100644
--- a/pkgs/development/python-modules/pygitguardian/default.nix
+++ b/pkgs/development/python-modules/pygitguardian/default.nix
@@ -6,7 +6,6 @@
   marshmallow-dataclass,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   responses,
   setuptools,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "marshmallow-dataclass" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/pygls/default.nix b/pkgs/development/python-modules/pygls/default.nix
index 49cf9dab4a26e..c75cf68715ed8 100644
--- a/pkgs/development/python-modules/pygls/default.nix
+++ b/pkgs/development/python-modules/pygls/default.nix
@@ -8,7 +8,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   typeguard,
   websockets,
 }:
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pygments/default.nix b/pkgs/development/python-modules/pygments/default.nix
index 82c0b2ec326ec..ff8569b9b8ebf 100644
--- a/pkgs/development/python-modules/pygments/default.nix
+++ b/pkgs/development/python-modules/pygments/default.nix
@@ -9,17 +9,20 @@
   # tests
   pytestCheckHook,
   wcag-contrast-ratio,
+  pythonOlder
 }:
 
 let
   pygments = buildPythonPackage rec {
     pname = "pygments";
-    version = "2.17.2";
+    version = "2.18.0";
     pyproject = true;
 
+    disabled = pythonOlder "3.8"; # 2.18.0 requirement
+
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-2kbOyf0t5b46inhPQ05MSrZwtP9U1gXEwnF+nUnEw2c=";
+      hash = "sha256-eG/4AvMukTEb/ziJ9umoboFQX+mfJzW7bWCuDFAE8Zk=";
     };
 
     nativeBuildInputs = [ hatchling ];
@@ -51,7 +54,7 @@ let
       description = "Generic syntax highlighter";
       mainProgram = "pygmentize";
       license = licenses.bsd2;
-      maintainers = with maintainers; [ ];
+      maintainers = with maintainers; [ sigmanificient ];
     };
   };
 in
diff --git a/pkgs/development/python-modules/pykoplenti/default.nix b/pkgs/development/python-modules/pykoplenti/default.nix
index e6ccb9bcbf2f0..a4f605692c5f2 100644
--- a/pkgs/development/python-modules/pykoplenti/default.nix
+++ b/pkgs/development/python-modules/pykoplenti/default.nix
@@ -8,7 +8,6 @@
   pycryptodome,
   pydantic,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -29,7 +28,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pydantic" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/pylxd/default.nix b/pkgs/development/python-modules/pylxd/default.nix
index 3c737f5041238..048822ad976e1 100644
--- a/pkgs/development/python-modules/pylxd/default.nix
+++ b/pkgs/development/python-modules/pylxd/default.nix
@@ -10,7 +10,6 @@
   pythonOlder,
   requests,
   urllib3,
-  pythonRelaxDepsHook,
   requests-toolbelt,
   requests-unixsocket,
   setuptools,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "urllib3" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/pymilvus/default.nix b/pkgs/development/python-modules/pymilvus/default.nix
index 3a498ee4ffa21..c9f706ca4a959 100644
--- a/pkgs/development/python-modules/pymilvus/default.nix
+++ b/pkgs/development/python-modules/pymilvus/default.nix
@@ -12,7 +12,6 @@
   pyarrow,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   scikit-learn,
   setuptools-scm,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     gitpython
-    pythonRelaxDepsHook
     setuptools-scm
     wheel
   ];
diff --git a/pkgs/development/python-modules/pyngo/default.nix b/pkgs/development/python-modules/pyngo/default.nix
index f580b50b01c1d..0f6c85d993c84 100644
--- a/pkgs/development/python-modules/pyngo/default.nix
+++ b/pkgs/development/python-modules/pyngo/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
 
   # build-system
   hatchling,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pynitrokey/default.nix b/pkgs/development/python-modules/pynitrokey/default.nix
index 900198cb425a5..2e40250adb4b9 100644
--- a/pkgs/development/python-modules/pynitrokey/default.nix
+++ b/pkgs/development/python-modules/pynitrokey/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   installShellFiles,
   libnitrokey,
   flit-core,
@@ -71,7 +70,6 @@ buildPythonPackage {
   nativeBuildInputs = [
     flit-core
     installShellFiles
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index ffce3a97b0c65..95aa20b78d45a 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -5,9 +5,9 @@
   buildPythonPackage,
   appdirs,
   cffi,
+  darwin,
   decorator,
   mako,
-  mesa_drivers,
   numpy,
   ocl-icd,
   oldest-supported-numpy,
@@ -22,7 +22,7 @@
 }:
 
 let
-  os-specific-buildInputs = if stdenv.isDarwin then [ mesa_drivers.dev ] else [ ocl-icd ];
+  os-specific-buildInputs = if stdenv.isDarwin then [ darwin.apple_sdk.frameworks.OpenCL ] else [ ocl-icd ];
 in
 buildPythonPackage rec {
   pname = "pyopencl";
diff --git a/pkgs/development/python-modules/pyowm/default.nix b/pkgs/development/python-modules/pyowm/default.nix
index d342ce313e8cb..78d8e05301e4f 100644
--- a/pkgs/development/python-modules/pyowm/default.nix
+++ b/pkgs/development/python-modules/pyowm/default.nix
@@ -8,7 +8,6 @@
   requests,
   setuptools,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     geojson
diff --git a/pkgs/development/python-modules/pyquil/default.nix b/pkgs/development/python-modules/pyquil/default.nix
index 77f2f3df334ed..612e78239c2ec 100644
--- a/pkgs/development/python-modules/pyquil/default.nix
+++ b/pkgs/development/python-modules/pyquil/default.nix
@@ -15,7 +15,6 @@
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   qcs-sdk-python,
   respx,
   rpcq,
@@ -51,7 +50,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     deprecated
diff --git a/pkgs/development/python-modules/pysaml2/default.nix b/pkgs/development/python-modules/pysaml2/default.nix
index 91fda24bfef6b..957394ad5fa3c 100644
--- a/pkgs/development/python-modules/pysaml2/default.nix
+++ b/pkgs/development/python-modules/pysaml2/default.nix
@@ -12,7 +12,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   repoze-who,
   requests,
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
index 3e995ca11f8a1..b062ff4356060 100644
--- a/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
@@ -6,7 +6,6 @@
   pysigma,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [ pysigma ];
diff --git a/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix b/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix
index 5716a6ebd79e9..2e2249fd9c54f 100644
--- a/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix
@@ -7,7 +7,6 @@
   pysigma-backend-elasticsearch,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     pysigma
diff --git a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
index 9c2976ed46f40..d0ec8be3b48ea 100644
--- a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
@@ -7,7 +7,6 @@
   pysigma-pipeline-sysmon,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
 }:
 
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [ pysigma ];
diff --git a/pkgs/development/python-modules/pysigma/default.nix b/pkgs/development/python-modules/pysigma/default.nix
index 6fbb4b8b93ed3..3ccbefb250e3f 100644
--- a/pkgs/development/python-modules/pysigma/default.nix
+++ b/pkgs/development/python-modules/pysigma/default.nix
@@ -8,7 +8,6 @@
   pyparsing,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
 }:
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     jinja2
diff --git a/pkgs/development/python-modules/pysilero-vad/default.nix b/pkgs/development/python-modules/pysilero-vad/default.nix
index 19cd2e70ed6a2..7d2b44a61ec28 100644
--- a/pkgs/development/python-modules/pysilero-vad/default.nix
+++ b/pkgs/development/python-modules/pysilero-vad/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   stdenv,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "numpy" ];
diff --git a/pkgs/development/python-modules/pysolcast/default.nix b/pkgs/development/python-modules/pysolcast/default.nix
index cb5c822820b1f..395130f016361 100644
--- a/pkgs/development/python-modules/pysolcast/default.nix
+++ b/pkgs/development/python-modules/pysolcast/default.nix
@@ -10,7 +10,6 @@
   requests,
   responses,
   poetry-core,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     anyconfig
diff --git a/pkgs/development/python-modules/pytest-examples/default.nix b/pkgs/development/python-modules/pytest-examples/default.nix
index 8dd796c5e0bfe..ed62ccbefd727 100644
--- a/pkgs/development/python-modules/pytest-examples/default.nix
+++ b/pkgs/development/python-modules/pytest-examples/default.nix
@@ -8,7 +8,6 @@
   pytest,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   ruff,
 }:
 
@@ -47,7 +46,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   buildInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pytest-golden/default.nix b/pkgs/development/python-modules/pytest-golden/default.nix
index 6cc78e6d7018e..1d2879049e453 100644
--- a/pkgs/development/python-modules/pytest-golden/default.nix
+++ b/pkgs/development/python-modules/pytest-golden/default.nix
@@ -10,7 +10,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   testfixtures,
 }:
 
@@ -39,7 +38,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     # hatchling used for > 0.2.2
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   buildInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pytest-httpx/default.nix b/pkgs/development/python-modules/pytest-httpx/default.nix
index b9dfda5404a39..59a5a76e2eb5d 100644
--- a/pkgs/development/python-modules/pytest-httpx/default.nix
+++ b/pkgs/development/python-modules/pytest-httpx/default.nix
@@ -7,7 +7,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   setuptools-scm,
 }:
@@ -27,7 +26,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-notebook/default.nix b/pkgs/development/python-modules/pytest-notebook/default.nix
index f65d7efd9ea2d..21f40beb6a893 100644
--- a/pkgs/development/python-modules/pytest-notebook/default.nix
+++ b/pkgs/development/python-modules/pytest-notebook/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   flit-core,
-  pythonRelaxDepsHook,
   attrs,
   jsonschema,
   nbclient,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     flit-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pytest-regressions/default.nix b/pkgs/development/python-modules/pytest-regressions/default.nix
index eb0afeda5e228..9c109021be28c 100644
--- a/pkgs/development/python-modules/pytest-regressions/default.nix
+++ b/pkgs/development/python-modules/pytest-regressions/default.nix
@@ -47,11 +47,6 @@ buildPythonPackage rec {
     "ignore::DeprecationWarning"
   ];
 
-  disabledTestPathss = lib.optionals (pythonAtLeast "3.12") [
-    # AttributeError: partially initialized module 'pandas' has no attribute '_pandas_datetime_CAPI' (most likely due to a circular import)
-    "tests/test_num_regression.py"
-  ];
-
   pythonImportsCheck = [
     "pytest_regressions"
     "pytest_regressions.plugin"
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index a20a469eb3c1e..055a993ca013b 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -15,7 +15,6 @@
   python-fsutil,
   python-slugify,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   setuptools,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "boto3" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/python-fx/default.nix b/pkgs/development/python-modules/python-fx/default.nix
index cdaae586a52e4..b3a15ff913ca3 100644
--- a/pkgs/development/python-modules/python-fx/default.nix
+++ b/pkgs/development/python-modules/python-fx/default.nix
@@ -19,7 +19,6 @@
   pytestCheckHook,
   pythonOlder,
   antlr4,
-  pythonRelaxDepsHook,
   pyyaml,
   setuptools,
   six,
@@ -52,7 +51,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     antlr4
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/python-jenkins/default.nix b/pkgs/development/python-modules/python-jenkins/default.nix
index 090f5acd8e4aa..8afb965dbaca4 100644
--- a/pkgs/development/python-modules/python-jenkins/default.nix
+++ b/pkgs/development/python-modules/python-jenkins/default.nix
@@ -14,7 +14,6 @@
   requests-mock,
   stestr,
   multiprocess,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -34,7 +33,6 @@ buildPythonPackage rec {
       --replace test_jenkins_open_no_timeout dont_test_jenkins_open_no_timeout
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = [ "setuptools" ];
 
   buildInputs = [ mock ];
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index c79e3f7e8d7bc..f2df743ee1c42 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -22,7 +22,6 @@
   pytestCheckHook,
   python-lsp-jsonrpc,
   pythonOlder,
-  pythonRelaxDepsHook,
   rope,
   setuptools,
   setuptools-scm,
diff --git a/pkgs/development/python-modules/python-matter-server/default.nix b/pkgs/development/python-modules/python-matter-server/default.nix
index e981e6ce8c6a7..b955d681ac0aa 100644
--- a/pkgs/development/python-modules/python-matter-server/default.nix
+++ b/pkgs/development/python-modules/python-matter-server/default.nix
@@ -8,7 +8,6 @@
 
   # build
   setuptools,
-  pythonRelaxDepsHook,
 
   # propagates
   aiohttp,
@@ -83,7 +82,6 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "home-assistant-chip-clusters" ];
diff --git a/pkgs/development/python-modules/python-ndn/default.nix b/pkgs/development/python-modules/python-ndn/default.nix
index ad3d7fd724bc0..be659d33113b3 100644
--- a/pkgs/development/python-modules/python-ndn/default.nix
+++ b/pkgs/development/python-modules/python-ndn/default.nix
@@ -10,7 +10,6 @@
   pycryptodomex,
   pygtrie,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
   setuptools,
 }:
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     setuptools
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index 261624e1902f5..7a873d34bc2e6 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -15,7 +15,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/qcs-api-client/default.nix b/pkgs/development/python-modules/qcs-api-client/default.nix
index 0847a10ce625c..d45f7d2201887 100644
--- a/pkgs/development/python-modules/qcs-api-client/default.nix
+++ b/pkgs/development/python-modules/qcs-api-client/default.nix
@@ -15,7 +15,6 @@
   python-dateutil,
   pythonAtLeast,
   pythonOlder,
-  pythonRelaxDepsHook,
   respx,
   retrying,
   rfc3339,
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     attrs
diff --git a/pkgs/development/python-modules/qudida/default.nix b/pkgs/development/python-modules/qudida/default.nix
index 5003b5860c5da..7e0bac314b258 100644
--- a/pkgs/development/python-modules/qudida/default.nix
+++ b/pkgs/development/python-modules/qudida/default.nix
@@ -5,7 +5,6 @@
   numpy,
   opencv4,
   pythonOlder,
-  pythonRelaxDepsHook,
   scikit-learn,
   typing-extensions,
 }:
@@ -22,7 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-2xmOKIerDJqgAj5WWvv/Qd+3azYfhf1eE/eA11uhjMg=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [ "opencv-python" ];
 
diff --git a/pkgs/development/python-modules/questionary/default.nix b/pkgs/development/python-modules/questionary/default.nix
index 654aeca183d14..ea68441599303 100644
--- a/pkgs/development/python-modules/questionary/default.nix
+++ b/pkgs/development/python-modules/questionary/default.nix
@@ -7,7 +7,6 @@
   prompt-toolkit,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "prompt_toolkit" ];
diff --git a/pkgs/development/python-modules/radios/default.nix b/pkgs/development/python-modules/radios/default.nix
index d66a41e2b343b..241e95a189852 100644
--- a/pkgs/development/python-modules/radios/default.nix
+++ b/pkgs/development/python-modules/radios/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   aiodns,
   aiohttp,
   awesomeversion,
@@ -41,7 +40,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pycountry" ];
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index f6c09b8afae00..296deb7a64b08 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -37,7 +37,6 @@
   python,
   pythonAtLeast,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   scikit-image,
@@ -112,7 +111,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/redis-om/default.nix b/pkgs/development/python-modules/redis-om/default.nix
index 24b267d688ad0..e4c545ad48fde 100644
--- a/pkgs/development/python-modules/redis-om/default.nix
+++ b/pkgs/development/python-modules/redis-om/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pythonRelaxDepsHook,
   unasync,
   poetry-core,
   python,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
   };
 
   build-system = [
-    pythonRelaxDepsHook
     unasync
     poetry-core
   ];
diff --git a/pkgs/development/python-modules/remarshal/default.nix b/pkgs/development/python-modules/remarshal/default.nix
index 708e0acc53248..dedab0bbc95e8 100644
--- a/pkgs/development/python-modules/remarshal/default.nix
+++ b/pkgs/development/python-modules/remarshal/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # build deps
   poetry-core,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pytest" ];
diff --git a/pkgs/development/python-modules/reptor/default.nix b/pkgs/development/python-modules/reptor/default.nix
index a9051dc3eb5fb..96b017c59bc8a 100644
--- a/pkgs/development/python-modules/reptor/default.nix
+++ b/pkgs/development/python-modules/reptor/default.nix
@@ -16,7 +16,6 @@
   pytest,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   reptor,
   requests,
@@ -49,7 +48,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     asgiref
diff --git a/pkgs/development/python-modules/reqif/default.nix b/pkgs/development/python-modules/reqif/default.nix
index e8fb4e1e9665e..7548fb3c6f84b 100644
--- a/pkgs/development/python-modules/reqif/default.nix
+++ b/pkgs/development/python-modules/reqif/default.nix
@@ -9,7 +9,6 @@
   pytestCheckHook,
   python,
   pythonOlder,
-  pythonRelaxDepsHook,
   xmlschema,
 }:
 
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rich-pixels/default.nix b/pkgs/development/python-modules/rich-pixels/default.nix
index cda87a534fc40..62ce70c52576a 100644
--- a/pkgs/development/python-modules/rich-pixels/default.nix
+++ b/pkgs/development/python-modules/rich-pixels/default.nix
@@ -2,13 +2,11 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   hatchling,
   pillow,
+  rich,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
-  rich,
   syrupy,
 }:
 
diff --git a/pkgs/development/python-modules/riscv-config/default.nix b/pkgs/development/python-modules/riscv-config/default.nix
index b8762769b10cb..c03e97c6232e4 100644
--- a/pkgs/development/python-modules/riscv-config/default.nix
+++ b/pkgs/development/python-modules/riscv-config/default.nix
@@ -7,7 +7,6 @@
   pyyaml,
   ruamel-yaml,
   setuptools,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     cerberus
diff --git a/pkgs/development/python-modules/rising/default.nix b/pkgs/development/python-modules/rising/default.nix
index 85990fda48098..fee5c590de512 100644
--- a/pkgs/development/python-modules/rising/default.nix
+++ b/pkgs/development/python-modules/rising/default.nix
@@ -5,7 +5,6 @@
   pythonOlder,
   fetchFromGitHub,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   dill,
   lightning-utilities,
   numpy,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-sBzVTst5Tp2oZZ+Xsg3M7uAMbucL6idlpYwHvib3EaY=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "lightning-utilities" ];
 
diff --git a/pkgs/development/python-modules/rmrl/default.nix b/pkgs/development/python-modules/rmrl/default.nix
index f07165c23c18d..0dc783881414e 100644
--- a/pkgs/development/python-modules/rmrl/default.nix
+++ b/pkgs/development/python-modules/rmrl/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   poetry-core,
-  pythonRelaxDepsHook,
   pdfrw,
   reportlab,
   rmscene,
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/rmscene/default.nix b/pkgs/development/python-modules/rmscene/default.nix
index e402463eca6bc..7da1d58a976d9 100644
--- a/pkgs/development/python-modules/rmscene/default.nix
+++ b/pkgs/development/python-modules/rmscene/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   pythonOlder,
-  pythonRelaxDepsHook,
   fetchFromGitHub,
   poetry-core,
   packaging,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "packaging" ];
diff --git a/pkgs/development/python-modules/rnginline/default.nix b/pkgs/development/python-modules/rnginline/default.nix
index c868150bb98bd..966dec934aa2f 100644
--- a/pkgs/development/python-modules/rnginline/default.nix
+++ b/pkgs/development/python-modules/rnginline/default.nix
@@ -3,7 +3,6 @@
   fetchPypi,
   buildPythonPackage,
   poetry-core,
-  pythonRelaxDepsHook,
   lxml,
   docopt-ng,
   typing-extensions,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     docopt-ng
diff --git a/pkgs/development/python-modules/roadrecon/default.nix b/pkgs/development/python-modules/roadrecon/default.nix
index 9c4b5b7da1c90..87db63bab3a8e 100644
--- a/pkgs/development/python-modules/roadrecon/default.nix
+++ b/pkgs/development/python-modules/roadrecon/default.nix
@@ -11,7 +11,6 @@
   marshmallow-sqlalchemy,
   openpyxl,
   pythonOlder,
-  pythonRelaxDepsHook,
   roadlib,
   setuptools,
   sqlalchemy,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "flask" ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/robomachine/default.nix b/pkgs/development/python-modules/robomachine/default.nix
index 795e31cb701c2..69ca0941df4d0 100644
--- a/pkgs/development/python-modules/robomachine/default.nix
+++ b/pkgs/development/python-modules/robomachine/default.nix
@@ -5,7 +5,6 @@
   buildPythonPackage,
   fetchPypi,
   pyparsing,
-  pythonRelaxDepsHook,
   robotframework,
   setuptools,
 }:
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/roombapy/default.nix b/pkgs/development/python-modules/roombapy/default.nix
index 00a8793f36dc5..e2196301166a1 100644
--- a/pkgs/development/python-modules/roombapy/default.nix
+++ b/pkgs/development/python-modules/roombapy/default.nix
@@ -11,7 +11,6 @@
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   tabulate,
 }:
 
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "orjson" ];
diff --git a/pkgs/development/python-modules/safety-schemas/default.nix b/pkgs/development/python-modules/safety-schemas/default.nix
index 14774300b1f36..c94427bdf083d 100644
--- a/pkgs/development/python-modules/safety-schemas/default.nix
+++ b/pkgs/development/python-modules/safety-schemas/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   hatchling,
-  pythonRelaxDepsHook,
   dparse,
   packaging,
   pydantic,
@@ -24,7 +23,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "dparse" ];
diff --git a/pkgs/development/python-modules/safety/default.nix b/pkgs/development/python-modules/safety/default.nix
index 2399e4e977feb..3999897c90820 100644
--- a/pkgs/development/python-modules/safety/default.nix
+++ b/pkgs/development/python-modules/safety/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools,
   click,
   urllib3,
@@ -49,7 +48,6 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index c96ad040dc2c5..c8897cf3b7a6b 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -4,7 +4,6 @@
   pythonOlder,
   fetchFromGitHub,
   fetchpatch,
-  pythonRelaxDepsHook,
   setuptools,
   attrs,
   boto3,
@@ -60,7 +59,6 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/sarif-tools/default.nix b/pkgs/development/python-modules/sarif-tools/default.nix
index 20fdc0343457d..911e21198b8ac 100644
--- a/pkgs/development/python-modules/sarif-tools/default.nix
+++ b/pkgs/development/python-modules/sarif-tools/default.nix
@@ -11,7 +11,6 @@
   pyyaml,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -30,7 +29,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/schema-salad/default.nix b/pkgs/development/python-modules/schema-salad/default.nix
index 0010df2ab13c7..4df6f0af21f08 100644
--- a/pkgs/development/python-modules/schema-salad/default.nix
+++ b/pkgs/development/python-modules/schema-salad/default.nix
@@ -9,7 +9,6 @@
   mypy,
   mypy-extensions,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
   rdflib,
   requests,
diff --git a/pkgs/development/python-modules/schema/default.nix b/pkgs/development/python-modules/schema/default.nix
index 7bf1de67593bb..08d4ba5b0c582 100644
--- a/pkgs/development/python-modules/schema/default.nix
+++ b/pkgs/development/python-modules/schema/default.nix
@@ -5,7 +5,6 @@
   mock,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -20,7 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-8GcXESxhiVyrxHB3UriHFuhCCogZ1xQEUB4RT5EEMZc=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [ "contextlib2" ];
 
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index 591df46640db0..5f9105efbf406 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -16,7 +16,6 @@
   glibcLocales,
   llvmPackages,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pytest-xdist,
   pillow,
   joblib,
@@ -50,7 +49,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     gfortran
-    pythonRelaxDepsHook
   ];
 
   build-system = [
diff --git a/pkgs/development/python-modules/sev-snp-measure/default.nix b/pkgs/development/python-modules/sev-snp-measure/default.nix
index c6795d1318a1b..c586a1e0bd2df 100644
--- a/pkgs/development/python-modules/sev-snp-measure/default.nix
+++ b/pkgs/development/python-modules/sev-snp-measure/default.nix
@@ -3,7 +3,6 @@
   cryptography,
   fetchFromGitHub,
   lib,
-  pythonRelaxDepsHook,
   setuptools,
 }:
 
@@ -22,7 +21,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "cryptography" ];
diff --git a/pkgs/development/python-modules/signalslot/default.nix b/pkgs/development/python-modules/signalslot/default.nix
index 18c3db8a45ba3..0dcd543346667 100644
--- a/pkgs/development/python-modules/signalslot/default.nix
+++ b/pkgs/development/python-modules/signalslot/default.nix
@@ -3,7 +3,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonRelaxDepsHook,
   contexter,
   eventlet,
   mock,
@@ -28,7 +27,6 @@ buildPythonPackage rec {
       --replace "--cov-report html" ""
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     contexter
diff --git a/pkgs/development/python-modules/sisyphus-control/default.nix b/pkgs/development/python-modules/sisyphus-control/default.nix
index 1ca675582ca7a..eeaaea1cb01ec 100644
--- a/pkgs/development/python-modules/sisyphus-control/default.nix
+++ b/pkgs/development/python-modules/sisyphus-control/default.nix
@@ -7,7 +7,6 @@
   python-engineio,
   python-socketio,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -29,7 +28,6 @@ buildPythonPackage rec {
     "python-socketio"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/skl2onnx/default.nix b/pkgs/development/python-modules/skl2onnx/default.nix
index 32c482e71064c..8d258c18883cc 100644
--- a/pkgs/development/python-modules/skl2onnx/default.nix
+++ b/pkgs/development/python-modules/skl2onnx/default.nix
@@ -11,7 +11,6 @@
   onnxruntime,
   pandas,
   unittestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -33,7 +32,6 @@ buildPythonPackage rec {
     onnxconverter-common
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "scikit-learn" ];
 
diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index f7d7743ef6e5b..b7ddc0e832b0a 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -19,7 +19,6 @@
   pyjwt,
   pyopenssl,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   requests,
   setuptools,
@@ -47,7 +46,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     asn1crypto
diff --git a/pkgs/development/python-modules/spacy-transformers/default.nix b/pkgs/development/python-modules/spacy-transformers/default.nix
index 5d5e08197fa13..ddc71b75eac5b 100644
--- a/pkgs/development/python-modules/spacy-transformers/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/default.nix
@@ -6,7 +6,6 @@
   fetchFromGitHub,
   setuptools,
   cython,
-  pythonRelaxDepsHook,
   spacy,
   numpy,
   transformers,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
     cython
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     spacy
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index d84599ffc8126..4f479d1bde6e9 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -22,7 +22,6 @@
   pytestCheckHook,
   python,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   spacy-legacy,
@@ -58,7 +57,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     cython_0
   ];
 
diff --git a/pkgs/development/python-modules/sphinx-prompt/default.nix b/pkgs/development/python-modules/sphinx-prompt/default.nix
index 2d7a0074ede84..57fa112da926d 100644
--- a/pkgs/development/python-modules/sphinx-prompt/default.nix
+++ b/pkgs/development/python-modules/sphinx-prompt/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # build-system
   poetry-core,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
index d2ed00bed59c4..b53a9849ac066 100644
--- a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
+++ b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
@@ -7,7 +7,6 @@
   readthedocs-sphinx-ext,
   sphinxcontrib-jquery,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -32,7 +31,6 @@ buildPythonPackage rec {
     sphinxcontrib-jquery
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index e781abafac194..16e2a81e50432 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -1,8 +1,10 @@
 {
   lib,
   buildPythonPackage,
+  pythonAtLeast,
   pythonOlder,
   fetchFromGitHub,
+  fetchpatch2,
   isPyPy,
 
   # build-system
@@ -56,6 +58,14 @@ buildPythonPackage rec {
     hash = "sha256-XGGRWEvd1SbQsK8W5yxDzBd5hlvXcDzr8t5Qa6skH/M=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "python-3.13-compat.patch";
+      url = "https://github.com/sphinx-doc/sphinx/commit/3496de62b743942115acb486cf35dfcc102586c3.patch";
+      hash = "sha256-5VBPOQeGyj3a8VBq4hc9S/eKaeVZeGCTNislwgsauZo=";
+    })
+  ];
+
   build-system = [ flit-core ];
 
   dependencies =
@@ -116,6 +126,10 @@ buildPythonPackage rec {
       # Could not fetch remote image: http://localhost:7777/sphinx.png
       "test_copy_images"
     ]
+    ++ lib.optionals (pythonAtLeast "3.12") [
+      # https://github.com/sphinx-doc/sphinx/issues/12430
+      "test_autodoc_type_aliases"
+    ]
     ++ lib.optionals isPyPy [
       # PyPy has not __builtins__ which get asserted
       # https://doc.pypy.org/en/latest/cpython_differences.html#miscellaneous
diff --git a/pkgs/development/python-modules/sphinxawesome-theme/default.nix b/pkgs/development/python-modules/sphinxawesome-theme/default.nix
index 8d073b7fe123f..8d028f2c63e71 100644
--- a/pkgs/development/python-modules/sphinxawesome-theme/default.nix
+++ b/pkgs/development/python-modules/sphinxawesome-theme/default.nix
@@ -5,7 +5,6 @@
   poetry-core,
   sphinx,
   beautifulsoup4,
-  pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -19,7 +18,7 @@ buildPythonPackage rec {
     hash = "sha256-wk8eXAueR1OA0W/F8fO/2ElVgX2gkF2V9+IICdfNPF0=";
   };
 
-  build-system = [ poetry-core pythonRelaxDepsHook ];
+  build-system = [ poetry-core ];
   dependencies = [
     sphinx
     beautifulsoup4
diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index 0e0d56aa027e9..64f8c26489414 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   asn1crypto,
   astunparse,
   bincopy,
@@ -51,7 +50,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 0c9ddbe507445..a40b2897cdabb 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -41,7 +41,7 @@
 
 buildPythonPackage rec {
   pname = "sqlalchemy";
-  version = "2.0.30";
+  version = "2.0.31";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     rev = "refs/tags/rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-l6VxBK4RT/sAFkz3g633MrfQH9Bvp/JE12mdtqjsxd8=";
+    hash = "sha256-+bF7pdz8bxkR+mbrOI773qLoZVzBHpzKOENWPEuVFt8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/steamship/default.nix b/pkgs/development/python-modules/steamship/default.nix
index b1f2fb5001956..ef61a23970649 100644
--- a/pkgs/development/python-modules/steamship/default.nix
+++ b/pkgs/development/python-modules/steamship/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   setuptools-scm,
-  pythonRelaxDepsHook,
   requests,
   pydantic,
   aiohttp,
@@ -29,7 +28,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/streamlit/default.nix b/pkgs/development/python-modules/streamlit/default.nix
index 0880b4b9957c2..0b9516bd058d3 100644
--- a/pkgs/development/python-modules/streamlit/default.nix
+++ b/pkgs/development/python-modules/streamlit/default.nix
@@ -19,7 +19,6 @@
   pympler,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   requests,
   rich,
@@ -46,7 +45,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "packaging" ];
diff --git a/pkgs/development/python-modules/succulent/default.nix b/pkgs/development/python-modules/succulent/default.nix
index f46ae33d4c87f..f039a30d522ac 100644
--- a/pkgs/development/python-modules/succulent/default.nix
+++ b/pkgs/development/python-modules/succulent/default.nix
@@ -8,7 +8,6 @@
   pyyaml,
   poetry-core,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
   toml-adapt,
   xmltodict,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/svg2tikz/default.nix b/pkgs/development/python-modules/svg2tikz/default.nix
index 8d143ee4d58a0..4c63ce7dbf616 100644
--- a/pkgs/development/python-modules/svg2tikz/default.nix
+++ b/pkgs/development/python-modules/svg2tikz/default.nix
@@ -7,7 +7,6 @@
   inkex,
   lxml,
   pytestCheckHook,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -38,7 +37,6 @@ buildPythonPackage rec {
     "lxml"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/syncedlyrics/default.nix b/pkgs/development/python-modules/syncedlyrics/default.nix
index 9b2fb010b04ad..ec90db0811bb0 100644
--- a/pkgs/development/python-modules/syncedlyrics/default.nix
+++ b/pkgs/development/python-modules/syncedlyrics/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   poetry-core,
   pythonOlder,
-  pythonRelaxDepsHook,
   rapidfuzz,
   requests,
 }:
@@ -26,7 +25,6 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "rapidfuzz" ];
diff --git a/pkgs/development/python-modules/synologydsm-api/default.nix b/pkgs/development/python-modules/synologydsm-api/default.nix
index c94e65db81175..6fc64f5baad7e 100644
--- a/pkgs/development/python-modules/synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/synologydsm-api/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   fetchpatch,
   poetry-core,
-  pythonRelaxDepsHook,
   requests,
   urllib3,
   pytestCheckHook,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "urllib3" ];
diff --git a/pkgs/development/python-modules/tabcmd/default.nix b/pkgs/development/python-modules/tabcmd/default.nix
index e713fef830a78..7638e67378ae4 100644
--- a/pkgs/development/python-modules/tabcmd/default.nix
+++ b/pkgs/development/python-modules/tabcmd/default.nix
@@ -12,7 +12,6 @@
   pytestCheckHook,
   python3,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   setuptools-scm,
@@ -47,7 +46,6 @@ buildPythonPackage rec {
     "urllib3"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/tableauserverclient/default.nix b/pkgs/development/python-modules/tableauserverclient/default.nix
index bc4141a03e015..87d6bc18ad64a 100644
--- a/pkgs/development/python-modules/tableauserverclient/default.nix
+++ b/pkgs/development/python-modules/tableauserverclient/default.nix
@@ -6,7 +6,6 @@
   packaging,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   requests-mock,
   setuptools,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
     versioneer
   ];
 
diff --git a/pkgs/development/python-modules/tago/default.nix b/pkgs/development/python-modules/tago/default.nix
index 974a7b44884f3..eb42efff56896 100644
--- a/pkgs/development/python-modules/tago/default.nix
+++ b/pkgs/development/python-modules/tago/default.nix
@@ -6,7 +6,6 @@
   promise,
   python-socketio,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   websockets,
 }:
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = true;
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/tagoio-sdk/default.nix b/pkgs/development/python-modules/tagoio-sdk/default.nix
index b32338821d660..4e2984a987215 100644
--- a/pkgs/development/python-modules/tagoio-sdk/default.nix
+++ b/pkgs/development/python-modules/tagoio-sdk/default.nix
@@ -8,7 +8,6 @@
   python-dateutil,
   python-socketio,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   requests-mock,
 }:
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/taskw-ng/default.nix b/pkgs/development/python-modules/taskw-ng/default.nix
index 15f6412831d63..90f9ce35ed88c 100644
--- a/pkgs/development/python-modules/taskw-ng/default.nix
+++ b/pkgs/development/python-modules/taskw-ng/default.nix
@@ -8,7 +8,6 @@
   poetry-dynamic-versioning,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   taskwarrior,
 }:
@@ -37,7 +36,6 @@ buildPythonPackage rec {
     poetry-dynamic-versioning
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     kitchen
diff --git a/pkgs/development/python-modules/tbm-utils/default.nix b/pkgs/development/python-modules/tbm-utils/default.nix
index fbd675bd2ebf9..f2cec77022a70 100644
--- a/pkgs/development/python-modules/tbm-utils/default.nix
+++ b/pkgs/development/python-modules/tbm-utils/default.nix
@@ -10,7 +10,6 @@
   pprintpp,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   wrapt,
 }:
 
@@ -52,7 +51,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     attrs
diff --git a/pkgs/development/python-modules/tensorboard/default.nix b/pkgs/development/python-modules/tensorboard/default.nix
index 62b054d76f9a8..68e469eed7254 100644
--- a/pkgs/development/python-modules/tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorboard/default.nix
@@ -3,7 +3,6 @@
   fetchPypi,
   buildPythonPackage,
   pythonOlder,
-  pythonRelaxDepsHook,
   numpy,
   wheel,
   werkzeug,
@@ -35,7 +34,6 @@ buildPythonPackage rec {
     hash = "sha256-nytOfa2GZnYVwOXNBy8eqEA/wDKimfAHLW90hVd1zEU=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [
     "google-auth-oauthlib"
diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix
index b097963861c5b..6024d844d1c5d 100644
--- a/pkgs/development/python-modules/testtools/default.nix
+++ b/pkgs/development/python-modules/testtools/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   pythonAtLeast,
-  pythonRelaxDepsHook,
 
   # build-system
   hatchling,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     hatchling
     hatch-vcs
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [ "fixtures" ];
diff --git a/pkgs/development/python-modules/textnets/default.nix b/pkgs/development/python-modules/textnets/default.nix
index 9defe9da25ab7..09b47a1b12075 100644
--- a/pkgs/development/python-modules/textnets/default.nix
+++ b/pkgs/development/python-modules/textnets/default.nix
@@ -10,7 +10,6 @@
   poetry-core,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   scipy,
   setuptools,
   spacy,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     cython
     poetry-core
     setuptools
diff --git a/pkgs/development/python-modules/tf-keras/default.nix b/pkgs/development/python-modules/tf-keras/default.nix
index 0e04011592109..da7d2d6d869c7 100644
--- a/pkgs/development/python-modules/tf-keras/default.nix
+++ b/pkgs/development/python-modules/tf-keras/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
-  pythonRelaxDepsHook,
   setuptools,
   wheel,
   numpy,
@@ -25,7 +24,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/tf2onnx/default.nix b/pkgs/development/python-modules/tf2onnx/default.nix
index 7c1926a11cbd7..73c19842f103e 100644
--- a/pkgs/development/python-modules/tf2onnx/default.nix
+++ b/pkgs/development/python-modules/tf2onnx/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   pytest-runner,
   # runtime dependencies
   numpy,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     pytest-runner
   ];
 
diff --git a/pkgs/development/python-modules/thelogrus/default.nix b/pkgs/development/python-modules/thelogrus/default.nix
index 4331119261028..2ba9c5c1fd9b5 100644
--- a/pkgs/development/python-modules/thelogrus/default.nix
+++ b/pkgs/development/python-modules/thelogrus/default.nix
@@ -6,7 +6,6 @@
   poetry-core,
   pyaml,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -25,7 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pyaml" ];
diff --git a/pkgs/development/python-modules/tilequant/default.nix b/pkgs/development/python-modules/tilequant/default.nix
index 66d735d966bd4..e6f43890f5647 100644
--- a/pkgs/development/python-modules/tilequant/default.nix
+++ b/pkgs/development/python-modules/tilequant/default.nix
@@ -6,7 +6,6 @@
   ordered-set,
   pillow,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   setuptools-dso,
   sortedcollections,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pillow" ];
 
   build-system = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/tinycss2/default.nix b/pkgs/development/python-modules/tinycss2/default.nix
index 804d4efe59732..730bbfc4f4d7f 100644
--- a/pkgs/development/python-modules/tinycss2/default.nix
+++ b/pkgs/development/python-modules/tinycss2/default.nix
@@ -10,18 +10,20 @@
 
 buildPythonPackage rec {
   pname = "tinycss2";
-  version = "1.2.1";
+  version = "1.3.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "kozea";
     repo = "tinycss2";
-    rev = "refs/tags/v${version}";
+
+    # Tag v1.3.0 is missing the actual version number bump.
+    rev = "bda62b101530588718d931d61bcc343a628b9af9";
     # for tests
     fetchSubmodules = true;
-    hash = "sha256-rJtxMmW30NK+E+Dhh/fu6FPrEojWWdoEWNt0raYEubs=";
+    hash = "sha256-Exjxdm0VnnjHUKjquXsC/zDmwA7bELHdX1f55IGBjYk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index d5d7e823bed7c..752a6dc28eb58 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -30,7 +30,6 @@
   which,
   pybind11,
   removeReferencesTo,
-  pythonRelaxDepsHook,
 
   # Build inputs
   numactl,
@@ -429,7 +428,6 @@ buildPythonPackage rec {
       which
       ninja
       pybind11
-      pythonRelaxDepsHook
       removeReferencesTo
     ]
     ++ lib.optionals cudaSupport (
diff --git a/pkgs/development/python-modules/treex/default.nix b/pkgs/development/python-modules/treex/default.nix
index 151e6f41ac7be..cc98867484a66 100644
--- a/pkgs/development/python-modules/treex/default.nix
+++ b/pkgs/development/python-modules/treex/default.nix
@@ -16,7 +16,6 @@
   tensorflow,
   treeo,
   torchmetrics,
-  pythonRelaxDepsHook,
   torch,
 }:
 
@@ -44,7 +43,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   buildInputs = [ jaxlib ];
diff --git a/pkgs/development/python-modules/tubeup/default.nix b/pkgs/development/python-modules/tubeup/default.nix
index a9dd6c8f5a506..3b351c3a608ff 100644
--- a/pkgs/development/python-modules/tubeup/default.nix
+++ b/pkgs/development/python-modules/tubeup/default.nix
@@ -6,7 +6,6 @@
   yt-dlp,
   docopt,
   pythonOlder,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -21,7 +20,6 @@ buildPythonPackage rec {
     sha256 = "sha256-Pp4h0MBoYhczmxPq21cLiYpLUeFP+2JoACcFpBl3b0E=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     internetarchive
diff --git a/pkgs/development/python-modules/twill/default.nix b/pkgs/development/python-modules/twill/default.nix
index 3077cee0c6d10..9403f50f326b2 100644
--- a/pkgs/development/python-modules/twill/default.nix
+++ b/pkgs/development/python-modules/twill/default.nix
@@ -7,7 +7,6 @@
   pyparsing,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   quixote,
   setuptools,
 }:
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     httpx
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 8492807e71d21..8449cc2a6f125 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -130,6 +130,10 @@ buildPythonPackage rec {
       echo 'WorkerReporterTests.test_addSkipPyunit.skip = "'WorkerReporter' object has no attribute '_testStarted'"' >> src/twisted/trial/_dist/test/test_workerreporter.py
       echo 'LocalWorkerAMPTests.test_runSkip.skip = "twisted.protocols.amp.UnknownRemoteError: Code<UNKNOWN>: Unknown Error"' >> src/twisted/trial/_dist/test/test_worker.py
 
+      # https://github.com/twisted/twisted/issues/12194
+      echo 'FlattenerErrorTests.test_asynchronousFlattenError.skip = "builtins.KeyError: 'root'"' >> src/twisted/web/test/test_flatten.py
+      echo 'FlattenerErrorTests.test_cancel.skip = "builtins.KeyError: 'root'"' >> src/twisted/web/test/test_flatten.py
+
       # not packaged
       substituteInPlace src/twisted/test/test_failure.py \
         --replace "from cython_test_exception_raiser import raiser  # type: ignore[import]" "raiser = None"
diff --git a/pkgs/development/python-modules/txtai/default.nix b/pkgs/development/python-modules/txtai/default.nix
index a689f4381d6cf..b2b9704d5425c 100644
--- a/pkgs/development/python-modules/txtai/default.nix
+++ b/pkgs/development/python-modules/txtai/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
   # propagated build input
   faiss,
   torch,
@@ -159,7 +158,6 @@ buildPythonPackage {
     hash = "sha256-2d31wzUz0/FcrejDIog2EI4BXgjd7XXpN4tRXpLk5DI=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRemoveDeps = [
     # We call it faiss, not faiss-cpu.
diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index 1c80ea352c09d..41e7c35791ac7 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -8,6 +8,7 @@
   pytestCheckHook,
   typing-extensions,
   importlib-metadata,
+  mypy,
   sphinxHook,
   sphinx-autodoc-typehints,
   sphinx-rtd-theme,
@@ -16,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "typeguard";
-  version = "4.2.1";
-  format = "pyproject";
+  version = "4.3.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xVahuVlIIwUQBwylP6A0H7CWRhG9BdWY2H+1IRXWX+4=";
+    hash = "sha256-ku5qCuyRNRgermBn69YX/Z3o111xT7VIcopJM7HeplE=";
   };
 
   outputs = [
@@ -31,7 +32,7 @@ buildPythonPackage rec {
     "doc"
   ];
 
-  nativeBuildInputs = [
+  build-system = [
     glibcLocales
     setuptools
     setuptools-scm
@@ -40,13 +41,16 @@ buildPythonPackage rec {
     sphinx-rtd-theme
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     typing-extensions
   ] ++ lib.optionals (pythonOlder "3.10") [ importlib-metadata ];
 
   env.LC_ALL = "en_US.utf-8";
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    mypy
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "typeguard" ];
 
diff --git a/pkgs/development/python-modules/typer-shell/default.nix b/pkgs/development/python-modules/typer-shell/default.nix
index bb195d121fb62..b54ad8d256f6f 100644
--- a/pkgs/development/python-modules/typer-shell/default.nix
+++ b/pkgs/development/python-modules/typer-shell/default.nix
@@ -6,7 +6,6 @@
   fetchFromGitHub,
   iterfzf,
   poetry-core,
-  pythonRelaxDepsHook,
   pythonOlder,
   pyyaml,
   rich,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     click
diff --git a/pkgs/development/python-modules/typical/default.nix b/pkgs/development/python-modules/typical/default.nix
index 8201e4ba8104d..357bb8d1094a5 100644
--- a/pkgs/development/python-modules/typical/default.nix
+++ b/pkgs/development/python-modules/typical/default.nix
@@ -12,7 +12,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   sqlalchemy,
   ujson,
 }:
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     fastjsonschema
diff --git a/pkgs/development/python-modules/ufo2ft/default.nix b/pkgs/development/python-modules/ufo2ft/default.nix
index af40d6be25039..4710d1182992c 100644
--- a/pkgs/development/python-modules/ufo2ft/default.nix
+++ b/pkgs/development/python-modules/ufo2ft/default.nix
@@ -11,7 +11,6 @@
   fonttools,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools-scm,
   skia-pathops,
   ufolib2,
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "cffsubr" ];
diff --git a/pkgs/development/python-modules/universal-silabs-flasher/default.nix b/pkgs/development/python-modules/universal-silabs-flasher/default.nix
index e4b09034d18f3..55551a5206ef7 100644
--- a/pkgs/development/python-modules/universal-silabs-flasher/default.nix
+++ b/pkgs/development/python-modules/universal-silabs-flasher/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonRelaxDepsHook,
 
   # build-system
   setuptools,
@@ -43,7 +42,6 @@ buildPythonPackage rec {
       --replace-fail 'dynamic = ["version"]' 'version = "${version}"'
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/uplc/default.nix b/pkgs/development/python-modules/uplc/default.nix
index 993706665e087..8d93cd5926267 100644
--- a/pkgs/development/python-modules/uplc/default.nix
+++ b/pkgs/development/python-modules/uplc/default.nix
@@ -2,7 +2,6 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
-  pythonRelaxDepsHook,
   # Python deps
   frozenlist2,
   python-secp256k1-cardano,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-djJMNXijMVzMVzw8NZSe3YFRGyAPqdvr0P374Za5XkU=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     setuptools
diff --git a/pkgs/development/python-modules/vallox-websocket-api/default.nix b/pkgs/development/python-modules/vallox-websocket-api/default.nix
index 9558cbe056df8..292d18bee421e 100644
--- a/pkgs/development/python-modules/vallox-websocket-api/default.nix
+++ b/pkgs/development/python-modules/vallox-websocket-api/default.nix
@@ -3,7 +3,6 @@
   aiohttp,
   buildPythonPackage,
   pythonOlder,
-  pythonRelaxDepsHook,
   fetchFromGitHub,
   setuptools,
   construct,
@@ -28,7 +27,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "websockets" ];
diff --git a/pkgs/development/python-modules/vdirsyncer/default.nix b/pkgs/development/python-modules/vdirsyncer/default.nix
index ab0af940e3e19..7851df4a29712 100644
--- a/pkgs/development/python-modules/vdirsyncer/default.nix
+++ b/pkgs/development/python-modules/vdirsyncer/default.nix
@@ -23,7 +23,6 @@
   aioresponses,
   vdirsyncer,
   testers,
-  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -46,7 +45,6 @@ buildPythonPackage rec {
     setuptools
     setuptools-scm
     wheel
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "aiostream" ];
diff --git a/pkgs/development/python-modules/vega/default.nix b/pkgs/development/python-modules/vega/default.nix
index aa37f746a011e..d7fbe2cabaa2f 100644
--- a/pkgs/development/python-modules/vega/default.nix
+++ b/pkgs/development/python-modules/vega/default.nix
@@ -4,7 +4,6 @@
   fetchpatch,
   fetchPypi,
   pythonOlder,
-  pythonRelaxDepsHook,
   altair,
   ipytablewidgets,
   ipywidgets,
@@ -39,7 +38,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "pandas" ];
diff --git a/pkgs/development/python-modules/vivisect/default.nix b/pkgs/development/python-modules/vivisect/default.nix
index b5b93f3ccd225..ef939cbdca6e0 100644
--- a/pkgs/development/python-modules/vivisect/default.nix
+++ b/pkgs/development/python-modules/vivisect/default.nix
@@ -8,7 +8,6 @@
   pyasn1-modules,
   pycparser,
   pyqt5,
-  pythonRelaxDepsHook,
   pyqtwebengine,
   pythonOlder,
   withGui ? false,
@@ -34,7 +33,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/development/python-modules/vt-py/default.nix b/pkgs/development/python-modules/vt-py/default.nix
index c0d6fa22c952f..ca26ec29bd554 100644
--- a/pkgs/development/python-modules/vt-py/default.nix
+++ b/pkgs/development/python-modules/vt-py/default.nix
@@ -7,7 +7,6 @@
   pytest-asyncio,
   pytest-httpserver,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   pythonOlder,
   setuptools,
 }:
@@ -35,7 +34,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [ aiohttp ];
 
diff --git a/pkgs/development/python-modules/vulcan-api/default.nix b/pkgs/development/python-modules/vulcan-api/default.nix
index 91fb221734697..37baf7f80f342 100644
--- a/pkgs/development/python-modules/vulcan-api/default.nix
+++ b/pkgs/development/python-modules/vulcan-api/default.nix
@@ -8,7 +8,6 @@
   fetchFromGitHub,
   pyopenssl,
   pythonOlder,
-  pythonRelaxDepsHook,
   pytz,
   related,
   requests,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [ "faust-cchardet" ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = [
     aenum
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index a41f5b94632ad..fbd5d9baabf58 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -40,7 +40,6 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   pyyaml,
   requests,
   responses,
@@ -77,7 +76,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/weasel/default.nix b/pkgs/development/python-modules/weasel/default.nix
index 244b2e9587ad7..bf01bbf033d21 100644
--- a/pkgs/development/python-modules/weasel/default.nix
+++ b/pkgs/development/python-modules/weasel/default.nix
@@ -8,7 +8,6 @@
   pydantic,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   setuptools,
   smart-open,
@@ -38,7 +37,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/weasyprint/default.nix b/pkgs/development/python-modules/weasyprint/default.nix
index d07a93a3a8b43..8254891669a09 100644
--- a/pkgs/development/python-modules/weasyprint/default.nix
+++ b/pkgs/development/python-modules/weasyprint/default.nix
@@ -25,15 +25,15 @@
 
 buildPythonPackage rec {
   pname = "weasyprint";
-  version = "61.2";
+  version = "62.1";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit version;
     pname = "weasyprint";
-    hash = "sha256-R99s/u/4xsKM8uTK+DfN4XcV7+RicIradLqi6zkbYFk=";
+    hash = "sha256-vzwamsQZQnGnzxFyKcCTdEEFtQrC+mTApuROaK50KZI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/weasyprint/library-paths.patch b/pkgs/development/python-modules/weasyprint/library-paths.patch
index 6d884f43ed3cd..e54561a4018a2 100644
--- a/pkgs/development/python-modules/weasyprint/library-paths.patch
+++ b/pkgs/development/python-modules/weasyprint/library-paths.patch
@@ -1,14 +1,14 @@
 diff --git a/weasyprint/text/ffi.py b/weasyprint/text/ffi.py
-index 09f614aad..cbe9a73dd 100644
+index 3aba3e75..dde0e260 100644
 --- a/weasyprint/text/ffi.py
 +++ b/weasyprint/text/ffi.py
-@@ -415,22 +415,11 @@ def _dlopen(ffi, *names):
+@@ -429,22 +429,11 @@ if hasattr(os, 'add_dll_directory'):  # pragma: no cover
          with suppress((OSError, FileNotFoundError)):
              os.add_dll_directory(dll_directory)
  
 -gobject = _dlopen(
 -    ffi, 'gobject-2.0-0', 'gobject-2.0', 'libgobject-2.0-0',
--    'libgobject-2.0.so.0', 'libgobject-2.0.dylib',  'libgobject-2.0-0.dll')
+-    'libgobject-2.0.so.0', 'libgobject-2.0.dylib', 'libgobject-2.0-0.dll')
 -pango = _dlopen(
 -    ffi, 'pango-1.0-0', 'pango-1.0', 'libpango-1.0-0', 'libpango-1.0.so.0',
 -    'libpango-1.0.dylib', 'libpango-1.0-0.dll')
@@ -28,4 +28,5 @@ index 09f614aad..cbe9a73dd 100644
 +fontconfig = _dlopen(ffi, '@fontconfig@')
 +pangoft2 = _dlopen(ffi, '@pangoft2@')
  
- gobject.g_type_init()
\ No newline at end of file
+ gobject.g_type_init()
+ 
diff --git a/pkgs/development/python-modules/weaviate-client/default.nix b/pkgs/development/python-modules/weaviate-client/default.nix
index d9916af5069d8..67f2965805791 100644
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -9,7 +9,6 @@
   httpx,
   pydantic,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools-scm,
   tqdm,
   validators,
@@ -36,7 +35,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools-scm ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     authlib
diff --git a/pkgs/development/python-modules/weconnect-mqtt/default.nix b/pkgs/development/python-modules/weconnect-mqtt/default.nix
index 30e5accbb3cf2..bdbd57513c568 100644
--- a/pkgs/development/python-modules/weconnect-mqtt/default.nix
+++ b/pkgs/development/python-modules/weconnect-mqtt/default.nix
@@ -6,7 +6,6 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   weconnect,
 }:
@@ -39,7 +38,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   dependencies = [
     paho-mqtt
diff --git a/pkgs/development/python-modules/wheel-inspect/default.nix b/pkgs/development/python-modules/wheel-inspect/default.nix
index 683cec66d3a5b..43b5f8dbedd5e 100644
--- a/pkgs/development/python-modules/wheel-inspect/default.nix
+++ b/pkgs/development/python-modules/wheel-inspect/default.nix
@@ -7,7 +7,6 @@
   hatchling,
   headerparser,
   jsonschema,
-  pythonRelaxDepsHook,
   packaging,
   pytestCheckHook,
   pythonOlder,
@@ -42,7 +41,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/woob/default.nix b/pkgs/development/python-modules/woob/default.nix
index 7249390ab7189..41450c7e27a88 100644
--- a/pkgs/development/python-modules/woob/default.nix
+++ b/pkgs/development/python-modules/woob/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   fetchFromGitLab,
   fetchpatch,
-  pythonRelaxDepsHook,
   html2text,
   lxml,
   packaging,
@@ -48,7 +47,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "packaging" ];
diff --git a/pkgs/development/python-modules/xarray-dataclasses/default.nix b/pkgs/development/python-modules/xarray-dataclasses/default.nix
index 78de25f5bfbfc..09205ea9e1777 100644
--- a/pkgs/development/python-modules/xarray-dataclasses/default.nix
+++ b/pkgs/development/python-modules/xarray-dataclasses/default.nix
@@ -5,7 +5,6 @@
   pythonOlder,
   poetry-core,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   numpy,
   typing-extensions,
   xarray,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [ "xarray" ];
diff --git a/pkgs/development/python-modules/xhtml2pdf/default.nix b/pkgs/development/python-modules/xhtml2pdf/default.nix
index fcaee169841f7..1ab72c73a81be 100644
--- a/pkgs/development/python-modules/xhtml2pdf/default.nix
+++ b/pkgs/development/python-modules/xhtml2pdf/default.nix
@@ -12,7 +12,6 @@
   pytestCheckHook,
   python-bidi,
   pythonOlder,
-  pythonRelaxDepsHook,
   reportlab,
   setuptools,
   svglib,
@@ -42,7 +41,6 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index 02f6bc25c86a1..514f6222dc451 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -12,7 +12,6 @@
   pycryptodomex,
   pytestCheckHook,
   pythonOlder,
-  pythonRelaxDepsHook,
   sensor-state-data,
 }:
 
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   pythonRelaxDeps = [ "pycryptodomex" ];
 
diff --git a/pkgs/development/python-modules/yark/default.nix b/pkgs/development/python-modules/yark/default.nix
index 9196169d27de2..30143e8a90fa1 100644
--- a/pkgs/development/python-modules/yark/default.nix
+++ b/pkgs/development/python-modules/yark/default.nix
@@ -8,7 +8,6 @@
   poetry-core,
   progress,
   pythonOlder,
-  pythonRelaxDepsHook,
   requests,
   yt-dlp,
 }:
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ypy-websocket/default.nix b/pkgs/development/python-modules/ypy-websocket/default.nix
index 06aa6fec33c5f..d50c231a574b6 100644
--- a/pkgs/development/python-modules/ypy-websocket/default.nix
+++ b/pkgs/development/python-modules/ypy-websocket/default.nix
@@ -9,7 +9,6 @@
   y-py,
   pytest-asyncio,
   pytestCheckHook,
-  pythonRelaxDepsHook,
   uvicorn,
   websockets,
 }:
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zha/default.nix b/pkgs/development/python-modules/zha/default.nix
index f8ba88bdf0c64..4843d1e8a6f32 100644
--- a/pkgs/development/python-modules/zha/default.nix
+++ b/pkgs/development/python-modules/zha/default.nix
@@ -13,7 +13,6 @@
   pytestCheckHook,
   python-slugify,
   pythonOlder,
-  pythonRelaxDepsHook,
   setuptools,
   universal-silabs-flasher,
   wheel,
@@ -53,7 +52,6 @@ buildPythonPackage rec {
     "zigpy"
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   build-system = [
     setuptools
diff --git a/pkgs/development/python-modules/zope-interface/default.nix b/pkgs/development/python-modules/zope-interface/default.nix
index 3cc208094d26b..c94e4a0366c56 100644
--- a/pkgs/development/python-modules/zope-interface/default.nix
+++ b/pkgs/development/python-modules/zope-interface/default.nix
@@ -2,25 +2,30 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   zope-event,
 }:
 
 buildPythonPackage rec {
   pname = "zope.interface";
-  version = "5.5.2";
+  version = "6.4.post2";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v+4fP/YhQ4GUmeNI9bin86oCWfmspeDdrnOR0Fnc5nE=";
+    hash = "sha256-HCB+b239V0mib1pf2WZgLWuCTsANLfhKfpqSTokzZU4=";
   };
 
-  propagatedBuildInputs = [ zope-event ];
+  build-system = [ setuptools ];
+
+  dependencies = [ zope-event ];
 
   doCheck = false; # Circular deps.
 
   meta = with lib; {
+    changelog = "https://github.com/zopefoundation/zope.interface/blob/${version}/CHANGES.rst";
     description = "Zope.Interface";
-    homepage = "https://zope.org/Products/ZopeInterface";
+    homepage = "https://github.com/zopefoundation/zope.interface";
     license = licenses.zpl20;
     maintainers = [ maintainers.goibhniu ];
   };
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 3b925694c93ca..c726577b1f010 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -47,7 +47,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/development/tools/boost-build/default.nix b/pkgs/development/tools/boost-build/default.nix
index 6b485b80ea1c0..a74b029d327ad 100644
--- a/pkgs/development/tools/boost-build/default.nix
+++ b/pkgs/development/tools/boost-build/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   installPhase = ''
     runHook preInstall
 
-    ./b2 install --prefix="$out"
+    ./b2 ${lib.optionalString (stdenv.cc.isClang) "toolset=clang "}install --prefix="$out"
 
     # older versions of b2 created this symlink,
     # which we want to support building via useBoost.
diff --git a/pkgs/development/tools/build-managers/conan/default.nix b/pkgs/development/tools/build-managers/conan/default.nix
index a2f007a0fcf4f..39d974e0f3b8e 100644
--- a/pkgs/development/tools/build-managers/conan/default.nix
+++ b/pkgs/development/tools/build-managers/conan/default.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/circup/default.nix b/pkgs/development/tools/circup/default.nix
index e63e0d06ea14c..29b6cb3d8a381 100644
--- a/pkgs/development/tools/circup/default.nix
+++ b/pkgs/development/tools/circup/default.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/continuous-integration/buildbot/master.nix b/pkgs/development/tools/continuous-integration/buildbot/master.nix
index a0e11089497c2..ad9308ddda4c3 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/master.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/master.nix
@@ -9,7 +9,6 @@
 , buildbot
 , pythonOlder
 , python
-, pythonRelaxDepsHook
 , twisted
 , jinja2
 , msgpack
@@ -86,7 +85,6 @@ buildPythonApplication rec {
   };
 
   build-system = [
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/tools/djlint/default.nix b/pkgs/development/tools/djlint/default.nix
index d84afa203e5b3..07af36e98ceed 100644
--- a/pkgs/development/tools/djlint/default.nix
+++ b/pkgs/development/tools/djlint/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/tools/documentation/gi-docgen/default.nix b/pkgs/development/tools/documentation/gi-docgen/default.nix
index b2652f6ca9fd5..9d5da739745f5 100644
--- a/pkgs/development/tools/documentation/gi-docgen/default.nix
+++ b/pkgs/development/tools/documentation/gi-docgen/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gi-docgen";
-  version = "2023.3";
+  version = "2024.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gi-docgen/${lib.versions.major version}/gi-docgen-${version}.tar.xz";
-    hash = "sha256-TesfCXc/cGJZrGUgUNp7PuWYcbw/1c+3foEdt0mNyOc=";
+    hash = "sha256-hwx3+WIEYszknjVUKkLcFhL8hYcz6D274kjFNUWK7B4=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/tools/enochecker-test/default.nix b/pkgs/development/tools/enochecker-test/default.nix
index 7e0f25317eac4..ca6a49e3502fd 100644
--- a/pkgs/development/tools/enochecker-test/default.nix
+++ b/pkgs/development/tools/enochecker-test/default.nix
@@ -2,7 +2,6 @@
 , buildPythonApplication
 , fetchPypi
 , pythonOlder
-, pythonRelaxDepsHook
 
 , certifi
 , charset-normalizer
@@ -34,7 +33,6 @@ buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/tools/fdroidserver/default.nix b/pkgs/development/tools/fdroidserver/default.nix
index 4bf70a004d3eb..e8790999e1530 100644
--- a/pkgs/development/tools/fdroidserver/default.nix
+++ b/pkgs/development/tools/fdroidserver/default.nix
@@ -4,7 +4,6 @@
 , apksigner
 , buildPythonApplication
 , python3
-, pythonRelaxDepsHook
 , installShellFiles
 , androguard
 , babel
@@ -59,7 +58,6 @@ buildPythonApplication rec {
   '';
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     installShellFiles
   ];
 
diff --git a/pkgs/development/tools/jq/default.nix b/pkgs/development/tools/jq/default.nix
index 32c131cf78595..8d4ec0d1c5a65 100644
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@@ -20,6 +20,11 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "doc" "man" "dev" "lib" "out" ];
 
+  # https://github.com/jqlang/jq/issues/2871
+  postPatch = lib.optionalString stdenv.isFreeBSD ''
+    substituteInPlace Makefile.am --replace-fail "tests/mantest" "" --replace-fail "tests/optionaltest" ""
+  '';
+
   # Upstream script that writes the version that's eventually compiled
   # and printed in `jq --help` relies on a .git directory which our src
   # doesn't keep.
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 29d0a94e301ff..996bfeacb2d16 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -24,14 +24,14 @@ with two "luarocks" derivations.
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "luarocks";
-  version = "3.11.0";
+  pname = "luarocks_bootstrap";
+  version = "3.11.1";
 
   src = fetchFromGitHub {
     owner = "luarocks";
     repo = "luarocks";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mSwwBuLWoMT38iYaV/BTdDmmBz4heTRJzxBHC0Vrvc4=";
+    hash = "sha256-GglygI8HP+aDFEuucOkjQ2Pgfv4+jW+og+2vL3KoZCQ=";
   };
 
   patches = [
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     sed -e "1s@.*@#! ${lua}/bin/lua$LUA_SUFFIX@" -i "$out"/bin/*
     substituteInPlace $out/etc/luarocks/* \
-     --replace '${lua.luaOnBuild}' '${lua}'
+     --replace-fail '${lua.luaOnBuild}' '${lua}'
    ''
     + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd luarocks \
diff --git a/pkgs/development/tools/prospector/default.nix b/pkgs/development/tools/prospector/default.nix
index 598b2570600e7..58fab74c98841 100644
--- a/pkgs/development/tools/prospector/default.nix
+++ b/pkgs/development/tools/prospector/default.nix
@@ -27,7 +27,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/skjold/default.nix b/pkgs/development/tools/skjold/default.nix
index 75de1dfe1eb24..bbd5f57a778d0 100644
--- a/pkgs/development/tools/skjold/default.nix
+++ b/pkgs/development/tools/skjold/default.nix
@@ -20,7 +20,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     click
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 962bc3e246bec..106eaabd1e62f 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -7,6 +7,7 @@
 , gnupg
 , darwin, xcbuild
 , procps, icu
+, installShellFiles
 }:
 
 { enableNpm ? true, version, sha256, patches ? [] } @args:
@@ -69,7 +70,7 @@ let
     buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ApplicationServices ]
       ++ [ zlib libuv openssl http-parser icu bash ];
 
-    nativeBuildInputs = [ which pkg-config python ]
+    nativeBuildInputs = [ installShellFiles pkg-config python which ]
       ++ lib.optionals stdenv.isDarwin [ xcbuild ];
 
     outputs = [ "out" "libv8" ];
@@ -137,14 +138,25 @@ let
       "build-node-api-tests"
       "tooltest"
       "cctest"
+      "test-ci-js"
     ];
 
-    # Do not create __pycache__ when running tests.
-    checkFlags = [ "PYTHONDONTWRITEBYTECODE=1" ];
+    checkFlags = [
+      # Do not create __pycache__ when running tests.
+      "PYTHONDONTWRITEBYTECODE=1"
+      "FLAKY_TESTS=skip"
+      # Skip some tests that are not passing in this context
+      "CI_SKIP_TESTS=test-setproctitle,test-tls-cli-max-version-1.3,test-tls-client-auth,test-child-process-exec-env,test-fs-write-stream-eagain,test-tls-sni-option,test-https-foafssl,test-child-process-uid-gid,test-process-euid-egid,test-process-initgroups,test-process-uid-gid,test-process-setgroups"
+    ];
 
     postInstall = ''
       HOST_PATH=$out/bin patchShebangs --host $out
 
+      ${lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        $out/bin/${self.meta.mainProgram} --completion-bash > ${self.meta.mainProgram}.bash
+        installShellCompletion ${self.meta.mainProgram}.bash
+      ''}
+
       ${lib.optionalString (enableNpm) ''
         mkdir -p $out/share/bash-completion/completions
         ln -s $out/lib/node_modules/npm/lib/utils/completion.sh \
diff --git a/pkgs/development/web/nodejs/use-correct-env-in-tests.patch b/pkgs/development/web/nodejs/use-correct-env-in-tests.patch
new file mode 100644
index 0000000000000..d2fda8d2ceadf
--- /dev/null
+++ b/pkgs/development/web/nodejs/use-correct-env-in-tests.patch
@@ -0,0 +1,24 @@
+`/usr/bin/env` is not available.
+
+--- old/test/common/assertSnapshot.js
++++ new/test/common/assertSnapshot.js
+@@ -81,2 +81,2 @@ async function spawnAndAssert(filename, transform = (x) => x, { tty = false, ...
+-  const executable = tty ? 'tools/pseudo-tty.py' : process.execPath;
+-  const args = tty ? [process.execPath, ...flags, filename] : [...flags, filename];
++  const executable = tty ? 'python3' : process.execPath;
++  const args = tty ? ['tools/pseudo-tty.py', process.execPath, ...flags, filename] : [...flags, filename];
+--- old/test/parallel/test-child-process-default-options.js
++++ new/test/parallel/test-child-process-default-options.js
+@@ -35 +35 @@ if (isWindows) {
+-  child = spawn('/usr/bin/env', [], {});
++  child = spawn('env', [], {});
+--- old/test/parallel/test-child-process-env.js
++++ new/test/parallel/test-child-process-env.js
+@@ -51 +51 @@ if (isWindows) {
+-  child = spawn('/usr/bin/env', [], { env });
++  child = spawn('env', [], { env });
+--- old/test/parallel/test-child-process-exec-env.js
++++ new/test/parallel/test-child-process-exec-env.js
+@@ -47 +47 @@ if (!isWindows) {
+-  child = exec('/usr/bin/env', { env: { 'HELLO': 'WORLD' } }, after);
++  child = exec('env', { env: { 'HELLO': 'WORLD' } }, after);
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index 6b3ca7635e436..7f80e2070f383 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -1,4 +1,4 @@
-{ callPackage, lib, overrideCC, pkgs, buildPackages, openssl, python3, enableNpm ? true }:
+{ callPackage, lib, overrideCC, pkgs, buildPackages, openssl, python3, fetchpatch2, enableNpm ? true }:
 
 let
   # Clang 16+ cannot build Node v18 due to -Wenum-constexpr-conversion errors.
@@ -27,5 +27,10 @@ buildNodejs {
     ./revert-arm64-pointer-auth.patch
     ./node-npm-build-npm-package-logic.patch
     ./trap-handler-backport.patch
+    ./use-correct-env-in-tests.patch
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/534c122de166cb6464b489f3e6a9a544ceb1c913.patch";
+      hash = "sha256-4q4LFsq4yU1xRwNsM1sJoNVphJCnxaVe2IyL6AeHJ/I=";
+    })
   ];
 }
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index b716f9bdd1ed5..21da25aaab939 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -1,4 +1,4 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, fetchpatch2, openssl, python3, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
@@ -8,12 +8,16 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "20.12.2";
-  sha256 = "sha256-18vMX7+zHpAB8/AVC77aWavl3XE3qqYnOVjNWc41ztc=";
+  version = "20.14.0";
+  sha256 = "sha256-CGVQKPDYQ26IFj+RhgRNY10/Nqhe5Sjza9BbbF5Gwbs=";
   patches = [
-    ./revert-arm64-pointer-auth.patch
     ./disable-darwin-v8-system-instrumentation-node19.patch
     ./bypass-darwin-xcrun-node16.patch
     ./node-npm-build-npm-package-logic.patch
+    ./use-correct-env-in-tests.patch
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/534c122de166cb6464b489f3e6a9a544ceb1c913.patch";
+      hash = "sha256-4q4LFsq4yU1xRwNsM1sJoNVphJCnxaVe2IyL6AeHJ/I=";
+    })
   ];
 }
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index ec5cc40cc9c2d..a77c0987f0d96 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -1,4 +1,4 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, fetchpatch2, openssl, python3, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
@@ -14,5 +14,10 @@ buildNodejs {
     ./disable-darwin-v8-system-instrumentation-node19.patch
     ./bypass-darwin-xcrun-node16.patch
     ./node-npm-build-npm-package-logic.patch
+    ./use-correct-env-in-tests.patch
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/534c122de166cb6464b489f3e6a9a544ceb1c913.patch";
+      hash = "sha256-4q4LFsq4yU1xRwNsM1sJoNVphJCnxaVe2IyL6AeHJ/I=";
+    })
   ];
 }
diff --git a/pkgs/games/empty-epsilon/default.nix b/pkgs/games/empty-epsilon/default.nix
index 657607031295a..542e920b78fcb 100644
--- a/pkgs/games/empty-epsilon/default.nix
+++ b/pkgs/games/empty-epsilon/default.nix
@@ -33,7 +33,8 @@ let
     buildInputs = [ sfml libX11 glm SDL2 ];
 
     cmakeFlags = [
-      "-DFETCHCONTENT_SOURCE_DIR_BASIS=${basis-universal}"
+      (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_BASIS" "${basis-universal}")
+      (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DGLM_ENABLE_EXPERIMENTAL")
     ];
 
     meta = with lib; {
@@ -63,15 +64,16 @@ stdenv.mkDerivation {
   buildInputs = [ serious-proton sfml glew libX11 python3 glm SDL2 ninja ];
 
   cmakeFlags = [
-    "-DSERIOUS_PROTON_DIR=${serious-proton.src}"
-    "-DCPACK_PACKAGE_VERSION=${version.emptyepsilon}"
-    "-DCPACK_PACKAGE_VERSION_MAJOR=${major}"
-    "-DCPACK_PACKAGE_VERSION_MINOR=${minor}"
-    "-DCPACK_PACKAGE_VERSION_PATCH=${patch.emptyepsilon}"
-    "-DFETCHCONTENT_SOURCE_DIR_BASIS=${basis-universal}"
-    "-DFETCHCONTENT_SOURCE_DIR_MESHOPTIMIZER=${meshoptimizer.src}"
-    "-DCMAKE_AR=${stdenv.cc.cc}/bin/gcc-ar"
-    "-DCMAKE_RANLIB=${stdenv.cc.cc}/bin/gcc-ranlib"
+    (lib.cmakeFeature "SERIOUS_PROTON_DIR" "${serious-proton.src}")
+    (lib.cmakeFeature "CPACK_PACKAGE_VERSION" "${version.emptyepsilon}")
+    (lib.cmakeFeature "CPACK_PACKAGE_VERSION_MAJOR" "${major}")
+    (lib.cmakeFeature "CPACK_PACKAGE_VERSION_MINOR" "${minor}")
+    (lib.cmakeFeature "CPACK_PACKAGE_VERSION_PATCH" "${patch.emptyepsilon}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_BASIS" "${basis-universal}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_MESHOPTIMIZER" "${meshoptimizer.src}")
+    (lib.cmakeFeature "CMAKE_AR" "${stdenv.cc.cc}/bin/gcc-ar")
+    (lib.cmakeFeature "CMAKE_RANLIB" "${stdenv.cc.cc}/bin/gcc-ranlib")
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DGLM_ENABLE_EXPERIMENTAL")
     "-G Ninja"
   ];
 
diff --git a/pkgs/games/frogatto/engine.nix b/pkgs/games/frogatto/engine.nix
index 1efdb2ceee042..d5e380588176c 100644
--- a/pkgs/games/frogatto/engine.nix
+++ b/pkgs/games/frogatto/engine.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation {
     glm
   ];
 
+  env.CXXFLAGS = "-DGLM_ENABLE_EXPERIMENTAL -Wno-error=deprecated-declarations";
+
   enableParallelBuilding = true;
 
   installPhase = ''
diff --git a/pkgs/games/katago/default.nix b/pkgs/games/katago/default.nix
index a633430ee673e..6bbe30ce4d30a 100644
--- a/pkgs/games/katago/default.nix
+++ b/pkgs/games/katago/default.nix
@@ -53,11 +53,9 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (backend == "cuda") [
     cudaPackages.cudnn
     cudaPackages.cudatoolkit
-    mesa.drivers
   ] ++ lib.optionals (backend == "tensorrt") [
       cudaPackages.cudatoolkit
       cudaPackages.tensorrt
-      mesa.drivers
   ] ++ lib.optionals (backend == "opencl") [
     opencl-headers
     ocl-icd
diff --git a/pkgs/games/solarus/default.nix b/pkgs/games/solarus/default.nix
index fd80b03066ce6..b59c20c2b3226 100644
--- a/pkgs/games/solarus/default.nix
+++ b/pkgs/games/solarus/default.nix
@@ -22,6 +22,10 @@ mkDerivation rec {
     openal libmodplug libvorbis
     qtbase glm ];
 
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DGLM_ENABLE_EXPERIMENTAL")
+  ];
+
   preFixup = ''
     mkdir $lib/
     mv $out/lib $lib
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index eb3b84d04529e..ad98f3fa768f7 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -127,7 +127,7 @@ python3Packages.buildPythonApplication {
       -e s,/usr/bin/perl,${perl}/bin/perl,g \
       -e s,/usr/bin/file,${file}/bin/file,g \
       -e s,/usr/bin/gs,${ghostscript}/bin/gs,g \
-      -e s,/usr/share/cups/fonts,${ghostscript}/share/ghostscript/fonts,g \
+      -e s,/usr/share/cups/fonts,${ghostscript.fonts}/share/fonts,g \
       -e "s,ExecStart=/usr/bin/python /usr/bin/hp-config_usb_printer,ExecStart=$out/bin/hp-config_usb_printer,g" \
       -e s,Exec=/usr/bin/hp-uiscan,Exec=hp-uiscan,g \
       -e s,Icon=/usr/share/icons/Humanity/devices/48/printer.svg,Icon=printer,g \
diff --git a/pkgs/misc/flashfocus/default.nix b/pkgs/misc/flashfocus/default.nix
index 753f82f6bd44c..20f6846274b73 100644
--- a/pkgs/misc/flashfocus/default.nix
+++ b/pkgs/misc/flashfocus/default.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
   '';
 
   nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index 8410f77d2c077..64bdf7b0d99e5 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
     ./doc-no-ref.diff
   ];
 
-  outputs = [ "out" "man" "doc" ];
+  outputs = [ "out" "man" "doc" "fonts" ];
 
   enableParallelBuilding = true;
 
@@ -133,7 +133,9 @@ stdenv.mkDerivation rec {
 
     cp -r Resource "$out/share/ghostscript/${version}"
 
-    ln -s "${fonts}" "$out/share/ghostscript/fonts"
+    mkdir -p $fonts/share/fonts
+    cp -rv ${fonts}/* "$fonts/share/fonts/"
+    ln -s "$fonts/share/fonts" "$out/share/ghostscript/fonts"
   '' + lib.optionalString stdenv.isDarwin ''
     for file in $out/lib/*.dylib* ; do
       install_name_tool -id "$file" $file
diff --git a/pkgs/misc/lilypond/default.nix b/pkgs/misc/lilypond/default.nix
index acb3a543f68a8..e66c76614fb25 100644
--- a/pkgs/misc/lilypond/default.nix
+++ b/pkgs/misc/lilypond/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--disable-documentation"
      # FIXME: these URW fonts are not OTF, configure reports "URW++ OTF files... no".
-    "--with-urwotf-dir=${ghostscript}/share/ghostscript/fonts"
+    "--with-urwotf-dir=${ghostscript.fonts}/share/fonts"
     "--with-texgyre-dir=${gyre-fonts}/share/fonts/truetype/"
   ];
 
diff --git a/pkgs/misc/rich-cli/default.nix b/pkgs/misc/rich-cli/default.nix
index b6cf7684c44d7..a76f921dcf995 100644
--- a/pkgs/misc/rich-cli/default.nix
+++ b/pkgs/misc/rich-cli/default.nix
@@ -39,7 +39,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 4c06ea352ee03..f70ba4c7aad18 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -1,4 +1,5 @@
 { stdenv, lib, fetchFromGitLab, fetchpatch, makeWrapper, autoreconfHook
+, autoconf-archive
 , pkg-config, which
 , flex, bison
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
@@ -22,7 +23,7 @@
 }:
 
 let
-  apparmor-version = "3.1.7";
+  apparmor-version = "4.0.1";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
@@ -36,7 +37,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    hash = "sha256-AzY05bcpNYXix2GL4Rhc9d3RBA1pd2fwOa7yoiwc2nQ=";
+    hash = "sha256-0S/P62wi3/aPATvJL6afu+SebjoSHsTMu/WV9m7E1OE=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
@@ -86,6 +87,7 @@ let
     strictDeps = false;
 
     nativeBuildInputs = [
+      autoconf-archive
       autoreconfHook
       bison
       flex
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 0e32966615ac1..cc0576d4f64eb 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.7.1";
+  version = "2.7.3";
 
   outputs = [ "bin" "out" "dev" "man" ];
   separateDebugInfo = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-2l0UGeKobgGqMv15WCzVTSCIV8tUG8ov1Cal/xqqu8M=";
+    hash = "sha256-t3KuT23wzucgCyjOqWDk2q/yogPS/VAr6rPBMXsHpFY=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index 610f9d31353e2..1f7aa3abf0b6c 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -29,11 +29,9 @@ mkDerivation rec {
 
   src = fetchurl {
     url = "http://www.ffado.org/files/libffado-${version}.tgz";
-    hash = "sha256-f0x561ehKw6uMSri0RZip+v1JHZuhixtywl0PVU/N44=";
+    hash = "sha256-0iFXYyGctOoHCdc232Ud80/wV81tiS7ItiS0uLKyq2Y=";
   };
 
-  sourceRoot = "libffado-${version}/libffado";
-
   prePatch = ''
     substituteInPlace ./support/tools/ffado-diag.in \
       --replace /lib/modules/ "/run/booted-system/kernel-modules/lib/modules/"
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 320f10d551380..484e63bb357c9 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.382";
+  version = "0.383";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-j7ITcLilcnV8QCUFC/Ybv1dX6Kl36P0G9vBlrzifhFQ=";
+    hash = "sha256-jYD1/sl9ffe+lmrICLe32NU1u0Hi7ZfZrD4zWH+bxsk=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 3cc7759b41830..026a06668b8f6 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,17 +6,14 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.8.0";
+  version = "6.9.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-A6bMo9cakI0fFfe0lb4rj+hR+UFFjcRmSQDX9F/PaM4=";
+    hash = "sha256-L2Q9CeoRpKKgQ8kuK0abX3MijL8kGugGdgKW7Q7EE9A=";
   };
 
   postPatch = ''
-    # Don't try to create /var/lib/arpd:
-    sed -e '/ARPDDIR/d' -i Makefile
-
     substituteInPlace Makefile \
       --replace "CC := gcc" "CC ?= $CC"
   '';
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index c9bf296160629..8b316a8c758e9 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -667,20 +667,29 @@ let
     };
 
     security = {
+      # Report BUG() conditions and kill the offending process.
+      BUG = yes;
+      BUG_ON_DATA_CORRUPTION = yes;
+
       FORTIFY_SOURCE                   = option yes;
 
       # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
       DEBUG_LIST                       = yes;
+
       HARDENED_USERCOPY                = yes;
       RANDOMIZE_BASE                   = option yes;
+      STRICT_KERNEL_RWX                = yes;
+      STRICT_MODULE_RWX                = yes;
       STRICT_DEVMEM                    = mkDefault yes; # Filter access to /dev/mem
       IO_STRICT_DEVMEM                 = mkDefault yes;
       SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
+
       # Prevent processes from ptracing non-children processes
       SECURITY_YAMA                    = option yes;
       # The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem access) for a set of processes.
       # This does not have any effect if a program does not support it
       SECURITY_LANDLOCK                = whenAtLeast "5.13" yes;
+
       DEVKMEM                          = whenOlder "5.13" no; # Disable /dev/kmem
 
       USER_NS                          = yes; # Support for user namespaces
@@ -715,6 +724,10 @@ let
 
       # Enable support for page poisoning. Still needs to be enabled on the command line to actually work.
       PAGE_POISONING                   = yes;
+      # Randomize page allocator when page_alloc.shuffle=1
+      SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
+
+      INIT_ON_ALLOC_DEFAULT_ON = whenAtLeast "5.3" yes;
 
       # Enable stack smashing protections in schedule()
       # See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v4.8&id=0d9e26329b0c9263d4d9e0422d80a0e73268c52f
@@ -739,6 +752,10 @@ let
       # Mitigate straight line speculation at the cost of some file size
       SLS = whenBetween "5.17" "6.9" yes;
       MITIGATION_SLS = whenAtLeast "6.9" yes;
+
+      DEFAULT_MMAP_MIN_ADDR = freeform "65536";
+    } // optionalAttrs stdenv.hostPlatform.isAarch64 {
+      DEFAULT_MMAP_MIN_ADDR = freeform "32768";
     };
 
     microcode = {
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index d687366dbe2f8..0ab89d23952db 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -17,9 +17,6 @@ with (lib.kernel.whenHelpers version);
 assert (versionAtLeast version "4.9");
 
 {
-  # Report BUG() conditions and kill the offending process.
-  BUG = yes;
-
   # Mark LSM hooks read-only after init.  SECURITY_WRITABLE_HOOKS n
   # conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter
   # implicitly marks LSM hooks read-only after init.
@@ -31,8 +28,6 @@ assert (versionAtLeast version "4.9");
   SECURITY_SELINUX_DISABLE = whenOlder "6.4" no; # On 6.4: error: unused option: SECURITY_SELINUX_DISABLE
   SECURITY_WRITABLE_HOOKS  = option no;
 
-  STRICT_KERNEL_RWX = yes;
-
   # Perform additional validation of commonly targeted structures.
   DEBUG_CREDENTIALS     = whenOlder "6.6" yes;
   DEBUG_NOTIFIERS       = yes;
@@ -51,16 +46,11 @@ assert (versionAtLeast version "4.9");
   # restricts loading of line disciplines via TIOCSETD ioctl to CAP_SYS_MODULE
   CONFIG_LDISC_AUTOLOAD = option no;
 
-  # Randomize page allocator when page_alloc.shuffle=1
-  SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
-
   # Wipe higher-level memory allocations on free() with page_poison=1
-  PAGE_POISONING           = yes;
   PAGE_POISONING_NO_SANITY = whenOlder "5.11" yes;
   PAGE_POISONING_ZERO      = whenOlder "5.11" yes;
 
-  # Enable init_on_alloc and init_on_free by default
-  INIT_ON_ALLOC_DEFAULT_ON = whenAtLeast "5.3" yes;
+  # Enable init_on_free by default
   INIT_ON_FREE_DEFAULT_ON  = whenAtLeast "5.3" yes;
 
   # Wipe all caller-used registers on exit from a function
@@ -113,9 +103,6 @@ assert (versionAtLeast version "4.9");
   CC_STACKPROTECTOR_REGULAR = lib.mkForce (whenOlder "4.18" no);
   CC_STACKPROTECTOR_STRONG  = whenOlder "4.18" yes;
 
-  # Detect out-of-bound reads/writes and use-after-free
-  KFENCE = whenAtLeast "5.12" yes;
-
   # CONFIG_DEVMEM=n causes these to not exist anymore.
   STRICT_DEVMEM    = option no;
   IO_STRICT_DEVMEM = option no;
@@ -126,8 +113,4 @@ assert (versionAtLeast version "4.9");
 
   # not needed for less than a decade old glibc versions
   LEGACY_VSYSCALL_NONE = yes;
-
-  # Straight-Line-Speculation
-  # https://lwn.net/Articles/877845/
-  SLS = option yes;
 }
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 6a0ee908347ca..032283711cf38 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-PlGr/qZbKnaY37wikdmX/iYtP11WHShn1I7vACUgLG0=";
+    sha256 = "sha256-lcIOgghlBKrDCBDdO0hryjt8KADQd6aroQMun3ein2o=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/windows/mingw-w64/default.nix b/pkgs/os-specific/windows/mingw-w64/default.nix
index 706186c8e2f15..d464191328875 100644
--- a/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/pkgs/os-specific/windows/mingw-w64/default.nix
@@ -29,7 +29,7 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ windows.mingw_w64_headers ];
-  hardeningDisable = [ "stackprotector" "fortify" ];
+  hardeningDisable = [ "stackprotector" "stackclashprotection" "fortify" ];
 
   meta = {
     platforms = lib.platforms.windows;
diff --git a/pkgs/servers/apache-airflow/default.nix b/pkgs/servers/apache-airflow/default.nix
index 735356f8b7789..5021f66390bab 100644
--- a/pkgs/servers/apache-airflow/default.nix
+++ b/pkgs/servers/apache-airflow/default.nix
@@ -17,7 +17,6 @@ let
         };
         nativeBuildInputs = with pySelf; [
           setuptools
-          pythonRelaxDepsHook
         ];
         pythonRelaxDeps = [
           "werkzeug"
diff --git a/pkgs/servers/apache-airflow/python-package.nix b/pkgs/servers/apache-airflow/python-package.nix
index 50d3aaa7fbb51..14c39ede5a855 100644
--- a/pkgs/servers/apache-airflow/python-package.nix
+++ b/pkgs/servers/apache-airflow/python-package.nix
@@ -61,7 +61,6 @@
 , python-slugify
 , python3-openid
 , pythonOlder
-, pythonRelaxDepsHook
 , pyyaml
 , rich
 , rich-argparse
@@ -227,7 +226,6 @@ buildPythonPackage rec {
 
   buildInputs = [
     airflow-frontend
-    pythonRelaxDepsHook
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/servers/home-assistant/appdaemon.nix b/pkgs/servers/home-assistant/appdaemon.nix
index 40c55e9f5d788..c2bb51cc14a01 100644
--- a/pkgs/servers/home-assistant/appdaemon.nix
+++ b/pkgs/servers/home-assistant/appdaemon.nix
@@ -18,7 +18,6 @@ python3.pkgs.buildPythonApplication rec {
   pythonRelaxDeps = true;
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 2e60e21ae8f2a..60dbabfa87308 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -434,7 +434,6 @@ let
         };
         nativeBuildInputs = with self; [
           flit-core
-          pythonRelaxDepsHook
         ];
         pythonRelaxDeps = [
           "betterproto"
@@ -561,7 +560,6 @@ in python.pkgs.buildPythonApplication rec {
   };
 
   build-system = with python.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/servers/ldap/lldap/default.nix b/pkgs/servers/ldap/lldap/default.nix
index 7db37e57c2d2b..80d7710ccbaf4 100644
--- a/pkgs/servers/ldap/lldap/default.nix
+++ b/pkgs/servers/ldap/lldap/default.nix
@@ -5,7 +5,6 @@
 , nixosTests
 , rustPlatform
 , rustc
-, stdenv
 , wasm-bindgen-cli
 , wasm-pack
 , which
@@ -85,9 +84,6 @@ in rustPlatform.buildRustPackage (commonDerivationAttrs // {
     changelog = "https://github.com/lldap/lldap/blob/v${lldap.version}/CHANGELOG.md";
     license = licenses.gpl3Only;
     platforms = platforms.linux;
-    # See comment about wasm32-unknown-unknown in rustc.nix.
-    broken = lib.any (a: lib.hasAttr a stdenv.hostPlatform.gcc) [ "cpu" "float-abi" "fpu" ] ||
-      !stdenv.hostPlatform.gcc.thumb or true;
     maintainers = with maintainers; [ bendlas ];
     mainProgram = "lldap";
   };
diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index 7747e4ec092d1..ccc9fff51ace6 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -1,12 +1,12 @@
 {lib, stdenv, fetchurl, cyrus_sasl, libevent, nixosTests }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.26";
+  version = "1.6.27";
   pname = "memcached";
 
   src = fetchurl {
     url = "https://memcached.org/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-yTnHhZo8HPYDA+ndCAxjrEo4fuKEbVlc1SY6PcrNwvc=";
+    sha256 = "sha256-dP4UR8hmit+RD6epKftjWKr0pm73NOdRxbgSgHGw97U=";
   };
 
   configureFlags = [
diff --git a/pkgs/servers/monitoring/prometheus/dmarc-metrics-exporter/default.nix b/pkgs/servers/monitoring/prometheus/dmarc-metrics-exporter/default.nix
index 3968f0b5c11cc..0a5aa5f6f5140 100644
--- a/pkgs/servers/monitoring/prometheus/dmarc-metrics-exporter/default.nix
+++ b/pkgs/servers/monitoring/prometheus/dmarc-metrics-exporter/default.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/servers/pinnwand/default.nix b/pkgs/servers/pinnwand/default.nix
index c7549e1913a14..bbed9967c2ac5 100644
--- a/pkgs/servers/pinnwand/default.nix
+++ b/pkgs/servers/pinnwand/default.nix
@@ -27,7 +27,6 @@ with python3.pkgs; buildPythonApplication rec {
 
   nativeBuildInputs = [
     pdm-pep517
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 45cc6742c7205..787c48898ac60 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -327,7 +327,11 @@ in
               '';
               passthru = {
                 isFromBootstrapFiles = true;
-                hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
+                hardeningUnsupportedFlags = [
+                  "fortify3"
+                  "stackclashprotection"
+                  "zerocallusedregs"
+                ];
               };
             };
             clang-unwrapped = selfTools.libclang;
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index af68bf890ed29..f03c68a4c5cb0 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -119,6 +119,7 @@ let
     "pie"
     "relro"
     "stackprotector"
+    "stackclashprotection"
     "strictoverflow"
     "trivialautovarinit"
     "zerocallusedregs"
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 45c73d7709c66..e9a0bdea04c2a 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -47,10 +47,67 @@ getAllOutputNames() {
     fi
 }
 
+if [[ -n "${NIX_LOG_FD:-}" ]]; then
+    # Logs arguments to $NIX_LOG_FD, if it exists, no-op if it does not.
+    nixLog() {
+        echo "$@" >&"$NIX_LOG_FD"
+    }
+
+    # Log a hook, to be run before the hook is actually called.
+    # logging for "implicit" hooks -- the ones specified directly
+    # in derivation's arguments -- is done in _callImplicitHook instead.
+    _logHook() {
+        local hookKind="$1"
+        local hookExpr="$2"
+        shift 2
+
+        if declare -F "$hookExpr" > /dev/null 2>&1; then
+            nixLog "calling '$hookKind' function hook '$hookExpr'" "$@"
+        elif type -p "$hookExpr" > /dev/null; then
+            nixLog "sourcing '$hookKind' script hook '$hookExpr'"
+        elif [[ "$hookExpr" != "_callImplicitHook"* ]]; then
+            # Here we have a string hook to eval.
+            # Join lines onto one with literal \n characters unless NIX_DEBUG >= 2.
+            local exprToOutput
+            if (( "${NIX_DEBUG:-0}" >= 2 )); then
+                exprToOutput="$hookExpr"
+            else
+                # We have `r'\n'.join([line.lstrip() for lines in text.split('\n')])` at home.
+                local hookExprLine
+                while IFS= read -r hookExprLine; do
+                    # These lines often have indentation,
+                    # so let's remove leading whitespace.
+                    hookExprLine="${hookExprLine#"${hookExprLine%%[![:space:]]*}"}"
+                    # If this line wasn't entirely whitespace,
+                    # then add it to our output
+                    if [[ -n "$hookExprLine" ]]; then
+                        exprToOutput+="$hookExprLine\\n "
+                    fi
+                done <<< "$hookExpr"
+
+                # And then remove the final, unnecessary, \n
+                exprToOutput="${exprToOutput%%\\n }"
+            fi
+            nixLog "evaling '$hookKind' string hook '$exprToOutput'"
+        fi
+    }
+else
+    nixLog() {
+        # Stub.
+        # Note: because bash syntax, this colon is load bearing. Removing it
+        # will turn this function into a syntax error.
+        :
+    }
+
+    _logHook() {
+        # Load-bearing colon; same as above.
+        :
+    }
+fi
+
 ######################################################################
 # Hook handling.
 
-
 # Run all hooks with the specified name in the order in which they
 # were added, stopping if any fails (returns a non-zero exit
 # code). The hooks for <hookName> are the shell function or variable
@@ -64,6 +121,7 @@ runHook() {
     # Hack around old bash being bad and thinking empty arrays are
     # undefined.
     for hook in "_callImplicitHook 0 $hookName" ${!hooksSlice+"${!hooksSlice}"}; do
+        _logHook "$hookName" "$hook" "$@"
         _eval "$hook" "$@"
     done
 
@@ -81,6 +139,7 @@ runOneHook() {
     local hook ret=1
     # Hack around old bash like above
     for hook in "_callImplicitHook 1 $hookName" ${!hooksSlice+"${!hooksSlice}"}; do
+        _logHook "$hookName" "$hook" "$@"
         if _eval "$hook" "$@"; then
             ret=0
             break
@@ -100,10 +159,13 @@ _callImplicitHook() {
     local def="$1"
     local hookName="$2"
     if declare -F "$hookName" > /dev/null; then
+        nixLog "calling implicit '$hookName' function hook"
         "$hookName"
     elif type -p "$hookName" > /dev/null; then
+        nixLog "sourcing implicit '$hookName' script hook"
         source "$hookName"
     elif [ -n "${!hookName:-}" ]; then
+        nixLog "evaling implicit '$hookName' string hook"
         eval "${!hookName}"
     else
         return "$def"
@@ -644,6 +706,7 @@ activatePackage() {
     (( hostOffset <= targetOffset )) || exit 1
 
     if [ -f "$pkg" ]; then
+        nixLog "sourcing setup hook '$pkg'"
         source "$pkg"
     fi
 
@@ -667,6 +730,7 @@ activatePackage() {
     fi
 
     if [[ -f "$pkg/nix-support/setup-hook" ]]; then
+        nixLog "sourcing setup hook '$pkg/nix-support/setup-hook'"
         source "$pkg/nix-support/setup-hook"
     fi
 }
@@ -830,7 +894,7 @@ substituteStream() {
                 # deprecated 2023-11-22
                 # this will either get removed, or switch to the behaviour of --replace-fail in the future
                 if ! "$_substituteStream_has_warned_replace_deprecation"; then
-                    echo "substituteStream(): WARNING: '--replace' is deprecated, use --replace-{fail,warn,quiet}. ($description)" >&2
+                    echo "substituteStream() in derivation $name: WARNING: '--replace' is deprecated, use --replace-{fail,warn,quiet}. ($description)" >&2
                     _substituteStream_has_warned_replace_deprecation=true
                 fi
                 replace_mode='--replace-warn'
@@ -845,9 +909,9 @@ substituteStream() {
                 if [ "$pattern" != "$replacement" ]; then
                     if [ "${!var}" == "$savedvar" ]; then
                         if [ "$replace_mode" == --replace-warn ]; then
-                            printf "substituteStream(): WARNING: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
+                            printf "substituteStream() in derivation $name: WARNING: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
                         elif [ "$replace_mode" == --replace-fail ]; then
-                            printf "substituteStream(): ERROR: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
+                            printf "substituteStream() in derivation $name: ERROR: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
                             return 1
                         fi
                     fi
@@ -859,11 +923,11 @@ substituteStream() {
                 shift 2
                 # check if the used nix attribute name is a valid bash name
                 if ! [[ "$varName" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
-                    echo "substituteStream(): ERROR: substitution variables must be valid Bash names, \"$varName\" isn't." >&2
+                    echo "substituteStream() in derivation $name: ERROR: substitution variables must be valid Bash names, \"$varName\" isn't." >&2
                     return 1
                 fi
                 if [ -z ${!varName+x} ]; then
-                    echo "substituteStream(): ERROR: variable \$$varName is unset" >&2
+                    echo "substituteStream() in derivation $name: ERROR: variable \$$varName is unset" >&2
                     return 1
                 fi
                 pattern="@$varName@"
@@ -879,7 +943,7 @@ substituteStream() {
                 ;;
 
             *)
-                echo "substituteStream(): ERROR: Invalid command line argument: $1" >&2
+                echo "substituteStream() in derivation $name: ERROR: Invalid command line argument: $1" >&2
                 return 1
                 ;;
         esac
@@ -1558,9 +1622,7 @@ runPhase() {
     if [[ "$curPhase" = installCheckPhase && -z "${doInstallCheck:-}" ]]; then return; fi
     if [[ "$curPhase" = distPhase && -z "${doDist:-}" ]]; then return; fi
 
-    if [[ -n $NIX_LOG_FD ]]; then
-        echo "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }" >&"$NIX_LOG_FD"
-    fi
+    nixLog "@nix { \"action\": \"setPhase\", \"phase\": \"$currPhase\" }"
 
     showPhaseHeader "$curPhase"
     dumpVars
diff --git a/pkgs/stdenv/linux/bootstrap-tools/default.nix b/pkgs/stdenv/linux/bootstrap-tools/default.nix
index 6d2490acfa477..4450679983ff2 100644
--- a/pkgs/stdenv/linux/bootstrap-tools/default.nix
+++ b/pkgs/stdenv/linux/bootstrap-tools/default.nix
@@ -15,5 +15,10 @@ derivation ({
   langC = true;
   langCC = true;
   isGNU = true;
-  hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" "trivialautovarinit" ];
+  hardeningUnsupportedFlags = [
+    "fortify3"
+    "stackclashprotection"
+    "trivialautovarinit"
+    "zerocallusedregs"
+  ];
 } // extraAttrs)
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index 644c997de6191..28360b17527c6 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -167,7 +167,10 @@ let
     {
       scripts = [ "bin/xdg-screensaver" ];
       interpreter = "${bash}/bin/bash";
-      inputs = commonDeps ++ [ nettools perl procmail procps ];
+      inputs = commonDeps ++ [ nettools perl procps ]
+        # procmail's funky build system is currently broken in cross-build.
+        # xdg-screensaver will gracefully degrade if it's not available.
+        ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) procmail;
       # These are desktop-specific, so we don't want xdg-utils to be able to
       # call them when in a different setup.
       fake.external = commonFakes ++ [
@@ -176,7 +179,7 @@ let
         "xautolock"                 # Xautolock
         "xscreensaver-command"      # Xscreensaver
         "xset"                      # generic-ish X
-      ];
+      ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "lockfile"; # procmail
       keep = {
         "$MV" = true;
         "$XPROP" = true;
diff --git a/pkgs/tools/admin/ansible/doctor.nix b/pkgs/tools/admin/ansible/doctor.nix
index 8a14a049893ba..e6a370c46f909 100644
--- a/pkgs/tools/admin/ansible/doctor.nix
+++ b/pkgs/tools/admin/ansible/doctor.nix
@@ -30,7 +30,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/admin/ansible/later.nix b/pkgs/tools/admin/ansible/later.nix
index f040acdfbd0f2..d40355e09e814 100644
--- a/pkgs/tools/admin/ansible/later.nix
+++ b/pkgs/tools/admin/ansible/later.nix
@@ -45,7 +45,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
     poetry-dynamic-versioning
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/admin/ansible/lint.nix b/pkgs/tools/admin/ansible/lint.nix
index e3ff67eda963a..6970abd8a27f7 100644
--- a/pkgs/tools/admin/ansible/lint.nix
+++ b/pkgs/tools/admin/ansible/lint.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     setuptools
     setuptools-scm
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 568282fa86ab6..9080d88a59a76 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -23,10 +23,6 @@ let
       hash = "sha256-96hFvXs3Fcvad+PBEpS9RFMJkcD1qHqfQ+8gtVfEbnc=";
     };
 
-    nativeBuildInputs = [
-      python3.pkgs.pythonRelaxDepsHook
-    ];
-
     pythonRelaxDeps = [
       # botocore must not be relaxed
       "colorama"
diff --git a/pkgs/tools/admin/gimme-aws-creds/default.nix b/pkgs/tools/admin/gimme-aws-creds/default.nix
index 3b1a334c6be22..ab43e9971d8e8 100644
--- a/pkgs/tools/admin/gimme-aws-creds/default.nix
+++ b/pkgs/tools/admin/gimme-aws-creds/default.nix
@@ -37,7 +37,6 @@ python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python.pkgs; [
     installShellFiles
-    pythonRelaxDepsHook
   ];
 
   pythonRemoveDeps = [
diff --git a/pkgs/tools/admin/turbovnc/default.nix b/pkgs/tools/admin/turbovnc/default.nix
index aaba4768a9243..977204cc5ed2a 100644
--- a/pkgs/tools/admin/turbovnc/default.nix
+++ b/pkgs/tools/admin/turbovnc/default.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     # to the swrast dri driver in Mesa.
     # Can also be given at runtime to its `Xvnc` as:
     #   -dridir /nix/store/...-mesa-20.1.10-drivers/lib/dri/
-    "-DXORG_DRI_DRIVER_PATH=${mesa.drivers}/lib/dri"
+    "-DXORG_DRI_DRIVER_PATH=${mesa.driverLink}/lib/dri"
     # The build system doesn't find these files automatically.
     "-DTJPEG_JAR=${libjpeg_turbo.out}/share/java/turbojpeg.jar"
     "-DTJPEG_JNILIBRARY=${libjpeg_turbo.out}/lib/libturbojpeg.so"
diff --git a/pkgs/tools/audio/spotdl/default.nix b/pkgs/tools/audio/spotdl/default.nix
index 84261b04a91c2..457a0883ed688 100644
--- a/pkgs/tools/audio/spotdl/default.nix
+++ b/pkgs/tools/audio/spotdl/default.nix
@@ -20,7 +20,6 @@ in python.pkgs.buildPythonApplication rec {
 
   build-system = with python.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/tools/audio/wyoming/faster-whisper.nix b/pkgs/tools/audio/wyoming/faster-whisper.nix
index 563f2ce4562d6..4807e50adb429 100644
--- a/pkgs/tools/audio/wyoming/faster-whisper.nix
+++ b/pkgs/tools/audio/wyoming/faster-whisper.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/audio/wyoming/openwakeword.nix b/pkgs/tools/audio/wyoming/openwakeword.nix
index 69f10f1d208fe..78fb2e81d9fe3 100644
--- a/pkgs/tools/audio/wyoming/openwakeword.nix
+++ b/pkgs/tools/audio/wyoming/openwakeword.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/audio/wyoming/piper.nix b/pkgs/tools/audio/wyoming/piper.nix
index 8a614ef4083c8..0ba5e8db6c8fb 100644
--- a/pkgs/tools/audio/wyoming/piper.nix
+++ b/pkgs/tools/audio/wyoming/piper.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     setuptools
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/backup/tarsnapper/default.nix b/pkgs/tools/backup/tarsnapper/default.nix
index 843e61ecea573..36842b634378d 100644
--- a/pkgs/tools/backup/tarsnapper/default.nix
+++ b/pkgs/tools/backup/tarsnapper/default.nix
@@ -26,7 +26,6 @@ python3Packages.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3Packages; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/tools/backup/zfs-autobackup/default.nix b/pkgs/tools/backup/zfs-autobackup/default.nix
index 5999508fabf24..e29813caab27e 100644
--- a/pkgs/tools/backup/zfs-autobackup/default.nix
+++ b/pkgs/tools/backup/zfs-autobackup/default.nix
@@ -10,7 +10,6 @@ python3Packages.buildPythonApplication rec {
     sha256 = "sha256-rvtY7fsn2K2hueAsQkaPXcwxUAgE8j+GsQFF3eJKG2o=";
   };
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3Packages; [ colorama ];
 
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index f745f4f091aba..a2069c4fb64f7 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -1,58 +1,52 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, valgrind
-, enableStatic ? stdenv.hostPlatform.isStatic
-, enableShared ? !stdenv.hostPlatform.isStatic
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake
+, valgrind, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lz4";
   version = "1.9.4";
 
   src = fetchFromGitHub {
-    sha256 = "sha256-YiMCD3vvrG+oxBUghSrCmP2LAfAGZrEaKz0YoaQJhpI=";
-    rev = "v${version}";
-    repo = pname;
-    owner = pname;
+    repo = "lz4";
+    owner = "lz4";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-YiMCD3vvrG+oxBUghSrCmP2LAfAGZrEaKz0YoaQJhpI=";
   };
 
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = lib.optionals finalAttrs.doCheck [
+    valgrind
+  ];
+
+  outputs = [ "dev" "lib" "man" "out" ];
+
   patches = [
     (fetchpatch { # https://github.com/lz4/lz4/pull/1162
       name = "build-shared-no.patch";
       url = "https://github.com/lz4/lz4/commit/851ef4b23c7cbf4ceb2ba1099666a8b5ec4fa195.patch";
-      sha256 = "sha256-P+/uz3m7EAmHgXF/1Vncc0uKKxNVq6HNIsElx0rGxpw=";
+      hash = "sha256-P+/uz3m7EAmHgXF/1Vncc0uKKxNVq6HNIsElx0rGxpw=";
     })
   ];
 
-  # TODO(@Ericson2314): Separate binaries and libraries
-  outputs = [ "bin" "out" "dev" ];
-
-  buildInputs = lib.optional doCheck valgrind;
-
-  enableParallelBuilding = true;
-
-  makeFlags = [
-    "PREFIX=$(out)"
-    "INCLUDEDIR=$(dev)/include"
-    "BUILD_STATIC=${if enableStatic then "yes" else "no"}"
-    "BUILD_SHARED=${if enableShared then "yes" else "no"}"
-    "WINDRES:=${stdenv.cc.bintools.targetPrefix}windres"
-  ]
-    # TODO make full dictionary
-    ++ lib.optional stdenv.hostPlatform.isMinGW "TARGET_OS=MINGW"
-    ++ lib.optional stdenv.hostPlatform.isLinux "TARGET_OS=Linux"
-    ;
+  cmakeDir = "../build/cmake";
+  cmakeBuildDir = "build-dist";
 
   doCheck = false; # tests take a very long time
   checkTarget = "test";
 
-  # TODO(@Ericson2314): Make resusable setup hook for this issue on Windows.
-  postInstall =
-    lib.optionalString stdenv.hostPlatform.isWindows ''
-      mv $out/bin/*.dll $out/lib
-      ln -s $out/lib/*.dll
-    ''
-    + ''
-      moveToOutput bin "$bin"
-    '';
+  passthru.tests = {
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      version = "v${finalAttrs.version}";
+    };
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [ "liblz4" ];
+    };
+  };
 
   meta = with lib; {
     description = "Extremely fast compression algorithm";
@@ -66,5 +60,6 @@ stdenv.mkDerivation rec {
     homepage = "https://lz4.github.io/lz4/";
     license = with licenses; [ bsd2 gpl2Plus ];
     platforms = platforms.all;
+    mainProgram = "lz4";
   };
-}
+})
diff --git a/pkgs/tools/filesystems/rmfuse/default.nix b/pkgs/tools/filesystems/rmfuse/default.nix
index 04a4d62738788..7ce74671e5df0 100644
--- a/pkgs/tools/filesystems/rmfuse/default.nix
+++ b/pkgs/tools/filesystems/rmfuse/default.nix
@@ -18,7 +18,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/games/steamback/default.nix b/pkgs/tools/games/steamback/default.nix
index e7cc2c06b9109..a41b5f3ca7fb2 100644
--- a/pkgs/tools/games/steamback/default.nix
+++ b/pkgs/tools/games/steamback/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonApplication
 , fetchPypi
-, pythonRelaxDepsHook
 , setuptools
 , setuptools-scm
 , wheel
@@ -24,7 +23,6 @@ buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
     setuptools-scm
     wheel
   ];
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index 25a9ebeb18dc7..6cb681e6fde2c 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl
 , autoreconfHook, bison, glm, flex, wrapQtAppsHook, cmake, pkg-config
 , freeglut, ghostscriptX, imagemagick, fftw, eigen, libtirpc
-, boehmgc, libGLU, libGL, mesa, ncurses, readline, gsl, libsigsegv
+, boehmgc, libGLU, libGL, ncurses, readline, gsl, libsigsegv
 , python3, qtbase, qtsvg, boost
 , zlib, perl, curl
 , texinfo
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [
     glm
   ] ++ lib.optionals stdenv.isLinux [
-    freeglut libGLU libGL mesa.osmesa
+    freeglut libGLU libGL
   ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     OpenGL GLUT Cocoa
   ]);
diff --git a/pkgs/tools/graphics/mesa-demos/default.nix b/pkgs/tools/graphics/mesa-demos/default.nix
index 0bc30c8773fd3..660abc056ea9d 100644
--- a/pkgs/tools/graphics/mesa-demos/default.nix
+++ b/pkgs/tools/graphics/mesa-demos/default.nix
@@ -54,14 +54,12 @@ stdenv.mkDerivation rec {
     vulkan-loader
     libxkbcommon
     libdecor
-  ] ++ lib.optional (mesa ? osmesa) mesa.osmesa;
+  ];
 
   mesonFlags = [
-    "-Degl=${if stdenv.isDarwin then "disabled" else "auto"}"
-    "-Dlibdrm=${if mesa.libdrm == null then "disabled" else "enabled"}"
-    "-Dosmesa=${if mesa ? osmesa then "enabled" else "disabled"}"
-    "-Dwayland=${if wayland.withLibraries then "enabled" else "disabled"}"
     "-Dwith-system-data-files=true"
+    "-Dgles1=disabled"
+    "-Dosmesa=disabled"
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/graphics/vulkan-cts/default.nix b/pkgs/tools/graphics/vulkan-cts/default.nix
index 633adf5286519..5bc5daa5d81b6 100644
--- a/pkgs/tools/graphics/vulkan-cts/default.nix
+++ b/pkgs/tools/graphics/vulkan-cts/default.nix
@@ -106,9 +106,9 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru.updateScript = ./update.sh;
-  passthru.tests.lavapipe = runCommand "vulkan-cts-tests-lavapipe" { nativeBuildInputs = [ finalAttrs.finalPackage ]; } ''
-    # Expand the wildcard to pick the existing architecture
-    export VK_ICD_FILENAMES=$(echo ${mesa.drivers}/share/vulkan/icd.d/lvp_icd.*.json)
+  passthru.tests.lavapipe = runCommand "vulkan-cts-tests-lavapipe" {
+    nativeBuildInputs = [ finalAttrs.finalPackage mesa.llvmpipeHook ];
+  } ''
     deqp-vk -n dEQP-VK.api.smoke.triangle
     touch $out
   '';
diff --git a/pkgs/tools/misc/csvs-to-sqlite/default.nix b/pkgs/tools/misc/csvs-to-sqlite/default.nix
index 28537e9631ea3..2ed4af000f560 100644
--- a/pkgs/tools/misc/csvs-to-sqlite/default.nix
+++ b/pkgs/tools/misc/csvs-to-sqlite/default.nix
@@ -27,7 +27,6 @@ with python3.pkgs; buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/misc/cyclonedx-python/default.nix b/pkgs/tools/misc/cyclonedx-python/default.nix
index fa5be39000af3..ba6d137fa5b7d 100644
--- a/pkgs/tools/misc/cyclonedx-python/default.nix
+++ b/pkgs/tools/misc/cyclonedx-python/default.nix
@@ -36,7 +36,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with py.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with py.pkgs; [
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 7dc67ba2ef70f..0f4b3657a7a44 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -33,7 +33,6 @@ python.pkgs.buildPythonApplication rec {
     setuptools
     argcomplete
     installShellFiles
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/tools/misc/expect/0004-enable-cross-compilation.patch b/pkgs/tools/misc/expect/0004-enable-cross-compilation.patch
new file mode 100644
index 0000000000000..c09623d292b2e
--- /dev/null
+++ b/pkgs/tools/misc/expect/0004-enable-cross-compilation.patch
@@ -0,0 +1,295 @@
+From: Andrew Ruder <andrew.ruder@elecsyscorp.com>
+Subject: [PATCH] enable cross compilation for expect
+
+This patch was created by running ./configure on a modern Linux machine
+and inserting the results into the cross compilation section of
+each AC_MSG_CHECKING that bombed out with an error.
+
+Signed-off-by: Andrew Ruder <andrew.ruder@elecsyscorp.com>
+
+--
+
+The original patch, and description above, is originally from
+https://github.com/buildroot/buildroot/blob/master/package/expect/0001-enable-cross-compilation.patch
+
+This patch has been further modified to not hard-code Linux assumptions.
+
+---
+
+Index: expect-5.45/configure.in
+===================================================================
+--- expect-5.45.orig/configure.in	2013-11-14 07:59:58.732100595 -0600
++++ expect-5.45/configure.in	2013-11-14 07:59:58.732100595 -0600
+@@ -6,10 +6,12 @@
+ AC_INIT([expect],[5.45.4])
+ 
+ TEA_INIT([3.9])
+ 
+ AC_CONFIG_AUX_DIR(tclconfig)
++
++AC_LANG([C])
+ 
+ #--------------------------------------------------------------------
+ # Configure script for package 'Expect'.
+ # TEA compliant.
+ #--------------------------------------------------------------------
+@@ -465,26 +467,20 @@
+ # Some systems only define WNOHANG if _POSIX_SOURCE is defined
+ # The following merely tests that sys/wait.h can be included
+ # and if so that WNOHANG is not defined.  The only place I've
+ # seen this is ISC.
+ AC_MSG_CHECKING([if WNOHANG requires _POSIX_SOURCE])
+-AC_TRY_RUN([
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+ #include <sys/wait.h>
+-int
+-main() {
+ #ifndef WNOHANG
+-	return 0;
+-#else
+-	return 1;
++#  error "WNOHANG requires _POSIX_SOURCE to be defined"
+ #endif
+-}],
++]])],
+ 	AC_MSG_RESULT(yes)
+ 	AC_DEFINE(WNOHANG_REQUIRES_POSIX_SOURCE)
+ ,
+ 	AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ AC_MSG_CHECKING([if any value exists for WNOHANG])
+ rm -rf wnohang
+ AC_TRY_RUN([
+@@ -504,11 +501,12 @@
+ 	rm -f wnohang
+ ,
+ 	AC_MSG_RESULT(no)
+ 	AC_DEFINE(WNOHANG_BACKUP_VALUE, 1)
+ ,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
++	AC_MSG_RESULT(yes)
++	AC_DEFINE(WNOHANG_BACKUP_VALUE, 1)
+ )
+ 
+ #
+ # check how signals work
+ #
+@@ -572,11 +570,11 @@
+ }],
+ 	AC_MSG_RESULT(yes)
+ 	AC_DEFINE(REARM_SIG)
+ ,
+ 	AC_MSG_RESULT(no)
+-, AC_MSG_WARN([Expect can't be cross compiled])
++, AC_MSG_RESULT(no)
+ )
+ 
+ # HPUX7 has trouble with the big cat so split it
+ # Owen Rees <rtor@ansa.co.uk> 29Mar93 
+ SEDDEFS="${SEDDEFS}CONFEOF
+@@ -710,25 +708,19 @@
+     AC_DEFINE(POSIX)
+ fi
+ 
+ # first check for the pure bsd
+ AC_MSG_CHECKING([for struct sgttyb])
+-AC_TRY_RUN([
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+ #include <sgtty.h>
+-int
+-main()
+-{
+-  struct sgttyb tmp;
+-  return 0;
+-}],
++static struct sgttyb tmp;
++]])],
+         AC_MSG_RESULT(yes)
+         AC_DEFINE(HAVE_SGTTYB)
+         PTY_TYPE=sgttyb
+ ,
+         AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ # mach systems have include files for unimplemented features
+ # so avoid doing following test on those systems
+ if test $mach -eq 0 ; then
+@@ -735,116 +728,88 @@
+   # next check for the older style ttys
+   # note that if we detect termio.h (only), we still set PTY_TYPE=termios
+   # since that just controls which of pty_XXXX.c file is use and
+   # pty_termios.c is set up to handle pty_termio.
+   AC_MSG_CHECKING([for struct termio])
+-  AC_TRY_RUN([#include <termio.h>
+-  int
+-  main()
+-  {
+-    struct termio tmp;
+-    return 0;
+-  }],
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
++#include <termio.h>
++static struct termio tmp;
++]])],
+         AC_DEFINE(HAVE_TERMIO)
+         PTY_TYPE=termios
+         AC_MSG_RESULT(yes)
+ ,
+         AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+   # now check for the new style ttys (not yet posix)
+   AC_MSG_CHECKING([for struct termios])
+-  AC_TRY_RUN([
+-  /* including termios.h on Solaris 5.6 fails unless inttypes.h included */
+-#  ifdef HAVE_INTTYPES_H
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
++/* including termios.h on Solaris 5.6 fails unless inttypes.h included */
++#ifdef HAVE_INTTYPES_H
+ #  include <inttypes.h>
+-#  endif
+-#  include <termios.h>
+-  int
+-  main()
+-  {
+-    struct termios tmp;
+-    return 0;
+-  }],
++#endif
++#include <termios.h>
++static struct termios tmp;
++]])],
+         AC_DEFINE(HAVE_TERMIOS)
+         PTY_TYPE=termios
+         AC_MSG_RESULT(yes)
+   ,
+         AC_MSG_RESULT(no)
+-  ,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+   )
+ fi
+ 
+ AC_MSG_CHECKING([if TCGETS or TCGETA in termios.h])
+-AC_TRY_RUN([
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+ /* including termios.h on Solaris 5.6 fails unless inttypes.h included */
+ #ifdef HAVE_INTTYPES_H
+-#include <inttypes.h>
++#  include <inttypes.h>
+ #endif
+ #include <termios.h>
+-int
+-main() {
+-#if defined(TCGETS) || defined(TCGETA)
+-	return 0;
+-#else
+-	return 1;
++#
++#if !(defined(TCGETS) || defined(TCGETA))
++#  error "missing both of TCGETS and TCGETA"
+ #endif
+-}],
++]])],
+ 	AC_DEFINE(HAVE_TCGETS_OR_TCGETA_IN_TERMIOS_H)
+ 	AC_MSG_RESULT(yes)
+ ,
+ 	AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ AC_MSG_CHECKING([if TIOCGWINSZ in termios.h])
+-AC_TRY_RUN([
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+ /* including termios.h on Solaris 5.6 fails unless inttypes.h included */
+ #ifdef HAVE_INTTYPES_H
+-#include <inttypes.h>
++#  include <inttypes.h>
+ #endif
+ #include <termios.h>
+-int
+-main() {
+-#ifdef TIOCGWINSZ
+-	return 0;
+-#else
+-	return 1;
++
++#ifndef TIOCGWINSZ
++#  error "missing TIOCGWINSZ"
+ #endif
+-}],
++]])],
+ 	AC_DEFINE(HAVE_TIOCGWINSZ_IN_TERMIOS_H)
+ 	AC_MSG_RESULT(yes)
+ ,
+ 	AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ # finally check for Cray style ttys
+ AC_MSG_CHECKING([for Cray-style ptys])
+ SETUID=":"
+-AC_TRY_RUN([
+-int
+-main(){
+-#ifdef CRAY
+-	return 0;
+-#else
+-	return 1;
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
++#ifndef CRAY
++#  error "CRAY is not defined"
+ #endif
+-}
+-],
++]])],
+ 	PTY_TYPE=unicos
+ 	SETUID="chmod u+s"
+ 	AC_MSG_RESULT(yes)
+ ,
+ 	AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ #
+ # Check for select and/or poll. If both exist, we prefer select.
+ # if neither exists, define SIMPLE_EVENT.
+@@ -873,26 +842,24 @@
+ 
+ #
+ # check for timezones
+ #
+ AC_MSG_CHECKING([for SV-style timezone])
+-AC_TRY_RUN([
++AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+ extern char *tzname[2];
+ extern int daylight;
+ int
+ main()
+ {
+   int *x = &daylight;
+   char **y = tzname;
+ 
+   return 0;
+-}],
++}]])],
+ 	AC_DEFINE(HAVE_SV_TIMEZONE)
+ 	AC_MSG_RESULT(yes),
+ 	AC_MSG_RESULT(no)
+-,
+-	AC_MSG_ERROR([Expect can't be cross compiled])
+ )
+ 
+ 
+ # Following comment stolen from Tcl's configure.in:
+ #   Note:  in the following variable, it's important to use the absolute
+
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 543400380162d..102120a8604e4 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -10,12 +10,8 @@ tcl.mkTclDerivation rec {
   };
 
   patches = [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/buildroot/buildroot/c05e6aa361a4049eabd8b21eb64a34899ef83fc7/package/expect/0001-enable-cross-compilation.patch";
-      hash = "sha256-yyzE0Jjac5qaj7Svn4VpMiAqSNLYrw7VZbtFqgMVncs=";
-    })
     (substituteAll {
-      src = ./fix-cross-compilation.patch;
+      src = ./fix-build-time-run-tcl.patch;
       tcl = "${buildPackages.tcl}/bin/tclsh";
     })
     # The following patches fix compilation with clang 15+
@@ -27,8 +23,12 @@ tcl.mkTclDerivation rec {
       url = "https://sourceforge.net/p/expect/patches/_discuss/thread/b813ca9895/6759/attachment/expect-configure-c99.patch";
       hash = "sha256-PxQQ9roWgVXUoCMxkXEgu+it26ES/JuzHF6oML/nk54=";
     })
+    ./0004-enable-cross-compilation.patch
     # Include `sys/ioctl.h` and `util.h` on Darwin, which are required for `ioctl` and `openpty`.
-    ./fix-darwin-clang16.patch
+    # Include `termios.h` on FreeBSD for `openpty`
+    ./fix-darwin-bsd-clang16.patch
+    # Remove some code which causes it to link against a file that does not exist at build time on native FreeBSD
+    ./freebsd-unversioned.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/expect/fix-cross-compilation.patch b/pkgs/tools/misc/expect/fix-build-time-run-tcl.patch
index 8edc4bea39d69..8edc4bea39d69 100644
--- a/pkgs/tools/misc/expect/fix-cross-compilation.patch
+++ b/pkgs/tools/misc/expect/fix-build-time-run-tcl.patch
diff --git a/pkgs/tools/misc/expect/fix-darwin-clang16.patch b/pkgs/tools/misc/expect/fix-darwin-bsd-clang16.patch
index 9454769c99c8f..a0e11a5f9d6bc 100644
--- a/pkgs/tools/misc/expect/fix-darwin-clang16.patch
+++ b/pkgs/tools/misc/expect/fix-darwin-bsd-clang16.patch
@@ -14,16 +14,21 @@ diff -ur a/exp_win.c b/exp_win.c
 diff -ur d/pty_termios.c c/pty_termios.c
 --- d/pty_termios.c	2023-10-10 07:59:23.244452442 -0400
 +++ c/pty_termios.c	2023-10-10 08:00:35.303231582 -0400
-@@ -7,7 +7,13 @@
+@@ -7,7 +7,18 @@
  
  */
  
 -#include <pty.h> /* openpty */
 +/* openpty */
-+#ifdef __APPLE__
-+#include <util.h>
++#if defined(__APPLE__)
++#  include <util.h>
++#elif defined(__FreeBSD__)
++#  include <sys/types.h>
++#  include <sys/ioctl.h>
++#  include <termios.h>
++#  include <libutil.h>
 +#else /* pty.h is Linux-specific */
-+#include <pty.h>
++#  include <pty.h>
 +#endif
 +
  #include <stdio.h>
diff --git a/pkgs/tools/misc/expect/freebsd-unversioned.patch b/pkgs/tools/misc/expect/freebsd-unversioned.patch
new file mode 100644
index 0000000000000..345fa4f6277f6
--- /dev/null
+++ b/pkgs/tools/misc/expect/freebsd-unversioned.patch
@@ -0,0 +1,14 @@
+--- expect5.45.4/tclconfig/tcl.m4.orig	2024-05-29 11:24:56.150656190 -0700
++++ expect5.45.4/tclconfig/tcl.m4	2024-05-29 11:25:22.850790934 -0700
+@@ -1643,11 +1643,6 @@
+ 		LIBS=`echo $LIBS | sed s/-pthread//`
+ 		CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+ 		LDFLAGS="$LDFLAGS $PTHREAD_LIBS"])
+-	    # Version numbers are dot-stripped by system policy.
+-	    TCL_TRIM_DOTS=`echo ${VERSION} | tr -d .`
+-	    UNSHARED_LIB_SUFFIX='${TCL_TRIM_DOTS}.a'
+-	    SHARED_LIB_SUFFIX='${TCL_TRIM_DOTS}\$\{DBGX\}.so.1'
+-	    TCL_LIB_VERSIONS_OK=nodots
+ 	    ;;
+ 	Darwin-*)
+ 	    CFLAGS_OPTIMIZE="-Os"
diff --git a/pkgs/tools/misc/nanoemoji/default.nix b/pkgs/tools/misc/nanoemoji/default.nix
index 210eb5d6f8a2a..88b1cad122343 100644
--- a/pkgs/tools/misc/nanoemoji/default.nix
+++ b/pkgs/tools/misc/nanoemoji/default.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     setuptools-scm
-    pythonRelaxDepsHook
 
     pngquant
     resvg
diff --git a/pkgs/tools/misc/parquet-tools/default.nix b/pkgs/tools/misc/parquet-tools/default.nix
index 2e0d5744659a3..4775be223afac 100644
--- a/pkgs/tools/misc/parquet-tools/default.nix
+++ b/pkgs/tools/misc/parquet-tools/default.nix
@@ -39,7 +39,6 @@ buildPythonApplication rec {
 
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/misc/piston-cli/default.nix b/pkgs/tools/misc/piston-cli/default.nix
index 44ec8eabc149b..68519f2eb6432 100644
--- a/pkgs/tools/misc/piston-cli/default.nix
+++ b/pkgs/tools/misc/piston-cli/default.nix
@@ -18,7 +18,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/misc/pricehist/default.nix b/pkgs/tools/misc/pricehist/default.nix
index fc6c5753b7672..6930867cc4460 100644
--- a/pkgs/tools/misc/pricehist/default.nix
+++ b/pkgs/tools/misc/pricehist/default.nix
@@ -9,7 +9,6 @@
 , pytest-mock
 , responses
 , pytestCheckHook
-, pythonRelaxDepsHook
 }:
 
 buildPythonApplication rec {
@@ -33,7 +32,6 @@ buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/tools/misc/sqlite3-to-mysql/default.nix b/pkgs/tools/misc/sqlite3-to-mysql/default.nix
index 75d554ca4ecbe..f2bc903d3d581 100644
--- a/pkgs/tools/misc/sqlite3-to-mysql/default.nix
+++ b/pkgs/tools/misc/sqlite3-to-mysql/default.nix
@@ -23,7 +23,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     hatchling
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/misc/yubikey-manager/default.nix b/pkgs/tools/misc/yubikey-manager/default.nix
index 0bad719e33625..170968a98c44f 100644
--- a/pkgs/tools/misc/yubikey-manager/default.nix
+++ b/pkgs/tools/misc/yubikey-manager/default.nix
@@ -25,7 +25,6 @@ python3Packages.buildPythonPackage rec {
 
   nativeBuildInputs = with python3Packages; [
     poetry-core
-    pythonRelaxDepsHook
     installShellFiles
   ];
 
diff --git a/pkgs/tools/networking/burpsuite/default.nix b/pkgs/tools/networking/burpsuite/default.nix
index bc3ab38b74847..415cda5f6f555 100644
--- a/pkgs/tools/networking/burpsuite/default.nix
+++ b/pkgs/tools/networking/burpsuite/default.nix
@@ -52,7 +52,6 @@ buildFHSEnv {
     libdrm
     libudev0-shim
     libxkbcommon
-    mesa.drivers
     nspr
     nss
     pango
diff --git a/pkgs/tools/networking/cloud-custodian/default.nix b/pkgs/tools/networking/cloud-custodian/default.nix
index 0953a5e516da1..9425d85dce7f0 100644
--- a/pkgs/tools/networking/cloud-custodian/default.nix
+++ b/pkgs/tools/networking/cloud-custodian/default.nix
@@ -25,7 +25,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     argcomplete
diff --git a/pkgs/tools/security/amoco/default.nix b/pkgs/tools/security/amoco/default.nix
index c78cc8a605763..d3c687bcc8eef 100644
--- a/pkgs/tools/security/amoco/default.nix
+++ b/pkgs/tools/security/amoco/default.nix
@@ -16,7 +16,6 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/cfripper/default.nix b/pkgs/tools/security/cfripper/default.nix
index a1c9f94849810..d835d416c8b2e 100644
--- a/pkgs/tools/security/cfripper/default.nix
+++ b/pkgs/tools/security/cfripper/default.nix
@@ -25,7 +25,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/tools/security/coercer/default.nix b/pkgs/tools/security/coercer/default.nix
index e0d921e62e2d7..c2e8ee3dfe21c 100644
--- a/pkgs/tools/security/coercer/default.nix
+++ b/pkgs/tools/security/coercer/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/security/crackmapexec/default.nix b/pkgs/tools/security/crackmapexec/default.nix
index 7db3c804f911c..0a72fdff89aae 100644
--- a/pkgs/tools/security/crackmapexec/default.nix
+++ b/pkgs/tools/security/crackmapexec/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/crackql/default.nix b/pkgs/tools/security/crackql/default.nix
index cb3ecc1cb0a74..121ed522afae9 100644
--- a/pkgs/tools/security/crackql/default.nix
+++ b/pkgs/tools/security/crackql/default.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/enpass/default.nix b/pkgs/tools/security/enpass/default.nix
index 7ef13bce43075..20582a6d5c6bd 100644
--- a/pkgs/tools/security/enpass/default.nix
+++ b/pkgs/tools/security/enpass/default.nix
@@ -18,7 +18,6 @@ let
 
   # used of both wrappers and libpath
   libPath = lib.makeLibraryPath (with xorg; [
-    mesa.drivers
     libGLU libGL
     fontconfig
     freetype
diff --git a/pkgs/tools/security/expliot/default.nix b/pkgs/tools/security/expliot/default.nix
index 88fd1cf84b617..9a23087aa10d5 100644
--- a/pkgs/tools/security/expliot/default.nix
+++ b/pkgs/tools/security/expliot/default.nix
@@ -40,7 +40,6 @@ buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/security/faraday-agent-dispatcher/default.nix b/pkgs/tools/security/faraday-agent-dispatcher/default.nix
index 2a44e8186ed1b..4bb2065deab70 100644
--- a/pkgs/tools/security/faraday-agent-dispatcher/default.nix
+++ b/pkgs/tools/security/faraday-agent-dispatcher/default.nix
@@ -29,7 +29,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = with python3.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/tools/security/gallia/default.nix b/pkgs/tools/security/gallia/default.nix
index be66306c331bb..2f8c6da988c09 100644
--- a/pkgs/tools/security/gallia/default.nix
+++ b/pkgs/tools/security/gallia/default.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     aiofiles
diff --git a/pkgs/tools/security/ggshield/default.nix b/pkgs/tools/security/ggshield/default.nix
index aba9ce1c22775..4549546882f9c 100644
--- a/pkgs/tools/security/ggshield/default.nix
+++ b/pkgs/tools/security/ggshield/default.nix
@@ -21,7 +21,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ setuptools ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     appdirs
diff --git a/pkgs/tools/security/ioccheck/default.nix b/pkgs/tools/security/ioccheck/default.nix
index 3f899c33b5577..2637fea90528b 100644
--- a/pkgs/tools/security/ioccheck/default.nix
+++ b/pkgs/tools/security/ioccheck/default.nix
@@ -46,7 +46,6 @@ in py.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with py.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/security/knockpy/default.nix b/pkgs/tools/security/knockpy/default.nix
index 169165067c93d..6a4a28f868a54 100644
--- a/pkgs/tools/security/knockpy/default.nix
+++ b/pkgs/tools/security/knockpy/default.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   build-system = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/tools/security/knowsmore/default.nix b/pkgs/tools/security/knowsmore/default.nix
index 4c460eabcbe51..c3df59cf141f3 100644
--- a/pkgs/tools/security/knowsmore/default.nix
+++ b/pkgs/tools/security/knowsmore/default.nix
@@ -25,7 +25,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ setuptools ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     aioconsole
diff --git a/pkgs/tools/security/ldeep/default.nix b/pkgs/tools/security/ldeep/default.nix
index 098b811eb3f8d..5bb73911f0f9e 100644
--- a/pkgs/tools/security/ldeep/default.nix
+++ b/pkgs/tools/security/ldeep/default.nix
@@ -25,7 +25,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     cython
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/tools/security/maigret/default.nix b/pkgs/tools/security/maigret/default.nix
index f2d706bfe5105..cdbf6df4dd0f4 100644
--- a/pkgs/tools/security/maigret/default.nix
+++ b/pkgs/tools/security/maigret/default.nix
@@ -26,7 +26,6 @@ python3.pkgs.buildPythonApplication rec {
     })
   ];
 
-  nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3.pkgs; [
     aiodns
diff --git a/pkgs/tools/security/mitmproxy2swagger/default.nix b/pkgs/tools/security/mitmproxy2swagger/default.nix
index 0c940692f9e82..6731d7c21c53b 100644
--- a/pkgs/tools/security/mitmproxy2swagger/default.nix
+++ b/pkgs/tools/security/mitmproxy2swagger/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/security/netexec/default.nix b/pkgs/tools/security/netexec/default.nix
index 625cd39742521..3ac0eebda9545 100644
--- a/pkgs/tools/security/netexec/default.nix
+++ b/pkgs/tools/security/netexec/default.nix
@@ -48,7 +48,6 @@ python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python.pkgs; [
diff --git a/pkgs/tools/security/ospd-openvas/default.nix b/pkgs/tools/security/ospd-openvas/default.nix
index f047958c24929..5d7b517ec2869 100644
--- a/pkgs/tools/security/ospd-openvas/default.nix
+++ b/pkgs/tools/security/ospd-openvas/default.nix
@@ -23,7 +23,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ poetry-core ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3.pkgs; [
     defusedxml
diff --git a/pkgs/tools/security/quark-engine/default.nix b/pkgs/tools/security/quark-engine/default.nix
index c01704d0add6c..b2325c0a9a69f 100644
--- a/pkgs/tools/security/quark-engine/default.nix
+++ b/pkgs/tools/security/quark-engine/default.nix
@@ -19,7 +19,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ setuptools ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies = with python3.pkgs; [
     androguard
diff --git a/pkgs/tools/security/semgrep/default.nix b/pkgs/tools/security/semgrep/default.nix
index 13307d3101027..5baf13c2b8339 100644
--- a/pkgs/tools/security/semgrep/default.nix
+++ b/pkgs/tools/security/semgrep/default.nix
@@ -3,7 +3,6 @@
 , semgrep-core
 , buildPythonApplication
 , pythonPackages
-, pythonRelaxDepsHook
 
 , pytestCheckHook
 , git
@@ -42,7 +41,6 @@ buildPythonApplication rec {
     cd cli
   '';
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
   # tell cli/setup.py to not copy semgrep-core into the result
   # this means we can share a copy of semgrep-core and avoid an issue where it
   # copies the binary but doesn't retain the executable bit
diff --git a/pkgs/tools/security/tell-me-your-secrets/default.nix b/pkgs/tools/security/tell-me-your-secrets/default.nix
index 1d723aae52df8..30bd9d48fd234 100644
--- a/pkgs/tools/security/tell-me-your-secrets/default.nix
+++ b/pkgs/tools/security/tell-me-your-secrets/default.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/trueseeing/default.nix b/pkgs/tools/security/trueseeing/default.nix
index e5d89ab3ac0cc..c80abb6c31641 100644
--- a/pkgs/tools/security/trueseeing/default.nix
+++ b/pkgs/tools/security/trueseeing/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [
     flit-core
-    pythonRelaxDepsHook
   ];
 
   pythonRelaxDeps = true;
diff --git a/pkgs/tools/security/wapiti/default.nix b/pkgs/tools/security/wapiti/default.nix
index 1ddfbb703b967..77be8d9d5358d 100644
--- a/pkgs/tools/security/wapiti/default.nix
+++ b/pkgs/tools/security/wapiti/default.nix
@@ -26,7 +26,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [ setuptools ];
 
-  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
 
   dependencies =
     with python3.pkgs;
diff --git a/pkgs/tools/security/yaralyzer/default.nix b/pkgs/tools/security/yaralyzer/default.nix
index 47b5576e7bec8..9854a696ac991 100644
--- a/pkgs/tools/security/yaralyzer/default.nix
+++ b/pkgs/tools/security/yaralyzer/default.nix
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = with python3.pkgs; [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/tools/system/nvitop/default.nix b/pkgs/tools/system/nvitop/default.nix
index 1c7ed6083daf2..a89f5d04d65b3 100644
--- a/pkgs/tools/system/nvitop/default.nix
+++ b/pkgs/tools/system/nvitop/default.nix
@@ -16,7 +16,6 @@ python3Packages.buildPythonApplication rec {
 
   pythonRelaxDeps = [ "nvidia-ml-py" ];
 
-  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
 
   propagatedBuildInputs = with python3Packages; [
     cachetools
diff --git a/pkgs/tools/text/frogmouth/default.nix b/pkgs/tools/text/frogmouth/default.nix
index b2551b6387d68..8a93e86be66ca 100644
--- a/pkgs/tools/text/frogmouth/default.nix
+++ b/pkgs/tools/text/frogmouth/default.nix
@@ -17,7 +17,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     python3.pkgs.poetry-core
-    python3.pkgs.pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/typesetting/tex/nix/default.nix b/pkgs/tools/typesetting/tex/nix/default.nix
index e9017333c943c..feb444b98ff49 100644
--- a/pkgs/tools/typesetting/tex/nix/default.nix
+++ b/pkgs/tools/typesetting/tex/nix/default.nix
@@ -243,7 +243,7 @@ rec {
   # fonts.
   fontsConf = pkgs.makeFontsConf {
     fontDirectories = [
-      "${pkgs.ghostscript}/share/ghostscript/fonts"
+      "${pkgs.ghostscript.fonts}/share/fonts"
     ];
   };
 
diff --git a/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix b/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
index e289f9171c158..1356fc325047e 100644
--- a/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
+++ b/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
@@ -233,7 +233,7 @@ let
     # if the container is missing (that is, outputs == [ ]), create a file, to prevent passing the package to .withPackages
     ''
       for outputName in ''${!outputs[@]} ; do
-        if [[ -z ''${outputDrvs[$outputName]} ]] ; then
+        if [[ -n ''${outputDrvs[$outputName]} ]] ; then
           ln -s "''${outputDrvs[$outputName]}" "''${outputs[$outputName]}"
         else
           touch "''${outputs[$outputName]}"
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index d53c974a18d4c..81992a68421d3 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -35,7 +35,6 @@ localPython.pkgs.buildPythonApplication rec {
   '';
 
   nativeBuildInputs = with localPython.pkgs; [
-    pythonRelaxDepsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index adba1c835f36e..cdca4c0bd7d3d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7793,8 +7793,6 @@ with pkgs;
 
   expliot = callPackage ../tools/security/expliot { };
 
-  f2fs-tools = callPackage ../tools/filesystems/f2fs-tools { };
-
   Fabric = with python3Packages; toPythonApplication fabric;
 
   fail2ban = callPackage ../tools/security/fail2ban { };
@@ -15002,6 +15000,9 @@ with pkgs;
 
   ### DEVELOPMENT / COMPILERS
 
+  temurin-bin-22 = javaPackages.compiler.temurin-bin.jdk-22;
+  temurin-jre-bin-22 = javaPackages.compiler.temurin-bin.jre-22;
+
   temurin-bin-21 = javaPackages.compiler.temurin-bin.jdk-21;
   temurin-jre-bin-21 = javaPackages.compiler.temurin-bin.jre-21;
 
@@ -15023,8 +15024,8 @@ with pkgs;
   temurin-bin-8 = javaPackages.compiler.temurin-bin.jdk-8;
   temurin-jre-bin-8 = javaPackages.compiler.temurin-bin.jre-8;
 
-  temurin-bin = temurin-bin-21;
-  temurin-jre-bin = temurin-jre-bin-21;
+  temurin-bin = temurin-bin-22;
+  temurin-jre-bin = temurin-jre-bin-22;
 
   semeru-bin-21 = javaPackages.compiler.semeru-bin.jdk-21;
   semeru-jre-bin-21 = javaPackages.compiler.semeru-bin.jre-21;
@@ -20528,7 +20529,9 @@ with pkgs;
   # TODO: Fix references and add justStaticExecutables https://github.com/NixOS/nixpkgs/issues/318013
   emanote = haskellPackages.emanote;
 
-  enchant2 = callPackage ../development/libraries/enchant/2.x.nix { };
+  enchant2 = callPackage ../development/libraries/enchant/2.x.nix {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
   enchant = enchant2;
 
   enet = callPackage ../development/libraries/enet { };
@@ -21404,7 +21407,7 @@ with pkgs;
     icu74
   ;
 
-  icu = icu73;
+  icu = icu74;
 
   id3lib = callPackage ../development/libraries/id3lib { };
 
@@ -23228,10 +23231,12 @@ with pkgs;
   # Default libGLU
   libGLU = mesa_glu;
 
-  mesa = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa {
-    inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
-    inherit (darwin.apple_sdk_11_0.libs) Xplugin;
-  };
+  mesa = if stdenv.isDarwin
+    then darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/darwin.nix {
+      inherit (darwin.apple_sdk_11_0.libs) Xplugin;
+    }
+    else callPackage ../development/libraries/mesa {};
+
   mesa_i686 = pkgsi686Linux.mesa; # make it build on Hydra
 
   mesa_glu =  callPackage ../development/libraries/mesa-glu {
diff --git a/pkgs/top-level/java-packages.nix b/pkgs/top-level/java-packages.nix
index 2d59c358863b2..c80d6c28f840f 100644
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@@ -227,7 +227,7 @@ in {
       ../development/compilers/openjdk/22.nix
       ../development/compilers/zulu/22.nix
       {
-        openjdk22-bootstrap = temurin-bin.jdk-21;
+        openjdk22-bootstrap = temurin-bin.jdk-22;
         openjfx = openjfx22;
       };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 42562f4c3244c..65a71310e57b4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9024,7 +9024,9 @@ self: super: with self; {
 
   numpydoc = callPackage ../development/python-modules/numpydoc { };
 
-  numpy = callPackage ../development/python-modules/numpy { };
+  numpy_1 = callPackage ../development/python-modules/numpy/1.nix { };
+  numpy_2 = callPackage ../development/python-modules/numpy/2.nix { };
+  numpy = if self.pythonOlder "3.13" then numpy_1 else numpy_2;
 
   numpy-stl = callPackage ../development/python-modules/numpy-stl { };
 
@@ -11574,9 +11576,7 @@ self: super: with self; {
 
   phonemizer = callPackage ../development/python-modules/phonemizer { };
 
-  pyopencl = callPackage ../development/python-modules/pyopencl {
-    mesa_drivers = pkgs.mesa.drivers;
-  };
+  pyopencl = callPackage ../development/python-modules/pyopencl { };
 
   pyopengl = callPackage ../development/python-modules/pyopengl { };
 
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 087b43c3cb145..b0c7ec03827b4 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -292,7 +292,7 @@ let
           pkgsExtraHardening = super';
           stdenv = super'.withDefaultHardeningFlags (
             super'.stdenv.cc.defaultHardeningFlags ++ [
-              "zerocallusedregs"
+              "stackclashprotection"
               "trivialautovarinit"
             ]
           ) super'.stdenv;