diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index 7f57eda791ea..cfcc5549e8d1 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -47,6 +47,10 @@ Release branch. Used to specify that a package is not going to receive updates t
 
 The package’s homepage. Example: `https://www.gnu.org/software/hello/manual/`
 
+### `repository` {#var-meta-repository}
+
+A webpage where the package's source code can be viewed.  `https` links are preferred if available.  Automatically set to a default value if the package uses a `fetchFrom*` fetcher for its `src`. Example: `https://github.com/forthy42/gforth`
+
 ### `downloadPage` {#var-meta-downloadPage}
 
 The page where a link to the current version can be found. Example: `https://ftp.gnu.org/gnu/hello/`
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b328568e5b6a..f5dbcb02b57d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11231,6 +11231,12 @@
       fingerprint = "92D8 A09D 03DD B774 AABD 53B9 E136 2F07 D750 DB5C";
     }];
   };
+  lilacious = {
+    email = "yuchenhe126@gmail.com";
+    github = "Lilacious";
+    githubId = 101508537;
+    name = "Yuchen He";
+  };
   lillycham = {
     email = "lillycat332@gmail.com";
     github = "lillycat332";
@@ -17420,6 +17426,12 @@
     githubId = 92817635;
     name = "Sanskar Gurdasani";
   };
+  sarahec = {
+    email = "sarahec@nextquestion.net";
+    github = "sarahec";
+    githubId = 11277967;
+    name = "Sarah Clark";
+  };
   sarcasticadmin = {
     email = "rob@sarcasticadmin.com";
     github = "sarcasticadmin";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 1ddf536d3224..aec16e791f4d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -331,6 +331,7 @@
   ./security/systemd-confinement.nix
   ./security/tpm2.nix
   ./security/wrappers/default.nix
+  ./services/admin/docuum.nix
   ./services/admin/meshcentral.nix
   ./services/admin/oxidized.nix
   ./services/admin/pgadmin.nix
@@ -712,6 +713,7 @@
   ./services/misc/homepage-dashboard.nix
   ./services/misc/ihaskell.nix
   ./services/misc/input-remapper.nix
+  ./services/misc/invidious-router.nix
   ./services/misc/irkerd.nix
   ./services/misc/jackett.nix
   ./services/misc/jellyfin.nix
diff --git a/nixos/modules/services/admin/docuum.nix b/nixos/modules/services/admin/docuum.nix
new file mode 100644
index 000000000000..6f6cd4e02733
--- /dev/null
+++ b/nixos/modules/services/admin/docuum.nix
@@ -0,0 +1,45 @@
+{ config, pkgs, lib, utils, ... }:
+
+let
+  cfg = config.services.docuum;
+  inherit (lib) mkIf mkEnableOption mkOption getExe types;
+in
+{
+  options.services.docuum = {
+    enable = mkEnableOption "docuum daemon";
+
+    threshold = mkOption {
+      description = "Threshold for deletion in bytes, like `10 GB`, `10 GiB`, `10GB` or percentage-based thresholds like `50%`";
+      type = types.str;
+      default = "10 GB";
+      example = "50%";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.virtualisation.docker.enable;
+        message = "docuum requires docker on the host";
+      }
+    ];
+
+    systemd.services.docuum = {
+      after = [ "docker.socket" ];
+      requires = [ "docker.socket" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ config.virtualisation.docker.package ];
+      environment.HOME = "/var/lib/docuum";
+
+      serviceConfig = {
+        DynamicUser = true;
+        StateDirectory = "docuum";
+        SupplementaryGroups = [ "docker" ];
+        ExecStart = utils.escapeSystemdExecArgs [
+          (getExe pkgs.docuum)
+          "--threshold" cfg.threshold
+        ];
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/misc/invidious-router.nix b/nixos/modules/services/misc/invidious-router.nix
new file mode 100644
index 000000000000..01ef18dad535
--- /dev/null
+++ b/nixos/modules/services/misc/invidious-router.nix
@@ -0,0 +1,121 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.services.invidious-router;
+  settingsFormat = pkgs.formats.yaml {};
+  configFile = settingsFormat.generate "config.yaml" cfg.settings;
+in {
+  meta.maintainers = [lib.maintainers.s1ls];
+
+  options.services.invidious-router = {
+    enable = lib.mkEnableOption "Enables the invidious-router service";
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8050;
+      description = lib.mdDoc ''
+        Port to bind to.
+      '';
+    };
+    address = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = lib.mdDoc ''
+        Address on which invidious-router should listen on.
+      '';
+    };
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+      };
+      default = {
+        app = {
+          listen = "127.0.0.1:8050";
+          enable_youtube_fallback = false;
+          reload_instance_list_interval = "60s";
+        };
+        api = {
+          enabled = true;
+          url = "https://api.invidious.io/instances.json";
+          filter_regions = true;
+          allowed_regions = [
+            "AT"
+            "DE"
+            "CH"
+          ];
+        };
+        healthcheck = {
+          path = "/";
+          allowed_status_codes = [
+            200
+          ];
+          timeout = "1s";
+          interval = "10s";
+          filter_by_response_time = {
+            enabled = true;
+            qty_of_top_results = 3;
+          };
+          minimum_ratio = 0.2;
+          remove_no_ratio = true;
+          text_not_present = "YouTube is currently trying to block Invidious instances";
+        };
+      };
+      description = lib.mdDoc ''
+        Configuration for invidious-router.
+        Check https://gitlab.com/gaincoder/invidious-router#configuration
+        for configuration options.
+      '';
+    };
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.invidious-router;
+      defaultText = lib.literalExpression "pkgs.invidious-router";
+      description = lib.mdDoc ''
+        The invidious-router package to use.
+      '';
+    };
+    nginx = {
+      enable = lib.mkEnableOption (lib.mdDoc ''
+        Automatic nginx proxy configuration
+      '');
+      domain = lib.mkOption {
+        type = lib.types.str;
+        example = "invidious-router.example.com";
+        description = lib.mdDoc ''
+          The domain on which invidious-router should be served.
+        '';
+      };
+      extraDomains = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [];
+        description = lib.mdDoc ''
+          Additional domains to serve invidious-router on.
+        '';
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    systemd.services.invidious-router = {
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        Restart = "on-failure";
+        ExecStart = "${lib.getExe cfg.package} --configfile ${configFile}";
+        DynamicUser = "yes";
+      };
+    };
+
+    services.nginx.virtualHosts = lib.mkIf cfg.nginx.enable {
+      ${cfg.nginx.domain} = {
+        locations."/" = {
+          recommendedProxySettings = true;
+          proxyPass = "http://${cfg.address}:${toString cfg.port}";
+        };
+        enableACME = true;
+        forceSSL = true;
+        serverAliases = cfg.nginx.extraDomains;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix
index c4505534d635..f907aa68f55e 100644
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@@ -188,7 +188,14 @@ in
       description = lib.mdDoc ''The port which the Excalidraw backend for Jitsi should listen to.'';
     };
 
-    secureDomain.enable = mkEnableOption (lib.mdDoc "Authenticated room creation");
+    secureDomain = {
+      enable = mkEnableOption (lib.mdDoc "Authenticated room creation");
+      authentication = mkOption {
+        type = types.str;
+        default = "internal_hashed";
+        description = lib.mdDoc ''The authentication type to be used by jitsi'';
+      };
+    };
   };
 
   config = mkIf cfg.enable {
@@ -309,7 +316,7 @@ in
         enabled = true;
         domain = cfg.hostName;
         extraConfig = ''
-          authentication = ${if cfg.secureDomain.enable then "\"internal_hashed\"" else "\"jitsi-anonymous\""}
+          authentication = ${if cfg.secureDomain.enable then "\"${cfg.secureDomain.authentication}\"" else "\"jitsi-anonymous\""}
           c2s_require_encryption = false
           admins = { "focus@auth.${cfg.hostName}" }
           smacks_max_unacked_stanzas = 5
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 1ceaa40cca9d..7e75d78f667f 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -60,8 +60,26 @@ let
   }'';
 
   # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
+  OVMF2MB = pkgs.OVMF.override {
+    secureBoot = true;
+    fdSize2MB = true;
+  };
   ovmf-prefix = if pkgs.stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
   ovmf = pkgs.linkFarm "incus-ovmf" [
+    # 2MB must remain the default or existing VMs will fail to boot. New VMs will prefer 4MB
+    {
+      name = "OVMF_CODE.fd";
+      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_VARS.fd";
+      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.ms.fd";
+      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+
     {
       name = "OVMF_CODE.4MB.fd";
       path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_CODE.fd";
diff --git a/pkgs/applications/audio/spotify-player/default.nix b/pkgs/applications/audio/spotify-player/default.nix
index f3c675564512..e4e02f03891b 100644
--- a/pkgs/applications/audio/spotify-player/default.nix
+++ b/pkgs/applications/audio/spotify-player/default.nix
@@ -33,16 +33,16 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [ "" "alsa" "pulseaud
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-1aq+J1dP+hGJHq3boxZLUFfLLSFDY2uN6BwYXqHjCtk=";
+    hash = "sha256-TwMQtyg8ygFTI5DgT5rBVkZE31U4puaANIo5S8W0TXU=";
   };
 
-  cargoHash = "sha256-nULTz1H52L1kiTtViYfvxL+jrJ0uDk68oe8t5Hd7aCU=";
+  cargoHash = "sha256-RTvMywRWdZiBgNMjlUGa4jlD0HYOL3ESkVppGlsl4So=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/audio/squeezelite/default.nix b/pkgs/applications/audio/squeezelite/default.nix
index 694dd04d12a9..5c1ed3905539 100644
--- a/pkgs/applications/audio/squeezelite/default.nix
+++ b/pkgs/applications/audio/squeezelite/default.nix
@@ -45,13 +45,13 @@ stdenv.mkDerivation {
   pname = binName;
   # versions are specified in `squeezelite.h`
   # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "2.0.0.1473";
+  version = "2.0.0.1476";
 
   src = fetchFromGitHub {
     owner = "ralph-irving";
     repo = "squeezelite";
-    rev = "66c9b6a21834019a0230c39fcee74b6bf2891f7d";
-    hash = "sha256-MCH7vltF3jLGfxcRspXg9eQMx+e+lHSoxIanf91NrE0=";
+    rev = "7bba683e26f84b7dccc6ef5f40762a67b4f63606";
+    hash = "sha256-iRrZRnSIp8NbZ/Pi8WoQjyeBgxoU0mchNEf00W1Gsvo=";
   };
 
   buildInputs = [ flac libmad libvorbis mpg123 ]
diff --git a/pkgs/applications/blockchains/erigon/default.nix b/pkgs/applications/blockchains/erigon/default.nix
index ae77b64c7b04..d76f090efa86 100644
--- a/pkgs/applications/blockchains/erigon/default.nix
+++ b/pkgs/applications/blockchains/erigon/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "erigon";
-  version = "2.55.1";
+  version = "2.59.2";
 in
 buildGoModule {
   inherit pname version;
@@ -11,11 +11,11 @@ buildGoModule {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ttBJIx2QR3H5JFyquoGwZpWwT10r7X7GnGE4uEzuRZA=";
+    hash = "sha256-gSoaPoyPyryC1yzYaafnPXKpMNzI9fw9Yd0nKzziAKw=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-QLuWxec1gwMnVo0Zw8z4Ef8vzxc4xFpLL/TT986Sljo=";
+  vendorHash = "sha256-B3xbCI0szSAo9ULHDiqoTTR8tvgZUry7spDGuldu0lU=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:
@@ -34,6 +34,14 @@ buildGoModule {
     "cmd/rlpdump"
   ];
 
+  # Matches the tags to upstream's release build configuration
+  # https://github.com/ledgerwatch/erigon/blob/0c0dbe5f3a81cf8f16da8e4838312ab80ebe5302/.goreleaser.yml
+  #
+  # Enabling silkworm also breaks the build as it requires dynamically linked libraries.
+  # If we need it in the future, we should consider packaging silkworm and silkworm-go
+  # as depenedencies explicitly.
+  tags = "-tags=nosqlite,noboltdb,nosilkworm";
+
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/applications/graphics/oculante/default.nix b/pkgs/applications/graphics/oculante/default.nix
index f83184a488aa..fbbe037257bb 100644
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oculante";
-  version = "0.8.16";
+  version = "0.8.17";
 
   src = fetchFromGitHub {
     owner = "woelper";
     repo = "oculante";
     rev = version;
-    hash = "sha256-C8USTDW5C+mjj/fr242is/42RpmUvcK3lUeaq0/BSGA=";
+    hash = "sha256-kSCmBdTh4Z6b49fItv68w+hdIFH98g8lCfIVqj08wgg=";
   };
 
-  cargoHash = "sha256-w8k0QG509PRHHB1e4WThYnM6R0PwWMbSBxs2B0zQ0ww=";
+  cargoHash = "sha256-vZwzIV0l9iHEf2Iz/n1jY9Ai+YU5UkeSJPSqDkKy+nI=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 2c2c0813a88f..dbee3360d20c 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -94,11 +94,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.64.109";
+  version = "1.64.113";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-36igba0U3p8i7t91RxeG6PqlKYyHDDlj295ICcYmCNc=";
+    hash = "sha256-T0uVq1yxDXNi6x9ot5bs3NRaOQ+RwBThvULS6EZ+Bdg=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/ad/advcpmv/package.nix b/pkgs/by-name/ad/advcpmv/package.nix
deleted file mode 100644
index ba4caea99cd3..000000000000
--- a/pkgs/by-name/ad/advcpmv/package.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ coreutils
-, fetchFromGitHub
-}:
-
-let
-  advcpmv-data = {
-    pname = "advcpmv";
-    patch-version = "0.9";
-    coreutils-version = "9.4";
-    version = "${advcpmv-data.patch-version}-${advcpmv-data.coreutils-version}";
-    src = fetchFromGitHub {
-      owner = "jarun";
-      repo = "advcpmv";
-      rev = "a1f8b505e691737db2f7f2b96275802c45f65c59";
-      hash = "sha256-IHfMu6PyGRPc87J/hbxMUdosmLq13K0oWa5fPLWKOvo=";
-    };
-    patch-file = advcpmv-data.src + "/advcpmv-${advcpmv-data.version}.patch";
-  };
-  coreutilsNoSingleBinary = coreutils.override { singleBinary = false; };
-in
-assert (advcpmv-data.coreutils-version == coreutils.version);
-coreutilsNoSingleBinary.overrideAttrs (old: {
-  inherit (advcpmv-data) pname version;
-
-  patches = (old.patches or [ ]) ++ [
-    advcpmv-data.patch-file
-  ];
-
-  outputs = [ "out" ]; # Since we don't need info files
-
-  configureFlags = (old.configureFlags or [ ]) ++ [
-    # To not conflict with regular coreutils
-    "--program-prefix=adv"
-  ];
-
-  # Only cpg and mvg are desired, the others are not touched and therefore can
-  # be removed. Equally, the info directory is removed.
-  postFixup = (old.postFixup or "") + ''
-    rm -rf $out/share/info
-    pushd $out/bin
-    mv advcp cpg
-    mv advmv mvg
-    rm adv*
-    mv cpg advcp
-    mv mvg advmv
-    ln -s advcp cpg
-    ln -s advcp acp
-    ln -s advmv mvg
-    ln -s advmv amv
-    popd
-  '';
-
-  meta = old.meta // {
-    homepage = "https://github.com/jarun/advcpmv";
-    description = "Patched cp and mv from Coreutils that provides progress bars";
-    longDescription = ''
-      Advanced Copy is a mod for the GNU cp and GNU mv tools which adds a
-      progress bar and provides some info on what's going on. It was written by
-      Florian Zwicke and released under the GPL.
-    '';
-  };
-})
diff --git a/pkgs/by-name/bu/buttermanager/package.nix b/pkgs/by-name/bu/buttermanager/package.nix
new file mode 100644
index 000000000000..fe738b371219
--- /dev/null
+++ b/pkgs/by-name/bu/buttermanager/package.nix
@@ -0,0 +1,51 @@
+{ lib
+, fetchFromGitHub
+, python3Packages
+, wrapGAppsHook
+, qt5
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "buttermanager";
+  version = "2.5.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "egara";
+    repo = "buttermanager";
+    rev = version;
+    hash = "sha256-MLYJt7OMYlTFk8FCAlZJ1RGlFFXKfeAthWGp4JN+PfY=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    pyqt5
+    pyyaml
+    sip
+    tkinter
+  ];
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+    qt5.wrapQtAppsHook
+  ];
+
+  dontWrapQtApps = true;
+  dontWrapGApps = true;
+  makeWrapperArgs = [ "\${qtWrapperArgs[@]}" "\${gappsWrapperArgs[@]}"];
+
+  postInstall = ''
+    substituteInPlace packaging/buttermanager.desktop \
+      --replace-fail /opt/buttermanager/gui/buttermanager.svg buttermanager
+
+    install -Dm444 packaging/buttermanager.desktop -t $out/share/applications
+    install -Dm444 packaging/buttermanager.svg -t $out/share/icons/hicolor/scalable/apps
+  '';
+
+  meta = with lib; {
+    description = "Btrfs tool for managing snapshots, balancing filesystems and upgrading the system safetly";
+    homepage = "https://github.com/egara/buttermanager";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ t4ccer ];
+    mainProgram = "buttermanager";
+  };
+}
diff --git a/pkgs/by-name/do/docuum/package.nix b/pkgs/by-name/do/docuum/package.nix
new file mode 100644
index 000000000000..65c455038e67
--- /dev/null
+++ b/pkgs/by-name/do/docuum/package.nix
@@ -0,0 +1,38 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "docuum";
+  version = "0.23.1";
+
+  src = fetchFromGitHub {
+    owner = "stepchowfun";
+    repo = "docuum";
+    rev = "v${version}";
+    hash = "sha256-jZJkI4rk/8O6MsHjuDqmIiRc1LJpTajk/rSUVYnHiOs=";
+  };
+
+  cargoHash = "sha256-qBigfW0W3t0a43y99H22gmKBnhsu08Yd1CTTatsRfRs=";
+
+  checkFlags = [
+    # fails, no idea why
+    "--skip=format::tests::code_str_display"
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.IOKit
+  ];
+
+  meta = with lib; {
+    description = "Least recently used (LRU) eviction of Docker images";
+    homepage = "https://github.com/stepchowfun/docuum";
+    changelog = "https://github.com/stepchowfun/docuum/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mkg20001 ];
+    mainProgram = "docuum";
+  };
+}
diff --git a/pkgs/by-name/ha/hacompanion/package.nix b/pkgs/by-name/ha/hacompanion/package.nix
index dbf8be29cb46..eeb1cd7fe8a2 100644
--- a/pkgs/by-name/ha/hacompanion/package.nix
+++ b/pkgs/by-name/ha/hacompanion/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "hacompanion";
-  version = "1.0.11";
+  version = "1.0.12";
 
   src = fetchFromGitHub {
     owner = "tobias-kuendig";
     repo = "hacompanion";
     rev = "v${version}";
-    hash = "sha256-gTsA5XBjLlm/cITwQwYNudPK9SbSEaiAIjjdvRS3+8Q=";
+    hash = "sha256-3uPn139e8TyP0rE9hfRKw192YyexG+f3KmlHMmgCN7A=";
   };
 
   vendorHash = "sha256-ZZ8nxN+zUeFhSXyoHLMgzeFllnIkKdoVnbVK5KjrLEQ=";
diff --git a/pkgs/by-name/pd/pdf4qt/find_lcms2_path.patch b/pkgs/by-name/pd/pdf4qt/find_lcms2_path.patch
new file mode 100644
index 000000000000..eb38b07feb45
--- /dev/null
+++ b/pkgs/by-name/pd/pdf4qt/find_lcms2_path.patch
@@ -0,0 +1,21 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 98752ec..aa029b3 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -55,7 +55,15 @@ endif()
+ qt_standard_project_setup()
+ 
+ find_package(OpenSSL REQUIRED)
+-find_package(lcms REQUIRED)
++SET(LCMS2_NAMES ${LCMS2_NAMES} lcms2 liblcms2 liblcms2_static)
++FIND_LIBRARY(LCMS2_LIBRARY NAMES ${LCMS2_NAMES} )
++FIND_PATH(LCMS2_INCLUDE_DIR lcms2.h)
++add_library(lcms2::lcms2 UNKNOWN IMPORTED)
++set_target_properties(lcms2::lcms2 PROPERTIES
++    IMPORTED_LOCATION ${LCMS2_LIBRARY}
++    INTERFACE_INCLUDE_DIRECTORIES ${LCMS2_INCLUDE_DIR}
++    INTERFACE_COMPILE_DEFINITIONS "HAVE_LCMS2=1;CMS_NO_REGISTER_KEYWORD=1")
++set_property(GLOBAL APPEND PROPERTY INTERNAL_DEPS_PROP lcms2::lcms2)
+ find_package(ZLIB REQUIRED)
+ find_package(Freetype REQUIRED)
+ find_package(OpenJPEG CONFIG REQUIRED)
diff --git a/pkgs/by-name/pd/pdf4qt/package.nix b/pkgs/by-name/pd/pdf4qt/package.nix
new file mode 100644
index 000000000000..95152518f799
--- /dev/null
+++ b/pkgs/by-name/pd/pdf4qt/package.nix
@@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, substituteAll
+, lcms
+, cmake
+, pkg-config
+, qt6
+, openjpeg
+, tbb_2021_8
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pdf4qt";
+  version = "1.3.7";
+
+  src = fetchFromGitHub {
+    owner = "JakubMelka";
+    repo = "PDF4QT";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-wZJDMLEaHGBPSToQ+ObSfB5tw/fTIX1i5tmNPmIa7Ck=";
+  };
+
+  patches = [
+    # lcms2 cmake module only appears when built with vcpkg.
+    # We directly search for the corresponding libraries and
+    # header files instead.
+    ./find_lcms2_path.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qt6.qttools
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtwayland
+    qt6.qtsvg
+    qt6.qtspeech
+    lcms
+    openjpeg
+    tbb_2021_8
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "PDF4QT_INSTALL_TO_USR" false)
+  ];
+
+  meta = {
+    description = "Open source PDF editor";
+    longDescription = ''
+      This software is consisting of PDF rendering library,
+      and several applications, such as advanced document
+      viewer, command line tool, and document page
+      manipulator application. Software is implementing PDF
+      functionality based on PDF Reference 2.0.
+    '';
+    homepage = "https://jakubmelka.github.io";
+    license = lib.licenses.lgpl3Only;
+    mainProgram = "Pdf4QtViewerLite";
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/applications/misc/pot/Cargo.lock b/pkgs/by-name/po/pot/Cargo.lock
similarity index 99%
rename from pkgs/applications/misc/pot/Cargo.lock
rename to pkgs/by-name/po/pot/Cargo.lock
index a8dcf7612e3a..88e10a2d1d88 100644
--- a/pkgs/applications/misc/pot/Cargo.lock
+++ b/pkgs/by-name/po/pot/Cargo.lock
@@ -2791,9 +2791,9 @@ dependencies = [
 
 [[package]]
 name = "lingua"
-version = "1.6.1"
+version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73989d32b4cd00a69e78d979203fa3b87e43fae0236a29544331c2ccfa180fdd"
+checksum = "d109aef84956f04b8b5866db17e59f964152411915ad27b6e291b262d63a442c"
 dependencies = [
  "ahash",
  "brotli",
@@ -2821,6 +2821,7 @@ dependencies = [
  "lingua-spanish-language-model",
  "lingua-thai-language-model",
  "lingua-turkish-language-model",
+ "lingua-ukrainian-language-model",
  "lingua-vietnamese-language-model",
  "maplit",
  "once_cell",
@@ -3014,6 +3015,15 @@ dependencies = [
  "include_dir",
 ]
 
+[[package]]
+name = "lingua-ukrainian-language-model"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14ed035dd4b7ec5f76fe3b07e5f499d76c4cdb2a6d275459e4cdd3a3d21f131a"
+dependencies = [
+ "include_dir",
+]
+
 [[package]]
 name = "lingua-vietnamese-language-model"
 version = "1.1.0"
@@ -3582,9 +3592,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "open"
@@ -4650,9 +4660,9 @@ dependencies = [
 
 [[package]]
 name = "serde-wasm-bindgen"
-version = "0.6.1"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17ba92964781421b6cef36bf0d7da26d201e96d84e1b10e7ae6ed416e516906d"
+checksum = "4c1432112bce8b966497ac46519535189a3250a3812cd27a999678a69756f79f"
 dependencies = [
  "js-sys",
  "serde",
diff --git a/pkgs/applications/misc/pot/default.nix b/pkgs/by-name/po/pot/package.nix
similarity index 95%
rename from pkgs/applications/misc/pot/default.nix
rename to pkgs/by-name/po/pot/package.nix
index fdc0a6b6c414..aac04e5a0bcc 100644
--- a/pkgs/applications/misc/pot/default.nix
+++ b/pkgs/by-name/po/pot/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pot";
-  version = "2.7.4";
+  version = "2.7.9";
 
   src = fetchFromGitHub {
     owner = "pot-app";
     repo = "pot-desktop";
     rev = version;
-    hash = "sha256-c7FHkp/utvrr7qasY+XKaTnPaiZWb8M5EGiFne52osQ=";
+    hash = "sha256-Y2gFLvRNBjOGxdpIeoY1CXEip0Ht73aymWIP5wuc9kU=";
   };
 
   sourceRoot = "${src.name}/src-tauri";
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
 
     dontFixup = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-BQ5M+pKEXGJzWmxMchNgxpvLpgFCRIg33GQCvO4TLz4=";
+    outputHash = "sha256-LuY5vh642DgSa91eUcA/AT+ovDcP9tZFE2dKyicCOeQ=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
diff --git a/pkgs/by-name/ra/railway-travel/package.nix b/pkgs/by-name/ra/railway-travel/package.nix
new file mode 100644
index 000000000000..be09a63e6dd0
--- /dev/null
+++ b/pkgs/by-name/ra/railway-travel/package.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  cargo,
+  desktop-file-utils,
+  meson,
+  ninja,
+  pkg-config,
+  rustPlatform,
+  rustc,
+  wrapGAppsHook4,
+  cairo,
+  gdk-pixbuf,
+  glib,
+  gtk4,
+  libadwaita,
+  pango,
+  darwin,
+}:
+stdenv.mkDerivation rec {
+  pname = "railway-travel";
+  version = "2.4.0";
+
+  src = fetchFromGitLab {
+    owner = "schmiddi-on-mobile";
+    repo = "railway";
+    rev = version;
+    hash = "sha256-2iLxErEP0OG+BcG7fvJBzNjh95EkNoC3NC7rKxPLhYk=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-yalFC7Pw9rq1ylLwoxLi4joTyjQsZJ/ZC61GhTNc49w=";
+  };
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    cargo
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    wrapGAppsHook4
+  ];
+
+  buildInputs =
+    [
+      cairo
+      gdk-pixbuf
+      glib
+      gtk4
+      libadwaita
+      pango
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Foundation
+      darwin.apple_sdk.frameworks.Security
+    ];
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isClang [ "-Wno-error=incompatible-function-pointer-types" ]
+  );
+
+  meta = with lib; {
+    description = "Find all your travel information";
+    homepage = "https://gitlab.com/schmiddi-on-mobile/railway";
+    changelog = "https://gitlab.com/schmiddi-on-mobile/railway/-/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ lilacious ];
+    mainProgram = "diebahn";
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/se/sesh/package.nix b/pkgs/by-name/se/sesh/package.nix
index ccfc53274e2c..919bc5e6a047 100644
--- a/pkgs/by-name/se/sesh/package.nix
+++ b/pkgs/by-name/se/sesh/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "sesh";
-  version = "0.15.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "joshmedeski";
     repo = "sesh";
     rev = "v${version}";
-    hash = "sha256-vV1b0YhDBt/dJJCrxvVV/FIuOIleTg4mI496n4/Y/Hk=";
+    hash = "sha256-eFqqiGIbS9HW7czAtSIPmvbynvg2gsu4luKsL25vxn4=";
   };
 
   vendorHash = "sha256-zt1/gE4bVj+3yr9n0kT2FMYMEmiooy3k1lQ77rN6sTk=";
diff --git a/pkgs/by-name/tr/treedome/package.nix b/pkgs/by-name/tr/treedome/package.nix
index a7752abf0fd6..86a554b2f8ae 100644
--- a/pkgs/by-name/tr/treedome/package.nix
+++ b/pkgs/by-name/tr/treedome/package.nix
@@ -19,12 +19,12 @@
 
 let
   pname = "treedome";
-  version = "0.4.3";
+  version = "0.4.5";
 
   src = fetchgit {
     url = "https://codeberg.org/solver-orgz/treedome";
     rev = version;
-    hash = "sha256-FBzRsBoV3wnt2nu5WMnaTnBNC51jG120E0Orm55KhBg=";
+    hash = "sha256-YkyjG/ee5WeO5OD4FZnWaqcOJO3YC0uQkbwGkCNBxC8=";
     fetchLFS = true;
   };
 
diff --git a/pkgs/development/compilers/dotnet/common.nix b/pkgs/development/compilers/dotnet/common.nix
index 0d8890e61da2..63b3a7de374e 100644
--- a/pkgs/development/compilers/dotnet/common.nix
+++ b/pkgs/development/compilers/dotnet/common.nix
@@ -4,6 +4,8 @@
 , writeText
 , testers
 , runCommand
+, expect
+, curl
 }: type: args: stdenv.mkDerivation (finalAttrs: args // {
   doInstallCheck = true;
 
@@ -27,37 +29,97 @@
 
 } // lib.optionalAttrs (type == "sdk") {
   passthru = {
-    tests = {
+    tests = let
+      mkDotnetTest =
+        {
+          name,
+          template,
+          usePackageSource ? false,
+          build,
+          # TODO: use correct runtimes instead of sdk
+          runtime ? finalAttrs.finalPackage,
+          runInputs ? [],
+          run ? null,
+        }:
+        let
+          built = runCommand "dotnet-test-${name}" { buildInputs = [ finalAttrs.finalPackage ]; } (''
+            HOME=$PWD/.home
+            dotnet new nugetconfig
+            dotnet nuget disable source nuget
+          '' + lib.optionalString usePackageSource ''
+            dotnet nuget add source ${finalAttrs.finalPackage.packages}
+          '' + ''
+            dotnet new ${template} -n test -o .
+          '' + build);
+        in
+          if run == null
+            then build
+          else
+            runCommand "${built.name}-run" { src = built; nativeBuildInputs = runInputs; } (
+              lib.optionalString (runtime != null) ''
+                # TODO: use runtime here
+                export DOTNET_ROOT=${runtime}
+              '' + run);
+
+      checkConsoleOutput = command: ''
+        output="$(${command})"
+        # yes, older SDKs omit the comma
+        [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
+      '';
+
+    in {
       version = testers.testVersion {
         package = finalAttrs.finalPackage;
       };
 
-      console = runCommand "dotnet-test-console" {
-        nativeBuildInputs = [ finalAttrs.finalPackage ];
-      } ''
-        HOME=$(pwd)/fake-home
-        dotnet new nugetconfig
-        dotnet nuget disable source nuget
-        dotnet new console -n test -o .
-        output="$(dotnet run)"
-        # yes, older SDKs omit the comma
-        [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
-      '';
+      console = mkDotnetTest {
+        name = "console";
+        template = "console";
+        build = checkConsoleOutput "dotnet run";
+      };
 
-      single-file = let build = runCommand "dotnet-test-build-single-file" {
-        nativeBuildInputs = [ finalAttrs.finalPackage ];
-      } ''
-        HOME=$(pwd)/fake-home
-        dotnet new nugetconfig
-        dotnet nuget disable source nuget
-        dotnet nuget add source ${finalAttrs.finalPackage.packages}
-        dotnet new console -n test -o .
-        dotnet publish --use-current-runtime -p:PublishSingleFile=true -o $out
-      ''; in runCommand "dotnet-test-run-single-file" {} ''
-        output="$(${build}/test)"
-        # yes, older SDKs omit the comma
-        [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
-      '';
+      publish = mkDotnetTest {
+        name = "publish";
+        template = "console";
+        build = "dotnet publish -o $out";
+        run = checkConsoleOutput "$src/test";
+      };
+
+      single-file = mkDotnetTest {
+        name = "single-file";
+        template = "console";
+        usePackageSource = true;
+        build = "dotnet publish --use-current-runtime -p:PublishSingleFile=true -o $out";
+        runtime = null;
+        run = checkConsoleOutput "$src/test";
+      };
+
+      web = mkDotnetTest {
+        name = "publish";
+        template = "web";
+        build = "dotnet publish -o $out";
+        runInputs = [ expect curl ];
+        run = ''
+          expect <<"EOF"
+            set status 1
+            spawn $env(src)/test
+            expect_before default abort
+            expect -re {Now listening on: ([^\r]+)\r} {
+              set url $expect_out(1,string)
+            }
+            expect "Application started. Press Ctrl+C to shut down."
+            set output [exec curl -sSf $url]
+            if {$output != "Hello World!"} {
+              send_error "Unexpected output: $output\n"
+              exit 1
+            }
+            send \x03
+            catch wait result
+            exit [lindex $result 3]
+          EOF
+          touch $out
+        '';
+      };
     } // args.passthru.tests or {};
   } // args.passthru or {};
 })
diff --git a/pkgs/development/compilers/idris2/build-idris.nix b/pkgs/development/compilers/idris2/build-idris.nix
index e66306c4344b..1df763e4c4fd 100644
--- a/pkgs/development/compilers/idris2/build-idris.nix
+++ b/pkgs/development/compilers/idris2/build-idris.nix
@@ -32,28 +32,34 @@ let
     "idrisLibraries"
   ];
 
-  sharedAttrs = drvAttrs // {
-    pname = ipkgName;
-    inherit version;
-    src = src;
-    nativeBuildInputs = [ idris2 makeWrapper ] ++ attrs.nativeBuildInputs or [];
-    buildInputs = propagatedIdrisLibraries ++ attrs.buildInputs or [];
+  derivation = stdenv.mkDerivation (finalAttrs:
+    drvAttrs // {
+      pname = ipkgName;
+      inherit version;
+      src = src;
+      nativeBuildInputs = [ idris2 makeWrapper ] ++ attrs.nativeBuildInputs or [];
+      buildInputs = propagatedIdrisLibraries ++ attrs.buildInputs or [];
 
-    IDRIS2_PACKAGE_PATH = libDirs;
+      IDRIS2_PACKAGE_PATH = libDirs;
 
-    buildPhase = ''
-      runHook preBuild
-      idris2 --build ${ipkgFileName}
-      runHook postBuild
-    '';
+      buildPhase = ''
+        runHook preBuild
+        idris2 --build ${ipkgFileName}
+        runHook postBuild
+      '';
 
-    passthru = {
-      inherit propagatedIdrisLibraries;
-    };
-  };
+      passthru = {
+        inherit propagatedIdrisLibraries;
+      };
+
+      shellHook = ''
+        export IDRIS2_PACKAGE_PATH="${finalAttrs.IDRIS2_PACKAGE_PATH}"
+      '';
+    }
+  );
 
 in {
-  executable = stdenv.mkDerivation (sharedAttrs // {
+  executable = derivation.overrideAttrs {
     installPhase = ''
       runHook preInstall
       mkdir -p $out/bin
@@ -76,11 +82,11 @@ in {
       fi
       runHook postInstall
     '';
-  });
+  };
 
   library = { withSource ? false }:
     let installCmd = if withSource then "--install-with-src" else "--install";
-    in stdenv.mkDerivation (sharedAttrs // {
+    in derivation.overrideAttrs {
       installPhase = ''
         runHook preInstall
         mkdir -p $out/${libSuffix}
@@ -88,5 +94,5 @@ in {
         idris2 ${installCmd} ${ipkgFileName}
         runHook postInstall
       '';
-    });
+    };
 }
diff --git a/pkgs/development/coq-modules/serapi/default.nix b/pkgs/development/coq-modules/serapi/default.nix
index f48cce55d4dc..d993bbdf1020 100644
--- a/pkgs/development/coq-modules/serapi/default.nix
+++ b/pkgs/development/coq-modules/serapi/default.nix
@@ -71,7 +71,8 @@ in
           if version == "8.11.0+0.11.1" then version
           else builtins.replaceStrings [ "+" ] [ "." ] version
         }.tbz";
-    sha256 = release."${version}".sha256;
+    # abort/syntax error will fail package set eval, but throw is "fine"
+    sha256 = release."${version}".sha256 or (throw "Unknown version '${version}'");
   };
 
   patches =
diff --git a/pkgs/development/misc/brev-cli/default.nix b/pkgs/development/misc/brev-cli/default.nix
index 39824b634b11..146d41321c6a 100644
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.277";
+  version = "0.6.279";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-s80veDxN0GfHKOwDhxx1ArZXqk8OPSl+d/Ruxj0oLJA=";
+    sha256 = "sha256-jQkaMFTArXPSCm6aBQb/vb4JEkgHtmzJl/Iz/f/pBSY=";
   };
 
   vendorHash = "sha256-IR/tgqh8rS4uN5jSOcopCutbHCKHSU9icUfRhOgu4t8=";
diff --git a/pkgs/development/python-modules/argilla/default.nix b/pkgs/development/python-modules/argilla/default.nix
index f4886e311f85..bd05a3d076f5 100644
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@@ -65,7 +65,7 @@
 }:
 let
   pname = "argilla";
-  version = "1.26.0";
+  version = "1.26.1";
   optional-dependencies = {
     server = [
       fastapi
@@ -126,7 +126,7 @@ buildPythonPackage {
     owner = "argilla-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+8oN3afbpBQU2tRb2Oq12IlmoCg4O1LUHtt4hl2FOEI=";
+    hash = "sha256-7d8zvP06GrHrSEJn2NNv2BUNea1wamf21e+qa1dZU18=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/django-webpush/default.nix b/pkgs/development/python-modules/django-webpush/default.nix
index 44d670dfeede..5f04dccb1ca6 100644
--- a/pkgs/development/python-modules/django-webpush/default.nix
+++ b/pkgs/development/python-modules/django-webpush/default.nix
@@ -22,17 +22,21 @@ buildPythonPackage rec {
     hash = "sha256-Mwp53apdPpBcn7VfDbyDlvLAVAG65UUBhT0w9OKjKbU=";
   };
 
-  nativeBuildInputs = [
+  pythonRelaxDeps = [
+    "pywebpush"
+  ];
+
+  build-system = [
     pythonRelaxDepsHook
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     django
     pywebpush
   ];
 
-  # nothing to test
+  # Module has no tests
   doCheck = false;
 
   pythonImportsCheck = [
@@ -40,7 +44,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "A Package made for integrating and sending Web Push Notification in Django Application";
+    description = "Module for integrating and sending Web Push Notification in Django Application";
     homepage = "https://github.com/safwanrahman/django-webpush/";
     changelog = "https://github.com/safwanrahman/django-webpush/releases/tag/${src.rev}";
     license = licenses.gpl3Plus;
diff --git a/pkgs/development/python-modules/findpython/default.nix b/pkgs/development/python-modules/findpython/default.nix
index 78875b6db2c8..aa0905fed01f 100644
--- a/pkgs/development/python-modules/findpython/default.nix
+++ b/pkgs/development/python-modules/findpython/default.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "findpython";
-  version = "0.5.1";
+  version = "0.6.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -25,7 +25,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UGSjA5PFLvyMajV5DDdbiwAF1vdPFykDW0tCZHNH4T0=";
+    hash = "sha256-A2p4QbiOLzckM6WJsfCSGVGXN9KYnrX1Nw1wr7z4R2U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index 1593e7c9d84b..7717982dd4e0 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "huggingface-hub";
-  version = "0.22.0";
+  version = "0.22.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "huggingface_hub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jq7oCQlLXwr859mhHYolKp/N63Z0SIksMTwNL0JjfNQ=";
+    hash = "sha256-Y/oUF+d6Oo45x9cufZxjaJCQpoY0acPhetbyAt8M3pQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index 79fbbb1ed893..3c2cee34008c 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.1.36";
+  version = "0.1.38";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YHYzC4c7VOPBiBgtJcN/hPccZMJBL5E8VsIAwErhWjg=";
+    hash = "sha256-hK9zPEmO0LaRnbLTbc9ABE9a7UAZU9yZZUswu955CJU=";
   };
 
   sourceRoot = "${src.name}/python";
diff --git a/pkgs/development/python-modules/pylacus/default.nix b/pkgs/development/python-modules/pylacus/default.nix
index 1f2790ad2031..09941db80a0e 100644
--- a/pkgs/development/python-modules/pylacus/default.nix
+++ b/pkgs/development/python-modules/pylacus/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pylacus";
-  version = "1.8.2";
+  version = "1.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "ail-project";
     repo = "PyLacus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wXdQe/4Xw/D0MRFqNfSKimJ99aCE7M7k1neT/+t7ixY=";
+    hash = "sha256-ytO9wtCkiC6CLWLkmSV/R+Rnx/W4Jv2dsgykZ2GB13U=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pywebpush/default.nix b/pkgs/development/python-modules/pywebpush/default.nix
index 903ad646b8b5..ebb3313b20c5 100644
--- a/pkgs/development/python-modules/pywebpush/default.nix
+++ b/pkgs/development/python-modules/pywebpush/default.nix
@@ -1,28 +1,36 @@
 { lib
-, fetchPypi
+, aiohttp
 , buildPythonPackage
 , cryptography
+, fetchPypi
 , http-ece
-, py-vapid
-, requests
-, six
-, coverage
-, flake8
 , mock
+, py-vapid
 , pytestCheckHook
+, pythonOlder
+, requests
+, setuptools
+, six
 }:
 
 buildPythonPackage rec {
   pname = "pywebpush";
-  version = "1.14.1";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+I1+K/XofGFt+wS4yVwRkjjFEWWbAvc17nfMFoQoVe4=";
+    hash = "sha256-A8zD6XW2A3S3Y0xJVZVha+Ujvyx9oNl26E/amsjGMwE=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    aiohttp
     cryptography
     http-ece
     py-vapid
@@ -31,19 +39,20 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    coverage
-    flake8
     mock
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "pywebpush" ];
+  pythonImportsCheck = [
+    "pywebpush"
+  ];
 
   meta = with lib; {
     description = "Webpush Data encryption library for Python";
-    mainProgram = "pywebpush";
     homepage = "https://github.com/web-push-libs/pywebpush";
+    changelog = "https://github.com/web-push-libs/pywebpush/releases/tag/${version}";
     license = licenses.mpl20;
     maintainers = with maintainers; [ peterhoeg ];
+    mainProgram = "pywebpush";
   };
 }
diff --git a/pkgs/development/python-modules/reptor/default.nix b/pkgs/development/python-modules/reptor/default.nix
index 013008581a53..1843505af86d 100644
--- a/pkgs/development/python-modules/reptor/default.nix
+++ b/pkgs/development/python-modules/reptor/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "reptor";
-  version = "0.14";
+  version = "0.16";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "Syslifters";
     repo = "reptor";
     rev = "refs/tags/${version}";
-    hash = "sha256-XZiFVIUyLVVr3ZraOAuXs+shl4vk3S8OJHNHV4p10YY=";
+    hash = "sha256-xyk83XPITD1sAtuFcndTQg0otDMO89LK+B+9SD89kvo=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/requirements-parser/default.nix b/pkgs/development/python-modules/requirements-parser/default.nix
index b2b7697a464a..1f35ce49b25c 100644
--- a/pkgs/development/python-modules/requirements-parser/default.nix
+++ b/pkgs/development/python-modules/requirements-parser/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "requirements-parser";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "madpah";
     repo = "requirements-parser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fUx6NBD6qxAyArGgCiB2J1Ak7pudx/LI0+rCHjLnc1M=";
+    hash = "sha256-P1uMpg9uoPp18KwdBHkvpMGV8eKhTEsDCKwz2JsTOug=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/scalene/default.nix b/pkgs/development/python-modules/scalene/default.nix
new file mode 100644
index 000000000000..29a51e38b631
--- /dev/null
+++ b/pkgs/development/python-modules/scalene/default.nix
@@ -0,0 +1,87 @@
+{ lib
+, buildPythonPackage
+, hypothesis
+, fetchpatch
+, fetchPypi
+, setuptools
+, setuptools-scm
+, cloudpickle
+, cython
+, jinja2
+, numpy
+, psutil
+, pynvml
+, pytestCheckHook
+, pythonOlder
+, rich
+}:
+
+buildPythonPackage rec {
+  pname = "scalene";
+  version = "1.5.38";
+  pyproject = true;
+  disabled = pythonOlder "3.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-LR1evkn2m6FNBmJnUUJubesxIPeHG6RDgLFBHDuxe38=";
+  };
+
+  patches = [
+    # fix scalene_config import. remove on next update
+    (fetchpatch {
+      name = "scalene_config-import-fix.patch";
+      url = "https://github.com/plasma-umass/scalene/commit/cd437be11f600ac0925ce77efa516e6d83934200.patch";
+      hash = "sha256-YjFh+mu5jyIJYUQFhmGqLXhec6lgQAdj4tWxij3NkwU=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cython
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    cloudpickle
+    jinja2
+    psutil
+    pynvml
+    rich
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    hypothesis
+    numpy
+  ];
+
+  disabledTestPaths = [
+    # remove on next update
+    # Failing Darwin-specific tests that were subsequently removed from the source repo.
+    "tests/test_coverup_35.py"
+    "tests/test_coverup_42.py"
+    "tests/test_coverup_43.py"
+  ];
+
+  # remove scalene directory to prevent pytest import confusion
+  preCheck = ''
+    rm -rf scalene
+  '';
+
+  pythonImportsCheck = [ "scalene" ];
+
+  meta = with lib; {
+    description = "High-resolution, low-overhead CPU, GPU, and memory profiler for Python with AI-powered optimization suggestions";
+    homepage = "https://github.com/plasma-umass/scalene";
+    changelog = "https://github.com/plasma-umass/scalene/releases/tag/v${version}";
+    mainProgram = "scalene";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ sarahec ];
+  };
+}
diff --git a/pkgs/servers/misc/oven-media-engine/default.nix b/pkgs/servers/misc/oven-media-engine/default.nix
index 35db446c70a2..c5e2d181c1cb 100644
--- a/pkgs/servers/misc/oven-media-engine/default.nix
+++ b/pkgs/servers/misc/oven-media-engine/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oven-media-engine";
-  version = "0.15.14";
+  version = "0.16.5";
 
   src = fetchFromGitHub {
     owner = "AirenSoft";
     repo = "OvenMediaEngine";
     rev = "v${version}";
-    sha256 = "sha256-pLLnk0FXJ6gb0WSdWGEzJSEbKdOpjdWECIRzrHvi8HQ=";
+    sha256 = "sha256-hkLIJ3vGpnywcOw+bfEsQESGFe1FUcCVJlMlVgGsrNs=";
   };
 
   sourceRoot = "${src.name}/src";
@@ -40,10 +40,6 @@ stdenv.mkDerivation rec {
     patchShebangs core/colorgcc
     patchShebangs projects/main/update_git_info.sh
 
-    sed -i -e 's/const AVOutputFormat /AVOutputFormat /g' \
-      projects/modules/mpegts/mpegts_writer.cpp \
-      projects/modules/file/file_writer.cpp \
-      projects/modules/rtmp/rtmp_writer.cpp
     sed -i -e '/^CC =/d' -e '/^CXX =/d' -e '/^AR =/d' projects/third_party/pugixml-1.9/scripts/pugixml.make
   '';
 
diff --git a/pkgs/servers/web-apps/mediawiki/default.nix b/pkgs/servers/web-apps/mediawiki/default.nix
index 23f0e6c2153c..bab57f257683 100644
--- a/pkgs/servers/web-apps/mediawiki/default.nix
+++ b/pkgs/servers/web-apps/mediawiki/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mediawiki";
-  version = "1.41.0";
+  version = "1.41.1";
 
   src = fetchurl {
     url = "https://releases.wikimedia.org/mediawiki/${lib.versions.majorMinor version}/mediawiki-${version}.tar.gz";
-    hash = "sha256-84Qrcqp6JYiPHsYyMj3YkEF3OaEg2VHEhfhQ4MzLQhs=";
+    hash = "sha256-TguqlTuF6U0xBAyyUSCrxgb6hpsuMxJr37t/xhPoxLI=";
   };
 
   postPatch = ''
diff --git a/pkgs/shells/fzf-git-sh/default.nix b/pkgs/shells/fzf-git-sh/default.nix
index 8d7ce5d1e0f7..e9cda521fb1d 100644
--- a/pkgs/shells/fzf-git-sh/default.nix
+++ b/pkgs/shells/fzf-git-sh/default.nix
@@ -39,12 +39,12 @@ stdenv.mkDerivation rec {
       -e "s,\buniq\b,${coreutils}/bin/uniq," \
       -e "s,\bcolumn\b,${util-linux}/bin/column," \
       -e "s,\bfzf-tmux\b,${fzf}/bin/fzf-tmux," \
-      -e "/display-message/!s,\bgit\b,${git}/bin/git,g" \
       -e "s,\bgrep\b,${gnugrep}/bin/grep," \
       -e "s,\bsed\b,${gnused}/bin/sed," \
       -e "/fzf-tmux/!s,\btmux\b,${tmux}/bin/tmux," \
       -e "s,\bxargs\b,${findutils}/bin/xargs," \
       -e "s,\bxdg-open\b,${xdg-utils}/bin/xdg-open," \
+      -e "/display-message\|fzf-git-\$o-widget\|\burl=\|\$remote_url =~ /!s,\bgit\b,${git}/bin/git,g" \
       -e "s,__fzf_git=.*BASH_SOURCE.*,__fzf_git=$out/share/${pname}/fzf-git.sh," \
       -e "/__fzf_git=.*readlink.*/d" \
       fzf-git.sh
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 63c853e3dc31..eb4482be7894 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -296,6 +296,10 @@ let
       str
     ];
     downloadPage = str;
+    repository = union [
+      (listOf str)
+      str
+    ];
     changelog = union [
       (listOf str)
       str
@@ -444,7 +448,29 @@ let
     let
       outputs = attrs.outputs or [ "out" ];
     in
-    {
+    optionalAttrs (attrs ? src.meta.homepage || attrs ? srcs && isList attrs.srcs && any (src: src ? meta.homepage) attrs.srcs) {
+      # should point to an http-browsable source tree, if available.
+      # fetchers like fetchFromGitHub set it automatically.
+      # this could be handled a lot easier if we nulled it instead
+      # of having it be undefined, but that wouldn't match the
+      # other attributes.
+      repository = let
+        getSrcs = attrs:
+          if attrs ? src
+          then
+            [ attrs.src ]
+          else
+            lib.filter (src: src ? meta.homepage) attrs.srcs;
+        getHomePages = srcs: map (src: src.meta.homepage) srcs;
+        unlist = list:
+          if lib.length list == 1
+          then
+            lib.elemAt list 0
+          else
+            list;
+      in
+        unlist (getHomePages (getSrcs attrs));
+    } // {
       # `name` derivation attribute includes cross-compilation cruft,
       # is under assert, and is sanitized.
       # Let's have a clean always accessible version here.
diff --git a/pkgs/tools/admin/aliyun-cli/default.nix b/pkgs/tools/admin/aliyun-cli/default.nix
index 78a7c62e9f77..e4ca2a611c3f 100644
--- a/pkgs/tools/admin/aliyun-cli/default.nix
+++ b/pkgs/tools/admin/aliyun-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.200";
+  version = "3.0.201";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aliyun";
     repo = pname;
     fetchSubmodules = true;
-    sha256 = "sha256-xUP7zEWq5zTNzDaazmsL2h4QznsE5K3Rzo08qctCA3M=";
+    sha256 = "sha256-gI+D65wBnuexSJF89KjWJ5p4RJXs64Zg23V9RGwUTws=";
   };
 
   vendorHash = "sha256-t9ukiREUEmW6KK7m5Uv5Ce6n/1GsBLom9H35eEyOBys=";
diff --git a/pkgs/tools/admin/granted/default.nix b/pkgs/tools/admin/granted/default.nix
index 4761d49e8bec..5b428505f82b 100644
--- a/pkgs/tools/admin/granted/default.nix
+++ b/pkgs/tools/admin/granted/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "granted";
-  version = "0.21.1";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "common-fate";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-aHqMsEqlD/a/qQEjRKQU/+9Ov5BTnptExuO0eEXvf9k=";
+    sha256 = "sha256-cN7c5oJAP6ZHjq8o6PZHv40fdjCJtkGbPS2Vh+EWDHw=";
   };
 
-  vendorHash = "sha256-I4sds5r61oGop+EtOpDgTYwLbSVBBSBmNbRU56sCYjo=";
+  vendorHash = "sha256-lVP32y+XCPaVp8FtnN/13wBXTPQDHupaVw0T/nWtmYo=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
index 3019a2593640..5af095ae1556 100644
--- a/pkgs/tools/security/aws-iam-authenticator/default.nix
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.6.18";
+  version = "0.6.19";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-QhtDfi6USazpPq+7VnJX9YqTxsm7y1CZpIXiZyHaGG4=";
+    hash = "sha256-wgMMa1PFKNArI4pk7gA2o8HHgF84Q+rga4j+UC1/Js8=";
   };
 
-  vendorHash = "sha256-TDsY05jnutNIKx0z6/8vGvsgYCIKBkTxh9mXqk4IR38=";
+  vendorHash = "sha256-wJqtIuLiidO3XFkvhSXRZcFR/31rR4U9BXjFilsr5a0=";
 
   ldflags = let PKG = "sigs.k8s.io/aws-iam-authenticator"; in [
     "-s"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8f271535dbd9..2b05d40d9de2 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -59,6 +59,7 @@ mapAliases ({
   AusweisApp2 = ausweisapp; # Added 2023-11-08
   a4term = a4; # Added 2023-10-06
   adtool = throw "'adtool' has been removed, as it was broken and unmaintained";
+  advcpmv = throw "'advcpmv' has been removed, as it is not being actively maintained and break recent coreutils."; # Added 2024-03-29
   aether = throw "aether has been removed from nixpkgs; upstream unmaintained, security issues"; # Added 2023-10-03
   airfield = throw "airfield has been removed due to being unmaintained"; # Added 2023-05-19
   alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream"; # Added 2023-07-28
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 039950c8bc9e..d3bab087bf0a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -26855,6 +26855,8 @@ with pkgs;
 
   sampler = callPackage ../applications/misc/sampler { };
 
+  scalene = with python3Packages; toPythonApplication scalene;
+
   scalr-cli = callPackage ../tools/admin/scalr-cli { };
 
   scaphandre = callPackage ../servers/scaphandre { };
@@ -34164,8 +34166,6 @@ with pkgs;
 
   pop-launcher = callPackage ../applications/misc/pop-launcher { };
 
-  pot = callPackage ../applications/misc/pot { };
-
   pothos = libsForQt5.callPackage ../applications/radio/pothos { };
 
   potrace = callPackage ../applications/graphics/potrace { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 61ed5392c5b2..810868a51b69 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -13336,6 +13336,8 @@ self: super: with self; {
 
   sasmodels = callPackage ../development/python-modules/sasmodels { };
 
+  scalene = callPackage ../development/python-modules/scalene { };
+
   scales = callPackage ../development/python-modules/scales { };
 
   scancode-toolkit = callPackage ../development/python-modules/scancode-toolkit { };