diff --git a/.github/labeler.yml b/.github/labeler.yml
index d7adc601e580..b88f7f5179ec 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -369,3 +369,8 @@
     - changed-files:
       - any-glob-to-any-file:
         - nixos/modules/**/*
+"8.has: maintainer-list (update)":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - maintainers/maintainer-list.nix
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 612923fbe6f1..7a168d14a479 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -20,7 +20,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
diff --git a/.github/workflows/basic-eval.yml b/.github/workflows/basic-eval.yml
index ff9e6d5a3814..6059ba784959 100644
--- a/.github/workflows/basic-eval.yml
+++ b/.github/workflows/basic-eval.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
     - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
     - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
       with:
diff --git a/.github/workflows/check-by-name.yml b/.github/workflows/check-by-name.yml
index 5863d0186f9b..8e2011cb6d52 100644
--- a/.github/workflows/check-by-name.yml
+++ b/.github/workflows/check-by-name.yml
@@ -91,7 +91,7 @@ jobs:
             exit 1
           fi
           echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
-      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           # pull_request_target checks out the base branch by default
           ref: ${{ env.mergedSha }}
diff --git a/.github/workflows/check-cherry-picks.yml b/.github/workflows/check-cherry-picks.yml
index 82a8eca01adf..f8d244594165 100644
--- a/.github/workflows/check-cherry-picks.yml
+++ b/.github/workflows/check-cherry-picks.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       with:
         fetch-depth: 0
         filter: blob:none
diff --git a/.github/workflows/check-maintainers-sorted.yaml b/.github/workflows/check-maintainers-sorted.yaml
index 6c3eb3723668..062522928c2a 100644
--- a/.github/workflows/check-maintainers-sorted.yaml
+++ b/.github/workflows/check-maintainers-sorted.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/check-nix-format.yml b/.github/workflows/check-nix-format.yml
index 31e105281a77..aca8808fa261 100644
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index e0a264cf485f..bb864ace316b 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -24,7 +24,7 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/manual-nixos.yml b/.github/workflows/manual-nixos.yml
index 8e6dd17d3168..ac5532a25370 100644
--- a/.github/workflows/manual-nixos.yml
+++ b/.github/workflows/manual-nixos.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/manual-nixpkgs.yml b/.github/workflows/manual-nixpkgs.yml
index f3347a92d1f8..672ebf61ac77 100644
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/nix-parse.yml b/.github/workflows/nix-parse.yml
index a45198f1475e..b86594e0d53b 100644
--- a/.github/workflows/nix-parse.yml
+++ b/.github/workflows/nix-parse.yml
@@ -24,7 +24,7 @@ jobs:
         if [[ -s "$HOME/changed_files" ]]; then
           echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
         fi
-    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index eba0d6cae3e2..d9ad593618ae 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -41,7 +41,7 @@ jobs:
             into: staging-23.11
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
diff --git a/.github/workflows/periodic-merge-6h.yml b/.github/workflows/periodic-merge-6h.yml
index 986b7013d0e7..a3131e802534 100644
--- a/.github/workflows/periodic-merge-6h.yml
+++ b/.github/workflows/periodic-merge-6h.yml
@@ -39,7 +39,7 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
index 8f85ad89e2f7..36d84d617dc4 100644
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8c4331ca2512..089b21e54632 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9094,6 +9094,12 @@
     github = "joshua-cooper";
     githubId = 35612334;
   };
+  jcaesar = {
+    name = "Julius Michaelis";
+    matrix = "@julius:mtx.liftm.de";
+    github = "jcaesar";
+    githubId = 1753388;
+  };
   jceb = {
     name = "Jan Christoph Ebersbach";
     email = "jceb@e-jc.de";
@@ -10970,6 +10976,12 @@
     githubId = 2422454;
     name = "Kai Wohlfahrt";
   };
+  kylecarbs = {
+    name = "Kyle Carberry";
+    email = "kyle@carberry.com";
+    github = "kylecarbs";
+    githubId = 7122116;
+  };
   kylehendricks = {
     name = "Kyle Hendricks";
     email = "kyle-github@mail.hendricks.nu";
@@ -11590,12 +11602,6 @@
     githubId = 918448;
     name = "Anthony Lodi";
   };
-  loewenheim = {
-    email = "loewenheim@mailbox.org";
-    github = "loewenheim";
-    githubId = 7622248;
-    name = "Sebastian Zivota";
-  };
   logo = {
     email = "logo4poop@protonmail.com";
     matrix = "@logo4poop:matrix.org";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 76aacb47acaf..68577cb9d7c9 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -44,10 +44,6 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 - A new option `systemd.sysusers.enable` was added. If enabled, users and
   groups are created with systemd-sysusers instead of with a custom perl script.
 
-- The default dbus implementation has transitioned to dbus-broker from the classic dbus daemon for better performance and reliability. Users can revert to the classic dbus daemon by setting `services.dbus.implementation = "dbus";`. For detailed deviations, refer to [dbus-broker's deviations page](https://github.com/bus1/dbus-broker/wiki/Deviations).
-
-- GNOME has been updated to v46. Refer to the [release notes](https://release.gnome.org/46/) for more details. Notably this release brings experimental VRR support, default GTK renderer changes and WebDAV support in Online Accounts. This release we have also stopped including the legacy and unsupported Adwaita-Dark theme by default.
-
 - `virtualisation.docker.enableNvidia` and `virtualisation.podman.enableNvidia` options are deprecated. `hardware.nvidia-container-toolkit.enable` should be used instead. This option will expose GPUs on containers with the `--device` CLI option. This is supported by Docker 25, Podman 3.2.0 and Singularity 4. Any container runtime that supports the CDI specification will take advantage of this feature.
 
 - `system.etc.overlay.enable` option was added. If enabled, `/etc` is
diff --git a/nixos/lib/qemu-common.nix b/nixos/lib/qemu-common.nix
index b946f62d93dc..f1e19c5b3b72 100644
--- a/nixos/lib/qemu-common.nix
+++ b/nixos/lib/qemu-common.nix
@@ -35,6 +35,8 @@ rec {
         aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -machine virt,gic-version=max,accel=kvm:tcg -cpu max";
         powerpc64le-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
         powerpc64-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
+        riscv32-linux = "${qemuPkg}/bin/qemu-system-riscv32 -machine virt";
+        riscv64-linux = "${qemuPkg}/bin/qemu-system-riscv64 -machine virt";
         x86_64-darwin = "${qemuPkg}/bin/qemu-kvm -cpu max";
       };
       otherHostGuestMatrix = {
diff --git a/nixos/modules/services/home-automation/wyoming/faster-whisper.nix b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
index cbff3ab3e617..d0fca6a41c7b 100644
--- a/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
+++ b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
@@ -119,6 +119,8 @@ in
         wantedBy = [
           "multi-user.target"
         ];
+        # https://github.com/rhasspy/wyoming-faster-whisper/issues/27
+        environment."HF_HUB_CACHE" = "/tmp";
         serviceConfig = {
           DynamicUser = true;
           User = "wyoming-faster-whisper";
diff --git a/nixos/modules/services/system/dbus.nix b/nixos/modules/services/system/dbus.nix
index a9fc88e320c6..8dba0aca6433 100644
--- a/nixos/modules/services/system/dbus.nix
+++ b/nixos/modules/services/system/dbus.nix
@@ -39,7 +39,7 @@ in
 
       implementation = mkOption {
         type = types.enum [ "dbus" "broker" ];
-        default = "broker";
+        default = "dbus";
         description = ''
           The implementation to use for the message bus defined by the D-Bus specification.
           Can be either the classic dbus daemon or dbus-broker, which aims to provide high
diff --git a/nixos/modules/services/web-apps/coder.nix b/nixos/modules/services/web-apps/coder.nix
index d4a5b7b2b89c..5450adbe118d 100644
--- a/nixos/modules/services/web-apps/coder.nix
+++ b/nixos/modules/services/web-apps/coder.nix
@@ -223,4 +223,5 @@ in {
       };
     };
   };
+  meta.maintainers = pkgs.coder.meta.maintainers;
 }
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 06c1253d1fb6..c30f4577fdd8 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -249,7 +249,7 @@ let
           ${concatStringsSep " " config.virtualisation.qemu.networkingOptions} \
           ${concatStringsSep " \\\n    "
             (mapAttrsToList
-              (tag: share: "-virtfs local,path=${share.source},security_model=none,mount_tag=${tag}")
+              (tag: share: "-virtfs local,path=${share.source},security_model=${share.securityModel},mount_tag=${tag}")
               config.virtualisation.sharedDirectories)} \
           ${drivesCmdLine config.virtualisation.qemu.drives} \
           ${concatStringsSep " \\\n    " config.virtualisation.qemu.options} \
@@ -462,6 +462,18 @@ in
               type = types.path;
               description = "The mount point of the directory inside the virtual machine";
             };
+            options.securityModel = mkOption {
+              type = types.enum [ "passthrough" "mapped-xattr" "mapped-file" "none" ];
+              default = "mapped-xattr";
+              description = ''
+                The security model to use for this share:
+
+                - `passthrough`: files are stored using the same credentials as they are created on the guest (this requires QEMU to run as root)
+                - `mapped-xattr`: some of the file attributes like uid, gid, mode bits and link target are stored as file attributes
+                - `mapped-file`: the attributes are stored in the hidden .virtfs_metadata directory. Directories exported by this security model cannot interact with other unix tools
+                - `none`: same as "passthrough" except the sever won't report failures if it fails to set file attributes like ownership
+              '';
+            };
           });
         default = { };
         example = {
@@ -1091,18 +1103,22 @@ in
       nix-store = mkIf cfg.mountHostNixStore {
         source = builtins.storeDir;
         target = "/nix/store";
+        securityModel = "none";
       };
       xchg = {
         source = ''"$TMPDIR"/xchg'';
+        securityModel = "none";
         target = "/tmp/xchg";
       };
       shared = {
         source = ''"''${SHARED_DIR:-$TMPDIR/xchg}"'';
         target = "/tmp/shared";
+        securityModel = "none";
       };
       certs = mkIf cfg.useHostCerts {
         source = ''"$TMPDIR"/certs'';
         target = "/etc/ssl/certs";
+        securityModel = "none";
       };
     };
 
diff --git a/nixos/tests/coder.nix b/nixos/tests/coder.nix
index 12813827284b..fd1fa0cc3031 100644
--- a/nixos/tests/coder.nix
+++ b/nixos/tests/coder.nix
@@ -1,8 +1,6 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "coder";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ shyim ghuntley ];
-  };
+  meta.maintainers = pkgs.coder.meta.maintainers;
 
   nodes.machine =
     { pkgs, ... }:
diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix
index a57d66f82eac..4a7bcd5a8226 100644
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@@ -610,6 +610,11 @@ in {
     # Returns a comma separated representation of the given list in sorted
     # order, that matches the output format of switch-to-configuration.pl
     sortedUnits = xs: lib.concatStringsSep ", " (builtins.sort builtins.lessThan xs);
+
+    dbusService = {
+      "dbus" = "dbus.service";
+      "broker" = "dbus-broker.service";
+    }.${nodes.machine.services.dbus.implementation};
   in /* python */ ''
     def switch_to_specialisation(system, name, action="test", fail=False):
         if name == "":
@@ -691,9 +696,9 @@ in {
     with subtest("continuing from an aborted switch"):
         # An aborted switch will write into a file what it tried to start
         # and a second switch should continue from this
-        machine.succeed("echo dbus-broker.service > /run/nixos/start-list")
+        machine.succeed("echo ${dbusService} > /run/nixos/start-list")
         out = switch_to_specialisation("${machine}", "modifiedSystemConf")
-        assert_contains(out, "starting the following units: dbus-broker.service\n")
+        assert_contains(out, "starting the following units: ${dbusService}\n")
 
     with subtest("fstab mounts"):
         switch_to_specialisation("${machine}", "")
@@ -732,7 +737,7 @@ in {
         out = switch_to_specialisation("${machine}", "")
         assert_contains(out, "stopping the following units: test.mount\n")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: dbus-broker.service\n")
+        assert_contains(out, "reloading the following units: ${dbusService}\n")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
@@ -740,7 +745,7 @@ in {
         out = switch_to_specialisation("${machine}", "storeMountModified")
         assert_lacks(out, "stopping the following units:")
         assert_contains(out, "NOT restarting the following changed units: -.mount")
-        assert_contains(out, "reloading the following units: dbus-broker.service\n")
+        assert_contains(out, "reloading the following units: ${dbusService}\n")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
@@ -751,7 +756,7 @@ in {
         out = switch_to_specialisation("${machine}", "swap")
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: dbus-broker.service\n")
+        assert_contains(out, "reloading the following units: ${dbusService}\n")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_contains(out, "the following new units were started: swapfile.swap")
@@ -760,7 +765,7 @@ in {
         assert_contains(out, "stopping swap device: /swapfile")
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: dbus-broker.service\n")
+        assert_contains(out, "reloading the following units: ${dbusService}\n")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
@@ -781,7 +786,7 @@ in {
         assert_lacks(out, "installing dummy bootloader")  # test does not install a bootloader
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: dbus-broker.service\n")  # huh
+        assert_contains(out, "reloading the following units: ${dbusService}\n")  # huh
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_contains(out, "the following new units were started: test.service\n")
@@ -858,7 +863,7 @@ in {
         assert_lacks(out, "installing dummy bootloader")  # test does not install a bootloader
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: dbus-broker.service\n")  # huh
+        assert_contains(out, "reloading the following units: ${dbusService}\n")  # huh
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_contains(out, "the following new units were started: test.service\n")
diff --git a/pkgs/applications/audio/grandorgue/default.nix b/pkgs/applications/audio/grandorgue/default.nix
index 54bd0cad3593..9e519510eb72 100644
--- a/pkgs/applications/audio/grandorgue/default.nix
+++ b/pkgs/applications/audio/grandorgue/default.nix
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation rec {
   pname = "grandorgue";
-  version = "3.14.1-1";
+  version = "3.14.2-1";
 
   src = fetchFromGitHub {
     owner = "GrandOrgue";
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-EyMTWsaqJX7H7aCbu5ww9tQBMwJ7BzobWMWg5Y/ZgJE=";
+    hash = "sha256-FHM8fFUga9poGhojKBTF4gsJ6L4XEksueVxfMbngvks=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/backup/pika-backup/default.nix b/pkgs/applications/backup/pika-backup/default.nix
index 7adaa00d6078..3d919449be3e 100644
--- a/pkgs/applications/backup/pika-backup/default.nix
+++ b/pkgs/applications/backup/pika-backup/default.nix
@@ -21,20 +21,20 @@
 
 stdenv.mkDerivation rec {
   pname = "pika-backup";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "pika-backup";
     rev = "v${version}";
-    hash = "sha256-yxr98CJuu15TGiIXCBhU2bOgvct6jQ5xAraD9Z0sL2Q=";
+    hash = "sha256-Z9vRuz5PwOhJ3DQD9zvCilgTMww7bRL4aR6fRoHIayI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-ce8SdBvRdFp1BU9OPcByoJjCiSrAkQqtmfCeJ3B+Piw=";
+    hash = "sha256-hcfkwxwLOUBMj6rvhI5F4OO9UaSP7CAE0JNOGlh2lVY=";
   };
 
   patches = [
diff --git a/pkgs/applications/blockchains/groestlcoin/default.nix b/pkgs/applications/blockchains/groestlcoin/default.nix
index 78389b28c954..4e6e685316bf 100644
--- a/pkgs/applications/blockchains/groestlcoin/default.nix
+++ b/pkgs/applications/blockchains/groestlcoin/default.nix
@@ -14,7 +14,6 @@
 , miniupnpc
 , zeromq
 , zlib
-, db53
 , sqlite
 , qrencode
 , qtbase ? null
@@ -33,13 +32,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = if withGui then "groestlcoin" else "groestlcoind";
-  version = "26.0";
+  version = "27.0";
 
   src = fetchFromGitHub {
     owner = "Groestlcoin";
     repo = "groestlcoin";
     rev = "v${version}";
-    sha256 = "00qvaf53jszsk1rr029zmq60v8w0r92192ab65k2krkmh7ybla9l";
+    sha256 = "0f6vi2k5xvjrhiazfjcd4aj246dfcg51xsnqb9wdjl41cg0ckwmf";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config installShellFiles ]
@@ -49,7 +48,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withGui [ wrapQtAppsHook ];
 
   buildInputs = [ boost libevent miniupnpc zeromq zlib ]
-    ++ lib.optionals withWallet [ db53 sqlite ]
+    ++ lib.optionals withWallet [ sqlite ]
     ++ lib.optionals withGui [ qrencode qtbase qttools ];
 
   postInstall = ''
diff --git a/pkgs/applications/blockchains/terra-station/default.nix b/pkgs/applications/blockchains/terra-station/default.nix
index 5c4a7cc8b354..54ecd28550c2 100644
--- a/pkgs/applications/blockchains/terra-station/default.nix
+++ b/pkgs/applications/blockchains/terra-station/default.nix
@@ -5,6 +5,7 @@
 , bash
 , makeWrapper
 , electron
+, asar
 }:
 
 let
@@ -31,7 +32,7 @@ stdenv.mkDerivation rec {
     inherit sha256;
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper asar ];
 
   dontConfigure = true;
   dontBuild = true;
@@ -48,6 +49,13 @@ stdenv.mkDerivation rec {
     cp -a usr/share/* $out/share
     cp -a "opt/Terra Station/"{locales,resources} $out/share/${pname}
 
+    # patch pre-built node modules
+    asar e $out/share/${pname}/resources/app.asar asar-unpacked
+    find asar-unpacked -name '*.node' -exec patchelf \
+      --add-rpath "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}" \
+      {} \;
+    asar p asar-unpacked $out/share/${pname}/resources/app.asar
+
     substituteInPlace $out/share/applications/station-electron.desktop \
       --replace "/opt/Terra Station/station-electron" ${pname}
 
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index a88785e70817..fb57331cc3b4 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -113,6 +113,17 @@ rec {
       xz
     ];
   }).overrideAttrs (attrs: {
+    postInstall = (attrs.postInstall or "") + lib.optionalString (stdenv.isLinux) ''
+      (
+        cd $out/clion
+
+        for dir in plugins/clion-radler/DotFiles/linux-*; do
+          rm -rf $dir/dotnet
+          ln -s ${dotnet-sdk_7} $dir/dotnet
+        done
+      )
+    '';
+
     postFixup = (attrs.postFixup or "") + lib.optionalString (stdenv.isLinux) ''
       (
         cd $out/clion
diff --git a/pkgs/applications/editors/quartus-prime/default.nix b/pkgs/applications/editors/quartus-prime/default.nix
index 51a1a2925e92..2b3ee4095175 100644
--- a/pkgs/applications/editors/quartus-prime/default.nix
+++ b/pkgs/applications/editors/quartus-prime/default.nix
@@ -3,6 +3,7 @@
 , withQuesta ? true
 , supportedDevices ? [ "Arria II" "Cyclone V" "Cyclone IV" "Cyclone 10 LP" "MAX II/V" "MAX 10 FPGA" ]
 , unwrapped ? callPackage ./quartus.nix { inherit unstick supportedDevices withQuesta; }
+, extraProfile ? ""
 }:
 
 let
@@ -114,7 +115,7 @@ in buildFHSEnv rec {
     if [ "$NIXPKGS_IS_QUESTA_WRAPPER" != 1 ]; then
         export LD_PRELOAD=''${LD_PRELOAD:+$LD_PRELOAD:}/usr/lib/libudev.so.0
     fi
-  '';
+  '' + extraProfile;
 
   # Run the wrappers directly, instead of going via bash.
   runScript = "";
diff --git a/pkgs/applications/editors/standardnotes/default.nix b/pkgs/applications/editors/standardnotes/default.nix
index e61f57c76448..bc44c8e9f620 100644
--- a/pkgs/applications/editors/standardnotes/default.nix
+++ b/pkgs/applications/editors/standardnotes/default.nix
@@ -4,6 +4,9 @@
 , dpkg
 , makeWrapper
 , electron
+, libsecret
+, asar
+, glib
 , desktop-file-utils
 , callPackage
 }:
@@ -28,16 +31,28 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
 
-  nativeBuildInputs = [ makeWrapper dpkg desktop-file-utils ];
+  nativeBuildInputs = [ makeWrapper dpkg desktop-file-utils asar ];
 
   unpackPhase = "dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner";
 
-  installPhase = ''
+  installPhase = let
+    libPath = lib.makeLibraryPath [
+      libsecret
+      glib
+      stdenv.cc.cc.lib
+    ];
+  in
+    ''
     runHook preInstall
 
     mkdir -p $out/bin $out/share/standardnotes
     cp -R usr/share/{applications,icons} $out/share
     cp -R opt/Standard\ Notes/resources/app.asar $out/share/standardnotes/
+    asar e $out/share/standardnotes/app.asar asar-unpacked
+    find asar-unpacked -name '*.node' -exec patchelf \
+      --add-rpath "${libPath}" \
+      {} \;
+    asar p asar-unpacked $out/share/standardnotes/app.asar
 
     makeWrapper ${electron}/bin/electron $out/bin/standardnotes \
       --add-flags $out/share/standardnotes/app.asar
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 62d8b5a519dd..2776640fdf59 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -937,6 +937,7 @@ https://github.com/xiyaowong/transparent.nvim/,HEAD,
 https://github.com/Wansmer/treesj/,main,
 https://github.com/tremor-rs/tremor-vim/,,
 https://github.com/cappyzawa/trim.nvim/,,
+https://github.com/simonclean/triptych.nvim/,HEAD,
 https://github.com/folke/trouble.nvim/,,
 https://github.com/Pocco81/true-zen.nvim/,,
 https://github.com/tesaguri/trust.vim/,HEAD,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 07d8e5430a7b..409cb43eae35 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1822,7 +1822,7 @@ let
         mktplcRef = {
           publisher = "github";
           name = "copilot-chat";
-          version = "0.14.2024032901";  # compatible with vscode 1.88.1
+          version = "0.14.2024032901"; # compatible with vscode 1.88.1
           hash = "sha256-+6N7IGO5j0wP5Zg8CwapHeKGWiZzc43VM4jCtqJDJIQ=";
         };
         meta = {
@@ -2853,6 +2853,22 @@ let
 
       ms-python.python = callPackage ./ms-python.python { };
 
+      ms-python.debugpy = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "debugpy";
+          publisher = "ms-python";
+          version = "2023.3.13121011";
+          hash = "sha256-owYUEyQl2FQytApfuI97N4y9p7/dL0lu6EBk/AzSMjw=";
+        };
+        meta = {
+          description = "Python debugger (debugpy) extension for VS Code";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.debugpy";
+          homepage = "https://github.com/Microsoft/vscode-python-debugger";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.carlthome ];
+        };
+      };
+
       ms-python.vscode-pylance = callPackage ./ms-python.vscode-pylance { };
 
       ms-toolsai.datawrangler = buildVscodeMarketplaceExtension {
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index c61b1662a6c4..4ba40b417c8c 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -38,14 +38,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mame";
-  version = "0.264";
+  version = "0.265";
   srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
     rev = "mame${srcVersion}";
-    hash = "sha256-0UWMBKM//XWm8PFl60JvTLGaDBMVZFnVrbX4omy2F4I=";
+    hash = "sha256-jXGmABFeoT8g2UtVV159gUpdWcBvb9aX3uiFi2neVQI=";
   };
 
   outputs = [ "out" "tools" ];
diff --git a/pkgs/applications/graphics/oculante/default.nix b/pkgs/applications/graphics/oculante/default.nix
index cf7dadedbd6a..a0c8da470555 100644
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oculante";
-  version = "0.8.18";
+  version = "0.8.19";
 
   src = fetchFromGitHub {
     owner = "woelper";
     repo = "oculante";
     rev = version;
-    hash = "sha256-TLY6ydYeRuT93jjUeE7EaFNNllwla4h563UhXAxSyko=";
+    hash = "sha256-oCgnz1WMg7YypIT8Tjk2m+f/43Aj88rDVCxQ92aL3RY=";
   };
 
-  cargoHash = "sha256-RKJE09Z4XxRLWQ95Om3tru4rI2TD7XmxoHhPHFirREo=";
+  cargoHash = "sha256-vlU7egAht+kgA5Vx0HAwQOIax9qD4FLRo1ZUNx4RieY=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/misc/cobalt/default.nix b/pkgs/applications/misc/cobalt/default.nix
index e35939536a61..1fda51767541 100644
--- a/pkgs/applications/misc/cobalt/default.nix
+++ b/pkgs/applications/misc/cobalt/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cobalt";
-  version = "0.19.2";
+  version = "0.19.3";
 
   src = fetchFromGitHub {
     owner = "cobalt-org";
     repo = "cobalt.rs";
     rev = "v${version}";
-    sha256 = "sha256-W0XbNZDSeSK6oxOD1JeLNF+c6/6cy/WQrrmQbSKeqk4=";
+    sha256 = "sha256-aAhceExz5SENL+FhPHyx8HmaNOWjNsynv81Rj2cS5M8=";
   };
 
-  cargoHash = "sha256-IM2SKovb8FYwA/c4R3N7M+oVuGfuc5sK+r6FP9YMk+I=";
+  cargoHash = "sha256-vw7fGsTSEVO8s1LzilKJN5lGzOfQcms1h7rnTOyE4Kw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index 35be59a3166e..5fe74bbe204a 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -5,6 +5,7 @@
 , makeWrapper
 # graphs will not sync without matching upstream's major electron version
 , electron_27
+, autoPatchelfHook
 , git
 , nix-update-script
 }:
@@ -30,7 +31,8 @@ in {
   dontConfigure = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
+  buildInputs = [ stdenv.cc.cc.lib ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/misc/protonup-qt/default.nix b/pkgs/applications/misc/protonup-qt/default.nix
index 9fbe6d0f4aa3..8823744bf3a1 100644
--- a/pkgs/applications/misc/protonup-qt/default.nix
+++ b/pkgs/applications/misc/protonup-qt/default.nix
@@ -20,6 +20,8 @@ appimageTools.wrapType2 {
       --replace 'Icon=net.davidotek.pupgui2' 'Icon=${pname}'
   '';
 
+  extraPkgs = pkgs: with pkgs; [ zstd ];
+
   meta = with lib; {
     homepage = "https://davidotek.github.io/protonup-qt/";
     description = "Install and manage Proton-GE and Luxtorpeda for Steam and Wine-GE for Lutris with this graphical user interface.";
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 7f3265cbd8bf..761e7f0d1d7b 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.10.7";
+  version = "2.10.8";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    hash = "sha256-0C8lVQrFxrk9ym4aCz0PhUS2iByx9rj5Id0xFIq4Efc=";
+    hash = "sha256-VzEgZshzIHXI0J172W1zI1E8dU8iYJq0lO01LpI8Y+U=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
diff --git a/pkgs/applications/networking/cluster/clusterctl/default.nix b/pkgs/applications/networking/cluster/clusterctl/default.nix
index 3eccd57c68f9..2bfa0662dba8 100644
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "clusterctl";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "cluster-api";
     rev = "v${version}";
-    hash = "sha256-pG0jr+LCKMwJGDndEZw6vho3zylsoGBVdXqruSS7SDQ=";
+    hash = "sha256-e+Ut6xoNUY9cJjjJ43P0siEa+G1igllcb8veirk1UX0=";
   };
 
   vendorHash = "sha256-ALRnccGjPGuAITtuz79Cao95NhvSczAzspSMXytlw+A=";
@@ -29,6 +29,7 @@ buildGoModule rec {
 
     installShellCompletion --cmd clusterctl \
       --bash <($out/bin/clusterctl completion bash) \
+      --fish <($out/bin/clusterctl completion fish) \
       --zsh <($out/bin/clusterctl completion zsh)
   '';
 
@@ -38,12 +39,12 @@ buildGoModule rec {
     version = "v${version}";
   };
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/kubernetes-sigs/cluster-api/releases/tag/${src.rev}";
     description = "Kubernetes cluster API tool";
     mainProgram = "clusterctl";
     homepage = "https://cluster-api.sigs.k8s.io/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ qjoly ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ qjoly ];
   };
 }
diff --git a/pkgs/applications/networking/cluster/cmctl/default.nix b/pkgs/applications/networking/cluster/cmctl/default.nix
index feb1b03d26fe..14c92f1b773e 100644
--- a/pkgs/applications/networking/cluster/cmctl/default.nix
+++ b/pkgs/applications/networking/cluster/cmctl/default.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "cmctl";
-  version = "1.14.4";
+  version = "1.14.5";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cert-manager";
     rev = "v${version}";
-    hash = "sha256-iUXN+8ueCxGsFnwhC2WjrQQSXV7TGUR80xaKqjxcC6o=";
+    hash = "sha256-WitYq3/veaARZQHoseJnT5h0AGmXVlLzRe8KCOJuY0w=";
   };
 
   sourceRoot = "${src.name}/cmd/ctl";
 
-  vendorHash = "sha256-ViKsqqM6l/tQSGgj8Yt2L57x+eE1Pd3xCVPuWpIjWOQ=";
+  vendorHash = "sha256-27XvT33S/vgGo5MQDpHzTN+K1nNPR6OOFggzLhatygI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-git.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-git.nix
index d04faf440081..032ccfe8f96a 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-git.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-git.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , coreutils
 , findutils
-, git
+, gitMinimal
 , gnugrep
 , gnused
 , makeWrapper
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
     patchShebangs $out/helm-git/helm-git{,-plugin.sh}
     wrapProgram $out/helm-git/helm-git \
-        --prefix PATH : ${lib.makeBinPath [ coreutils findutils git gnugrep gnused ]}
+        --prefix PATH : ${lib.makeBinPath [ coreutils findutils gitMinimal gnugrep gnused ]}
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
index 130508f95e30..0b1f3b034cce 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "7.5.1";
+  version = "7.6.0";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-afKR+P2YPkv4OMIr8LzWeAMZWr0zaJ1R0BQD87gQuSk=";
+  hash = "sha256-sGOWsFZTO9VQDkCqhsOkW5aY+sh0fLH7kPPe/bAzGvg=";
 }
diff --git a/pkgs/applications/networking/n8n/default.nix b/pkgs/applications/networking/n8n/default.nix
index 20775c4ed4af..7677abfb0ccf 100644
--- a/pkgs/applications/networking/n8n/default.nix
+++ b/pkgs/applications/networking/n8n/default.nix
@@ -10,6 +10,7 @@ nodePackages.n8n.override {
   nativeBuildInputs = [
     pkgs.nodePackages.node-pre-gyp
     pkgs.which
+    pkgs.xcbuild
   ];
 
   buildInputs = [
@@ -30,6 +31,9 @@ nodePackages.n8n.override {
   # makes libmongocrypt bindings not look for static libraries in completely wrong places
   BUILD_TYPE = "dynamic";
 
+  # Disable NAPI_EXPERIMENTAL to allow to build with Node.js≥18.20.0.
+  NIX_CFLAGS_COMPILE = "-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT";
+
   dontNpmInstall = true;
 
   passthru = {
diff --git a/pkgs/applications/networking/nextdns/default.nix b/pkgs/applications/networking/nextdns/default.nix
index 678e9f68ee21..7699d5d399c8 100644
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nextdns";
-  version = "1.42.0";
+  version = "1.43.0";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${version}";
-    sha256 = "sha256-aQUz6FK04h3nzieK9fX7odVVt/zcdhXlX3T1Z1rN/ak=";
+    sha256 = "sha256-5aznAAO53EFeq/fap10ARGerKzQAvLx0zOeG6OWkymw=";
   };
 
-  vendorHash = "sha256-DATSGSFRMrX972CWCiSIlOhDuAG3zcVyuILZ3IpVirM=";
+  vendorHash = "sha256-U5LJF1RX0ZS0PhjQTZKXrJo89WPfSZaVbgskWcYNlJY=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index 924f683b52aa..0ff43b584bea 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -21,14 +21,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "24.4.3";
+  version = "24.4.4";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-dthb+FkytNiiS2s7VdMgYxvNbGeBx5gONOYkHHphigY=";
+    hash = "sha256-nTRCW76UogaTOyxQ5HfWUln6Lip/LpoyPG+m+mMCb1I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/robotics/betaflight-configurator/default.nix b/pkgs/applications/science/robotics/betaflight-configurator/default.nix
index dd2e4ea9591c..84f94102da13 100644
--- a/pkgs/applications/science/robotics/betaflight-configurator/default.nix
+++ b/pkgs/applications/science/robotics/betaflight-configurator/default.nix
@@ -13,10 +13,10 @@ let
 in
 stdenv.mkDerivation rec {
   inherit pname;
-  version = "10.9.0";
+  version = "10.10.0";
   src = fetchurl {
     url = "https://github.com/betaflight/${pname}/releases/download/${version}/${pname}_${version}_linux64-portable.zip";
-    sha256 = "sha256-9FzMyBIR2u1zXHtTWJABM6RF1+OyjYdEPlRwtig9blI=";
+    sha256 = "sha256-UB5Vr5wyCUZbOaQNckJQ1tAXwh8VSLNI1IgTiJzxV08=";
   };
 
   # remove large unneeded files
diff --git a/pkgs/applications/terminal-emulators/x3270/default.nix b/pkgs/applications/terminal-emulators/x3270/default.nix
index 8890d57b3203..010345aa03df 100644
--- a/pkgs/applications/terminal-emulators/x3270/default.nix
+++ b/pkgs/applications/terminal-emulators/x3270/default.nix
@@ -1,39 +1,72 @@
-{ lib, stdenv, fetchurl, m4, expat
-, libX11, libXt, libXaw, libXmu, bdftopcf, mkfontdir
-, fontadobe100dpi, fontadobeutopia100dpi, fontbh100dpi
-, fontbhlucidatypewriter100dpi, fontbitstream100dpi
+{ stdenv
+, darwin
+, lib
+, libiconv
+, fetchurl
+, m4
+, expat
+, libX11
+, libXt
+, libXaw
+, libXmu
+, bdftopcf
+, mkfontdir
+, fontadobe100dpi
+, fontadobeutopia100dpi
+, fontbh100dpi
+, fontbhlucidatypewriter100dpi
+, fontbitstream100dpi
 , tcl
-, ncurses }:
-
+, ncurses
+}:
 let
   majorVersion = "4";
-  minorVersion = "0";
-  versionSuffix = "ga9";
-in stdenv.mkDerivation rec {
+  minorVersion = "3";
+  versionSuffix = "ga8";
+in
+stdenv.mkDerivation rec {
   pname = "x3270";
   version = "${majorVersion}.${minorVersion}${versionSuffix}";
 
   src = fetchurl {
-    url = "http://x3270.bgp.nu/download/0${majorVersion}.0${minorVersion}/suite3270-${version}-src.tgz";
-    sha256 = "0km24rgll0s4ji6iz8lvy5ra76ds162s95y33w5px6697cwqkp9j";
+    url =
+      "http://x3270.bgp.nu/download/0${majorVersion}.0${minorVersion}/suite3270-${version}-src.tgz";
+    sha256 = "sha256-gcC6REfZentIPEDhGznUSYu8mvVfpPeMz/Bks+N43Fk=";
   };
 
-  buildFlags = [ "unix" ];
+  buildFlags = lib.optional stdenv.isLinux "unix";
 
-  postConfigure = ''
-    pushd c3270 ; ./configure ; popd
+  configureFlags = lib.optionals stdenv.isDarwin [
+    "--enable-c3270"
+    "--enable-pr3270"
+    "--enable-s3270"
+    "--enable-tcl3270"
+  ];
+
+  postBuild = ''
+    make install.man
   '';
 
+  pathsToLink = [ "/share/man" ];
+
   nativeBuildInputs = [ m4 ];
   buildInputs = [
     expat
-    libX11 libXt libXaw libXmu bdftopcf mkfontdir
-    fontadobe100dpi fontadobeutopia100dpi fontbh100dpi
-    fontbhlucidatypewriter100dpi fontbitstream100dpi
+    libX11
+    libXt
+    libXaw
+    libXmu
+    bdftopcf
+    mkfontdir
+    fontadobe100dpi
+    fontadobeutopia100dpi
+    fontbh100dpi
+    fontbhlucidatypewriter100dpi
+    fontbitstream100dpi
     tcl
     ncurses
     expat
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
 
   meta = with lib; {
     description = "IBM 3270 terminal emulator for the X Window System";
diff --git a/pkgs/applications/version-management/gfold/default.nix b/pkgs/applications/version-management/gfold/default.nix
index 1459e2f18e80..b60c38fa1d30 100644
--- a/pkgs/applications/version-management/gfold/default.nix
+++ b/pkgs/applications/version-management/gfold/default.nix
@@ -1,13 +1,12 @@
-{ fetchFromGitHub
-, gitMinimal
-, gfold
-, lib
-, libiconv
-, makeWrapper
-, rustPlatform
-, Security
-, stdenv
-, testers
+{
+  fetchFromGitHub,
+  gfold,
+  lib,
+  libiconv,
+  rustPlatform,
+  Security,
+  stdenv,
+  testers,
 }:
 
 let
@@ -26,7 +25,10 @@ rustPlatform.buildRustPackage {
 
   cargoHash = "sha256-wDUOYK9e0i600UnJ0w0FPI2GhTa/QTq/2+ICiDWrmEU=";
 
-  buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+    Security
+  ];
 
   passthru.tests.version = testers.testVersion {
     package = gfold;
@@ -35,11 +37,10 @@ rustPlatform.buildRustPackage {
   };
 
   meta = with lib; {
-    description =
-      "CLI tool to help keep track of your Git repositories, written in Rust";
+    description = "CLI tool to help keep track of your Git repositories, written in Rust";
     homepage = "https://github.com/nickgerace/gfold";
     license = licenses.asl20;
-    maintainers = [];
+    maintainers = [ maintainers.sigmanificient ];
     platforms = platforms.unix;
     mainProgram = "gfold";
   };
diff --git a/pkgs/applications/version-management/git-codereview/default.nix b/pkgs/applications/version-management/git-codereview/default.nix
index 2bbcc10202af..a337443e87ea 100644
--- a/pkgs/applications/version-management/git-codereview/default.nix
+++ b/pkgs/applications/version-management/git-codereview/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-codereview";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "review";
     rev = "v${version}";
-    hash = "sha256-aLvx9lYQJYUw2XBj+2P+yEJMboUjmHKzxP5QA3N93JA=";
+    hash = "sha256-fIvNaMfgwnMBUNo6kr37zhKiBgKNzT2E0dLLtqaVBvI=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/version-management/git-mit/default.nix b/pkgs/applications/version-management/git-mit/default.nix
index bdef9fe1ea7d..508f416515ad 100644
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.12.197";
+  version = "5.12.198";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-Z03FDdlg1IBXHpurKr6RwmtZkaptyeQe+0lgKn/GTTQ=";
+    hash = "sha256-4tWgIwDmGZhMFTVT5VzmGj69zV8FGTV0yBHUy5Iu1Xw=";
   };
 
-  cargoHash = "sha256-V8TV8RM3T7DYqwNV/r5PkkJVtyAQLdY3BR3sz26phdY=";
+  cargoHash = "sha256-vKiCKcyB1Q2CNA4HpE8dc5gh+nlrz0VERIMaTGlDH5Y=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/video/haruna/default.nix b/pkgs/applications/video/haruna/default.nix
index 14b0ca9497bc..273b26808af5 100644
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@@ -1,6 +1,6 @@
 { lib
+, stdenv
 , fetchFromGitLab
-, mkKdeDerivation
 , breeze-icons
 , breeze
 , cmake
@@ -15,7 +15,7 @@
 , kirigami
 , kxmlgui
 , kdoctools
-, mpv
+, mpvqt
 , pkg-config
 , wrapQtAppsHook
 , qqc2-desktop-style
@@ -23,7 +23,7 @@
 , yt-dlp
 }:
 
-mkKdeDerivation rec {
+stdenv.mkDerivation rec {
   pname = "haruna";
   version = "1.0.2";
 
@@ -56,7 +56,7 @@ mkKdeDerivation rec {
     kirigami
     kxmlgui
     kdoctools
-    mpv
+    mpvqt
     qtbase
   ];
 
diff --git a/pkgs/applications/video/mpv/scripts/buildLua.nix b/pkgs/applications/video/mpv/scripts/buildLua.nix
index e0afa7d932c6..8db7d4b1aa3c 100644
--- a/pkgs/applications/video/mpv/scripts/buildLua.nix
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@@ -2,7 +2,10 @@
 , stdenvNoCC }:
 
 let
-  escapedList = with lib; concatMapStringsSep " " (s: "'${escape [ "'" ] s}'");
+  # Escape strings for embedding in shell scripts
+  escaped = s: "'${lib.escape [ "'" ] s}'";
+  escapedList = lib.concatMapStringsSep " " escaped;
+
   fileName = pathStr: lib.last (lib.splitString "/" pathStr);
   scriptsDir = "$out/share/mpv/scripts";
 
@@ -50,14 +53,14 @@ lib.makeOverridable (args: stdenvNoCC.mkDerivation (extendedBy
         }
         [ ${with builtins; toString (length extraScripts)} -eq 0 ] || {
           echo "mpvScripts.buildLua does not support 'extraScripts'" \
-               "when 'scriptPath' is a directory"
+               "when 'scriptPath' is a directory" >&2
           exit 1
         }
         mkdir -p "${scriptsDir}"
         cp -a "${scriptPath}" "${scriptsDir}/${scriptName}"
       else
-        install -m644 -Dt "${scriptsDir}" \
-          ${escapedList ([ scriptPath ] ++ extraScripts)}
+        install -m644 -Dt "${scriptsDir}" ${escaped scriptPath}
+        ${lib.optionalString (extraScripts != []) ''cp -at "${scriptsDir}/" ${escapedList extraScripts}''}
       fi
 
       runHook postInstall
diff --git a/pkgs/applications/video/mpv/scripts/cutter.nix b/pkgs/applications/video/mpv/scripts/cutter.nix
index 69eba782cc1d..36bc69bebaf8 100644
--- a/pkgs/applications/video/mpv/scripts/cutter.nix
+++ b/pkgs/applications/video/mpv/scripts/cutter.nix
@@ -29,7 +29,6 @@ buildLua {
   extraScripts = [ "c_concat.sh" ];
 
   postInstall = ''
-    chmod 0755 $out/share/mpv/scripts/c_concat.sh
     wrapProgram $out/share/mpv/scripts/c_concat.sh \
       --run "mkdir -p ~/.config/mpv/cutter/"
   '';
diff --git a/pkgs/applications/video/mpv/scripts/sponsorblock.nix b/pkgs/applications/video/mpv/scripts/sponsorblock.nix
index 077b8f0590b2..56ac2575ecde 100644
--- a/pkgs/applications/video/mpv/scripts/sponsorblock.nix
+++ b/pkgs/applications/video/mpv/scripts/sponsorblock.nix
@@ -32,7 +32,7 @@ buildLua {
       --replace 'mp.find_config_file("scripts")' "\"$out/share/mpv/scripts\""
   '';
 
-  postInstall = "cp -a sponsorblock_shared $out/share/mpv/scripts/";
+  extraScripts = [ "sponsorblock_shared" ];
 
   passthru.updateScript = nix-update-script {
     extraArgs = [ "--version=branch" ];
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix b/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix
index deebf1af7b84..f400fced2ac0 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-shaderfilter";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-shaderfilter";
     rev = version;
-    sha256 = "sha256-J7tCEIB9zQ0zZFl1eSuEARd+KqpNClHfYx3wcLawFeM=";
+    sha256 = "sha256-INxz8W4AMKxRcfpZkhqqsWWWQQVEc2G9iFQBit1YA2E=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix b/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix
index c6e9f450b990..82767da10d99 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-vertical-canvas";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "Aitum";
     repo = "obs-vertical-canvas";
     rev = version;
-    sha256 = "sha256-baEF8vcAmac4bwpzJnGE2WczTa6vojjRQ/oEKgYeXgk=";
+    sha256 = "sha256-3lFM7bOzsKex6JUdbcw8MNS4PRzaN/E/vngdukgfV0s=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/video/shotcut/default.nix b/pkgs/applications/video/shotcut/default.nix
index 25fe296df2da..87732ad75b8c 100644
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@@ -21,13 +21,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "shotcut";
-  version = "24.04.13";
+  version = "24.04.28";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "shotcut";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-xEdCsvclZXCJgoOnx5ZyOElCXjGpbrOtC7VOR5Hgvpg=";
+    hash = "sha256-iMg2XrTrLFZXXvnJ7lMdkxf/LTaL9bh9Nc2jsPOS0eo=";
   };
 
   nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook ];
diff --git a/pkgs/applications/video/vdr/default.nix b/pkgs/applications/video/vdr/default.nix
index c5159fdd61f0..5713aeb954af 100644
--- a/pkgs/applications/video/vdr/default.nix
+++ b/pkgs/applications/video/vdr/default.nix
@@ -5,12 +5,12 @@
 }: stdenv.mkDerivation rec {
 
   pname = "vdr";
-  version = "2.6.6";
+  version = "2.6.7";
 
   src = fetchgit {
     url = "git://git.tvdr.de/vdr.git";
     rev = version;
-    hash = "sha256-3om/Q67PHtX/aIG4zMCaJTyD9bZNEcyE5LQTeb+zB+M=";
+    hash = "sha256-6i3EQgARwMLNejgB0NevmLmd9OrNBvjqW+qLrAdqUxE=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/window-managers/hackedbox/default.nix b/pkgs/applications/window-managers/hackedbox/default.nix
index f38d0d6beb9b..45f17c0c912e 100644
--- a/pkgs/applications/window-managers/hackedbox/default.nix
+++ b/pkgs/applications/window-managers/hackedbox/default.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  CXXFLAGS = "-std=c++98";
+
   buildInputs = [
     freetype
     fribidi
diff --git a/pkgs/by-name/ar/arrow-cpp/package.nix b/pkgs/by-name/ar/arrow-cpp/package.nix
index 23a2432c824e..723acbc2531f 100644
--- a/pkgs/by-name/ar/arrow-cpp/package.nix
+++ b/pkgs/by-name/ar/arrow-cpp/package.nix
@@ -64,26 +64,26 @@ let
     name = "arrow-testing";
     owner = "apache";
     repo = "arrow-testing";
-    rev = "ad82a736c170e97b7c8c035ebd8a801c17eec170";
-    hash = "sha256-wN0dam0ZXOAJ+D8bGDMhsdaV3llI9LsiCXwqW9mR3gQ=";
+    rev = "25d16511e8d42c2744a1d94d90169e3a36e92631";
+    hash = "sha256-fXeWM/8jBfJY7KL6PVfRbzB8i4sp6PHsnMSHCX5kzfI=";
   };
 
   parquet-testing = fetchFromGitHub {
     name = "parquet-testing";
     owner = "apache";
     repo = "parquet-testing";
-    rev = "d69d979223e883faef9dc6fe3cf573087243c28a";
-    hash = "sha256-CUckfNjfDW05crWigzMP5b9UynviXKGZUlIr754OoGU=";
+    rev = "74278bc4a1122d74945969e6dec405abd1533ec3";
+    hash = "sha256-WbpndtAviph6+I/F2bevuMI9DkfSv4SMPgMaP98k6Qo=";
   };
 
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "arrow-cpp";
-  version = "15.0.0";
+  version = "16.0.0";
 
   src = fetchurl {
     url = "mirror://apache/arrow/arrow-${finalAttrs.version}/apache-arrow-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Ad0/cOhdm1uTPsksDbik71BKUQX3jS2GIuhCeftFwl0=";
+    hash = "sha256-n0BRrpRzyXmR2a+AHi+UrjRVBncZyn+QuBN/nppwC40=";
   };
 
   sourceRoot = "apache-arrow-${finalAttrs.version}/cpp";
@@ -116,8 +116,8 @@ stdenv.mkDerivation (finalAttrs: {
   ARROW_SUBSTRAIT_URL = fetchFromGitHub {
     owner = "substrait-io";
     repo = "substrait";
-    rev = "v0.27.0";
-    hash = "sha256-wptEAXembah04pzqAz6UHeUxp+jMf6Lh/IdyuIhy/a8=";
+    rev = "v0.44.0";
+    hash = "sha256-V739IFTGPtbGPlxcOi8sAaYSDhNUEpITvN9IqdPReug=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/audiness/package.nix b/pkgs/by-name/au/audiness/package.nix
index 06d3e4c49a94..40dafa76288b 100644
--- a/pkgs/by-name/au/audiness/package.nix
+++ b/pkgs/by-name/au/audiness/package.nix
@@ -6,17 +6,20 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "audiness";
-  version = "0.3.2";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "audiusGmbH";
     repo = "audiness";
     rev = "refs/tags/${version}";
-    hash = "sha256-vc2k3oEMTgzm/C6z6BieRrT3cSP0IkY+D3RXkNGaZTE=";
+    hash = "sha256-UJe4ZawjAuUoSKEdIgjh8zZu/amYLZ8rpUDahSHokKA=";
   };
 
-  pythonRelaxDeps = [ "validators" ];
+  pythonRelaxDeps = [
+    "typer"
+    "validators"
+  ];
 
   build-system = with python3.pkgs; [ poetry-core ];
 
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index ea91392eeacc..9f9d962743d7 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -27,20 +27,20 @@ let
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.14.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-kUvDtqv3Tdnntr4Ny5pM406KA5++AHsCoAiPg4x4Rsw=";
+    hash = "sha256-nhs44W7cOREdULdXFNZpFGeeZeVTGUffKOBhtL4zAaw=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-VvUpAdF4ouy695om3qpsyrmiMf69OFgfpQyeZArQEDs=";
+  npmDepsHash = "sha256-p4rBEOK9zKGO1q3SCKpfdX3EPMkYHRvn9UnGBhsksSE=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cu/cue/package.nix b/pkgs/by-name/cu/cue/package.nix
index f8185f7c347f..0d5e0ced778e 100644
--- a/pkgs/by-name/cu/cue/package.nix
+++ b/pkgs/by-name/cu/cue/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "cue";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "cue-lang";
     repo = "cue";
     rev = "v${version}";
-    hash = "sha256-0HNE7NzTdq1bXj9tBZvBQ3m6Q5iuyAMKMOz0kyOJi7w=";
+    hash = "sha256-GU1PG5ciUqbRlAveq2ouqnBYIBEdMSSM0H/1eHL+zlo=";
   };
 
   vendorHash = "sha256-0OZtKIDdEnQLnSj109EpGvaZvMIy7gPAZ+weHzYKGSg=";
diff --git a/pkgs/by-name/cu/cups-printers/package.nix b/pkgs/by-name/cu/cups-printers/package.nix
index 9b5e336316e0..50af156ff668 100644
--- a/pkgs/by-name/cu/cups-printers/package.nix
+++ b/pkgs/by-name/cu/cups-printers/package.nix
@@ -1,6 +1,7 @@
-{ lib
-, fetchFromGitHub
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -16,26 +17,27 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   pythonRelaxDeps = [
+    "typer"
     "validators"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-    poetry-core
-    pythonRelaxDepsHook
-  ];
+  build-system = with python3.pkgs; [ poetry-core ];
 
-  propagatedBuildInputs = with python3.pkgs; [
-    pycups
-    typer
-    validators
-  ] ++ typer.optional-dependencies.all;
+  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
+
+  dependencies =
+    with python3.pkgs;
+    [
+      pycups
+      typer
+      validators
+    ]
+    ++ typer.optional-dependencies.all;
 
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "cups_printers"
-  ];
+  pythonImportsCheck = [ "cups_printers" ];
 
   meta = with lib; {
     description = "Tool for interacting with a CUPS server";
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index ee864183f55b..9284bc2218b7 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -21,15 +21,15 @@ let
     src = fetchFromGitHub {
       owner = "domenkozar";
       repo = "nix";
-      rev = "ecd0af0c1f56de32cbad14daa1d82a132bf298f8";
-      hash = "sha256-92xq7eXlxIT5zFNccLpjiP7sdQqQI30Gyui2p/PfKZM=";
+      rev = "b24a9318ea3f3600c1e24b4a00691ee912d4de12";
+      hash = "sha256-BGvBhepCufsjcUkXnEEXhEVjwdJAwPglCC2+bInc794=";
     };
     buildInputs = old.buildInputs ++ [ libgit2 ];
     doCheck = false;
     doInstallCheck = false;
   });
 
-  version = "1.0.4";
+  version = "1.0.5";
 in rustPlatform.buildRustPackage {
   pname = "devenv";
   inherit version;
@@ -38,10 +38,10 @@ in rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     rev = "v${version}";
-    hash = "sha256-JODoFPcYKOr39dErx8JFSjeWKmO5PUsHJrF2VU6MFEg=";
+    hash = "sha256-W5DFIifCjGYJXJzLU3RpqBeqes4zrf0Sr/6rwzTygPU=";
   };
 
-  cargoHash = "sha256-//THEzW0OYEDSLrOELBaWnwjDbUc4jpwRDQfWJO/saA=";
+  cargoHash = "sha256-a6o28oonA6G0xo83PXwbH86V0aDDAAA2zajE67qsSU0=";
 
   nativeBuildInputs = [ makeWrapper pkg-config ];
 
diff --git a/pkgs/by-name/di/disko/package.nix b/pkgs/by-name/di/disko/package.nix
index 20048c763bdc..8585876ee001 100644
--- a/pkgs/by-name/di/disko/package.nix
+++ b/pkgs/by-name/di/disko/package.nix
@@ -9,12 +9,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   name = "disko";
-  version = "1.5.0";
+  version = "1.6.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "disko";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5DUNQl9BSmLxgGLbF05G7hi/UTk9DyZq8AuEszhQA7Q=";
+    hash = "sha256-h3pOvHCXkSdp1KOZqtkQmHgkR7VaOJXDhqhumk7sZLY=";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ bash ];
diff --git a/pkgs/by-name/fa/fastfetch/package.nix b/pkgs/by-name/fa/fastfetch/package.nix
index b8344d0bfaee..9bb0fd4919ea 100644
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -46,13 +46,13 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.9.2";
+  version = "2.10.2";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-SEt/qw8ixlgRY2+fqyCmhqzLVoAw/BMl//JqQxbuB0s=";
+    hash = "sha256-1ok2HR9RapS+MF8zuNLhzMZMz0F2AQsKsxNqCT7QF/8=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/by-name/fn/fnott/package.nix b/pkgs/by-name/fn/fnott/package.nix
index 8e4327bc80c3..ad66d3874826 100644
--- a/pkgs/by-name/fn/fnott/package.nix
+++ b/pkgs/by-name/fn/fnott/package.nix
@@ -20,14 +20,14 @@
 
 stdenv.mkDerivation rec {
   pname = "fnott";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fnott";
     rev = version;
-    hash = "sha256-8SKInlj54BP3Gn/DNVoLN62+Dfa8G5d/q2xGUXXdsjo=";
+    hash = "sha256-F2Pt3xbWDZZ3s056KU3qLXUrFQ0wT7QYK4GvR7slMYc=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/version-management/got/default.nix b/pkgs/by-name/go/got/package.nix
similarity index 84%
rename from pkgs/applications/version-management/got/default.nix
rename to pkgs/by-name/go/got/package.nix
index 2448e4ccffea..127ff219ed5e 100644
--- a/pkgs/applications/version-management/got/default.nix
+++ b/pkgs/by-name/go/got/package.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchurl
 , pkg-config
-, openssl
+, libressl
 , libbsd
 , libevent
 , libuuid
@@ -12,21 +12,22 @@
 , ncurses
 , bison
 , autoPatchelfHook
+, testers
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "got";
-  version = "0.97";
+  version = "0.98.2";
 
   src = fetchurl {
     url = "https://gameoftrees.org/releases/portable/got-portable-${finalAttrs.version}.tar.gz";
-    hash = "sha256-4HpIlKRYUDoymCBH8GS8DDXaY0nYiVvotpBkwglOO3I=";
+    hash = "sha256-/11K2ZIu3xyAVbI5hlCXL9RjyAlZDb544uqxv3ihUMg=";
   };
 
   nativeBuildInputs = [ pkg-config bison ]
     ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
 
-  buildInputs = [ openssl libbsd libevent libuuid libmd zlib ncurses ]
+  buildInputs = [ libressl libbsd libevent libuuid libmd zlib ncurses ]
     ++ lib.optionals stdenv.isDarwin [ libossp_uuid ];
 
   configureFlags = [ "--enable-gotd" ];
@@ -45,13 +46,9 @@ stdenv.mkDerivation (finalAttrs: {
     "-include getopt.h"
   ]);
 
-  doInstallCheck = true;
-
-  installCheckPhase = ''
-    runHook preInstallCheck
-    test "$($out/bin/got --version)" = "got ${finalAttrs.version}"
-    runHook postInstallCheck
-  '';
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+  };
 
   meta = {
     changelog = "https://gameoftrees.org/releases/CHANGES";
diff --git a/pkgs/by-name/gr/grafana-kiosk/package.nix b/pkgs/by-name/gr/grafana-kiosk/package.nix
new file mode 100644
index 000000000000..0c1c40ad310c
--- /dev/null
+++ b/pkgs/by-name/gr/grafana-kiosk/package.nix
@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "grafana-kiosk";
+  version = "1.0.6";
+
+  src = fetchFromGitHub {
+    owner = "grafana";
+    repo = "grafana-kiosk";
+    rev = "v${version}";
+    hash = "sha256-KXEbhRFD++VeVI1Fbrai+IYb3lyGKs+plYPoKIZD0JM=";
+  };
+
+  vendorHash = "sha256-sXaxyPNuHDUOkYcWYm94YvJmr1mGe4HdzttWrNSK2Pw=";
+
+  meta = with lib; {
+    description = "Kiosk Utility for Grafana";
+    homepage = "https://github.com/grafana/grafana-kiosk";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ marcusramberg ];
+    mainProgram = "grafana-kiosk";
+  };
+}
diff --git a/pkgs/by-name/ha/hamtransfer/package.nix b/pkgs/by-name/ha/hamtransfer/package.nix
new file mode 100644
index 000000000000..49dbe40cd988
--- /dev/null
+++ b/pkgs/by-name/ha/hamtransfer/package.nix
@@ -0,0 +1,42 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, protobuf
+, sqlite
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "hamtransfer";
+  version = "unstable-2024-04-05";
+
+  src = fetchFromGitHub {
+    owner = "ThomasHabets";
+    repo = "hamtransfer";
+    rev = "6b0ac28e0b8cdcc3ac9aba9cd6115e48c4f26c1e";
+    hash = "sha256-yZwbFjs+mnTbU+75dwRhVjvXXoHQuzgE9GlliUQZV1s=";
+  };
+
+  cargoHash = "sha256-lFzsURGhEcuTL6dHt4/l54eT3mD7H8tsW/+unisdjKY=";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    sqlite
+  ];
+
+  postInstall = ''
+    mv $out/bin/downloader $out/bin/hamtransfer-downloader
+    mv $out/bin/uploader $out/bin/hamtransfer-uploader
+  '';
+
+  meta = with lib; {
+    description = "Tool for transferring files over amateur radio using modern techniques";
+    homepage = "https://github.com/ThomasHabets/hamtransfer";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ matthewcroughan sarcasticadmin pkharvey ];
+  };
+}
diff --git a/pkgs/by-name/hy/hyprland-monitor-attached/package.nix b/pkgs/by-name/hy/hyprland-monitor-attached/package.nix
index 6f505aa7981e..291b1f5a249d 100644
--- a/pkgs/by-name/hy/hyprland-monitor-attached/package.nix
+++ b/pkgs/by-name/hy/hyprland-monitor-attached/package.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprland-monitor-attached";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "coffebar";
     repo = "hyprland-monitor-attached";
     rev = version;
-    hash = "sha256-McenpaoEjQIB709VlLkyVGoUwVoMe7TJPb8Lrh1efw8=";
+    hash = "sha256-+bgOOm1B513COcWdUIJ/+GREQH5CR8/RNOcZVkjO2hI=";
   };
 
-  cargoHash = "sha256-QH32NYZJcSxTMgHZKqksy2+DLw62G+knJgoj6OGRfQE=";
+  cargoHash = "sha256-vQfDsP2Tc+Kj95wXIzPTlf6kRdBgdio0QkM9EJRjZjE=";
 
   meta = with lib; {
     description = "Automatically run a script when a monitor connects (or disconnects) in Hyprland";
diff --git a/pkgs/by-name/ic/icloudpd/package.nix b/pkgs/by-name/ic/icloudpd/package.nix
index 01f30919e273..f4e920883831 100644
--- a/pkgs/by-name/ic/icloudpd/package.nix
+++ b/pkgs/by-name/ic/icloudpd/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "icloudpd";
-  version = "1.17.4";
+  version = "1.17.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "icloud-photos-downloader";
     repo = "icloud_photos_downloader";
     rev = "v${version}";
-    hash = "sha256-xsUayewn6c+TFqQnvDWe+1y4o76Quq8sK1WkSFFgPkc=";
+    hash = "sha256-1tyvoDAlh2UuPWDqA7mwC1v5kij3v3aBZBfIG/vluJo=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/kd/kdotool/package.nix b/pkgs/by-name/kd/kdotool/package.nix
new file mode 100644
index 000000000000..f6c8f77cea7c
--- /dev/null
+++ b/pkgs/by-name/kd/kdotool/package.nix
@@ -0,0 +1,30 @@
+{ lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  dbus
+}:
+
+rustPlatform.buildRustPackage rec {
+  version = "0.2.1";
+  pname = "kdotool";
+
+  src = fetchFromGitHub {
+    owner = "jinliu";
+    repo = "kdotool";
+    rev = "v${version}";
+    hash = "sha256-ogdZziNV4b3h9LiEyWFrD/I/I4k8Z5rNFTNjQpWBQtg=";
+  };
+
+  cargoHash = "sha256-pL5vLfNWsZi75mI5K/PYVmgHTPCyIKpQY0YU2CJABN8=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dbus ];
+
+  meta = with lib; {
+    description = "xdotool-like for KDE Wayland";
+    homepage = "https://github.com/jinliu/kdotool";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ kotatsuyaki ];
+  };
+}
diff --git a/pkgs/by-name/li/littlefs-fuse/package.nix b/pkgs/by-name/li/littlefs-fuse/package.nix
index 0ed4453d62aa..81300a8a8224 100644
--- a/pkgs/by-name/li/littlefs-fuse/package.nix
+++ b/pkgs/by-name/li/littlefs-fuse/package.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "littlefs-fuse";
-  version = "2.7.7";
+  version = "2.7.8";
   src = fetchFromGitHub {
     owner = "littlefs-project";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-MCmi0CBs3RLuYn+1BsS6pIeR/tHS1lGNyV3ZwlsnQCA=";
+    hash = "sha256-dJt2Tcw+qdcOoZ9ejao9NXys/OYQTvbP9+dD6DCzFAw=";
   };
   buildInputs = [ fuse ];
   installPhase = ''
diff --git a/pkgs/by-name/lo/local-ai/lib.nix b/pkgs/by-name/lo/local-ai/lib.nix
new file mode 100644
index 000000000000..46f3ba88e5db
--- /dev/null
+++ b/pkgs/by-name/lo/local-ai/lib.nix
@@ -0,0 +1,30 @@
+{ lib
+, writers
+, writeText
+, linkFarmFromDrvs
+}: {
+  genModels = configs:
+    let
+      name = lib.strings.sanitizeDerivationName
+        (builtins.concatStringsSep "_" ([ "local-ai-models" ] ++ (builtins.attrNames configs)));
+
+      genModelFiles = name: config:
+        let
+          templateName = type: name + "_" + type;
+
+          config' = lib.recursiveUpdate config ({
+            inherit name;
+          } // lib.optionalAttrs (lib.isDerivation config.parameters.model) {
+            parameters.model = config.parameters.model.name;
+          } // lib.optionalAttrs (config ? template) {
+            template = builtins.mapAttrs (n: _: templateName n) config.template;
+          });
+        in
+        [ (writers.writeYAML "${name}.yaml" config') ]
+        ++ lib.optional (lib.isDerivation config.parameters.model)
+          config.parameters.model
+        ++ lib.optionals (config ? template)
+          (lib.mapAttrsToList (n: writeText "${templateName n}.tmpl") config.template);
+    in
+    linkFarmFromDrvs name (lib.flatten (lib.mapAttrsToList genModelFiles configs));
+}
diff --git a/pkgs/by-name/lo/local-ai/module.nix b/pkgs/by-name/lo/local-ai/module.nix
new file mode 100644
index 000000000000..d7b70048121f
--- /dev/null
+++ b/pkgs/by-name/lo/local-ai/module.nix
@@ -0,0 +1,56 @@
+{ pkgs, config, lib, ... }:
+let
+  cfg = config.services.local-ai;
+  inherit (lib) mkOption types;
+in
+{
+  options.services.local-ai = {
+    enable = lib.mkEnableOption "Enable service";
+
+    package = lib.mkPackageOption pkgs "local-ai" { };
+
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8080;
+    };
+
+    threads = mkOption {
+      type = types.int;
+      default = 1;
+    };
+
+    models = mkOption {
+      type = types.either types.package types.str;
+      default = "models";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.local-ai = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = lib.escapeShellArgs ([
+          "${cfg.package}/bin/local-ai"
+          "--debug"
+          "--address"
+          ":${toString cfg.port}"
+          "--threads"
+          (toString cfg.threads)
+          "--localai-config-dir"
+          "."
+          "--models-path"
+          (toString cfg.models)
+        ]
+        ++ cfg.extraArgs);
+        RuntimeDirectory = "local-ai";
+        WorkingDirectory = "%t/local-ai";
+      };
+    };
+  };
+}
diff --git a/pkgs/by-name/lo/local-ai/package.nix b/pkgs/by-name/lo/local-ai/package.nix
index f597097dc8e3..061122c3f848 100644
--- a/pkgs/by-name/lo/local-ai/package.nix
+++ b/pkgs/by-name/lo/local-ai/package.nix
@@ -6,6 +6,8 @@
 , fetchpatch
 , fetchFromGitHub
 , protobuf
+, protoc-gen-go
+, protoc-gen-go-grpc
 , grpc
 , openssl
 , llama-cpp
@@ -61,8 +63,8 @@ let
 
   inherit (cudaPackages) libcublas cuda_nvcc cuda_cccl cuda_cudart cudatoolkit;
 
-  go-llama-ggml = effectiveStdenv.mkDerivation {
-    name = "go-llama-ggml";
+  go-llama = effectiveStdenv.mkDerivation {
+    name = "go-llama";
     src = fetchFromGitHub {
       owner = "go-skynet";
       repo = "go-llama.cpp";
@@ -98,8 +100,8 @@ let
     src = fetchFromGitHub {
       owner = "ggerganov";
       repo = "llama.cpp";
-      rev = "1b67731e184e27a465b8c5476061294a4af668ea";
-      hash = "sha256-0WWbsklpW6HhFRkvWpYh8Lhi8VIansS/zmyIKNQRkIs=";
+      rev = "784e11dea1f5ce9638851b2b0dddb107e2a609c8";
+      hash = "sha256-yAQAUo5J+a6O2kTqhFL1UH0tANxpQn3JhAd3MByaC6I=";
       fetchSubmodules = true;
     };
     postPatch = prev.postPatch + ''
@@ -252,8 +254,8 @@ let
     src = fetchFromGitHub {
       owner = "ggerganov";
       repo = "whisper.cpp";
-      rev = "8f253ef3af1c62c04316ba4afa7145fc4d701a8c";
-      hash = "sha256-yHHjhpQIn99A/hqFwAb7TfTf4Q9KnKat93zyXS70bT8=";
+      rev = "858452d58dba3acdc3431c9bced2bb8cfd9bf418";
+      hash = "sha256-2fT3RgGpBex1mF6GJsVDo4rb0F31YqxTymsXcrpQAZk=";
     };
 
     nativeBuildInputs = [ cmake pkg-config ]
@@ -371,18 +373,18 @@ let
       stdenv;
 
   pname = "local-ai";
-  version = "2.12.4";
+  version = "2.13.0";
   src = fetchFromGitHub {
     owner = "go-skynet";
     repo = "LocalAI";
     rev = "v${version}";
-    hash = "sha256-piu2B6u4ZfxiOd9SXrE7jiiiwL2SM8EqXo2s5qeKRl0=";
+    hash = "sha256-jZE8Ow9FFhnx/jvsURLYlYtSuKpE4UWBezxg/mpHs9g=";
   };
 
   self = buildGoModule.override { stdenv = effectiveStdenv; } {
     inherit pname version src;
 
-    vendorHash = "sha256-8Hu1y/PK21twnB7D22ltslFFzRrsB8d1R2hkgIFB/XY=";
+    vendorHash = "sha256-nWNK2YekQnBSLx4ouNSe6esIe0yFuo69E0HStYLQANg=";
 
     env.NIX_CFLAGS_COMPILE = lib.optionalString with_stablediffusion " -isystem ${opencv}/include/opencv4";
 
@@ -392,12 +394,12 @@ let
       in
       ''
         sed -i Makefile \
-          -e 's;git clone.*go-llama-ggml$;${cp} ${go-llama-ggml} sources/go-llama-ggml;' \
+          -e 's;git clone.*go-llama\.cpp$;${cp} ${go-llama} sources/go-llama\.cpp;' \
           -e 's;git clone.*gpt4all$;${cp} ${gpt4all} sources/gpt4all;' \
           -e 's;git clone.*go-piper$;${cp} ${if with_tts then go-piper else go-piper.src} sources/go-piper;' \
-          -e 's;git clone.*go-rwkv$;${cp} ${go-rwkv} sources/go-rwkv;' \
+          -e 's;git clone.*go-rwkv\.cpp$;${cp} ${go-rwkv} sources/go-rwkv\.cpp;' \
           -e 's;git clone.*whisper\.cpp$;${cp} ${whisper-cpp.src} sources/whisper\.cpp;' \
-          -e 's;git clone.*go-bert$;${cp} ${go-bert} sources/go-bert;' \
+          -e 's;git clone.*go-bert\.cpp$;${cp} ${go-bert} sources/go-bert\.cpp;' \
           -e 's;git clone.*diffusion$;${cp} ${if with_stablediffusion then go-stable-diffusion else go-stable-diffusion.src} sources/go-stable-diffusion;' \
           -e 's;git clone.*go-tiny-dream$;${cp} ${if with_tinydream then go-tiny-dream else go-tiny-dream.src} sources/go-tiny-dream;' \
           -e 's, && git checkout.*,,g' \
@@ -415,14 +417,19 @@ let
       ++ lib.optionals with_stablediffusion go-stable-diffusion.buildInputs
       ++ lib.optionals with_tts go-piper.buildInputs;
 
-    nativeBuildInputs = [ makeWrapper ]
-      ++ lib.optionals with_cublas [ cuda_nvcc ];
+    nativeBuildInputs = [
+      protobuf
+      protoc-gen-go
+      protoc-gen-go-grpc
+      makeWrapper
+    ]
+    ++ lib.optionals with_cublas [ cuda_nvcc ];
 
     enableParallelBuilding = false;
 
     modBuildPhase = ''
       mkdir sources
-      make prepare-sources
+      make prepare-sources protogen-go
       go mod tidy -v
     '';
 
@@ -486,7 +493,7 @@ let
 
     passthru.local-packages = {
       inherit
-        go-tiny-dream go-rwkv go-bert go-llama-ggml gpt4all go-piper
+        go-tiny-dream go-rwkv go-bert go-llama gpt4all go-piper
         llama-cpp-grpc whisper-cpp go-tiny-dream-ncnn espeak-ng' piper-phonemize
         piper-tts';
     };
@@ -498,6 +505,7 @@ let
     };
 
     passthru.tests = callPackages ./tests.nix { inherit self; };
+    passthru.lib = callPackages ./lib.nix { };
 
     meta = with lib; {
       description = "OpenAI alternative to run local LLMs, image and audio generation";
diff --git a/pkgs/by-name/lo/local-ai/tests.nix b/pkgs/by-name/lo/local-ai/tests.nix
index 82d1b775dab8..7cebc6fff938 100644
--- a/pkgs/by-name/lo/local-ai/tests.nix
+++ b/pkgs/by-name/lo/local-ai/tests.nix
@@ -5,156 +5,244 @@
 , fetchurl
 , writers
 , symlinkJoin
-, linkFarmFromDrvs
 , jq
 }:
+let
+  common-config = { config, ... }: {
+    imports = [ ./module.nix ];
+    services.local-ai = {
+      enable = true;
+      package = self;
+      threads = config.virtualisation.cores;
+    };
+  };
+
+  inherit (self.lib) genModels;
+in
 {
   version = testers.testVersion {
     package = self;
     version = "v" + self.version;
+    command = "local-ai --help";
   };
 
-  health =
-    let
-      port = "8080";
-    in
-    testers.runNixOSTest {
-      name = self.name + "-health";
-      nodes.machine = {
-        systemd.services.local-ai = {
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig.ExecStart = "${self}/bin/local-ai --debug --localai-config-dir . --address :${port}";
-        };
-      };
-      testScript = ''
+  health = testers.runNixOSTest ({ config, ... }: {
+    name = self.name + "-health";
+    nodes.machine = common-config;
+    testScript =
+      let
+        port = "8080";
+      in
+      ''
         machine.wait_for_open_port(${port})
         machine.succeed("curl -f http://localhost:${port}/readyz")
       '';
-    };
+  });
 
-  # https://localai.io/docs/getting-started/manual/
-  llama =
+  # https://localai.io/features/embeddings/#bert-embeddings
+  bert =
     let
-      port = "8080";
-      gguf = fetchurl {
-        url = "https://huggingface.co/TheBloke/Luna-AI-Llama2-Uncensored-GGUF/resolve/main/luna-ai-llama2-uncensored.Q4_K_M.gguf";
-        sha256 = "6a9dc401c84f0d48996eaa405174999c3a33bf12c2bfd8ea4a1e98f376de1f15";
+      model = "embedding";
+      model-configs.${model} = {
+        # Note: q4_0 and q4_1 models can not be loaded
+        parameters.model = fetchurl {
+          url = "https://huggingface.co/skeskinen/ggml/resolve/main/all-MiniLM-L6-v2/ggml-model-f16.bin";
+          sha256 = "9c195b2453a4fef60a4f6be3a88a39211366214df6498a4fe4885c9e22314f50";
+        };
+        backend = "bert-embeddings";
+        embeddings = true;
+      };
+
+      models = genModels model-configs;
+
+      requests.request = {
+        inherit model;
+        input = "Your text string goes here";
       };
-      models = linkFarmFromDrvs "models" [
-        gguf
-      ];
     in
     testers.runNixOSTest {
-      name = self.name + "-llama";
-      nodes.machine =
-        let
-          cores = 4;
-        in
-        {
-          virtualisation = {
-            inherit cores;
-            memorySize = 8192;
-          };
-          systemd.services.local-ai = {
-            wantedBy = [ "multi-user.target" ];
-            serviceConfig.ExecStart = "${self}/bin/local-ai --debug --threads ${toString cores} --models-path ${models} --localai-config-dir . --address :${port}";
-          };
-        };
+      name = self.name + "-bert";
+      nodes.machine = {
+        imports = [ common-config ];
+        virtualisation.cores = 2;
+        virtualisation.memorySize = 2048;
+        services.local-ai.models = models;
+      };
+      passthru = { inherit models requests; };
       testScript =
         let
-          # https://localai.io/features/text-generation/#chat-completions
-          request-chat-completions = {
-            model = gguf.name;
-            messages = [{ role = "user"; content = "Say this is a test!"; }];
-            temperature = 0.7;
-          };
-          # https://localai.io/features/text-generation/#edit-completions
-          request-edit-completions = {
-            model = gguf.name;
-            instruction = "rephrase";
-            input = "Black cat jumped out of the window";
-            temperature = 0.7;
-          };
-          # https://localai.io/features/text-generation/#completions
-          request-completions = {
-            model = gguf.name;
-            prompt = "A long time ago in a galaxy far, far away";
-            temperature = 0.7;
-          };
+          port = "8080";
         in
         ''
           machine.wait_for_open_port(${port})
           machine.succeed("curl -f http://localhost:${port}/readyz")
           machine.succeed("curl -f http://localhost:${port}/v1/models --output models.json")
-          machine.succeed("${jq}/bin/jq --exit-status 'debug | .data[].id == \"${gguf.name}\"' models.json")
-          machine.succeed("curl -f http://localhost:${port}/v1/chat/completions --json @${writers.writeJSON "request-chat-completions.json" request-chat-completions} --output chat-completions.json")
-          machine.succeed("${jq}/bin/jq --exit-status 'debug | .object == \"chat.completion\"' chat-completions.json")
-          machine.succeed("curl -f http://localhost:${port}/v1/edits --json @${writers.writeJSON "request-edit-completions.json" request-edit-completions} --output edit-completions.json")
-          machine.succeed("${jq}/bin/jq --exit-status 'debug | .object == \"edit\"' edit-completions.json")
-          machine.succeed("curl -f http://localhost:${port}/v1/completions --json @${writers.writeJSON "request-completions.json" request-completions} --output completions.json")
-          machine.succeed("${jq}/bin/jq --exit-status 'debug | .object ==\"text_completion\"' completions.json")
+          machine.succeed("${jq}/bin/jq --exit-status 'debug | .data[].id == \"${model}\"' models.json")
+          machine.succeed("curl -f http://localhost:${port}/embeddings --json @${writers.writeJSON "request.json" requests.request} --output embeddings.json")
+          machine.succeed("${jq}/bin/jq --exit-status 'debug | .model == \"${model}\"' embeddings.json")
         '';
     };
 
-} // lib.optionalAttrs self.features.with_tts {
-  # https://localai.io/features/text-to-audio/#piper
-  tts =
+} // lib.optionalAttrs (!self.features.with_cublas && !self.features.with_clblas) {
+  # https://localai.io/docs/getting-started/manual/
+  llama =
     let
-      port = "8080";
-      voice-en-us = fetchzip {
-        url = "https://github.com/rhasspy/piper/releases/download/v0.0.2/voice-en-us-danny-low.tar.gz";
-        hash = "sha256-5wf+6H5HeQY0qgdqnAG1vSqtjIFM9lXH53OgouuPm0M=";
-        stripRoot = false;
+      model = "gpt-3.5-turbo";
+
+      # https://localai.io/advanced/#full-config-model-file-reference
+      model-configs.${model} = rec {
+        context_size = 8192;
+        parameters = {
+          # https://huggingface.co/lmstudio-community/Meta-Llama-3-8B-Instruct-GGUF
+          # https://ai.meta.com/blog/meta-llama-3/
+          model = fetchurl {
+            url = "https://huggingface.co/lmstudio-community/Meta-Llama-3-8B-Instruct-GGUF/resolve/main/Meta-Llama-3-8B-Instruct-Q4_K_M.gguf";
+            sha256 = "ab9e4eec7e80892fd78f74d9a15d0299f1e22121cea44efd68a7a02a3fe9a1da";
+          };
+          # defaults from:
+          # https://deepinfra.com/meta-llama/Meta-Llama-3-8B-Instruct
+          temperature = 0.7;
+          top_p = 0.9;
+          top_k = 0;
+          # following parameter leads to outputs like: !!!!!!!!!!!!!!!!!!!
+          #repeat_penalty = 1;
+          presence_penalty = 0;
+          frequency_penalty = 0;
+          max_tokens = 100;
+        };
+        stopwords = [ "<|eot_id|>" ];
+        template = {
+          # Templates implement following specifications
+          # https://github.com/meta-llama/llama3/tree/main?tab=readme-ov-file#instruction-tuned-models
+          # ... and are insprired by:
+          # https://github.com/mudler/LocalAI/blob/master/embedded/models/llama3-instruct.yaml
+          #
+          # The rules for template evaluateion are defined here:
+          # https://pkg.go.dev/text/template
+          chat_message = ''
+            <|start_header_id|>{{.RoleName}}<|end_header_id|>
+
+            {{.Content}}${builtins.head stopwords}'';
+
+          chat = "<|begin_of_text|>{{.Input}}<|start_header_id|>assistant<|end_header_id|>";
+        };
       };
-      ggml-tiny-en = fetchurl {
-        url = "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-tiny.en-q5_1.bin";
-        hash = "sha256-x3xXZvHO8JtrfUfyG1Rsvd1BV4hrO11tT3CekeZsfCs=";
-      };
-      whisper-en = {
-        name = "whisper-en";
-        backend = "whisper";
-        parameters.model = ggml-tiny-en.name;
-      };
-      models = symlinkJoin {
-        name = "models";
-        paths = [
-          voice-en-us
-          (linkFarmFromDrvs "whisper-en" [
-            (writers.writeYAML "whisper-en.yaml" whisper-en)
-            ggml-tiny-en
-          ])
-        ];
+
+      models = genModels model-configs;
+
+      requests = {
+        # https://localai.io/features/text-generation/#chat-completions
+        chat-completions = {
+          inherit model;
+          messages = [{ role = "user"; content = "1 + 2 = ?"; }];
+        };
+        # https://localai.io/features/text-generation/#edit-completions
+        edit-completions = {
+          inherit model;
+          instruction = "rephrase";
+          input = "Black cat jumped out of the window";
+          max_tokens = 50;
+        };
+        # https://localai.io/features/text-generation/#completions
+        completions = {
+          inherit model;
+          prompt = "A long time ago in a galaxy far, far away";
+        };
       };
     in
     testers.runNixOSTest {
-      name = self.name + "-tts";
-      nodes.machine =
-        let
-          cores = 2;
-        in
-        {
-          virtualisation = {
-            inherit cores;
-          };
-          systemd.services.local-ai = {
-            wantedBy = [ "multi-user.target" ];
-            serviceConfig.ExecStart = "${self}/bin/local-ai --debug --threads ${toString cores} --models-path ${models} --localai-config-dir . --address :${port}";
-          };
-        };
+      name = self.name + "-llama";
+      nodes.machine = {
+        imports = [ common-config ];
+        virtualisation.cores = 4;
+        virtualisation.memorySize = 8192;
+        services.local-ai.models = models;
+      };
+      passthru = { inherit models requests; };
       testScript =
         let
-          request = {
-            model = "en-us-danny-low.onnx";
-            backend = "piper";
-            input = "Hello, how are you?";
-          };
+          port = "8080";
         in
         ''
           machine.wait_for_open_port(${port})
           machine.succeed("curl -f http://localhost:${port}/readyz")
-          machine.succeed("curl -f http://localhost:${port}/tts --json @${writers.writeJSON "request.json" request} --output out.wav")
-          machine.succeed("curl -f http://localhost:${port}/v1/audio/transcriptions --header 'Content-Type: multipart/form-data' --form file=@out.wav --form model=${whisper-en.name} --output transcription.json")
-          machine.succeed("${jq}/bin/jq --exit-status 'debug | .segments | first.text == \"${request.input}\"' transcription.json")
+          machine.succeed("curl -f http://localhost:${port}/v1/models --output models.json")
+          machine.succeed("${jq}/bin/jq --exit-status 'debug | .data[].id == \"${model}\"' models.json")
+
+          machine.succeed("curl -f http://localhost:${port}/v1/chat/completions --json @${writers.writeJSON "request-chat-completions.json" requests.chat-completions} --output chat-completions.json")
+          machine.succeed("${jq}/bin/jq --exit-status 'debug | .object == \"chat.completion\"' chat-completions.json")
+          machine.succeed("${jq}/bin/jq --exit-status 'debug | .choices | first.message.content | tonumber == 3' chat-completions.json")
+
+          machine.succeed("curl -f http://localhost:${port}/v1/edits --json @${writers.writeJSON "request-edit-completions.json" requests.edit-completions} --output edit-completions.json")
+          machine.succeed("${jq}/bin/jq --exit-status 'debug | .object == \"edit\"' edit-completions.json")
+          machine.succeed("${jq}/bin/jq --exit-status '.usage.completion_tokens | debug == ${toString requests.edit-completions.max_tokens}' edit-completions.json")
+
+          machine.succeed("curl -f http://localhost:${port}/v1/completions --json @${writers.writeJSON "request-completions.json" requests.completions} --output completions.json")
+          machine.succeed("${jq}/bin/jq --exit-status 'debug | .object ==\"text_completion\"' completions.json")
+          machine.succeed("${jq}/bin/jq --exit-status '.usage.completion_tokens | debug == ${toString model-configs.${model}.parameters.max_tokens}' completions.json")
+        '';
+    };
+
+} // lib.optionalAttrs (self.features.with_tts && !self.features.with_cublas && !self.features.with_clblas) {
+  # https://localai.io/features/text-to-audio/#piper
+  tts =
+    let
+      model-stt = "whisper-en";
+      model-configs.${model-stt} = {
+        backend = "whisper";
+        parameters.model = fetchurl {
+          url = "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-tiny.en-q5_1.bin";
+          hash = "sha256-x3xXZvHO8JtrfUfyG1Rsvd1BV4hrO11tT3CekeZsfCs=";
+        };
+      };
+
+      model-tts = "piper-en";
+      model-configs.${model-tts} = {
+        backend = "piper";
+        parameters.model = "en-us-danny-low.onnx";
+      };
+
+      models =
+        let
+          models = genModels model-configs;
+        in
+        symlinkJoin {
+          inherit (models) name;
+          paths = [
+            models
+            (fetchzip {
+              url = "https://github.com/rhasspy/piper/releases/download/v0.0.2/voice-en-us-danny-low.tar.gz";
+              hash = "sha256-5wf+6H5HeQY0qgdqnAG1vSqtjIFM9lXH53OgouuPm0M=";
+              stripRoot = false;
+            })
+          ];
+        };
+
+      requests.request = {
+        model = model-tts;
+        input = "Hello, how are you?";
+      };
+    in
+    testers.runNixOSTest {
+      name = self.name + "-tts";
+      nodes.machine = {
+        imports = [ common-config ];
+        virtualisation.cores = 2;
+        services.local-ai.models = models;
+      };
+      passthru = { inherit models requests; };
+      testScript =
+        let
+          port = "8080";
+        in
+        ''
+          machine.wait_for_open_port(${port})
+          machine.succeed("curl -f http://localhost:${port}/readyz")
+          machine.succeed("curl -f http://localhost:${port}/v1/models --output models.json")
+          machine.succeed("${jq}/bin/jq --exit-status 'debug' models.json")
+          machine.succeed("curl -f http://localhost:${port}/tts --json @${writers.writeJSON "request.json" requests.request} --output out.wav")
+          machine.succeed("curl -f http://localhost:${port}/v1/audio/transcriptions --header 'Content-Type: multipart/form-data' --form file=@out.wav --form model=${model-stt} --output transcription.json")
+          machine.succeed("${jq}/bin/jq --exit-status 'debug | .segments | first.text == \"${requests.request.input}\"' transcription.json")
         '';
     };
 }
diff --git a/pkgs/by-name/ma/marwaita-x/package.nix b/pkgs/by-name/ma/marwaita-x/package.nix
new file mode 100644
index 000000000000..1fb947272d30
--- /dev/null
+++ b/pkgs/by-name/ma/marwaita-x/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, nix-update-script
+, gdk-pixbuf
+, gtk-engine-murrine
+, gtk_engines
+, librsvg
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "marwaita-x";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "darkomarko42";
+    repo = "marwaita-x";
+    rev = finalAttrs.version;
+    sha256 = "sha256-AkhysmA7QTHiH6yLEHFHgXFhRXb3l0elvYfy+oXsvZE=";
+  };
+
+  buildInputs = [
+    gdk-pixbuf
+    gtk_engines
+    librsvg
+  ];
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/themes
+    cp -a Marwaita* $out/share/themes
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A new version for Marwaita GTK theme";
+    homepage = "https://www.pling.com/p/2044790/";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ romildo ];
+  };
+})
diff --git a/pkgs/by-name/mi/mini-calc/package.nix b/pkgs/by-name/mi/mini-calc/package.nix
index fbd92b4177d0..d8a385121e1a 100644
--- a/pkgs/by-name/mi/mini-calc/package.nix
+++ b/pkgs/by-name/mi/mini-calc/package.nix
@@ -1,4 +1,10 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  gnuplot,
+  makeWrapper,
+}:
 rustPlatform.buildRustPackage rec {
   pname = "mini-calc";
   version = "2.13.0";
@@ -11,6 +17,14 @@ rustPlatform.buildRustPackage rec {
   };
 
   cargoHash = "sha256-QFzrJBnGKAgDhjbbik0WP3Y1fNoHMAiWpEHfidFQGPk=";
+
+  nativeBuildInputs = [ makeWrapper ];
+  postFixup = ''
+    wrapProgram $out/bin/mini-calc \
+      --prefix PATH : "${lib.makeBinPath [ gnuplot ]}"
+
+  '';
+
   meta = {
     description = "A fully-featured minimalistic configurable calculator written in Rust";
     changelog = "https://github.com/coco33920/calc/blob/${version}/CHANGELOG.md";
diff --git a/pkgs/by-name/mi/missidentify/fix-darwin-build.patch b/pkgs/by-name/mi/missidentify/fix-darwin-build.patch
new file mode 100644
index 000000000000..cc54480567af
--- /dev/null
+++ b/pkgs/by-name/mi/missidentify/fix-darwin-build.patch
@@ -0,0 +1,11 @@
+--- a/main.h
++++ b/main.h
+@@ -68,7 +68,7 @@ memset(VAR,0,SIZE * sizeof(TYPE));
+ 
+ 
+ 
+-#ifdef __GLIBC__
++#if defined(__GLIBC__) || defined (__APPLE__)
+ extern char *__progname;
+ #else
+ char *__progname;
\ No newline at end of file
diff --git a/pkgs/by-name/mi/missidentify/package.nix b/pkgs/by-name/mi/missidentify/package.nix
new file mode 100644
index 000000000000..2fbce5bf96f2
--- /dev/null
+++ b/pkgs/by-name/mi/missidentify/package.nix
@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "missidentify";
+  version = "1.0";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/missidentify/missidentify/missidentify-${finalAttrs.version}/missidentify-${finalAttrs.version}.tar.gz";
+    hash = "sha256-nnIRN8hpKM0IZCe0HUrrJGrxvBYKeBmdU168rlo8op0=";
+  };
+
+  patches = [
+    # define PATH_MAX variable to fix a FTBFS in Hurd.
+    (fetchurl {
+      name = "fix-FTBFS-Hurd.patch";
+      url = "https://salsa.debian.org/pkg-security-team/missidentify/-/raw/14b7169c3157dbad65fc80fdd82ec6634df20ffd/debian/patches/fix-FTBFS-Hurd.patch";
+      hash = "sha256-wGEzTfT76s5Q7s/5s913c4x9MMn9c0v/4Lhr+QakPQY=";
+    })
+    # fix a hyphen used as minus sign and a typo in manpage.
+    (fetchurl {
+      name = "fix-manpage.patch";
+      url = "https://salsa.debian.org/pkg-security-team/missidentify/-/raw/14b7169c3157dbad65fc80fdd82ec6634df20ffd/debian/patches/fix-manpage.patch";
+      hash = "sha256-7LzQs6ETRSjdnEhlKOVWC3grevwOmGs0h4Z6AYGysD8=";
+    })
+    # fix darwin build
+    ./fix-darwin-build.patch
+  ];
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  configureFlags = lib.optionals (stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64) [ "--build=arm" ];
+
+  meta = with lib; {
+    description = "Find Win32 applications";
+    longDescription = ''
+      Miss Identify is a program to find Win32 applications. In
+      its default mode it displays the filename of any executable
+      that does not have an executable extension (i.e. exe, dll,
+      com, sys, cpl, hxs, hxi, olb, rll, or tlb). The program can
+      also be run to display all executables encountered,
+      regardless of the extension. This is handy when looking
+      for all of the executables on a drive. Other options allow
+      the user to record the strings found in an executable and
+      to work recursively.
+    '';
+    mainProgram = "missidentify";
+    homepage = "https://missidentify.sourceforge.net";
+    maintainers = with maintainers; [ d3vil0p3r ];
+    platforms = platforms.unix;
+    license = licenses.gpl2Only;
+  };
+})
diff --git a/pkgs/by-name/mo/mo/package.nix b/pkgs/by-name/mo/mo/package.nix
new file mode 100644
index 000000000000..5de0716fde5d
--- /dev/null
+++ b/pkgs/by-name/mo/mo/package.nix
@@ -0,0 +1,36 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, runtimeShell
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mo";
+  version = "3.0.5";
+
+  src = fetchFromGitHub {
+    owner = "tests-always-included";
+    repo = pname;
+    rev = version;
+    hash = "sha256-CFAvTpziKzSkdomvCf8PPXYbYcJxjB4EValz2RdD2b0=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp mo $out/bin/.
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Moustache templates for Bash";
+    homepage = "https://github.com/tests-always-included/mo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sheepforce ];
+  };
+}
diff --git a/pkgs/by-name/ni/nixos-anywhere/package.nix b/pkgs/by-name/ni/nixos-anywhere/package.nix
index 197a320d4c62..ffd74761a9fe 100644
--- a/pkgs/by-name/ni/nixos-anywhere/package.nix
+++ b/pkgs/by-name/ni/nixos-anywhere/package.nix
@@ -12,11 +12,11 @@
 , gnused
 , lib
 , makeWrapper
+, sshpass
 }:
 let
   runtimeDeps = [
     gitMinimal # for git flakes
-    rsync
     nix
     coreutils
     curl # when uploading tarballs
@@ -24,16 +24,18 @@ let
     gawk
     findutils
     gnused # needed by ssh-copy-id
+    sshpass # used to provide password for ssh-copy-id
+    rsync # used to upload extra-files
   ];
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "nixos-anywhere";
-  version = "1.1.2";
+  version = "1.2.0";
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nixos-anywhere";
     rev = finalAttrs.version;
-    hash = "sha256-JzgZnHQ4Bknh1ebE4iMVzR3cWZG+8k7MRy0X7cNSnBE=";
+    hash = "sha256-u3PFJup/XOz2MBhvqCzm94iH6Z4nrE0KmBgT/OnNDqU=";
   };
   nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 2d1c40e09cdf..57291810870d 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.2.1";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     rev = "v${version}";
-    hash = "sha256-AAgkxBbGH45n140jm28+J3hqYxzUIL6IVLGWD9oBexo=";
+    hash = "sha256-W0HDoQURZxTvMyFfRGOu8gcZJihtvXvrEaObmi/CAk0=";
   };
 
-  vendorHash = "sha256-fP6yxfIQoVaBC9hYcrCyo3YP3ntEVDbDTwKMO9TdyDI=";
+  vendorHash = "sha256-wWdsLU656wBAUmnVw21wo+a/OLmyhZ2Bq0j8S190XQs=";
 
   meta = with lib; {
     homepage = "https://github.com/guyfedwards/nom";
diff --git a/pkgs/by-name/op/opensplat/package.nix b/pkgs/by-name/op/opensplat/package.nix
new file mode 100644
index 000000000000..cd6052f5369b
--- /dev/null
+++ b/pkgs/by-name/op/opensplat/package.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  ninja,
+  fetchFromGitHub,
+  fetchpatch,
+  python3,
+  opencv,
+  nlohmann_json,
+  nanoflann,
+  glm,
+  cxxopts,
+  config,
+  # Upstream has rocm/hip support, too. anyone?
+  cudaSupport ? config.cudaSupport,
+  cudaPackages,
+  autoAddDriverRunpath,
+}:
+let
+  version = "1.1.2";
+  torch = python3.pkgs.torch.override { inherit cudaSupport; };
+  # Using a normal stdenv with cuda torch gives
+  # ld: /nix/store/k1l7y96gv0nc685cg7i3g43i4icmddzk-python3.11-torch-2.2.1-lib/lib/libc10.so: undefined reference to `std::ios_base_library_init()@GLIBCXX_3.4.32'
+  stdenv' = if cudaSupport then cudaPackages.backendStdenv else stdenv;
+in
+stdenv'.mkDerivation {
+  pname = "opensplat";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "pierotofy";
+    repo = "OpenSplat";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3tk62b5fSf6wzuc5TwkdfAKgUMrw3ZxetCJa2RVMS/s=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "install-executables.patch";
+      url = "https://github.com/pierotofy/OpenSplat/commit/b4c4176819b508978583b7ebf66306171807a8e6.patch";
+      hash = "sha256-BUgPMcO3lt3ZEzv24u36k3aTEIoloOhxrCGi1KQ5Epk=";
+    })
+  ];
+
+  postPatch = ''
+    # the two vendored gsplats are so heavily modified they may be considered a fork
+    find vendor ! -name 'gsplat*' -maxdepth 1 -mindepth 1 -exec rm -rf {} +
+    mkdir vendor/{nanoflann,glm}
+    ln -s ${glm}/include/glm vendor/glm/glm
+    ln -s ${nanoflann}/include/nanoflann.hpp vendor/nanoflann/nanoflann.hpp
+    ln -s ${nlohmann_json}/include/nlohmann vendor/json
+    ln -s ${cxxopts}/include/cxxopts.hpp vendor/cxxopts.hpp
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ] ++ lib.optionals cudaSupport [
+    cudaPackages.cuda_nvcc
+    autoAddDriverRunpath
+  ];
+
+  buildInputs = [
+    nlohmann_json
+    torch.cxxdev
+    torch
+    opencv
+  ] ++ lib.optionals cudaSupport [
+    cudaPackages.cuda_cudart
+  ];
+
+  env.TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" python3.pkgs.torch.cudaCapabilities}";
+
+  cmakeFlags = [
+    (lib.cmakeBool "CMAKE_SKIP_RPATH" true)
+  ] ++ lib.optionals cudaSupport [
+    (lib.cmakeFeature "GPU_RUNTIME" "CUDA")
+    (lib.cmakeFeature "CUDA_TOOLKIT_ROOT_DIR" "${cudaPackages.cudatoolkit}/")
+  ];
+
+  meta = {
+    description = "Production-grade 3D gaussian splatting";
+    homepage = "https://github.com/pierotofy/OpenSplat/";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jcaesar ];
+    platforms = lib.platforms.linux ++ lib.optionals (!cudaSupport) lib.platforms.darwin;
+  };
+}
diff --git a/pkgs/by-name/op/openvas-scanner/package.nix b/pkgs/by-name/op/openvas-scanner/package.nix
index 85a60640d711..66587f76d605 100644
--- a/pkgs/by-name/op/openvas-scanner/package.nix
+++ b/pkgs/by-name/op/openvas-scanner/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openvas-scanner";
-  version = "23.0.1";
+  version = "23.1.0";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "openvas-scanner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-pqbwi3btNEM+qiTqtjIxiDv2wMf1LerltFvLCybiW0Y=";
+    hash = "sha256-2tMCyEBVR/DQP7Dny5iPypv2IWkurfxhZEHC/f+Pe8c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pe/peergos/package.nix b/pkgs/by-name/pe/peergos/package.nix
index f91c8ea78618..dc142f44ce59 100644
--- a/pkgs/by-name/pe/peergos/package.nix
+++ b/pkgs/by-name/pe/peergos/package.nix
@@ -1,20 +1,19 @@
-{ lib
-, stdenv
-, fetchurl
-, jre
-, makeWrapper
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jre,
+  makeWrapper,
+  nix-update-script,
 }:
 
-let
-  version = "0.14.1";
-  peergos = fetchurl {
-    url = "https://github.com/Peergos/web-ui/releases/download/v${version}/Peergos.jar";
-    hash = "sha256-oCsUuFxTAL0vAabGggGhZHaF40A5TLfkT15HYPiKHlU=";
-  };
-in
 stdenv.mkDerivation rec {
   pname = "peergos";
-  inherit version;
+  version = "0.17.0";
+  src = fetchurl {
+    url = "https://github.com/Peergos/web-ui/releases/download/v${version}/Peergos.jar";
+    hash = "sha256-sQPEKvtQDRQ4dF22tZjPhK7DLtDVAcudxoA4+GOeeZA=";
+  };
 
   dontUnpack = true;
   dontBuild = true;
@@ -24,21 +23,33 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    install -D ${peergos} $out/share/java/peergos.jar
-    makeWrapper ${lib.getExe jre} $out/bin/${pname} \
-      --add-flags "-jar -Djava.library.path=native-lib $out/share/java/${pname}.jar"
+    install -D ${src} $out/share/java/peergos.jar
+    makeWrapper ${lib.getExe jre} $out/bin/peergos \
+      --add-flags "-jar -Djava.library.path=native-lib $out/share/java/peergos.jar"
 
     runHook postInstall
   '';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^(v[0-9.]+)$"
+    ];
+  };
+
+  meta = {
+    changelog = "https://github.com/Peergos/web-ui/releases/tag/v${version}";
     description = "A p2p, secure file storage, social network and application protocol";
-    mainProgram = "peergos";
+    downloadPage = "https://github.com/Peergos/web-ui";
     homepage = "https://peergos.org/";
     # peergos have agpt3 license, peergos-web-ui have gpl3, both are used
-    license = [ licenses.agpl3Only licenses.gpl3Only ];
-    platforms = platforms.all;
-    maintainers = with maintainers; [ raspher ];
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    license = [
+      lib.licenses.agpl3Only
+      lib.licenses.gpl3Only
+    ];
+    mainProgram = "peergos";
+    maintainers = with lib.maintainers; [ raspher ];
+    platforms = lib.platforms.all;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
   };
 }
diff --git a/pkgs/by-name/ro/route-graph/package.nix b/pkgs/by-name/ro/route-graph/package.nix
index 7b5e20451a98..36158282f783 100644
--- a/pkgs/by-name/ro/route-graph/package.nix
+++ b/pkgs/by-name/ro/route-graph/package.nix
@@ -6,22 +6,26 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "route-graph";
-  version = "0.2.1";
+  version = "0.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "audiusGmbH";
     repo = "route-graph";
     rev = "refs/tags/${version}";
-    hash = "sha256-OOXLmHxWre5t4tysDXV23PTkyUG6Zcpanw0fVCOLFTM=";
+    hash = "sha256-HmfmUeT5vt0yWVs7GhIPVt4NZtTfe7HYPLRqfQE/tZM=";
   };
 
   pythonRelaxDeps = [
+    "typer"
     "typing-extensions"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [
     poetry-core
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
     pythonRelaxDepsHook
   ];
 
diff --git a/pkgs/by-name/si/simplotask/package.nix b/pkgs/by-name/si/simplotask/package.nix
index 59c8d804f7e2..d08d53ed88c4 100644
--- a/pkgs/by-name/si/simplotask/package.nix
+++ b/pkgs/by-name/si/simplotask/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "simplotask";
-  version = "1.15.1";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "umputun";
     repo = "spot";
     rev = "v${version}";
-    hash = "sha256-XLkq8Oe3EsP0wf0sA7NSZWIsQQnOAGmvlVQad35+5Ws=";
+    hash = "sha256-VnQIg5HXZZwvYpaYDF1CIphLtE4S+1zADE1WnicXOSQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
index 57e16a1a138c..b66180a22fc8 100644
--- a/pkgs/by-name/sn/snapcraft/package.nix
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -11,7 +11,7 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "snapcraft";
-  version = "8.2.0";
+  version = "8.2.1";
 
   pyproject = true;
 
@@ -24,7 +24,7 @@ python3Packages.buildPythonApplication rec {
     owner = "canonical";
     repo = "snapcraft";
     rev = "refs/tags/${version}";
-    hash = "sha256-uRapRL+492FOju83o3OBsYK52hwOOG6b4EbdMVpAlBs=";
+    hash = "sha256-PVJVvkc/LtGFbs93OWmkopaAXZFudLJedpmetrjU010=";
   };
 
   patches = [
diff --git a/pkgs/by-name/st/stackit-cli/package.nix b/pkgs/by-name/st/stackit-cli/package.nix
index 14c88a8fa494..e96738d45960 100644
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "stackit-cli";
-  version = "0.2.3";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "stackitcloud";
     repo = "stackit-cli";
     rev = "v${version}";
-    hash = "sha256-ci7P0VbIuYoIzaiNhUCNRFa3YxYxBsat5U46DwGq6WY=";
+    hash = "sha256-EoZ1ThAve08NitKf6jPJNyqkGz0JUW2GmzKtvWm9cDU=";
   };
 
-  vendorHash = "sha256-ecf/7BoCvybga8RVRiXvrAf2a5uLvIOFk4qNJiguSpo=";
+  vendorHash = "sha256-WQNb4vs1qcsY0hqlLXNiH67065/yq5xZEgZBOwFZzNM=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/libraries/stduuid/default.nix b/pkgs/by-name/st/stduuid/package.nix
similarity index 51%
rename from pkgs/development/libraries/stduuid/default.nix
rename to pkgs/by-name/st/stduuid/package.nix
index c7e31c990087..af9ea3763981 100644
--- a/pkgs/development/libraries/stduuid/default.nix
+++ b/pkgs/by-name/st/stduuid/package.nix
@@ -1,7 +1,8 @@
-{ stdenv, cmake, fetchFromGitHub, lib }: let
+{ stdenv, cmake, fetchFromGitHub, fetchpatch, lib }: let
   version = "1.2.3";
 in stdenv.mkDerivation {
-  name = "stduuid-${version}";
+  pname = "stduuid";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "mariusbancila";
@@ -12,6 +13,15 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake ];
 
+  patches = [
+    # stduuid report version 1.0 instead of 1.2.3 for cmake's find_package to properly work
+    # If version is updated one day, this patch will need to be updated
+    (fetchpatch {
+      url = "https://github.com/OlivierLDff/stduuid/commit/b02c70c0a4bef2c82152503e13c9a67d6631b13d.patch";
+      hash = "sha256-tv4rllhngdgjXX35kcM69yXo0DXF/BQ+AUbiC1gJIU8=";
+    })
+  ];
+
   meta = {
     description = "A C++17 cross-platform implementation for UUIDs";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/st/step-cli/package.nix b/pkgs/by-name/st/step-cli/package.nix
new file mode 100644
index 000000000000..65f8959e34e2
--- /dev/null
+++ b/pkgs/by-name/st/step-cli/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}: let
+  version = "0.26.1";
+in
+  buildGoModule {
+    pname = "step-cli";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "smallstep";
+      repo = "cli";
+      rev = "refs/tags/v${version}";
+      hash = "sha256-BVxdgyQsfCwHw/zjP3AKNib3sRWoBpMlZ7vh71nso94=";
+    };
+
+    ldflags = [
+      "-w"
+      "-s"
+      "-X=main.Version=${version}"
+    ];
+
+    preCheck = ''
+      # Tries to connect to smallstep.com
+      rm command/certificate/remote_test.go
+    '';
+
+    vendorHash = "sha256-Z6wrWkyAGi01gH7+v2+VkyqRNqDwLFVwXm/1FIMzURg=";
+
+    meta = {
+      description = "A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";
+      homepage = "https://smallstep.com/cli/";
+      changelog = "https://github.com/smallstep/cli/blob/v${version}/CHANGELOG.md";
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [isabelroses];
+      platforms = lib.platforms.linux ++ lib.platforms.darwin;
+      mainProgram = "step";
+    };
+  }
diff --git a/pkgs/by-name/sw/swaybg/package.nix b/pkgs/by-name/sw/swaybg/package.nix
index aa5d12cdfc4f..6536847abbe4 100644
--- a/pkgs/by-name/sw/swaybg/package.nix
+++ b/pkgs/by-name/sw/swaybg/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "swaybg";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "swaywm";
     repo = "swaybg";
     rev = "v${version}";
-    hash = "sha256-Qk5iGALlSVSzgBJzYzyLdLHhj/Zq1R4nFseACBmIBuA=";
+    hash = "sha256-IJcPSBJErf8Dy9YhYAc9eg/llgaaLZCQSB0Brof+kpg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/sy/symfony-cli/package.nix b/pkgs/by-name/sy/symfony-cli/package.nix
index 9931e4f59089..1036022bc68b 100644
--- a/pkgs/by-name/sy/symfony-cli/package.nix
+++ b/pkgs/by-name/sy/symfony-cli/package.nix
@@ -10,14 +10,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.8.15";
-  vendorHash = "sha256-rkvQhZSoKZIl/gFgekLUelem2FGbRL9gp1LEzYN88Dc=";
+  version = "5.8.16";
+  vendorHash = "sha256-bhlD7EgOkWjRTsw1hH0GKjtFkLbOzr28wR4JJKOJwnY=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    hash = "sha256-HbBg2oCsogY3X4jgjknqwNe2bszXjylvE+h5/iyg2pM=";
+    hash = "sha256-V67RLa/Tn9ZdV+vnhFSht0wtIYYZOAGAYP9R1Lxn9aI=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/ue/ueviewer/package.nix b/pkgs/by-name/ue/ueviewer/package.nix
new file mode 100644
index 000000000000..7ce9fc3d18da
--- /dev/null
+++ b/pkgs/by-name/ue/ueviewer/package.nix
@@ -0,0 +1,97 @@
+{ gccStdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, unstableGitUpdater
+, libpng
+, perl
+, SDL2
+, zlib
+}:
+
+gccStdenv.mkDerivation (finalAttrs: {
+  pname = "ueviewer";
+  version = "0-unstable-2024-02-23";
+
+  src = fetchFromGitHub {
+    owner = "gildor2";
+    repo = "UEViewer";
+    rev = "a0bfb468d42be831b126632fd8a0ae6b3614f981";
+    hash = "sha256-Cz4jK2jJMzz57/RcEzjIjD611vCy7l3xQ0pQZjneTFQ=";
+  };
+
+  patches = [
+    # Fix compilation on Darwin
+    # Remove when https://github.com/gildor2/UEViewer/pull/319 merged
+    (fetchpatch {
+      name = "0001-ueviewer-Dont-use-c++2a-standard.patch";
+      url = "https://github.com/gildor2/UEViewer/commit/d44bef038abca99c84d7f418aedcbcb761de58aa.patch";
+      hash = "sha256-v68yoBLz0dUB3evlKApKuajKQiOwbJczVeW5oxYaVyw=";
+    })
+  ];
+
+  postPatch = ''
+    patchShebangs build.sh Unreal/Shaders/make.pl Tools/genmake
+
+    # Enable more verbose build output
+    # Unify -j arguments on make calls
+    # Show what's being run
+    substituteInPlace build.sh \
+      --replace-fail '#	echo ">> Debug: $*"' '	echo ">> Debug: $*"' \
+      --replace-fail 'make -j 4 -f $makefile' 'make -f $makefile' \
+      --replace-fail 'make -f $makefile' "make ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES}} -f \$makefile SHELL='sh -x'"
+
+    # - Use correct compiler from stdenv
+    # - Use C++ compiler instead of relying on leniency
+    # -pipe breaks GCC on Darwin: clang-16: error: no input files
+    substituteInPlace Tools/genmake \
+      --replace-fail 'my $platf = "gcc";' "my \$platf = \"$CXX\";" \
+      --replace-fail '-pipe' ""
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    perl
+  ];
+
+  buildInputs = [
+    libpng
+    zlib
+  ] ++ lib.optionals (!gccStdenv.hostPlatform.isDarwin) [
+    SDL2
+  ];
+
+  enableParallelBuilding = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    ./build.sh
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 umodel $out/bin/umodel
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = unstableGitUpdater {
+    # Tags represent various milestones, nothing that can be mapped to a numerical version number
+    hardcodeZeroVersion = true;
+  };
+
+  meta = with lib; {
+    description = "Viewer and exporter for Unreal Engine 1-4 assets (aka umodel)";
+    homepage = "https://www.gildor.org/en/projects/umodel";
+    license = licenses.mit;
+    mainProgram = "umodel";
+    maintainers = with maintainers; [ OPNA2608 ];
+    # Hardcoded usage of SSE2
+    platforms = platforms.x86;
+  };
+})
diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index 6f0022f127dc..5427471c8229 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "updatecli";
-  version = "0.75.0";
+  version = "0.76.0";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8jQCwnc/kj3m/02nrA/na422rrvxxF7D3LzUen3O6ms=";
+    hash = "sha256-UfiwagyE3w+kcPJnDDNTCGrxghnag/RPz6SSdAglyYA=";
   };
 
-  vendorHash = "sha256-7LC5gzK54u8zEtDOyeU1kgIycGLxOeMWYrrDTvC3gVQ=";
+  vendorHash = "sha256-STiVtzA78zeo5wywwzvA0dqmBW3REUvcpOXuWjpxReY=";
 
   # tests require network access
   doCheck = false;
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index d3952f621a12..a3a8677e0886 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -13,6 +13,9 @@
 , moreutils
 , cacert
 , nodePackages
+, pipewire
+, libpulseaudio
+, autoPatchelfHook
 , withTTS ? true
   # Enables the use of vencord from nixpkgs instead of
   # letting vesktop manage it's own version
@@ -81,6 +84,13 @@ stdenv.mkDerivation (finalAttrs: {
     nodePackages.pnpm
     nodePackages.nodejs
     makeWrapper
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    pipewire
+    libpulseaudio
+    stdenv.cc.cc.lib
   ];
 
   patches = [
@@ -106,6 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
     # using `pnpm exec` here apparently makes it ignore ELECTRON_SKIP_BINARY_DOWNLOAD
     ./node_modules/.bin/electron-builder \
       --dir \
+      -c.asarUnpack="**/*.node" \
       -c.electronDist=${electron}/libexec/electron \
       -c.electronVersion=${electron.version}
   '';
@@ -115,8 +126,8 @@ stdenv.mkDerivation (finalAttrs: {
     ''
       runHook preInstall
 
-      mkdir -p $out/opt/Vesktop/resources
-      cp dist/linux-*unpacked/resources/app.asar $out/opt/Vesktop/resources
+      mkdir -p $out/opt/Vesktop
+      cp -r dist/linux-*unpacked/resources $out/opt/Vesktop/
 
       pushd build
       ${libicns}/bin/icns2png -x icon.icns
diff --git a/pkgs/by-name/ze/zed-editor/Cargo.lock b/pkgs/by-name/ze/zed-editor/Cargo.lock
index 4c7a03238d09..1ab0e76ed9d6 100644
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@@ -12520,7 +12520,7 @@ dependencies = [
 
 [[package]]
 name = "zed"
-version = "0.132.3"
+version = "0.132.4"
 dependencies = [
  "activity_indicator",
  "anyhow",
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index cb9da85157d7..dc49348a20b9 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -27,13 +27,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zed";
-  version = "0.132.3";
+  version = "0.132.4";
 
   src = fetchFromGitHub {
     owner = "zed-industries";
     repo = "zed";
     rev = "refs/tags/v${version}";
-    hash = "sha256-EuoUDke8vBPQkiMa9WlP2K3FroIBBAVNJRjsRx4rkO0=";
+    hash = "sha256-4jnPqfLmxp3YpUAIpc/CZ5pv040uDggjeNzJJ2v021E=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/data/themes/alacritty-theme/default.nix b/pkgs/data/themes/alacritty-theme/default.nix
index b24f27f326dc..27c28cad1430 100644
--- a/pkgs/data/themes/alacritty-theme/default.nix
+++ b/pkgs/data/themes/alacritty-theme/default.nix
@@ -1,18 +1,18 @@
 { lib
 , fetchFromGitHub
-, nix-update-script
+, unstableGitUpdater
 , stdenvNoCC
 , ... }:
 
 stdenvNoCC.mkDerivation (self: {
-  name = "alacritty-theme";
-  version = "unstable-2024-03-06";
+  pname = "alacritty-theme";
+  version = "0-unstable-2024-04-24";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "cb786242b6f5e00a57e2f541e7bf1115f3950650";
-    hash = "sha256-fZJ0F4zJy6HOwWtZGm5yN4WfeFNJnW/UJhoQSZ0Bpxk=";
+    rev = "e866efd4ac4e1b4b05892bf9f9bae0540754bca3";
+    hash = "sha256-Uv/Nv2aipnMBM7F4IoUiLF4U/27SF9H/EEfnwGfjiIs=";
   };
 
   dontConfigure = true;
@@ -26,8 +26,8 @@ stdenvNoCC.mkDerivation (self: {
     runHook postInstall
   '';
 
-  passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version=branch" ];
+  passthru.updateScript = unstableGitUpdater {
+    hardcodeZeroVersion = true;
   };
 
   meta = with lib; {
diff --git a/pkgs/data/themes/fluent-gtk-theme/default.nix b/pkgs/data/themes/fluent-gtk-theme/default.nix
index b6f3fdc092ea..9efa36aa88b7 100644
--- a/pkgs/data/themes/fluent-gtk-theme/default.nix
+++ b/pkgs/data/themes/fluent-gtk-theme/default.nix
@@ -21,15 +21,15 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "light" "dark" ] col
 lib.checkListOfEnum "${pname}: size variants" [ "standard" "compact" ] sizeVariants
 lib.checkListOfEnum "${pname}: tweaks" [ "solid" "float" "round" "blur" "noborder" "square" ] tweaks
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "2023-06-20";
+  version = "2024-04-28";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
-    repo = pname;
-    rev = version;
-    hash = "sha256-hUXlzLdcWeOHEJx3+vCMpxvJst6Rr8ISvlzlsUgCrhg=";
+    repo = "fluent-gtk-theme";
+    rev = finalAttrs.version;
+    hash = "sha256-0zf3fHtWcrbT26jgwgsPEDDhBWErOkgXyvGwSWV8rGs=";
   };
 
   nativeBuildInputs = [
@@ -67,11 +67,11 @@ stdenvNoCC.mkDerivation rec {
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     description = "Fluent design gtk theme";
     homepage = "https://github.com/vinceliuice/Fluent-gtk-theme";
-    license = licenses.gpl3Only;
-    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ romildo ];
   };
-}
+})
diff --git a/pkgs/data/themes/onestepback/default.nix b/pkgs/data/themes/onestepback/default.nix
index c18d55db5b44..ed0d0235fc06 100644
--- a/pkgs/data/themes/onestepback/default.nix
+++ b/pkgs/data/themes/onestepback/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "onestepback";
-  version = "0.994";
+  version = "0.997";
 
   srcs = [
     (fetchurl {
-      url = "http://www.vide.memoire.free.fr/perso/OneStepBack/OneStepBack-v${version}.zip";
-      hash = "sha256-kjGiGo4bF1mWJPnaPv2lf7rGG/uAntHK61mH6lcJ6e4=";
+      url = "http://www.vide.memoire.free.fr/pages/onestepback/OneStepBack-v${version}.zip";
+      hash = "sha256-uB6pfnTkMKeP71rAvn1olJJeCL84222UT5uxG72sywE=";
     })
     (fetchurl {
-      url = "http://www.vide.memoire.free.fr/perso/OneStepBack/OneStepBack-darker-v${version}.zip";
-      hash = "sha256-AuurSa45uF5GbPqaMXKblWkv3YGkYL1z0VjWrbnsB/I=";
+      url = "http://www.vide.memoire.free.fr/pages/onestepback/OneStepBack-wm2-v${version}.zip";
+      hash = "sha256-Zdv4ZrQPficbCxPBKF3RFNavlSn/VV/efiZVUT86zRc=";
     })
   ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Gtk theme inspired by the NextStep look";
-    homepage = "http://www.vide.memoire.free.fr/perso/OneStepBack";
+    homepage = "http://www.vide.memoire.free.fr/pages/onestepback";
     license = licenses.gpl3Plus;
     platforms = platforms.all;
     maintainers = [ maintainers.romildo ];
diff --git a/pkgs/desktops/plasma-5/3rdparty/addons/polonium.nix b/pkgs/desktops/plasma-5/3rdparty/addons/polonium.nix
index 10d4c7c1d98a..60638800fc90 100644
--- a/pkgs/desktops/plasma-5/3rdparty/addons/polonium.nix
+++ b/pkgs/desktops/plasma-5/3rdparty/addons/polonium.nix
@@ -11,13 +11,13 @@
 
 buildNpmPackage rec {
   pname = "polonium";
-  version = "1.0b1";
+  version = "1.0rc";
 
   src = fetchFromGitHub {
     owner = "zeroxoneafour";
     repo = pname;
     rev = "v" + version;
-    hash = "sha256-2uthjNhQm+hkRCPXGQm2LZunTj+J0SUuUfZL0PeRd4s=";
+    hash = "sha256-AdMeIUI7ZdctpG/kblGdk1DBy31nDyolPVcTvLEHnNs=";
   };
 
   npmDepsHash = "sha256-kaT3Uyq+/JkmebakG9xQuR4Kjo7vk6BzI1/LffOj/eo=";
@@ -45,7 +45,7 @@ buildNpmPackage rec {
   meta = with lib; {
     description = "Auto-tiler that uses KWin 6.0+ tiling functionality";
     license = licenses.mit;
-    maintainers = with maintainers; [ peterhoeg ];
+    maintainers = with maintainers; [ peterhoeg kotatsuyaki ];
     inherit (plasma-framework.meta) platforms;
   };
 }
diff --git a/pkgs/development/embedded/stm32/stm32cubemx/default.nix b/pkgs/development/embedded/stm32/stm32cubemx/default.nix
index 4bcad690bbbd..6d58322767d3 100644
--- a/pkgs/development/embedded/stm32/stm32cubemx/default.nix
+++ b/pkgs/development/embedded/stm32/stm32cubemx/default.nix
@@ -13,11 +13,11 @@ let
   iconame = "STM32CubeMX";
   package = stdenvNoCC.mkDerivation rec {
     pname = "stm32cubemx";
-    version = "6.10.0";
+    version = "6.11.1";
 
     src = fetchzip {
       url = "https://sw-center.st.com/packs/resource/library/stm32cube_mx_v${builtins.replaceStrings ["."] [""] version}-lin.zip";
-      sha256 = "sha256-B5Sf+zM7h9BiFqDYrLS0JdqZi3dGy6H9gAaJIN3izeM=";
+      hash = "sha256-By9T43GLM1J63TkRi3kl05h1RflBorU1QHgYOrXQ9N0=";
       stripRoot = false;
     };
 
@@ -84,7 +84,7 @@ let
   };
   in
   buildFHSEnv {
-    inherit (package) pname meta;
+    inherit (package) pname version meta;
     runScript = "${package.outPath}/bin/stm32cubemx";
     targetPkgs = pkgs:
       with pkgs; [
diff --git a/pkgs/development/interpreters/boron/default.nix b/pkgs/development/interpreters/boron/default.nix
index 541c3525b660..e6570c2e8919 100644
--- a/pkgs/development/interpreters/boron/default.nix
+++ b/pkgs/development/interpreters/boron/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "boron";
-  version = "2.0.8";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "https://sourceforge.net/projects/urlan/files/Boron/boron-${version}.tar.gz";
-    sha256 = "sha256-Ni/LJgOABC2wXDMsg1ZAuZWSQdFT9/Fa4lH4+V0gy8M=";
+    sha256 = "sha256-50HKcK2hQpe9k9RIoVa/N5krTRKlW9AsGYTmHITx7Nc=";
   };
 
   # this is not a standard Autotools-like `configure` script
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index cedc8ef29232..b440e56812ad 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clojure";
-  version = "1.11.2.1446";
+  version = "1.11.3.1456";
 
   src = fetchurl {
     # https://github.com/clojure/brew-install/releases
     url = "https://github.com/clojure/brew-install/releases/download/${finalAttrs.version}/clojure-tools-${finalAttrs.version}.tar.gz";
-    hash = "sha256-qn7/sPyVDfjZPLeWxlUBBljAW/d8cCw6lEm3/deS73E=";
+    hash = "sha256-ymOkUUDSj5KzFMBY1D7gErjPAK5E/QjFDGcwDo5fzW0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/accounts-qt/default.nix b/pkgs/development/libraries/accounts-qt/default.nix
index 8a11d3375491..8e5dd411fca2 100644
--- a/pkgs/development/libraries/accounts-qt/default.nix
+++ b/pkgs/development/libraries/accounts-qt/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, lib, fetchFromGitLab, doxygen, glib, libaccounts-glib, pkg-config, qmake, qtbase, wrapQtAppsHook }:
+{ stdenv, lib, fetchFromGitLab, gitUpdater, doxygen, glib, libaccounts-glib, pkg-config, qmake, qtbase, wrapQtAppsHook }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "accounts-qt";
-  version = "1.16-unstable-2023-11-24";
+  version = "1.17";
 
   # pinned to fork with Qt6 support
   src = fetchFromGitLab {
-    owner = "nicolasfella";
+    owner = "accounts-sso";
     repo = "libaccounts-qt";
-    rev = "18557f7def9af8f4a9e0e93e9f575ae11e5066aa";
-    hash = "sha256-8FGZmg2ljSh1DYZfklMTrWN7Sdlk/Atw0qfpbb+GaBc=";
+    rev = "refs/tags/VERSION_${finalAttrs.version}";
+    hash = "sha256-mPZgD4r7vlUP6wklvZVknGqTXZBckSOtNzK7p6e2qSA=";
   };
 
   propagatedBuildInputs = [ glib libaccounts-glib ];
@@ -21,11 +21,15 @@ stdenv.mkDerivation {
     patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$out"/bin/*
   '';
 
+  passthru.updateScript = gitUpdater {
+    rev = "VERSION_";
+  };
+
   meta = with lib; {
     description = "Qt library for accessing the online accounts database";
     mainProgram = "accountstest";
-    homepage = "https://gitlab.com/accounts-sso";
+    homepage = "https://gitlab.com/accounts-sso/libaccounts-qt";
     license = licenses.lgpl21;
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/development/libraries/ayatana-ido/default.nix b/pkgs/development/libraries/ayatana-ido/default.nix
index 85c785be3cb3..7e15b74ebee4 100644
--- a/pkgs/development/libraries/ayatana-ido/default.nix
+++ b/pkgs/development/libraries/ayatana-ido/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ayatana-ido";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "AyatanaIndicators";
     repo = pname;
     rev = version;
-    sha256 = "sha256-uecUyqSL02SRdlLbWIy0luHACTFoyMXQ6rOIYuisZsw=";
+    sha256 = "sha256-Y+5fHUe1HAjU/cy7jWKE7zVQUezJNFg4q9tn7H1+NuA=";
   };
 
   nativeBuildInputs = [ pkg-config cmake ];
diff --git a/pkgs/development/libraries/cista/default.nix b/pkgs/development/libraries/cista/default.nix
index 30070fe02dae..e2f302b5812b 100644
--- a/pkgs/development/libraries/cista/default.nix
+++ b/pkgs/development/libraries/cista/default.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
 
 stdenv.mkDerivation rec {
   pname = "cista";
@@ -19,7 +24,7 @@ stdenv.mkDerivation rec {
     homepage = "https://cista.rocks";
     description = "A simple, high-performance, zero-copy C++ serialization & reflection library";
     license = licenses.mit;
-    maintainers = [];
+    maintainers = [ maintainers.sigmanificient ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/coost/default.nix b/pkgs/development/libraries/coost/default.nix
index 3d0c15bbc2ef..7a259d44faf0 100644
--- a/pkgs/development/libraries/coost/default.nix
+++ b/pkgs/development/libraries/coost/default.nix
@@ -1,5 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, cmake, curl, openssl, gitUpdater
-, withCurl ? true, withOpenSSL ? true }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  curl,
+  openssl,
+  gitUpdater,
+  withCurl ? true,
+  withOpenSSL ? true,
+}:
 
 stdenv.mkDerivation rec {
   pname = "coost";
@@ -21,9 +30,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = lib.optional withCurl curl ++ lib.optional withOpenSSL openssl;
 
-  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ]
-    ++ lib.optional withCurl "-DWITH_LIBCURL=ON"
-    ++ lib.optional withOpenSSL "-DWITH_OPENSSL=ON";
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+  ] ++ lib.optional withCurl "-DWITH_LIBCURL=ON" ++ lib.optional withOpenSSL "-DWITH_OPENSSL=ON";
 
   passthru.updateScript = gitUpdater { };
 
@@ -31,7 +40,7 @@ stdenv.mkDerivation rec {
     description = "A tiny boost library in C++11";
     homepage = "https://github.com/idealvin/coost";
     license = licenses.mit;
-    maintainers = [];
+    maintainers = [ maintainers.sigmanificient ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/howard-hinnant-date/default.nix b/pkgs/development/libraries/howard-hinnant-date/default.nix
index 4f3e74f5d8a8..f7af4975de56 100644
--- a/pkgs/development/libraries/howard-hinnant-date/default.nix
+++ b/pkgs/development/libraries/howard-hinnant-date/default.nix
@@ -33,6 +33,13 @@ stdenv.mkDerivation rec {
       src = ./make-zoneinfo-available.diff;
       inherit tzdata;
     })
+    # The reported version to cmake's find_package() is 3.0.0, but the actual
+    # version is 3.0.1. This patch fixes that.
+    (fetchpatch {
+      name = "fix-cmake-version.patch";
+      url = "https://github.com/HowardHinnant/date/commit/2e19c006e2218447ee31f864191859517603f59f.patch";
+      hash = "sha256-SRAWrwv64ap3Qh3RlhwqgS0L2YsrjqVSgw6iH3KlWvk=";
+    })
   ];
 
   # Tweaks to fix undefined variable substitutions
diff --git a/pkgs/development/libraries/kddockwidgets/default.nix b/pkgs/development/libraries/kddockwidgets/default.nix
index 29b7bf992775..a1020fe98679 100644
--- a/pkgs/development/libraries/kddockwidgets/default.nix
+++ b/pkgs/development/libraries/kddockwidgets/default.nix
@@ -1,24 +1,32 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , qtbase
+, qtdeclarative
+, qtquickcontrols2
 , qtx11extras
+, spdlog
+, fmt
+, nlohmann_json
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "KDDockWidgets";
-  version = "1.7.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "KDAB";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-k5Hn9kxq1+tH5kV/ZeD4xzQLDgcY4ACC+guP7YJD4C8=";
+    sha256 = "sha256-V4BMD1kYyaMlqNBo8otpV5yBt/PICzhBTkEMX9N3lbk=";
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ qtbase qtx11extras ];
+  buildInputs = [ spdlog fmt nlohmann_json ];
+  propagatedBuildInputs = [ qtbase qtdeclarative qtquickcontrols2 qtx11extras ];
+
+  dontWrapQtApps = true;
 
   meta = with lib; {
     description = "KDAB's Dock Widget Framework for Qt";
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index 06b528ff8cf7..80038b79442a 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "leatherman";
-  version = "1.12.12";
+  version = "1.12.13";
 
   src = fetchFromGitHub {
-    sha256 = "sha256-V/AMdJ3ldlgBaO8gS0FOqb5tTdRGGW/+3LZq/TKkdog=";
+    sha256 = "sha256-rfh4JLnLekx9UhyLH6eDJUeItPROmY/Lc6mcWpbGb3s=";
     rev = version;
     repo = "leatherman";
     owner = "puppetlabs";
diff --git a/pkgs/development/libraries/libaccounts-glib/default.nix b/pkgs/development/libraries/libaccounts-glib/default.nix
index c540f4bc26ec..310d13c978b3 100644
--- a/pkgs/development/libraries/libaccounts-glib/default.nix
+++ b/pkgs/development/libraries/libaccounts-glib/default.nix
@@ -1,17 +1,17 @@
-{ lib, stdenv, fetchFromGitLab, meson, mesonEmulatorHook, ninja, glib, check, python3, vala, gtk-doc, glibcLocales
+{ lib, stdenv, fetchFromGitLab, gitUpdater, meson, mesonEmulatorHook, ninja, glib, check, python3, vala, gtk-doc, glibcLocales
 , libxml2, libxslt, pkg-config, sqlite, docbook_xsl, docbook_xml_dtd_43, gobject-introspection }:
 
 stdenv.mkDerivation rec {
   pname = "libaccounts-glib";
-  version = "1.26";
+  version = "1.27";
 
   outputs = [ "out" "dev" "devdoc" "py" ];
 
   src = fetchFromGitLab {
     owner = "accounts-sso";
     repo = "libaccounts-glib";
-    rev = version;
-    sha256 = "sha256-KVKylt+XjLfidsS2KzT7oFXP6rTR528lYAUP8dffu7k=";
+    rev = "VERSION_${version}";
+    sha256 = "sha256-mLhcwp8rhCGSB1K6rTWT0tuiINzgwULwXINfCbgPKEg=";
   };
 
   nativeBuildInputs = [
@@ -46,11 +46,17 @@ stdenv.mkDerivation rec {
   LC_ALL = "en_US.UTF-8";
 
   mesonFlags = [
+    "-Dinstall-py-overrides=true"
     "-Dpy-overrides-dir=${placeholder "py"}/${python3.sitePackages}/gi/overrides"
   ];
 
+  passthru.updateScript = gitUpdater {
+    rev = "VERSION_";
+  };
+
   meta = with lib; {
     description = "Library for managing accounts which can be used from GLib applications";
+    homepage = "https://gitlab.com/accounts-sso/libaccounts-glib";
     platforms = platforms.linux;
     license = licenses.lgpl21;
   };
diff --git a/pkgs/development/libraries/libglibutil/default.nix b/pkgs/development/libraries/libglibutil/default.nix
index acd8b374b58b..66fa722573fd 100644
--- a/pkgs/development/libraries/libglibutil/default.nix
+++ b/pkgs/development/libraries/libglibutil/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libglibutil";
-  version = "1.0.76";
+  version = "1.0.77";
 
   src = fetchFromGitHub {
     owner = "sailfishos";
     repo = pname;
     rev = version;
-    sha256 = "sha256-qp3zcaoLM6G3DZgb2Jic1OhHetraEmYRiGkbQlSBnjs=";
+    sha256 = "sha256-SLpyQsRl7yfCAgK3udSSQo8OZOf6FRCzFKIDDUKg1gs=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/liboqs/default.nix b/pkgs/development/libraries/liboqs/default.nix
index 4962f9459d79..e703dc3647fa 100644
--- a/pkgs/development/libraries/liboqs/default.nix
+++ b/pkgs/development/libraries/liboqs/default.nix
@@ -1,9 +1,10 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, openssl
-, enableStatic ? stdenv.hostPlatform.isStatic
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  openssl,
+  enableStatic ? stdenv.hostPlatform.isStatic,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,6 +36,6 @@ stdenv.mkDerivation rec {
     homepage = "https://openquantumsafe.org";
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = [];
+    maintainers = [ maintainers.sigmanificient ];
   };
 }
diff --git a/pkgs/development/libraries/libsv/default.nix b/pkgs/development/libraries/libsv/default.nix
index 9c6279937560..4136c6471407 100644
--- a/pkgs/development/libraries/libsv/default.nix
+++ b/pkgs/development/libraries/libsv/default.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
 
 stdenv.mkDerivation rec {
   pname = "libsv";
@@ -17,7 +22,7 @@ stdenv.mkDerivation rec {
     description = "Public domain cross-platform semantic versioning in C99";
     homepage = "https://github.com/uael/sv";
     license = licenses.unlicense;
-    maintainers = [];
+    maintainers = [ lib.maintainers.sigmanificient ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/miniz/default.nix b/pkgs/development/libraries/miniz/default.nix
index 8592dc5f1224..0c4d902f40bb 100644
--- a/pkgs/development/libraries/miniz/default.nix
+++ b/pkgs/development/libraries/miniz/default.nix
@@ -1,29 +1,41 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib
+, fetchFromGitHub
+, nix-update-script
+, stdenv
+, testers
+, validatePkgConfig
+, cmake
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "miniz";
-  version = "2.2.0";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "richgel999";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-7hc/yNJh4sD5zGQLeHjowbUtV/1mUDQre1tp9yKMSSY=";
+    repo = "miniz";
+    rev = finalAttrs.version;
+    hash = "sha256-3J0bkr2Yk+MJXilUqOCHsWzuykySv5B1nepmucvA4hg=";
   };
+  passthru.updateScript = nix-update-script {};
 
-  nativeBuildInputs = [ cmake ];
+  strictDeps = true;
+  nativeBuildInputs = [ cmake validatePkgConfig ];
 
   postFixup = ''
-    substituteInPlace "$out"/share/pkgconfig/miniz.pc \
-      --replace '=''${prefix}//' '=/' \
-      --replace '=''${exec_prefix}//' '=/'
+    substituteInPlace "$out"/lib/pkgconfig/miniz.pc \
+      --replace-fail '=''${prefix}//' '=/' \
+      --replace-fail '=''${exec_prefix}//' '=/'
   '';
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Single C source file zlib-replacement library";
     homepage = "https://github.com/richgel999/miniz";
     license = licenses.mit;
     maintainers = with maintainers; [ astro ];
     platforms = platforms.unix;
+    pkgConfigModules = [ "miniz" ];
   };
-}
+})
diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index db9c727f8e0b..02e587661890 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -20,11 +20,11 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");
 
 stdenv.mkDerivation  rec {
   pname = "mpich";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    sha256 = "sha256-pkpmeBueUxKtBS0yaJ4jJS90WyfuiBisKsDIIJvAuQ4=";
+    sha256 = "sha256-IzMbIpnyh8NBlyftwt+JItfnq7uf0Kx04DuZZvmtQtc=";
   };
 
   outputs = [ "out" "doc" "man" ];
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index 6604596fe468..c4b851207954 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -15,10 +15,6 @@
 , buildPackages
 , python3
 , config
-
-  # options
-, developerBuild ? false
-, debug ? false
 }:
 
 let
@@ -47,7 +43,6 @@ let
       qtbase = callPackage ./modules/qtbase.nix {
         withGtk3 = !stdenv.hostPlatform.isMinGW;
         inherit (srcs.qtbase) src version;
-        inherit developerBuild;
         inherit (darwin.apple_sdk_11_0.frameworks)
           AGL AVFoundation AppKit Contacts CoreBluetooth EventKit GSS MetalKit;
         patches = [
@@ -197,7 +192,6 @@ let
             name = "qmake6-hook";
             propagatedBuildInputs = [ qtbase.dev ];
             substitutions = {
-              inherit debug;
               fix_qmake_libtool = ./hooks/fix-qmake-libtool.sh;
             };
           } ./hooks/qmake-hook.sh)
diff --git a/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh
index 8c4ce096443f..130e8290a3fe 100644
--- a/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-6/hooks/qmake-hook.sh
@@ -18,12 +18,6 @@ qmakePrePhase() {
         "NIX_OUTPUT_PLUGIN=${!outputBin}/${qtPluginPrefix:?}"
     )
 
-    if [ -n "@debug@" ]; then
-        qmakeFlags+=("CONFIG+=debug")
-    else
-        qmakeFlags+=("CONFIG+=release")
-    fi
-
     qmakeFlags+=("${qmakeFlags_orig[@]}")
 }
 prePhases+=" qmakePrePhase"
diff --git a/pkgs/development/libraries/qt-6/hooks/qtbase-setup-hook.sh b/pkgs/development/libraries/qt-6/hooks/qtbase-setup-hook.sh
index 9bc68e6cd3d6..5006d6b65530 100644
--- a/pkgs/development/libraries/qt-6/hooks/qtbase-setup-hook.sh
+++ b/pkgs/development/libraries/qt-6/hooks/qtbase-setup-hook.sh
@@ -15,20 +15,6 @@ else # Only set up Qt once.
     . @fix_qt_builtin_paths@
     . @fix_qt_module_paths@
 
-    # Disable debug symbols if qtbase was built without debugging.
-    # This stops -dev paths from leaking into other outputs.
-    if [ -z "@debug@" ]; then
-        NIX_CFLAGS_COMPILE="${NIX_CFLAGS_COMPILE-}${NIX_CFLAGS_COMPILE:+ }-DQT_NO_DEBUG"
-    fi
-
-    # Integration with CMake:
-    # Set the CMake build type corresponding to how qtbase was built.
-    if [ -n "@debug@" ]; then
-        cmakeBuildType="Debug"
-    else
-        cmakeBuildType="Release"
-    fi
-
     # Build tools are often confused if QMAKE is unset.
     export QMAKE=@out@/bin/qmake
 
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
index a14028e1259a..a327b88991ef 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
@@ -92,13 +92,10 @@
   # options
 , libGLSupported ? stdenv.hostPlatform.isLinux
 , libGL
-, debug ? false
-, developerBuild ? false
 , qttranslations ? null
 }:
 
 let
-  debugSymbols = debug || developerBuild;
   isCrossBuild = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 in
 stdenv.mkDerivation rec {
@@ -106,8 +103,6 @@ stdenv.mkDerivation rec {
 
   inherit src version;
 
-  debug = debugSymbols;
-
   propagatedBuildInputs = [
     libxml2
     libxslt
@@ -195,7 +190,6 @@ stdenv.mkDerivation rec {
     CoreBluetooth
   ]
   ++ lib.optional withGtk3 gtk3
-  ++ lib.optional developerBuild gdb
   ++ lib.optional (cups != null && lib.meta.availableOn stdenv.hostPlatform cups) cups
   ++ lib.optional (libmysqlclient != null && !stdenv.hostPlatform.isMinGW) libmysqlclient
   ++ lib.optional (postgresql != null && lib.meta.availableOn stdenv.hostPlatform postgresql) postgresql;
@@ -266,8 +260,6 @@ stdenv.mkDerivation rec {
     patchelf --add-rpath "${libmysqlclient}/lib/mariadb" $out/${qtPluginPrefix}/sqldrivers/libqsqlmysql.so
   '';
 
-  dontStrip = debugSymbols;
-
   dontWrapQtApps = true;
 
   setupHook = ../hooks/qtbase-setup-hook.sh;
diff --git a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
index 63e02e98ff74..a7372dfba22e 100644
--- a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
+++ b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "qtstyleplugin-kvantum${lib.optionalString isQt5 "5"}";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "tsujan";
     repo = "Kvantum";
     rev = "V${finalAttrs.version}";
-    hash = "sha256-i+QjVPSzWNPVQmQkB+u/3Wrvqqoz5OIjRdyZKXzxZh4=";
+    hash = "sha256-cGMS0lEtgd64rjeEfYwJplf9rva0FtpaQMCfxyramE8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/rnnoise/default.nix b/pkgs/development/libraries/rnnoise/default.nix
index af4fcf30153c..eb77106fd29f 100644
--- a/pkgs/development/libraries/rnnoise/default.nix
+++ b/pkgs/development/libraries/rnnoise/default.nix
@@ -1,28 +1,84 @@
-{ stdenv, lib, fetchFromGitHub, autoreconfHook }:
+{ stdenv, lib, fetchurl, fetchzip, autoreconfHook, writeScript, fetchpatch
+, modelUrl ? "", modelHash ? "" # Allow overriding the model URL and hash
+}:
 
-stdenv.mkDerivation (rec {
+let
+  modelVersionJSON = lib.importJSON ./model-version.json;
+
+  # Copy from https://gitlab.xiph.org/xiph/rnnoise/-/raw/v${version}/model_version
+  default_model_version = modelVersionJSON.version;
+
+  # Either use the default model or the one provided by package override
+  model_url = if (modelUrl == "") then "https://media.xiph.org/rnnoise/models/rnnoise_data-${default_model_version}.tar.gz" else modelUrl;
+  model_hash = if (modelHash == "") then modelVersionJSON.hash else modelHash;
+
+in stdenv.mkDerivation (finalAttrs: {
   pname = "rnnoise";
-  version = "2021-01-22";
+  version = "0.2";
 
-  src = fetchFromGitHub {
-    owner = "xiph";
-    repo = "rnnoise";
-    rev = "1cbdbcf1283499bbb2230a6b0f126eb9b236defd";
-    sha256 = "1y0rzgmvy8bf9a431garpm2w177s6ajgf79y5ymw4yb0pik57rwb";
+  src = fetchzip {
+    urls = [
+      "https://gitlab.xiph.org/xiph/rnnoise/-/archive/v${finalAttrs.version}/rnnoise-v${finalAttrs.version}.tar.gz"
+      "https://github.com/xiph/rnnoise/archive/v${finalAttrs.version}.tar.gz"
+    ];
+    hash = "sha256-Qaf+0iOprq7ILRWNRkBjsniByctRa/lFVqiU5ZInF/Q=";
   };
 
+  patches = [
+    # remove when updating
+    (fetchpatch {
+      url = "https://github.com/xiph/rnnoise/commit/372f7b4b76cde4ca1ec4605353dd17898a99de38.patch";
+      hash = "sha256-Dzikb59hjVxd1XIEj/Je4evxtGORkaNcqE+zxOJMSvs=";
+    })
+  ];
+
+  model = fetchurl {
+    url = model_url;
+    hash = model_hash;
+  };
+
+  postPatch = ''
+    tar xvomf ${finalAttrs.model}
+  '';
+
   nativeBuildInputs = [ autoreconfHook ];
 
   postInstall = ''
     install -Dt $out/bin examples/.libs/rnnoise_demo
   '';
 
-  meta = with lib; {
+  passthru.updateScript = writeScript "update-rnnoise.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl jq common-updater-scripts nix nix-prefetch findutils moreutils
+
+    prefetch-sri() {
+        nix-prefetch-url "$1" | xargs nix hash to-sri --type sha256
+    }
+
+    res="$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
+      -sL "https://api.github.com/repos/xiph/rnnoise/tags?per_page=1")"
+
+    version="$(echo $res | jq '.[0].name | split("v") | .[1]' --raw-output)"
+    update-source-version ${finalAttrs.pname} "$version" --ignore-same-hash
+
+    model_version=$(curl -sL "https://raw.githubusercontent.com/xiph/rnnoise/v$version/model_version")
+    model_url="https://media.xiph.org/rnnoise/models/rnnoise_data-$model_version.tar.gz"
+    model_hash="$(prefetch-sri $model_url)"
+
+    modelJson=pkgs/development/libraries/rnnoise/model-version.json
+
+    jq --arg version "$model_version" \
+        --arg hash "$model_hash" \
+        '.version = $version | .hash = $hash' \
+        "$modelJson" | sponge "$modelJson"
+  '';
+
+  meta = {
     description = "Recurrent neural network for audio noise reduction";
     homepage = "https://people.xiph.org/~jm/demo/rnnoise/";
-    license = licenses.bsd3;
-    maintainers = [ maintainers.nh2 ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nh2 ];
     mainProgram = "rnnoise_demo";
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/development/libraries/rnnoise/model-version.json b/pkgs/development/libraries/rnnoise/model-version.json
new file mode 100644
index 000000000000..830f8cc36018
--- /dev/null
+++ b/pkgs/development/libraries/rnnoise/model-version.json
@@ -0,0 +1,4 @@
+{
+  "version": "0b50c45",
+  "hash": "sha256-SsgcXAiE7EvVkHAmqq4WIJt7ds2df3GvWCCUovmPS0M="
+}
diff --git a/pkgs/development/libraries/science/math/petsc/filter_mpi_warnings.patch b/pkgs/development/libraries/science/math/petsc/filter_mpi_warnings.patch
index 6a3c7bee051e..f3a34de9304e 100644
--- a/pkgs/development/libraries/science/math/petsc/filter_mpi_warnings.patch
+++ b/pkgs/development/libraries/science/math/petsc/filter_mpi_warnings.patch
@@ -1,12 +1,12 @@
 diff --git a/src/snes/tutorials/makefile b/src/snes/tutorials/makefile
-index 168febb34b6..71068469066 100644
+index 672a62a..a5fd1c4 100644
 --- a/src/snes/tutorials/makefile
 +++ b/src/snes/tutorials/makefile
 @@ -13,6 +13,7 @@ include ${PETSC_DIR}/lib/petsc/conf/rules
  #  these tests are used by the makefile in PETSC_DIR for basic tests of the install and should not be removed
  testex5f: ex5f.PETSc
  	-@${MPIEXEC} -n 1 ${MPIEXEC_TAIL} ./ex5f -snes_rtol 1e-4 > ex5f_1.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex5f_1.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex5f_1.tmp; \
          if (${DIFF} output/ex5f_1.testout ex5f_1.tmp > /dev/null 2>&1) then \
            echo "Fortran example src/snes/tutorials/ex5f run successfully with 1 MPI process"; \
          else \
@@ -14,7 +14,7 @@ index 168febb34b6..71068469066 100644
          ${MAKE} PETSC_ARCH=${PETSC_ARCH} PETSC_DIR=${PETSC_DIR} ex5f.rm;
  testex19: ex19.PETSc
  	-@${MPIEXEC} -n 1 ${MPIEXEC_TAIL} ./ex19 -da_refine 3 -pc_type mg -ksp_type fgmres  > ex19_1.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
          if (${DIFF} output/ex19_1.testout ex19_1.tmp > /dev/null 2>&1) then \
            echo "C/C++ example src/snes/tutorials/ex19 run successfully with 1 MPI process"; \
          else \
@@ -22,7 +22,7 @@ index 168febb34b6..71068469066 100644
          ${RM} -f ex19_1.tmp;
  testex19_mpi:
  	-@${MPIEXEC} -n 2 ${MPIEXEC_TAIL} ./ex19 -da_refine 3 -pc_type mg -ksp_type fgmres  > ex19_1.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
          if (${DIFF} output/ex19_1.testout ex19_1.tmp > /dev/null 2>&1) then \
            echo "C/C++ example src/snes/tutorials/ex19 run successfully with 2 MPI processes"; \
          else \
@@ -30,7 +30,7 @@ index 168febb34b6..71068469066 100644
  #use unpreconditioned norm because HYPRE device installations use different AMG parameters
  runex19_hypre:
  	-@${MPIEXEC} -n 2 ${MPIEXEC_TAIL} ./ex19 -da_refine 3 -snes_monitor_short -ksp_norm_type unpreconditioned -pc_type hypre > ex19_1.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
            if (${DIFF} output/ex19_hypre.out ex19_1.tmp) then \
              echo "C/C++ example src/snes/tutorials/ex19 run successfully with hypre"; \
            else  \
@@ -38,7 +38,7 @@ index 168febb34b6..71068469066 100644
            ${RM} -f ex19_1.tmp
  runex19_hypre_cuda:
  	-@${MPIEXEC} -n 2 ${MPIEXEC_TAIL} ./ex19 -dm_vec_type cuda -dm_mat_type aijcusparse -da_refine 3 -snes_monitor_short -ksp_norm_type unpreconditioned -pc_type hypre > ex19_1.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
  	   if (${DIFF} output/ex19_hypre.out ex19_1.tmp) then \
             echo "C/C++ example src/snes/tutorials/ex19 run successfully with hypre/cuda"; \
             else  \
@@ -46,7 +46,7 @@ index 168febb34b6..71068469066 100644
  	   ${RM} -f ex19_1.tmp
  runex19_hypre_hip:
  	-@${MPIEXEC} -n 2 ${MPIEXEC_TAIL} ./ex19 -dm_vec_type hip -da_refine 3 -snes_monitor_short -ksp_norm_type unpreconditioned -pc_type hypre > ex19_1.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
  	   if (${DIFF} output/ex19_hypre.out ex19_1.tmp) then \
             echo "C/C++ example src/snes/tutorials/ex19 run successfully with hypre/hip"; \
             else \
@@ -54,7 +54,7 @@ index 168febb34b6..71068469066 100644
  	   ${RM} -f ex19_1.tmp
  runex19_cuda:
  	-@${MPIEXEC} -n 1 ${MPIEXEC_TAIL} ./ex19 -snes_monitor -dm_mat_type seqaijcusparse -dm_vec_type seqcuda -pc_type gamg -pc_gamg_esteig_ksp_max_it 10 -ksp_monitor -mg_levels_ksp_max_it 3  > ex19_1.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
  	   if (${DIFF} output/ex19_cuda_1.out ex19_1.tmp) then \
             echo "C/C++ example src/snes/tutorials/ex19 run successfully with cuda"; \
             else  \
@@ -62,7 +62,7 @@ index 168febb34b6..71068469066 100644
  	   ${RM} -f ex19_1.tmp
  runex19_ml:
  	-@${MPIEXEC} -n 2 ${MPIEXEC_TAIL} ./ex19 -da_refine 3 -snes_monitor_short -pc_type ml > ex19_1.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
  	   if (${DIFF} output/ex19_ml.out ex19_1.tmp) then  \
             echo "C/C++ example src/snes/tutorials/ex19 run successfully with ml"; \
             else \
@@ -70,7 +70,7 @@ index 168febb34b6..71068469066 100644
             ${RM} -f ex19_1.tmp
  runex19_fieldsplit_mumps:
  	-@${MPIEXEC} -n 2 ${MPIEXEC_TAIL} ./ex19 -pc_type fieldsplit -pc_fieldsplit_block_size 4 -pc_fieldsplit_type SCHUR -pc_fieldsplit_0_fields 0,1,2 -pc_fieldsplit_1_fields 3 -fieldsplit_0_pc_type lu -fieldsplit_1_pc_type lu -snes_monitor_short -ksp_monitor_short  -fieldsplit_0_pc_factor_mat_solver_type mumps -fieldsplit_1_pc_factor_mat_solver_type mumps > ex19_6.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex19_6.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex19_6.tmp; \
  	   if (${DIFF} output/ex19_fieldsplit_5.out ex19_6.tmp) then  \
             echo "C/C++ example src/snes/tutorials/ex19 run successfully with mumps"; \
             else  \
@@ -78,7 +78,7 @@ index 168febb34b6..71068469066 100644
             ${RM} -f ex19_6.tmp
  runex19_superlu_dist:
  	-@${MPIEXEC} -n 1 ${MPIEXEC_TAIL} ./ex19 -da_grid_x 20 -da_grid_y 20 -pc_type lu -pc_factor_mat_solver_type superlu_dist > ex19.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex19.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex19.tmp; \
  	   if (${DIFF} output/ex19_superlu.out ex19.tmp) then \
             echo "C/C++ example src/snes/tutorials/ex19 run successfully with superlu_dist"; \
             else  \
@@ -86,7 +86,7 @@ index 168febb34b6..71068469066 100644
  	   ${RM} -f ex19.tmp
  runex19_suitesparse:
  	-@${MPIEXEC} -n 1 ${MPIEXEC_TAIL} ./ex19 -da_refine 3 -snes_monitor_short -pc_type lu -pc_factor_mat_solver_type umfpack > ex19_1.tmp 2>&1; \
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex19_1.tmp; \
  	   if (${DIFF} output/ex19_suitesparse.out ex19_1.tmp) then \
             echo "C/C++ example src/snes/tutorials/ex19 run successfully with suitesparse"; \
             else \
@@ -94,7 +94,7 @@ index 168febb34b6..71068469066 100644
  	   ${RM} -f ex19_1.tmp
  runex3k_kokkos: ex3k.PETSc
  	-@OMP_PROC_BIND=false ${MPIEXEC} -n 2 ${MPIEXEC_TAIL} ./ex3k -view_initial -dm_vec_type kokkos -dm_mat_type aijkokkos -use_gpu_aware_mpi 0 -snes_monitor > ex3k_1.tmp 2>&1 ;\
-+        sed -i '/hwloc\/linux/d ; /ERROR opendir(\/sys\/class\/net) failed/d' ex3k_1.tmp; \
++        sed -i '/hwloc\/linux/d ; /ERROR scandir(\/sys\/class\/net) failed/d' ex3k_1.tmp; \
  	if (${DIFF} output/ex3k_1.out ex3k_1.tmp) then \
            echo "C/C++ example src/snes/tutorials/ex3k run successfully with kokkos-kernels"; \
          else \
diff --git a/pkgs/development/ocaml-modules/earlybird/default.nix b/pkgs/development/ocaml-modules/earlybird/default.nix
index 9803a20368c3..9d6c3664822d 100644
--- a/pkgs/development/ocaml-modules/earlybird/default.nix
+++ b/pkgs/development/ocaml-modules/earlybird/default.nix
@@ -6,7 +6,7 @@
 
 buildDunePackage rec {
   pname = "earlybird";
-  version = "1.2.1";
+  version = "1.3.2";
 
   minimalOCamlVersion = "4.12";
 
@@ -14,7 +14,7 @@ buildDunePackage rec {
     owner = "hackwaly";
     repo = "ocamlearlybird";
     rev = version;
-    hash = "sha256-p29uTdx8+mZKXUL+ng/FzpKuhnykEe8Sy968Wa/KUn4=";
+    hash = "sha256-E6ZZRkGO6Bqr6jWlV9fL3ibFwUVChHR17TPGeP94hfk=";
   };
 
   nativeBuildInputs = [ menhir ];
diff --git a/pkgs/development/ocaml-modules/ninja_utils/default.nix b/pkgs/development/ocaml-modules/ninja_utils/default.nix
new file mode 100644
index 000000000000..2510cc93abbc
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ninja_utils/default.nix
@@ -0,0 +1,22 @@
+{ lib, fetchzip, buildDunePackage, re }:
+
+buildDunePackage rec {
+  pname = "ninja_utils";
+  version = "0.9.0";
+
+  minimalOCamlVersion = "4.12";
+
+  src = fetchzip {
+    url = "https://github.com/CatalaLang/ninja_utils/archive/refs/tags/${version}.tar.gz";
+    hash = "sha256-VSj1IXfczoI3lSAtOqQPIqsxX+HgyxKzlssKd7By/Lo=";
+  };
+
+  propagatedBuildInputs = [ re ];
+
+  meta = {
+    description = "Small library used to generate Ninja build files";
+    homepage = "https://github.com/CatalaLang/ninja_utils";
+    license = lib.licenses.asl20;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/uring/default.nix b/pkgs/development/ocaml-modules/uring/default.nix
index 4940f38f1b4a..1930aa5bbff5 100644
--- a/pkgs/development/ocaml-modules/uring/default.nix
+++ b/pkgs/development/ocaml-modules/uring/default.nix
@@ -3,6 +3,7 @@
 , cstruct
 , dune-configurator
 , fetchurl
+, fetchpatch
 , fmt
 , optint
 , mdx
@@ -19,6 +20,14 @@ buildDunePackage rec {
     hash = "sha256-4OGst19vqEzuNVxO5xxtzS+mEilEBFoEc7lC3j3sTk4=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "musl-1.2.5.patch";
+      url = "https://github.com/ocaml-multicore/ocaml-uring/commit/abe340086574c124061434054937d1f19ee6bb71.patch";
+      hash = "sha256-J4ZQAdQZ9fhT3/vAh5FYMyvMllTowe4GyHJy5RGUTv0=";
+    })
+  ];
+
   propagatedBuildInputs = [
     cstruct
     fmt
diff --git a/pkgs/development/python-modules/androidtvremote2/default.nix b/pkgs/development/python-modules/androidtvremote2/default.nix
index 976ba217ce46..a0c066c4d975 100644
--- a/pkgs/development/python-modules/androidtvremote2/default.nix
+++ b/pkgs/development/python-modules/androidtvremote2/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "androidtvremote2";
-  version = "0.0.14";
+  version = "0.0.15";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "androidtvremote2";
     rev = "refs/tags/v${version}";
-    hash = "sha256-m53TlNrrCjA4CqvR02Yph7Gr5Dt17VJFBX6MC3arWOI=";
+    hash = "sha256-aLNmuMuwaMhl/Utv6bVU4fR8zmhj0fUiInL4RHT4dVw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/anova-wifi/default.nix b/pkgs/development/python-modules/anova-wifi/default.nix
index a7cd85ca8b9e..4f4c00cd7bed 100644
--- a/pkgs/development/python-modules/anova-wifi/default.nix
+++ b/pkgs/development/python-modules/anova-wifi/default.nix
@@ -1,17 +1,18 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, poetry-core
-, aiohttp
-, sensor-state-data
-, pytestCheckHook
-, pytest-asyncio
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  poetry-core,
+  aiohttp,
+  sensor-state-data,
+  pytestCheckHook,
+  pytest-asyncio,
 }:
 
 buildPythonPackage rec {
   pname = "anova-wifi";
-  version = "0.11.7";
+  version = "0.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -20,19 +21,17 @@ buildPythonPackage rec {
     owner = "Lash-L";
     repo = "anova_wifi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-G87lNPyFnMO0YWKtLv/RgSZ0j0exFro24erwYv87V90=";
+    hash = "sha256-0RRnQBLglPnPin9/gqWDKIsfi5V7ydrdDKwm93WEnvk=";
   };
 
   postPatch = ''
-      substituteInPlace pyproject.toml \
-        --replace "--cov=anova_wifi --cov-report=term-missing:skip-covered" ""
-    '';
+    substituteInPlace pyproject.toml \
+      --replace-fail "--cov=anova_wifi --cov-report=term-missing:skip-covered" ""
+  '';
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     sensor-state-data
   ];
diff --git a/pkgs/development/python-modules/approvaltests/default.nix b/pkgs/development/python-modules/approvaltests/default.nix
index 9c7cab503834..9898dffe82ab 100644
--- a/pkgs/development/python-modules/approvaltests/default.nix
+++ b/pkgs/development/python-modules/approvaltests/default.nix
@@ -5,7 +5,6 @@
 , buildPythonPackage
 , empty-files
 , fetchFromGitHub
-, fetchpatch2
 , mock
 , mrjob
 , numpy
@@ -21,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "approvaltests";
-  version = "11.1.3";
+  version = "11.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,16 +29,9 @@ buildPythonPackage rec {
     owner = "approvals";
     repo = "ApprovalTests.Python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VqE2Oj3b+ZfKT+fhJ9DxBClfa8Wz8w/puAnAotN3eG4=";
+    hash = "sha256-oG1TH9F8IYDZWLuL2TIesNuZQVzGQRqkGk502HTG+O8=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      url = "https://github.com/approvals/ApprovalTests.Python/commit/dac7c8a8aa62f31dca7a687d4dbf08158351d5e1.patch";
-      hash = "sha256-TMyfXNtzpGci6tdFRhxiKJRjCWRD5LkaffPY8EVj53E=";
-    })
-  ];
-
   build-system = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/craft-application/default.nix b/pkgs/development/python-modules/craft-application/default.nix
index 5cdbe74cf6a5..03753c8c35b8 100644
--- a/pkgs/development/python-modules/craft-application/default.nix
+++ b/pkgs/development/python-modules/craft-application/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "craft-application";
-  version = "2.6.0";
+  version = "2.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-application";
     rev = "refs/tags/${version}";
-    hash = "sha256-zwkbSo20ogq24YtvFOCYICk25XS8FuxRbW5jfX4gDJM=";
+    hash = "sha256-mWXEc54JsZAl6KD33RF8juzDhFheQOLviJbM1B8RPSo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/google-api-python-client/default.nix b/pkgs/development/python-modules/google-api-python-client/default.nix
index 946090aed992..e88ee4650f06 100644
--- a/pkgs/development/python-modules/google-api-python-client/default.nix
+++ b/pkgs/development/python-modules/google-api-python-client/default.nix
@@ -1,14 +1,15 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, google-auth
-, google-auth-httplib2
-, google-api-core
-, httplib2
-, uritemplate
-, oauth2client
-, setuptools
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  google-auth,
+  google-auth-httplib2,
+  google-api-core,
+  httplib2,
+  uritemplate,
+  oauth2client,
+  setuptools,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -23,11 +24,9 @@ buildPythonPackage rec {
     hash = "sha256-l8BBBjDivr0ZTZnpG9Yg2rW8a27AvwM/mpEJtwC4Oss=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     google-auth
     google-auth-httplib2
     google-api-core
@@ -39,9 +38,7 @@ buildPythonPackage rec {
   # No tests included in archive
   doCheck = false;
 
-  pythonImportsCheck = [
-    "googleapiclient"
-  ];
+  pythonImportsCheck = [ "googleapiclient" ];
 
   meta = with lib; {
     description = "The official Python client library for Google's discovery based APIs";
diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index ddde5156f42f..f3cafa489d6e 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -1,16 +1,17 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, google-api-core
-, google-cloud-testutils
-, mock
-, pandas
-, proto-plus
-, protobuf
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  google-api-core,
+  google-cloud-testutils,
+  mock,
+  pandas,
+  proto-plus,
+  protobuf,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
@@ -25,20 +26,16 @@ buildPythonPackage rec {
     hash = "sha256-57HIdY/DVj/7mjR7xRcuJ4L0TBIbyA/BUoPiic/2db8=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     google-api-core
     proto-plus
     protobuf
   ] ++ google-api-core.optional-dependencies.grpc;
 
   passthru.optional-dependencies = {
-    pandas = [
-      pandas
-    ];
+    pandas = [ pandas ];
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index 61a4967199d0..671c5fc37e2a 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -1,21 +1,22 @@
-{ lib
-, buildPythonPackage
-, deprecated
-, fetchPypi
-, google-api-core
-, google-cloud-core
-, google-cloud-testutils
-, grpc-google-iam-v1
-, grpc-interceptor
-, libcst
-, mock
-, proto-plus
-, protobuf
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
-, sqlparse
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  deprecated,
+  fetchPypi,
+  google-api-core,
+  google-cloud-core,
+  google-cloud-testutils,
+  grpc-google-iam-v1,
+  grpc-interceptor,
+  libcst,
+  mock,
+  proto-plus,
+  protobuf,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  sqlparse,
+  setuptools,
 }:
 
 buildPythonPackage rec {
@@ -30,11 +31,9 @@ buildPythonPackage rec {
     hash = "sha256-MKtW6krGqnQ3hCmPgh4N5lRAGTe0DGDMegpUUoSpG0M=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     deprecated
     google-api-core
     google-cloud-core
@@ -46,9 +45,7 @@ buildPythonPackage rec {
   ] ++ google-api-core.optional-dependencies.grpc;
 
   passthru.optional-dependencies = {
-    libcst = [
-      libcst
-    ];
+    libcst = [ libcst ];
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/graphviz/default.nix b/pkgs/development/python-modules/graphviz/default.nix
index b31a0b6a9354..9d783b7bde22 100644
--- a/pkgs/development/python-modules/graphviz/default.nix
+++ b/pkgs/development/python-modules/graphviz/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "graphviz";
-  version = "0.20.2";
+  version = "0.20.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,8 +26,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "xflr6";
     repo = "graphviz";
-    rev = version;
-    hash = "sha256-q5y4QPBCtA1kMhxbOECodSeubj2bULnnNDrZZfxiry4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-IqjqcBEL4BK/VfRjdxJ9t/DkG8OMAoXJxbW5JXpALuw=";
   };
 
   patches = [
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     fontDirectories = [ freefont_ttf ];
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
@@ -75,5 +75,4 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
   };
-
 }
diff --git a/pkgs/development/python-modules/hishel/default.nix b/pkgs/development/python-modules/hishel/default.nix
index a4ab7b504a91..03dfcf4cf8ec 100644
--- a/pkgs/development/python-modules/hishel/default.nix
+++ b/pkgs/development/python-modules/hishel/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "hishel";
-  version = "0.0.25";
+  version = "0.0.26";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "karpetrosyan";
     repo = "hishel";
     rev = "refs/tags/${version}";
-    hash = "sha256-vDzXrAGJUqG9+wOUWXeKLYraUrILJFAQXf60iCAHRPo=";
+    hash = "sha256-+HjVxcTbY9nRj2938fqguOXuTM3XzJWccx0J6RK2h4A=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mdformat-mkdocs/default.nix b/pkgs/development/python-modules/mdformat-mkdocs/default.nix
index f4f421399850..611c5b11dc0c 100644
--- a/pkgs/development/python-modules/mdformat-mkdocs/default.nix
+++ b/pkgs/development/python-modules/mdformat-mkdocs/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "mdformat-mkdocs";
-  version = "2.0.9";
+  version = "2.0.10";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "KyleKing";
     repo = "mdformat-mkdocs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-50LHGQSR6foL3SqOK/pGQqOcuUgOE9bI1rt/RoIrVsA=";
+    hash = "sha256-N1VU9bOdVENIX6QsFa0jeVugmXjl3gNkVPS/m8gEB2Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/nestedtext/default.nix b/pkgs/development/python-modules/nestedtext/default.nix
index 185fffba413a..d0a925859d03 100644
--- a/pkgs/development/python-modules/nestedtext/default.nix
+++ b/pkgs/development/python-modules/nestedtext/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "nestedtext";
-  version = "3.6";
+  version = "3.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "KenKundert";
     repo = "nestedtext";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SHY/MTmYbNh3azkyvwEtuvT+V7YzfLi2B3FvBzv6Omo=";
+    hash = "sha256-lNqSmEmzuRGdXs/4mwKSh7yDGHnAykpIDIR+abbLCns=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/parquet/default.nix b/pkgs/development/python-modules/parquet/default.nix
index 85eb41fa51d4..92e5e7764794 100644
--- a/pkgs/development/python-modules/parquet/default.nix
+++ b/pkgs/development/python-modules/parquet/default.nix
@@ -1,31 +1,46 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pytestCheckHook
-, python-snappy
-, thriftpy2
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+  pytestCheckHook,
+  python-snappy,
+  pythonOlder,
+  setuptools,
+  thriftpy2,
 }:
 
 buildPythonPackage rec {
   pname = "parquet";
   version = "1.3.1";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "jcrobak";
     repo = "parquet-python";
-    rev = "v${version}";
-    sha256 = "1ahvg4dz9fzi4vdm9jmslq3v3jahjj17fdcc5fljgcw6h9yxyl2r";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-WVDffYKGsyepK4w1d4KUUMmxB6a6ylTbJvG79Bt5G6o=";
   };
 
-  propagatedBuildInputs = [
+  patches = [
+    # Refactor deprecated unittest aliases, https://github.com/jcrobak/parquet-python/pull/83
+    (fetchpatch {
+      name = "unittest-aliases.patch";
+      url = "https://github.com/jcrobak/parquet-python/commit/746bebd1e84d8945a3491e1ae5e44102ff534592.patch";
+      hash = "sha256-4awxlzman/YMfOz1WYNR+mVn1ixGku9sqlaMJ1QITYs=";
+    })
+  ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     python-snappy
     thriftpy2
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [
     # Fails with AttributeError
@@ -37,9 +52,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python implementation of the parquet columnar file format";
-    mainProgram = "parquet";
     homepage = "https://github.com/jcrobak/parquet-python";
+    changelog = "https://github.com/jcrobak/parquet-python/releases/tag/v${version}";
     license = licenses.bsd2;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "parquet";
   };
 }
diff --git a/pkgs/development/python-modules/py3buddy/default.nix b/pkgs/development/python-modules/py3buddy/default.nix
index b8a25480799b..2b3f3f48f137 100644
--- a/pkgs/development/python-modules/py3buddy/default.nix
+++ b/pkgs/development/python-modules/py3buddy/default.nix
@@ -4,35 +4,38 @@
 , pyusb
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "py3buddy";
-  version = "unstable-2019-09-29";
+  version = "1.0";
 
   src = fetchFromGitHub {
     owner = "armijnhemel";
-    repo = pname;
-    rev = "2b28908454645117368ca56df67548c93f4e0b03";
-    sha256 = "12ar4kbplavndarkrbibxi5i607f5sfia5myscvalqy78lc33798";
+    repo = "py3buddy";
+    rev = finalAttrs.version;
+    hash = "sha256-KJ0xGEXHY6o2074WFZ0u7gATS+wrrjyzanYretckWYk=";
   };
 
   propagatedBuildInputs = [ pyusb ];
 
   dontConfigure = true;
   dontBuild = true;
-  dontCheck = true;
 
   installPhase = ''
+    runHook preInstall
+
     install -D py3buddy.py $out/${python.sitePackages}/py3buddy.py
+
+    runHook postInstall
   '';
 
   postInstall = ''
     install -D 99-ibuddy.rules $out/lib/udev/rules.d/99-ibuddy.rules
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Code to work with the iBuddy MSN figurine";
     homepage = "https://github.com/armijnhemel/py3buddy";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ prusnak ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ prusnak ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index da50d8f45735..d88cd0abeba9 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -34,15 +34,6 @@ buildPythonPackage rec {
 
   sourceRoot = "apache-arrow-${version}/python";
 
-  postPatch = ''
-    substituteInPlace pyproject.toml setup.py \
-      --replace "setuptools_scm < 8.0.0" "setuptools_scm"
-  '' + lib.optionalString (pythonAtLeast "3.12") ''
-    substituteInPlace ./cmake_modules/FindPython3Alt.cmake --replace-fail \
-      "from distutils import sysconfig" \
-      "import sysconfig"
-  '';
-
   nativeBuildInputs = [
     cmake
     cython_0
@@ -78,8 +69,6 @@ buildPythonPackage rec {
   PYARROW_WITH_HDFS = zero_or_one true;
   PYARROW_WITH_PARQUET = zero_or_one true;
   PYARROW_WITH_PARQUET_ENCRYPTION = zero_or_one true;
-  # Plasma is deprecated since arrow 10.0.0
-  PYARROW_WITH_PLASMA = zero_or_one false;
   PYARROW_WITH_S3 = zero_or_one arrow-cpp.enableS3;
   PYARROW_WITH_GCS = zero_or_one arrow-cpp.enableGcs;
   PYARROW_BUNDLE_ARROW_CPP_HEADERS = zero_or_one false;
@@ -172,7 +161,6 @@ buildPythonPackage rec {
     "feather"
     "flight"
     "fs"
-    "hdfs"
     "json"
     "parquet"
   ];
diff --git a/pkgs/development/python-modules/pydash/default.nix b/pkgs/development/python-modules/pydash/default.nix
index b9ac4770f71e..a385b6f43130 100644
--- a/pkgs/development/python-modules/pydash/default.nix
+++ b/pkgs/development/python-modules/pydash/default.nix
@@ -1,41 +1,38 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, invoke
-, mock
-, pytest7CheckHook
-, pythonOlder
-, setuptools
-, sphinx-rtd-theme
-, typing-extensions
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  invoke,
+  mock,
+  pytest7CheckHook,
+  pythonOlder,
+  setuptools,
+  sphinx-rtd-theme,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "pydash";
-  version = "7.0.6";
+  version = "8.0.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "dgilland";
     repo = "pydash";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zwtUdP2fFFE5X0SDkBDetAQbKnZ1v24DGdzN3fQLa0A=";
+    hash = "sha256-4zNljz0U/iQd2DMC43qkdOY/mwtPlizgLmoaB7BVmxw=";
   };
 
   postPatch = ''
-    sed -i "/--cov/d" setup.cfg
-    sed -i "/--no-cov/d" setup.cfg
+    sed -i "/--cov/d" pyproject.toml
+    sed -i "/--no-cov/d" pyproject.toml
   '';
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
-    typing-extensions
-  ];
+  dependencies = [ typing-extensions ];
 
   nativeCheckInputs = [
     invoke
@@ -44,9 +41,7 @@ buildPythonPackage rec {
     sphinx-rtd-theme
   ];
 
-  pythonImportsCheck = [
-    "pydash"
-  ];
+  pythonImportsCheck = [ "pydash" ];
 
   disabledTestPaths = [
     # Disable mypy testing
diff --git a/pkgs/development/python-modules/pyqt6-webengine/default.nix b/pkgs/development/python-modules/pyqt6-webengine/default.nix
index 637a686f00cb..f227a1469ab5 100644
--- a/pkgs/development/python-modules/pyqt6-webengine/default.nix
+++ b/pkgs/development/python-modules/pyqt6-webengine/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pyqt6-webengine";
-  version = "6.6.0";
+  version = "6.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyQt6_WebEngine";
     inherit version;
-    hash = "sha256-1QuYTD+F5AnmkrFWEychUi1OjPm2wl4M+Sfuot+zlIc=";
+    hash = "sha256-aO3HrbbZ4nX13pVogeecyg1x+tQ5q+qhDYI7/1rFUAE=";
   };
 
   # fix include path and increase verbosity
diff --git a/pkgs/development/python-modules/pytest-json-report/default.nix b/pkgs/development/python-modules/pytest-json-report/default.nix
index f3b556699e8b..dce8df48a430 100644
--- a/pkgs/development/python-modules/pytest-json-report/default.nix
+++ b/pkgs/development/python-modules/pytest-json-report/default.nix
@@ -1,12 +1,13 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pytest
-, pytest-metadata
-, pytest-xdist
-, pytestCheckHook
-, pythonOlder
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytest,
+  pytest-metadata,
+  pytest-xdist,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
@@ -23,17 +24,11 @@ buildPythonPackage rec {
     hash = "sha256-hMB/atDuo7CjwhHFUOxVfgJ7Qp4AA9J428iv7hyQFcs=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  buildInputs = [
-    pytest
-  ];
+  buildInputs = [ pytest ];
 
-  propagatedBuildInputs = [
-    pytest-metadata
-  ];
+  dependencies = [ pytest-metadata ];
 
   nativeCheckInputs = [
     pytest-xdist
@@ -44,11 +39,12 @@ buildPythonPackage rec {
     # pytest-flaky is not available at the moment
     "test_bug_31"
     "test_environment_via_metadata_plugin"
+    # AssertionError
+    "test_report_collectors"
+    "test_report_crash_and_traceback"
   ];
 
-  pythonImportsCheck = [
-    "pytest_jsonreport"
-  ];
+  pythonImportsCheck = [ "pytest_jsonreport" ];
 
   meta = with lib; {
     description = "Pytest plugin to report test results as JSON";
diff --git a/pkgs/development/python-modules/python-lsp-black/default.nix b/pkgs/development/python-modules/python-lsp-black/default.nix
index 6387e833b7fc..20828ac3e38d 100644
--- a/pkgs/development/python-modules/python-lsp-black/default.nix
+++ b/pkgs/development/python-modules/python-lsp-black/default.nix
@@ -24,15 +24,20 @@ buildPythonPackage rec {
   };
 
   patches =
-    /** fix test failure with black<24.2.0;
-        remove this patch once python-lsp-black>2.0.0 */
+    /** includes a series of patches fixing tests not yet released as 2.0.1+ version
+        they are meant to keep up to date with black releases */
     lib.optional
-      (with lib; (versionOlder version "2.0.1") && (versionAtLeast black.version "24.2.0"))
+      (with lib; versionAtLeast black.version "24.2.0")
       (fetchpatch {
-        url = "https://patch-diff.githubusercontent.com/raw/python-lsp/python-lsp-black/pull/56.patch";
+        url = "https://github.com/python-lsp/python-lsp-black/commit/d43b41431379f9c9bb05fab158c4d97e6d515f8f.patch";
         hash = "sha256-38bYU27+xtA8Kq3appXTkNnkG5/XgrUJ2nQ5+yuSU2U=";
       })
-    ++ [ ];
+    ++ lib.optional
+      (with lib; versionAtLeast black.version "24.3.0")
+      (fetchpatch {
+        url = "https://github.com/python-lsp/python-lsp-black/commit/9298585a9d14d25920c33b188d79e820dc98d4a9.patch";
+        hash = "sha256-4u0VIS7eidVEiKRW2wc8lJVkJwhzJD/M+uuqmTtiZ7E=";
+      });
 
   nativeBuildInputs = [
     setuptools
diff --git a/pkgs/development/python-modules/pytibber/default.nix b/pkgs/development/python-modules/pytibber/default.nix
index e0c55bf0e9e9..83b1a73820e8 100644
--- a/pkgs/development/python-modules/pytibber/default.nix
+++ b/pkgs/development/python-modules/pytibber/default.nix
@@ -1,37 +1,35 @@
 { lib
 , aiohttp
-, async-timeout
 , buildPythonPackage
 , fetchFromGitHub
 , gql
-, graphql-subscription-manager
 , pytest-asyncio
 , pytestCheckHook
-, python-dateutil
 , pythonOlder
-, pytz
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pytibber";
-  version = "0.29.0";
-  format = "setuptools";
+  version = "0.29.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "pyTibber";
     rev = "refs/tags/${version}";
-    hash = "sha256-rj/uIgIDjmEGD6muUllTb0PdLkedarMgVq38qqNoMI4=";
+    hash = "sha256-fKeNQifSCxsqR2mhK2w5kG669byYNNLkfxAYTUtfWE0=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     aiohttp
-    async-timeout
     gql
-    graphql-subscription-manager
-    python-dateutil
   ] ++ gql.optional-dependencies.websockets;
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/quantiphy/default.nix b/pkgs/development/python-modules/quantiphy/default.nix
index 57ac30017ce4..56790351dcd6 100644
--- a/pkgs/development/python-modules/quantiphy/default.nix
+++ b/pkgs/development/python-modules/quantiphy/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "quantiphy";
-  version = "2.19";
+  version = "2.20";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,8 +22,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "KenKundert";
     repo = "quantiphy";
-    rev = "v${version}";
-    hash = "sha256-oSWq/D1EX6mxUDElfujyOSEtql0csAm72u2B5RuQddE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QXCs93plNSVNiCLEoXx2raH6EbH1rXyjvpBfl+8eXjc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/quixote/default.nix b/pkgs/development/python-modules/quixote/default.nix
new file mode 100644
index 000000000000..557a59390fb9
--- /dev/null
+++ b/pkgs/development/python-modules/quixote/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "quixote";
+  version = "3.6";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    pname = "Quixote";
+    inherit version;
+    hash = "sha256-78t6tznI3+vIRkWNi0HDPGhR8aGaET3IMXQvmAPdSSY=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "quixote" ];
+
+  disabledTestPaths = [
+    # Test has additional requirements
+    "quixote/ptl/test/test_ptl.py"
+  ];
+
+  meta = with lib; {
+    description = "A small and flexible Python Web application framework";
+    homepage = "https://pypi.org/project/Quixote/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index e1b886672c80..33e0c85697c1 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.216.1";
+  version = "2.217.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "sagemaker-python-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-z+vtUgR/Yxptz9Hzdb5bpAIIEN9JlSRVPt/aSKI4jHY=";
+    hash = "sha256-p73M0hBVpakdXGM56ECr4D3mQCBmB7Ud/p+Rj1+/Bic=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/skodaconnect/default.nix b/pkgs/development/python-modules/skodaconnect/default.nix
index 989b5711a810..3cd175e518f1 100644
--- a/pkgs/development/python-modules/skodaconnect/default.nix
+++ b/pkgs/development/python-modules/skodaconnect/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "skodaconnect";
-  version = "1.3.10";
+  version = "1.3.11";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "lendy007";
     repo = "skodaconnect";
     rev = "refs/tags/${version}";
-    hash = "sha256-H45rL9GFuTnP5VP0cRyqlmWJmX1Zvh7A7JcSKgcZCwA=";
+    hash = "sha256-Cy2sXj8+t8lIqrKmI9Aa7tNEIvRArynU/02ajJ+tYHg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/twill/default.nix b/pkgs/development/python-modules/twill/default.nix
index ddea5117a6c0..08e8ad74de22 100644
--- a/pkgs/development/python-modules/twill/default.nix
+++ b/pkgs/development/python-modules/twill/default.nix
@@ -1,40 +1,57 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, lxml
-, requests
-, pyparsing
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  httpx,
+  lxml,
+  pyparsing,
+  pytestCheckHook,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  quixote,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "twill";
-  version = "3.2.3";
-  format = "setuptools";
+  version = "3.2.4";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-m4jrxx7udWkRXzYS0Yfd14tKVHt8kGYPn2eTa4unOdc=";
+    hash = "sha256-YlZKvOGxLWwGh+MqCXf8tfruxLK60H73k1VQhGOSTc8=";
   };
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [ "lxml" ];
+
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [
+    httpx
     lxml
-    requests
     pyparsing
   ];
 
-  pythonImportsCheck = [
-    "twill"
+  nativeCheckInputs = [
+    pytestCheckHook
+    quixote
   ];
 
-  # pypi package comes without tests, other homepage does not provide all verisons
-  doCheck = false;
+  disabledTestPaths = [
+    # pytidylib is abandoned
+    "tests/test_tidy.py"
+  ];
+
+  pythonImportsCheck = [ "twill" ];
 
   meta = with lib; {
     description = "A simple scripting language for Web browsing";
     homepage = "https://twill-tools.github.io/twill/";
+    changelog = "https://github.com/twill-tools/twill/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ mic92 ];
   };
diff --git a/pkgs/development/python-modules/typed-settings/default.nix b/pkgs/development/python-modules/typed-settings/default.nix
index bf4801287276..fe2ebd26d7d1 100644
--- a/pkgs/development/python-modules/typed-settings/default.nix
+++ b/pkgs/development/python-modules/typed-settings/default.nix
@@ -1,21 +1,24 @@
-{ lib
-, attrs
-, buildPythonPackage
-, cattrs
-, click
-, click-option-group
-, fetchPypi
-, hatchling
-, pytestCheckHook
-, pythonOlder
-, tomli
-, typing-extensions
+{
+  lib,
+  attrs,
+  buildPythonPackage,
+  cattrs,
+  click,
+  click-option-group,
+  fetchPypi,
+  hatchling,
+  jinja2,
+  pydantic,
+  pytestCheckHook,
+  pythonOlder,
+  tomli,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "typed-settings";
   version = "24.2.0";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -25,46 +28,57 @@ buildPythonPackage rec {
     hash = "sha256-BuosfIlCgCD+h7eA/6/oE98zdURaT3eik+dysBpJR+Y=";
   };
 
-  nativeBuildInputs = [
-    hatchling
-  ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
-    attrs
-    cattrs
-    click-option-group
-  ] ++ lib.optionals (pythonOlder "3.11") [
-    tomli
-  ];
+  dependencies = lib.optionals (pythonOlder "3.11") [ tomli ];
 
   passthru.optional-dependencies = {
-    click = [
+    all = [
+      attrs
+      cattrs
       click
+      click-option-group
+      jinja2
+      pydantic
     ];
+    attrs = [ attrs ];
+    cattrs = [ cattrs ];
+    click = [ click ];
+    option-groups = [
+      click
+      click-option-group
+    ];
+    jinja = [ jinja2 ];
+    pydantic = [ pydantic ];
   };
 
-  checkInputs = [
+  nativeCheckInputs = [
     pytestCheckHook
     typing-extensions
-  ] ++ passthru.optional-dependencies.click;
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
-  pytestFlagsArray = [
-    "tests"
-  ];
+  pytestFlagsArray = [ "tests" ];
 
   disabledTests = [
     # AssertionError: assert [OptionInfo(p...
     "test_deep_options"
+    # 1Password CLI is not available
+    "TestOnePasswordLoader"
+    "test_handle_op"
   ];
 
-  pythonImportsCheck = [
-    "typed_settings"
+  disabledTestPaths = [
+    # 1Password CLI is not available
+    "tests/test_onepassword.py"
   ];
 
-  meta = {
+  pythonImportsCheck = [ "typed_settings" ];
+
+  meta = with lib; {
     description = "Typed settings based on attrs classes";
     homepage = "https://gitlab.com/sscherfke/typed-settings";
     changelog = "https://gitlab.com/sscherfke/typed-settings/-/blob/${version}/CHANGELOG.rst";
-    license = lib.licenses.mit;
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/typeshed-client/default.nix b/pkgs/development/python-modules/typeshed-client/default.nix
index 153f8a79daf4..196c696ff542 100644
--- a/pkgs/development/python-modules/typeshed-client/default.nix
+++ b/pkgs/development/python-modules/typeshed-client/default.nix
@@ -1,10 +1,12 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, importlib-resources
-, pytestCheckHook
-, pythonOlder
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  importlib-resources,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
@@ -12,7 +14,7 @@ buildPythonPackage rec {
   version = "2.5.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "JelleZijlstra";
@@ -21,25 +23,18 @@ buildPythonPackage rec {
     hash = "sha256-lITreXYn/ZOc1fF2Sqcn8UDrZAjWYfjFSEaAxqTHb4s=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     importlib-resources
+    typing-extensions
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [
-    "typeshed_client"
-  ];
+  pythonImportsCheck = [ "typeshed_client" ];
 
-  pytestFlagsArray = [
-    "tests/test.py"
-  ];
+  pytestFlagsArray = [ "tests/test.py" ];
 
   meta = with lib; {
     description = "Retrieve information from typeshed and other typing stubs";
diff --git a/pkgs/development/python-modules/typical/default.nix b/pkgs/development/python-modules/typical/default.nix
index 67d55e64243e..8201e4ba8104 100644
--- a/pkgs/development/python-modules/typical/default.nix
+++ b/pkgs/development/python-modules/typical/default.nix
@@ -1,24 +1,26 @@
-{ lib
-, buildPythonPackage
-, fastjsonschema
-, fetchFromGitHub
-, future-typing
-, inflection
-, orjson
-, pandas
-, pendulum
-, poetry-core
-, pydantic
-, pytestCheckHook
-, pythonOlder
-, sqlalchemy
-, ujson
+{
+  lib,
+  buildPythonPackage,
+  fastjsonschema,
+  fetchFromGitHub,
+  future-typing,
+  inflection,
+  orjson,
+  pandas,
+  pendulum,
+  poetry-core,
+  pydantic,
+  pytestCheckHook,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  sqlalchemy,
+  ujson,
 }:
 
 buildPythonPackage rec {
   pname = "typical";
   version = "2.8.1";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.10";
 
@@ -29,11 +31,13 @@ buildPythonPackage rec {
     hash = "sha256-2t9Jhdy9NmYBNzdtjjgUnoK2RDEUsAvDkYMcBRzEcmI=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  pythonRelaxDeps = [ "pendulum" ];
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [
     fastjsonschema
     future-typing
     inflection
@@ -43,10 +47,10 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-    pydantic
-    sqlalchemy
     pandas
+    pydantic
+    pytestCheckHook
+    sqlalchemy
   ];
 
   disabledTests = [
@@ -54,6 +58,12 @@ buildPythonPackage rec {
     "test_tagged_union_validate"
     # TypeError: 'NoneType' object cannot be interpreted as an integer
     "test_ujson"
+    # Failed: DID NOT RAISE <class 'ValueError'>
+    "test_invalid_path"
+    # AssertionError
+    "test_primitive"
+    "test_tojson"
+    "test_transmute_simple"
   ];
 
   disabledTestPaths = [
@@ -63,9 +73,7 @@ buildPythonPackage rec {
     "tests/mypy/test_mypy.py"
   ];
 
-  pythonImportsCheck = [
-    "typic"
-  ];
+  pythonImportsCheck = [ "typic" ];
 
   meta = with lib; {
     description = "Python library for runtime analysis, inference and validation of Python types";
diff --git a/pkgs/development/python-modules/vdirsyncer/default.nix b/pkgs/development/python-modules/vdirsyncer/default.nix
index b9046f991f6c..b41724549897 100644
--- a/pkgs/development/python-modules/vdirsyncer/default.nix
+++ b/pkgs/development/python-modules/vdirsyncer/default.nix
@@ -90,7 +90,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/pimutils/vdirsyncer";
     changelog = "https://github.com/pimutils/vdirsyncer/blob/v${version}/CHANGELOG.rst";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ loewenheim ];
+    maintainers = [ ];
     mainProgram = "vdirsyncer";
   };
 }
diff --git a/pkgs/development/python-modules/wasmer/default.nix b/pkgs/development/python-modules/wasmer/default.nix
index 947022eab4f6..0f2748208817 100644
--- a/pkgs/development/python-modules/wasmer/default.nix
+++ b/pkgs/development/python-modules/wasmer/default.nix
@@ -1,10 +1,10 @@
 { stdenv
 , lib
 , rustPlatform
-, rustc
 , callPackage
 , fetchFromGitHub
 , buildPythonPackage
+, pythonAtLeast
 , libiconv
 , libffi
 , libxml2
@@ -22,7 +22,7 @@ let
     , extraBuildInputs ? [ ]
     }: buildPythonPackage rec {
       inherit pname;
-      version = "1.1.0";
+      version = "1.1.1";
       format = "pyproject";
 
       outputs = [ "out" ] ++ lib.optional (pname == "wasmer") "testsout";
@@ -31,7 +31,7 @@ let
         owner = "wasmerio";
         repo = "wasmer-python";
         rev = version;
-        hash = "sha256-nOeOhQ1XY+9qmLGURrI5xbgBUgWe5XRpV38f73kKX2s=";
+        hash = "sha256-Iu28LMDNmtL2r7gJV5Vbb8HZj18dlkHe+mw/Y1L8YKE=";
       };
 
       cargoDeps = rustPlatform.fetchCargoTarball {
@@ -69,6 +69,8 @@ let
       pythonImportsCheck = [ "${lib.replaceStrings ["-"] ["_"] pname}" ];
 
       meta = with lib; {
+        # https://github.com/wasmerio/wasmer-python/issues/778
+        broken = pythonAtLeast "3.12";
         description = "Python extension to run WebAssembly binaries";
         homepage = "https://github.com/wasmerio/wasmer-python";
         license = licenses.mit;
@@ -81,19 +83,19 @@ in
   wasmer = common {
     pname = "wasmer";
     buildAndTestSubdir = "packages/api";
-    cargoHash = "sha256-twoog8LjQtoli+TlDipSuB7yLFkXQJha9BqobqgZW3Y=";
+    cargoHash = "sha256-vpbwU1HrIQmQkce9SK8UOHrX5tOLv/XKsfJHteqOteA=";
   };
 
   wasmer-compiler-cranelift = common {
     pname = "wasmer-compiler-cranelift";
     buildAndTestSubdir = "packages/compiler-cranelift";
-    cargoHash = "sha256-IqeMOY6emhIC7ekH8kIOZCr3JVkjxUg/lQli+ZZpdq4=";
+    cargoHash = "sha256-nv4cr52mUIuR3LWRT3eXU5b2LORwuN4iMbLX1efzovI=";
   };
 
   wasmer-compiler-llvm = common {
     pname = "wasmer-compiler-llvm";
     buildAndTestSubdir = "packages/compiler-llvm";
-    cargoHash = "sha256-xawbf5gXXV+7I2F2fDSaMvjtFvGDBtqX7wL3c28TSbA=";
+    cargoHash = "sha256-FA/xXlPaK8NxZIw7MCm9Fyesgu72Dsxhmb5xzOIINhE=";
     extraNativeBuildInputs = [ llvm_14 ];
     extraBuildInputs = [ libffi libxml2.out ncurses zlib ];
   };
@@ -101,6 +103,6 @@ in
   wasmer-compiler-singlepass = common {
     pname = "wasmer-compiler-singlepass";
     buildAndTestSubdir = "packages/compiler-singlepass";
-    cargoHash = "sha256-4nZHMCNumNhdGPOmHXlJ5POYP7K+VPjwhEUMgzGb/Rk=";
+    cargoHash = "sha256-yew7cB/7RLjW55jZmHFfIvaErgZ6XVxL1ucGGX2Cx18=";
   };
 }
diff --git a/pkgs/development/python-modules/weaviate-client/default.nix b/pkgs/development/python-modules/weaviate-client/default.nix
index 5cf8446ecba9..f92ef94177d5 100644
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -1,46 +1,57 @@
-{ lib
-, authlib
-, buildPythonPackage
-, fetchPypi
-, pythonOlder
-, setuptools-scm
-, tqdm
-, validators
+{
+  lib,
+  authlib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  grpcio,
+  grpcio-health-checking,
+  grpcio-tools,
+  httpx,
+  pydantic,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  setuptools-scm,
+  tqdm,
+  validators,
 }:
 
 buildPythonPackage rec {
   pname = "weaviate-client";
-  version = "4.5.5";
-  format = "setuptools";
+  version = "4.5.6";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-aZBliOjtoKMHrSxbPHx+CuS52AICpcyXvdKvFSk5d+M=";
+  src = fetchFromGitHub {
+    owner = "weaviate";
+    repo = "weaviate-python-client";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-P1GiTsRDbJssoLZR//c+b4IJ2Zyb/0PaBLL+wmmI6zc=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "validators>=0.18.2,<=0.21.0" "validators>=0.18.2" \
-      --replace "requests>=2.28.0,<2.29.0" "requests>=2.28.0"
-  '';
-
-  nativeBuildInputs = [
-    setuptools-scm
+  pythonRelaxDeps = [
+    "httpx"
+    "validators"
   ];
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools-scm ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [
     authlib
+    grpcio
+    grpcio-health-checking
+    grpcio-tools
+    httpx
+    pydantic
     tqdm
     validators
   ];
 
   doCheck = false;
 
-  pythonImportsCheck = [
-    "weaviate"
-  ];
+  pythonImportsCheck = [ "weaviate" ];
 
   meta = with lib; {
     description = "Python native client for easy interaction with a Weaviate instance";
diff --git a/pkgs/development/python-modules/yamlfix/default.nix b/pkgs/development/python-modules/yamlfix/default.nix
index 26b39ed87ed5..ee3a15d11bd0 100644
--- a/pkgs/development/python-modules/yamlfix/default.nix
+++ b/pkgs/development/python-modules/yamlfix/default.nix
@@ -6,6 +6,7 @@
 , pdm-backend
 , pytest-freezegun
 , pytest-xdist
+, pytest
 , pytestCheckHook
 , pythonOlder
 , ruyaml
@@ -26,12 +27,12 @@ buildPythonPackage rec {
     hash = "sha256-nadyBIzXHbWm0QvympRaYU38tuPJ3TPJg8EbvVv+4L0=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     pdm-backend
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     click
     maison
     ruyaml
@@ -51,24 +52,9 @@ buildPythonPackage rec {
     "yamlfix"
   ];
 
-  disabledTests = [
-    # AssertionError: assert ... Fixed <stdin> in...
-    "test_check_one_file_no_changes"
-    "test_config_parsing"
-    "test_corrects_code_from_stdin"
-    "test_corrects_one_file"
-    "test_corrects_three_files"
-    "test_empty_list_inline_comment_indentation"
-    "test_find_files"
-    "test_fix_code_converts_non_valid_false_booleans"
-    "test_ignores_correct_files"
-    "test_include_exclude_files"
-    "test_read_prefixed_environment_variables"
-    "test_section_whitelines"
-    "test_whitelines"
-    "test_sequence_style_env_enum_parsing"
-    "test_verbose_option"
-    "test_enforcing_flow_style_together_with_adjustable_newlines"
+  pytestFlagsArray = [
+    "-W"
+    "ignore::DeprecationWarning"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index e290bb2adf29..2f5a52590c27 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -621,6 +621,7 @@ let
     tikzDevice = with pkgs; [ which texliveMedium ];
     gridGraphics = [ pkgs.which ];
     adimpro = with pkgs; [ which xorg.xdpyinfo ];
+    tfevents = [ pkgs.protobuf ];
     rsvg = [ pkgs.librsvg.dev ];
     ssh = with pkgs; [ libssh ];
     s2 = [ pkgs.openssl.dev ];
diff --git a/pkgs/development/tools/algolia-cli/default.nix b/pkgs/development/tools/algolia-cli/default.nix
index 09a2cee47bba..1d02230ec96b 100644
--- a/pkgs/development/tools/algolia-cli/default.nix
+++ b/pkgs/development/tools/algolia-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "algolia-cli";
-  version = "1.6.7";
+  version = "1.6.8";
 
   src = fetchFromGitHub {
     owner = "algolia";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-g6UNFE1EEo40pqdTAmidG4/A+cQ89UZNp++B+q6AzeA=";
+    hash = "sha256-PqiFx1Bzv4cYwnlr1BDPGiumUUneT5sq64eFFcYPmaA=";
   };
 
   vendorHash = "sha256-cNuBTH7L2K4TgD0H9FZ9CjhE5AGXADaniGLD9Lhrtrk=";
diff --git a/pkgs/development/tools/allure/default.nix b/pkgs/development/tools/allure/default.nix
index 1c781b0f42f4..2d247e3f7d41 100644
--- a/pkgs/development/tools/allure/default.nix
+++ b/pkgs/development/tools/allure/default.nix
@@ -1,40 +1,48 @@
-{ lib, stdenv, makeWrapper, fetchurl, jre }:
+{ lib
+, stdenv
+, makeWrapper
+, fetchurl
+, jre
+}:
 
-let
+stdenv.mkDerivation (finalAttrs: {
   pname = "allure";
   version = "2.29.0";
-in
-stdenv.mkDerivation rec {
-  inherit pname version;
-  nativeBuildInputs = [ makeWrapper ];
-
-  buildInputs = [ jre ];
 
   src = fetchurl {
-    url = "https://github.com/allure-framework/allure2/releases/download/${version}/allure-${version}.tgz";
-    sha256 = "sha256-ohcVXblnCrNs57BWmz+wUwplfIG9fOW8l08LuipNhPs=";
+    url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
+    hash = "sha256-ohcVXblnCrNs57BWmz+wUwplfIG9fOW8l08LuipNhPs=";
   };
+
   dontConfigure = true;
   dontBuild = true;
 
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
+
   installPhase = ''
-    mkdir -p "$out/share"
+    runHook preInstall
+
+    mkdir -p $out/{bin,share}
     cd "$out/share"
     tar xvzf $src
-    mkdir -p "$out/bin"
-    makeWrapper $out/share/${pname}-${version}/bin/allure $out/bin/${pname} \
+    makeWrapper $out/share/${finalAttrs.meta.mainProgram}-${finalAttrs.version}/bin/allure $out/bin/${finalAttrs.meta.mainProgram} \
       --prefix PATH : "${jre}/bin"
+
+    runHook postInstall
   '';
 
-  dontCheck = true;
-
-  meta = with lib; {
+  meta =  {
     homepage = "https://docs.qameta.io/allure/";
     description = "Allure Report is a flexible, lightweight multi-language test reporting tool.";
+    longDescription = ''
+      Allure Report is a flexible, lightweight multi-language test reporting
+      tool providing clear graphical reports and allowing everyone involved
+      in the development process to extract the maximum of information from
+      the everyday testing process.
+      '';
+    license = lib.licenses.asl20;
     mainProgram = "allure";
-    longDescription = "Allure Report is a flexible, lightweight multi-language test reporting tool. It provides clear graphical reports and allows everyone involved in the development process to extract the maximum of information from the everyday testing process";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ happysalada ];
+    maintainers = with lib.maintainers; [ happysalada ];
   };
-}
-
+})
diff --git a/pkgs/development/tools/analysis/hotspot/default.nix b/pkgs/development/tools/analysis/hotspot/default.nix
index 7d36f4323283..b0165266b1a0 100644
--- a/pkgs/development/tools/analysis/hotspot/default.nix
+++ b/pkgs/development/tools/analysis/hotspot/default.nix
@@ -1,10 +1,15 @@
 { lib
-, mkDerivation
+, stdenv
+, binutils
 , cmake
-, elfutils
 , extra-cmake-modules
+, patchelfUnstable
+, wrapQtAppsHook
+, elfutils
 , fetchFromGitHub
+, fetchpatch
 , kconfigwidgets
+, kddockwidgets
 , ki18n
 , kio
 , kitemmodels
@@ -12,33 +17,48 @@
 , kparts
 , kwindowsystem
 , libelf
+, linuxPackages
 , qtbase
-, threadweaver
-, qtx11extras
-, zstd
-, kddockwidgets
+, qtsvg
 , rustc-demangle
+, syntax-highlighting
+, threadweaver
+, zstd
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "hotspot";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "KDAB";
     repo = "hotspot";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DW4R7+rnonmEMbCkNS7TGodw+3mEyHl6OlFK3kbG5HM=";
+    hash = "sha256-FJkDPWqNwoWg/15tvMnwke7PVtWVuqT0gtJBFQE0qZ4=";
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Backport stuck UI bug fix
+    # FIXME: remove in next update
+    (fetchpatch {
+      url = "https://github.com/KDAB/hotspot/commit/7639dee8617dba9b88182c7ff4887e8d3714ac98.patch";
+      hash = "sha256-aAo9uEy+MBztMhnC5jB08moZBeRCENU22R39pqSBXOY=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     extra-cmake-modules
+    # stable patchelf corrupts the binary
+    patchelfUnstable
+    wrapQtAppsHook
   ];
+
   buildInputs = [
     (elfutils.override { enableDebuginfod = true; }) # perfparser needs to find debuginfod.h
     kconfigwidgets
+    kddockwidgets
     ki18n
     kio
     kitemmodels
@@ -47,25 +67,24 @@ mkDerivation rec {
     kwindowsystem
     libelf
     qtbase
-    threadweaver
-    qtx11extras
-    zstd
-    kddockwidgets
+    qtsvg
     rustc-demangle
+    syntax-highlighting
+    threadweaver
+    zstd
   ];
 
-  # hotspot checks for the presence of third party libraries'
-  # git directory to give a nice warning when you forgot to clone
-  # submodules; but Nix clones them and removes .git (for reproducibility).
-  # So we need to fake their existence here.
-  postPatch = ''
-    mkdir -p 3rdparty/{perfparser,PrefixTickLabels}/.git
-  '';
-
   qtWrapperArgs = [
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ rustc-demangle ]}"
+    "--suffix PATH : ${lib.makeBinPath [ linuxPackages.perf binutils ]}"
   ];
 
+  preFixup = ''
+    patchelf \
+      --add-rpath ${lib.makeLibraryPath [ rustc-demangle ]} \
+      --add-needed librustc_demangle.so \
+      $out/libexec/hotspot-perfparser
+  '';
+
   meta = with lib; {
     description = "A GUI for Linux perf";
     mainProgram = "hotspot";
diff --git a/pkgs/development/tools/build-managers/moon/default.nix b/pkgs/development/tools/build-managers/moon/default.nix
index a5c9c8504768..08beabc6f74a 100644
--- a/pkgs/development/tools/build-managers/moon/default.nix
+++ b/pkgs/development/tools/build-managers/moon/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "moon";
-  version = "1.24.1";
+  version = "1.24.2";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-r59iW9Bstek1yOZKwBg08jShbinTPXL2RSt6fvhPFCQ=";
+    hash = "sha256-G1SblnbT0goOsefEy1QbCkp32JKs0usfKMWDsn3k7/M=";
   };
 
-  cargoHash = "sha256-ZM2Ytu8OSeGQGY0+eOx7/5BrS6ANnpGp8TywsrxbJvY=";
+  cargoHash = "sha256-z2Kgo8i6fk3sfX6bCBmyqIfFSw75v4NhnUFSBKJQwXs=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";
diff --git a/pkgs/development/tools/coder/default.nix b/pkgs/development/tools/coder/default.nix
index bee71dc2aeae..3f2ba448511a 100644
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@@ -100,7 +100,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://coder.com";
     license = lib.licenses.agpl3Only;
     mainProgram = "coder";
-    maintainers = with lib.maintainers; [ ghuntley urandom ];
+    maintainers = with lib.maintainers; [ ghuntley kylecarbs urandom ];
   };
 
   passthru = {
diff --git a/pkgs/development/tools/coder/update.sh b/pkgs/development/tools/coder/update.sh
index 335c20dd55a4..60e9a97af221 100755
--- a/pkgs/development/tools/coder/update.sh
+++ b/pkgs/development/tools/coder/update.sh
@@ -5,11 +5,10 @@ set -eu -o pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-LATEST_STABLE_VERSION=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --fail -sSL https://api.github.com/repos/coder/coder/releases | jq -r 'map(select(.prerelease == false)) | sort_by(.tag_name | sub("^v"; "") | split(".") | map(tonumber)) | .[-1].tag_name | sub("^v"; "")')
-
-# Fetch the latest mainline version
-LATEST_MAINLINE_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/coder/coder/releases | jq -r '.[0].tag_name')
-LATEST_MAINLINE_VERSION=$(echo ${LATEST_MAINLINE_TAG} | sed 's/^v//')
+# The released tagged as "latest" is always stable.
+LATEST_STABLE_VERSION=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --fail -sSL https://api.github.com/repos/coder/coder/releases/latest | jq -r '.tag_name | sub("^v"; "")')
+# The highest version that is not a pre-release is the latest mainline version.
+LATEST_MAINLINE_VERSION=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --fail -sSL https://api.github.com/repos/coder/coder/releases | jq -r 'map(select(.prerelease == false)) | sort_by(.tag_name | sub("^v"; "") | split(".") | map(tonumber)) | .[-1].tag_name | sub("^v"; "")')
 
 # Define the platforms
 declare -A ARCHS=(["x86_64-linux"]="linux_amd64.tar.gz"
diff --git a/pkgs/development/tools/conftest/default.nix b/pkgs/development/tools/conftest/default.nix
index 5fe017565f12..d44aedf372bf 100644
--- a/pkgs/development/tools/conftest/default.nix
+++ b/pkgs/development/tools/conftest/default.nix
@@ -6,15 +6,15 @@
 
 buildGoModule rec {
   pname = "conftest";
-  version = "0.51.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "conftest";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1jMVb1Hip7ljmt4WtFg3Qa2/rse2sjISTe3SUS5UCTo=";
+    hash = "sha256-TjBBKFWyqrqeiddAn5SDiLZ4HirWC4vYwIEA43IFSxY=";
   };
-  vendorHash = "sha256-Yw5p2mTTkYvRjeuF9owirohyClSS3j1gKVg8Ma2NIa8=";
+  vendorHash = "sha256-wQBeKPT/MSTd89UmtwKH7uX3sv7x1N5MXMKo/DZRmBk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/database/clickhouse-backup/default.nix b/pkgs/development/tools/database/clickhouse-backup/default.nix
index cf21789b126e..bf9ffa48e439 100644
--- a/pkgs/development/tools/database/clickhouse-backup/default.nix
+++ b/pkgs/development/tools/database/clickhouse-backup/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.5.2";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "AlexAkulov";
     repo = "clickhouse-backup";
     rev = "v${version}";
-    hash = "sha256-NbtHBlVavlVw1CH+Gy4VMukqUgQ8EFB2+8hU0hTFnH0=";
+    hash = "sha256-uFQm7VRxFozV/I1tywey5ljWqzt08aShVjlwUT3oz5w=";
   };
 
   vendorHash = "sha256-T4afeclCWldFJTzk08Ku8VPnXr/Gz0Fpb7G9YrK/iro=";
diff --git a/pkgs/development/tools/go-toml/default.nix b/pkgs/development/tools/go-toml/default.nix
index 24b673cbf021..5f5ad595cabf 100644
--- a/pkgs/development/tools/go-toml/default.nix
+++ b/pkgs/development/tools/go-toml/default.nix
@@ -3,13 +3,16 @@
   buildGoModule,
   fetchFromGitHub,
 }:
-buildGoModule rec {
-  pname = "go-toml";
+let
   version = "2.2.1";
+in
+buildGoModule {
+  pname = "go-toml";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "pelletier";
-    repo = pname;
+    repo = "go-toml";
     rev = "v${version}";
     sha256 = "sha256-DAtp9ovl6cny0rom80aK+bGe9U/p6zmTQo1Z3MscCjg=";
   };
@@ -22,16 +25,21 @@ buildGoModule rec {
     "cmd/tomltestgen"
   ];
 
+  # allowGoReference adds the flag `-trimpath` which is also denoted by, go-toml's goreleaser config
+  #  <https://github.com/pelletier/go-toml/blob/a3d5a0bb530b5206c728eed9cb57323061922bcb/.goreleaser.yaml#L13>
+  allowGoReference = true;
+
   ldflags = [
     "-s"
     "-w"
+    "-X main.version=${version}"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Go library for the TOML language";
     homepage = "https://github.com/pelletier/go-toml";
     changelog = "https://github.com/pelletier/go-toml/releases/tag/v${version}";
-    maintainers = [ maintainers.isabelroses ];
-    license = licenses.mit;
+    maintainers = [ lib.maintainers.isabelroses ];
+    license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/development/tools/java/jprofiler/default.nix b/pkgs/development/tools/java/jprofiler/default.nix
index 3a74e491f0e5..7f74d8665a80 100644
--- a/pkgs/development/tools/java/jprofiler/default.nix
+++ b/pkgs/development/tools/java/jprofiler/default.nix
@@ -36,7 +36,7 @@ let
 
   srcIcon = fetchurl {
     url = "https://www.ej-technologies.com/assets/content/header-product-jprofiler@2x-24bc4d84bd2a4eb641a5c8531758ff7c.png";
-    hash = "sha256-XUmuqhnNv7mZ3Gb4A0HLSlfiJd5xbCExVsw3hmXHeVE=";
+    hash = "sha256-4T0j2ctHmgWOSCmFG2PZCLJS57nIa5MxmJBpMYzy9FI=";
   };
 
   desktopItems = makeDesktopItem {
diff --git a/pkgs/development/tools/kustomize/default.nix b/pkgs/development/tools/kustomize/default.nix
index ad1ea3f61ab4..849c8054b002 100644
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "kustomize";
-  version = "5.3.0";
+  version = "5.4.1";
 
   ldflags = let t = "sigs.k8s.io/kustomize/api/provenance"; in
     [
@@ -15,13 +15,13 @@ buildGoModule rec {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "kustomize/v${version}";
-    hash = "sha256-TleO28Q6JaOz1OAJKbvLhN99a841FEhHL15NTMhS1Oc=";
+    hash = "sha256-zt+/CKIIaZxfjfMu9L4/bDc5MmaqeEp3MI/m++GQoEc=";
   };
 
   # avoid finding test and development commands
   modRoot = "kustomize";
   proxyVendor = true;
-  vendorHash = "sha256-inCBDIVdvkEdDJEwX7vdoWANk+f01VxhBGPKxrjR6Ao=";
+  vendorHash = "sha256-YxkZ2YlkvMihTYi34lfwpUrmGa4LrrWsP2cpJZY/41A=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/strace-analyzer/default.nix b/pkgs/development/tools/misc/strace-analyzer/default.nix
index 33371bee9373..625683196923 100644
--- a/pkgs/development/tools/misc/strace-analyzer/default.nix
+++ b/pkgs/development/tools/misc/strace-analyzer/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "strace-analyzer";
-  version = "0.5.2";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "wookietreiber";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wx0/Jb2uaS1qdRQymfE00IEOyfgLtD4lXYasaJgcoxo=";
+    sha256 = "sha256-KbdQeZoWFz4D5txu/411J0HNnIAs3t5IvO30/34vBek=";
   };
 
-  cargoHash = "sha256-3OS3LEEk58+IJDQrgwo+BJq6hblojk22QxDtZY5ofA4=";
+  cargoHash = "sha256-t1BFc5cNOQJIbufFH2hHI4f7SMrZ5mwVODXukdbHf3M=";
 
   nativeCheckInputs = [ strace ];
 
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index cd73494140da..c2dd4cb8e5c6 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "19.24.2";
+  version = "19.24.3";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-xr6ULlOBmRF1s/oge+AnANLGkP30U6T1tgoBvnCLf/4=";
+    hash = "sha256-sgtMK1ccf1rX5ZdQpTRClxx112eOFV+BWyTIpMlzLVA=";
   };
 
   vendorHash = "sha256-iSbQn86b1xZwlyo5nKYI7LEH5AyWCw7MLgD3Q0mtFfk=";
diff --git a/pkgs/development/tools/redisinsight/default.nix b/pkgs/development/tools/redisinsight/default.nix
index 5c4609e248d8..1131e495e86c 100644
--- a/pkgs/development/tools/redisinsight/default.nix
+++ b/pkgs/development/tools/redisinsight/default.nix
@@ -1,70 +1,84 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, makeWrapper
-, makeDesktopItem
-, fixup_yarn_lock
-, yarn
-, nodejs_18
-, python3
-, fetchYarnDeps
-, electron
-, desktopToDarwinBundle
-, nest-cli
-, libsass
-, buildPackages
-, pkg-config
-, sqlite
-, xdg-utils
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  makeWrapper,
+  makeDesktopItem,
+  copyDesktopItems,
+  fixup-yarn-lock,
+  yarn,
+  nodejs_18,
+  python3,
+  fetchYarnDeps,
+  electron,
+  nest-cli,
+  libsass,
+  buildPackages,
+  pkg-config,
+  sqlite,
+  xdg-utils,
 }:
+
 let
   nodejs = nodejs_18;
 in
 stdenv.mkDerivation (finalAttrs: {
-  pname = "redisinsight-electron";
+  pname = "redisinsight";
   version = "2.32";
 
   src = fetchFromGitHub {
     owner = "RedisInsight";
     repo = "RedisInsight";
-    rev = "${finalAttrs.version}";
+    rev = finalAttrs.version;
     hash = "sha256-esaH10AyEooym/62F5LJL7oP5UmD6T2UX8g/9QniL9s=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    sha256 = "NHKttywAaWAYkciGzYCnm1speHrWsv1t+dxL1DZgM7o=";
+    hash = "sha256-NHKttywAaWAYkciGzYCnm1speHrWsv1t+dxL1DZgM7o=";
   };
 
   feOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/redisinsight/yarn.lock";
-    sha256 = "1S1KNUOtmywQ0eyqVS2oRlhpjcL9eps8CR7AtC9ujSU=";
+    hash = "sha256-1S1KNUOtmywQ0eyqVS2oRlhpjcL9eps8CR7AtC9ujSU=";
   };
 
   apiOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/redisinsight/api/yarn.lock";
-    sha256 = "P99+1Dhdg/vznC2KepPrVGNlrofJFydXkZVxgwprIx4=";
+    hash = "sha256-P99+1Dhdg/vznC2KepPrVGNlrofJFydXkZVxgwprIx4=";
   };
 
-  nativeBuildInputs = [ yarn fixup_yarn_lock nodejs makeWrapper python3 nest-cli libsass pkg-config ]
-    ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
+  nativeBuildInputs = [
+    yarn
+    fixup-yarn-lock
+    nodejs
+    makeWrapper
+    python3
+    nest-cli
+    libsass
+    pkg-config
+    copyDesktopItems
+  ];
 
-  buildInputs = [ sqlite xdg-utils ];
+  buildInputs = [
+    sqlite
+    xdg-utils
+  ];
 
   configurePhase = ''
     runHook preConfigure
 
     export HOME=$(mktemp -d)
-    yarn config --offline set yarn-offline-mirror $offlineCache
-    fixup_yarn_lock yarn.lock
+    yarn config --offline set yarn-offline-mirror ${finalAttrs.offlineCache}
+    fixup-yarn-lock yarn.lock
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
 
-    yarn config --offline set yarn-offline-mirror $feOfflineCache
-    fixup_yarn_lock redisinsight/yarn.lock
+    yarn config --offline set yarn-offline-mirror ${finalAttrs.feOfflineCache}
+    fixup-yarn-lock redisinsight/yarn.lock
     yarn --offline --cwd redisinsight/ --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
 
-    yarn config --offline set yarn-offline-mirror $apiOfflineCache
-    fixup_yarn_lock redisinsight/api/yarn.lock
+    yarn config --offline set yarn-offline-mirror ${finalAttrs.apiOfflineCache}
+    fixup-yarn-lock redisinsight/api/yarn.lock
     yarn --offline --cwd redisinsight/api/ --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
 
     patchShebangs node_modules/
@@ -76,29 +90,32 @@ stdenv.mkDerivation (finalAttrs: {
     ln -sfv "${nodejs}/include" "$HOME/.node-gyp/${nodejs.version}"
     export npm_config_nodedir=${nodejs}
 
-    pushd redisinsight
     # Build the sqlite3 package.
+    pushd redisinsight
     npm_config_node_gyp="${buildPackages.nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" npm rebuild --verbose --sqlite=${sqlite.dev} sqlite3
     popd
 
+    # Build node-sass
+    LIBSASS_EXT=auto npm rebuild --verbose node-sass
+
     substituteInPlace redisinsight/api/config/default.ts \
-      --replace "process['resourcesPath']" "\"$out/share/redisinsight\"" \
+      --replace-fail "process['resourcesPath']" "\"$out/share/redisinsight\"" \
+
+    # has irrelevant files
+    rm -r resources/app
 
     runHook postConfigure
   '';
 
   buildPhase = ''
     runHook preBuild
-    yarn config --offline set yarn-offline-mirror $offlineCache
 
-    pushd node_modules/node-sass
-    LIBSASS_EXT=auto yarn run build --offline
-    popd
+    yarn config --offline set yarn-offline-mirror ${finalAttrs.offlineCache}
 
     yarn --offline build:prod
 
     yarn --offline electron-builder \
-      --dir ${if stdenv.isDarwin then "--macos" else "--linux"} ${if stdenv.hostPlatform.isAarch64 then "--arm64" else "--x64"} \
+      --dir \
       -c.electronDist=${electron}/libexec/electron \
       -c.electronVersion=${electron.version}
 
@@ -108,47 +125,47 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    # resources
-    mkdir -p "$out/share/redisinsight"
-    mkdir -p "$out/share/redisinsight/static/resources/plugins"
-    mkdir -p "$out/share/redisinsight/default"
+    mkdir -p "$out/share/redisinsight"/{app,defaults,static/plugins,static/resources/plugins}
 
-    cp -r release/${if stdenv.isDarwin then "darwin-" else "linux-"}${lib.optionalString stdenv.hostPlatform.isAarch64 "arm64-"}unpacked/resources/{app.asar,app.asar.unpacked} $out/share/redisinsight/
-    cp -r resources/ $out/share/redisinsight
+    cp -r release/*-unpacked/{locales,resources{,.pak}} "$out/share/redisinsight/app"
+    mv "$out/share/redisinsight/app/resources/resources" "$out/share/redisinsight"
 
     # icons
-    for icon in "$out/resources/icons/*.png"; do
+    for icon in "$out/share/redisinsight/resources/icons"/*.png; do
       mkdir -p "$out/share/icons/hicolor/$(basename $icon .png)/apps"
       ln -s "$icon" "$out/share/icons/hicolor/$(basename $icon .png)/apps/redisinsight.png"
     done
 
-    ln -s "${finalAttrs.desktopItem}/share/applications" "$out/share/applications"
-
     makeWrapper '${electron}/bin/electron' "$out/bin/redisinsight" \
-      --add-flags "$out/share/redisinsight/app.asar" \
+      --add-flags "$out/share/redisinsight/app/resources/app.asar" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-      --chdir "$out/share/redisinsight" \
-      --argv0 "$out/share/redisinsight/app.asar"
+      --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+      --inherit-argv0
 
     runHook postInstall
   '';
 
-  desktopItem = makeDesktopItem {
-    name = "redisinsight";
-    exec = "redisinsight %u";
-    icon = "redisinsight";
-    desktopName = "RedisInsight";
-    genericName = "RedisInsight Redis Client";
-    comment = finalAttrs.meta.description;
-    categories = [ "Development" ];
-    startupWMClass = "redisinsight";
-  };
+  desktopItems = [
+    (makeDesktopItem {
+      name = "redisinsight";
+      exec = "redisinsight %u";
+      icon = "redisinsight";
+      desktopName = "RedisInsight";
+      genericName = "RedisInsight Redis Client";
+      comment = finalAttrs.meta.description;
+      categories = [ "Development" ];
+      startupWMClass = "redisinsight";
+    })
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "RedisInsight Redis client powered by Electron";
     homepage = "https://github.com/RedisInsight/RedisInsight";
-    license = licenses.sspl;
-    maintainers = with maintainers; [ gmemstr ];
-    platforms = [ "x86_64-linux" ];
+    license = lib.licenses.sspl;
+    maintainers = with lib.maintainers; [
+      gmemstr
+      tomasajt
+    ];
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/development/tools/rust/cargo-clone/default.nix b/pkgs/development/tools/rust/cargo-clone/default.nix
index 4ad07b579347..8ce7e006dce7 100644
--- a/pkgs/development/tools/rust/cargo-clone/default.nix
+++ b/pkgs/development/tools/rust/cargo-clone/default.nix
@@ -4,6 +4,7 @@
 , pkg-config
 , openssl
 , stdenv
+, CoreServices
 , Security
 , SystemConfiguration
 }:
@@ -24,6 +25,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [
+    CoreServices
     Security
     SystemConfiguration
   ];
diff --git a/pkgs/development/tools/rust/cargo-deb/default.nix b/pkgs/development/tools/rust/cargo-deb/default.nix
index b70f742772c0..236fd2f3e025 100644
--- a/pkgs/development/tools/rust/cargo-deb/default.nix
+++ b/pkgs/development/tools/rust/cargo-deb/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deb";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "kornelski";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-LCyTbOSSz3O53hZmOPcK+tB5LNZLE4uwfOZrwJZuebc=";
+    hash = "sha256-FIBMwLgLLgf6m/ciSlYiQ46HHf1ux0QY4RkoidlaEjs=";
   };
 
-  cargoHash = "sha256-apT60W4lUCMsRvuzGkY8AkA8m8e7ESGGnmOpyv5Ca1I=";
+  cargoHash = "sha256-MmHwaodr/FLxCucfCkV/Cuflyu8902kpEPuTCKkchNU=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/development/tools/rust/cargo-show-asm/default.nix b/pkgs/development/tools/rust/cargo-show-asm/default.nix
index bd08268d5928..736d546ff2aa 100644
--- a/pkgs/development/tools/rust/cargo-show-asm/default.nix
+++ b/pkgs/development/tools/rust/cargo-show-asm/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-show-asm";
-  version = "0.2.32";
+  version = "0.2.34";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-4pMIL/wru9uE8Uyp/qvmo6IJxFcB0HLUHRSSV6DoI3g=";
+    hash = "sha256-+EzI17pnqO19A+KW1AsHtBpYZq1aENA03RkK03j31LI=";
   };
 
-  cargoHash = "sha256-N1NZONY8y88diAbWn+UaSHGpd4r7naxFWVmCyJkL3tQ=";
+  cargoHash = "sha256-VIfT7cXrXBE9mfHpDCI3diSD9ToRPH6UUP7ZOWvumbU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/selene/default.nix b/pkgs/development/tools/selene/default.nix
index b464bee86e06..0bd600423b31 100644
--- a/pkgs/development/tools/selene/default.nix
+++ b/pkgs/development/tools/selene/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "selene";
-  version = "0.26.1";
+  version = "0.27.1";
 
   src = fetchFromGitHub {
     owner = "kampfkarren";
     repo = pname;
     rev = version;
-    sha256 = "sha256-0imHwZNyhJXFai1J5tHqnQ6Ta10nETQ5TILGH0bHc8Y=";
+    sha256 = "sha256-NbVSFYv3nyEjSf0bFajcMaoWP2bS0EfJT8tDddjS7jg=";
   };
 
-  cargoHash = "sha256-Lm3agCnxDxcj7op17uiokK8Y790oMxwHJStvP/9DsI0=";
+  cargoHash = "sha256-e3oQUFtgdjqPiB2YpmqnFUG2scmYJhLSpUaw0W6RxIk=";
 
   nativeBuildInputs = lib.optionals robloxSupport [
     pkg-config
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index b9fa98a228ce..324218082bc3 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -42,6 +42,6 @@ rustPlatform.buildRustPackage rec {
     description = "A command line utility to work with Sentry";
     mainProgram = "sentry-cli";
     changelog = "https://github.com/getsentry/sentry-cli/raw/${version}/CHANGELOG.md";
-    maintainers = with maintainers; [ rizary loewenheim ];
+    maintainers = with maintainers; [ rizary ];
   };
 }
diff --git a/pkgs/development/tools/unityhub/default.nix b/pkgs/development/tools/unityhub/default.nix
index 3ef4b44953d1..84fe6d435936 100644
--- a/pkgs/development/tools/unityhub/default.nix
+++ b/pkgs/development/tools/unityhub/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.7.0";
+  version = "3.8.0";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/unityhub-amd64-${version}.deb";
-    sha256 = "sha256-cFHcfpsHSDlR82PtZ0leRDpvCD6nw0Qdb3PsYKMnosA=";
+    sha256 = "sha256-TjuOsF4LFqQGx4j5j/Er97MNhVm72qlvGYZvA5vuXs8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/web/bun/default.nix b/pkgs/development/web/bun/default.nix
index 512bbaa3e8ea..52b20dee8b15 100644
--- a/pkgs/development/web/bun/default.nix
+++ b/pkgs/development/web/bun/default.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.1.4";
+  version = "1.1.6";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-dBiwVO4WreVyIlbJVEyPZj46Dy/3W49mXdo7CiQWiAo=";
+        hash = "sha256-ffEu37NAT/74l1Kkr+e1hAkawbSeZlTQcHbqg/7jYOQ=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-XsyjcqKZ667iVTVsOKjaD9iORze0Zs8ZHiDYvuXQ07A=";
+        hash = "sha256-qKWtazbPfPjDxLChZ0FVyV2qQhPUHwF4wpHrFdCRlYg=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-M6MoYPNCGBP0KuNnv8cOnm47FJyxI6MXzsX+FvHxAEA=";
+        hash = "sha256-a3ol9tkKyVa6MoBq5cscRLAS5o8OCcIUX43opKtePos=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-9H/1qR6ZHHy5/abq2SjoUbUX6Y92/8MQem2inuWhVC8=";
+        hash = "sha256-IzjuIPXljt8EStcRdGj55SWIpqJdGQeVZVAS5u9sW+Y=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/kde/frameworks/kdoctools/default.nix b/pkgs/kde/frameworks/kdoctools/default.nix
index 8e8341997a2b..996e75c88538 100644
--- a/pkgs/kde/frameworks/kdoctools/default.nix
+++ b/pkgs/kde/frameworks/kdoctools/default.nix
@@ -8,9 +8,6 @@
 mkKdeDerivation {
   pname = "kdoctools";
 
-  # lots of self-references, the output is pretty small (~5MB), not worth trying to untangle
-  outputs = ["out"];
-
   # Perl could be used both at build time and at runtime.
   extraNativeBuildInputs = [perl perlPackages.URI];
   extraBuildInputs = [docbook_xml_dtd_45 docbook-xsl-nons];
diff --git a/pkgs/kde/lib/mk-kde-derivation.nix b/pkgs/kde/lib/mk-kde-derivation.nix
index 0b2ebd8ace7f..975d2e4af93a 100644
--- a/pkgs/kde/lib/mk-kde-derivation.nix
+++ b/pkgs/kde/lib/mk-kde-derivation.nix
@@ -91,7 +91,7 @@ in
     defaultArgs = {
       inherit version src;
 
-      outputs = ["out" "dev"];
+      outputs = ["out" "dev" "devtools"];
 
       nativeBuildInputs = [cmake qt6.wrapQtAppsHook moveDevHook] ++ extraNativeBuildInputs;
       buildInputs = [qt6.qtbase] ++ extraBuildInputs;
diff --git a/pkgs/kde/lib/move-dev-hook.sh b/pkgs/kde/lib/move-dev-hook.sh
index da5770e1bba1..a49cb91d22f3 100644
--- a/pkgs/kde/lib/move-dev-hook.sh
+++ b/pkgs/kde/lib/move-dev-hook.sh
@@ -2,7 +2,10 @@
 # shellcheck disable=SC2154
 
 moveKF6DevTools() {
-    moveToOutput "${qtPluginPrefix}/designer" "${!outputDev}"
+    if [ -n "$devtools" ]; then
+        mkdir -p "$devtools"
+        moveToOutput "${qtPluginPrefix}/designer" "$devtools"
+    fi
 }
 
 postInstallHooks+=('moveKF6DevTools')
diff --git a/pkgs/kde/misc/mpvqt/default.nix b/pkgs/kde/misc/mpvqt/default.nix
index 4ec52aba0793..fc237f97a803 100644
--- a/pkgs/kde/misc/mpvqt/default.nix
+++ b/pkgs/kde/misc/mpvqt/default.nix
@@ -17,7 +17,8 @@ mkKdeDerivation rec {
     hash = "sha256-XHiCxH7dJxJamloM2SJbiFHDt8j4rVfv/M9PaBzvgM4=";
   };
 
-  extraBuildInputs = [mpv qtdeclarative];
+  extraBuildInputs = [qtdeclarative];
+  extraPropagatedBuildInputs = [mpv];
 
   meta.license = with lib.licenses; [bsd2 bsd3 cc-by-sa-40 cc0 lgpl21Only lgpl3Only lgpl3Plus mit];
 }
diff --git a/pkgs/kde/plasma/breeze-grub/default.nix b/pkgs/kde/plasma/breeze-grub/default.nix
index a5fe01b4cad7..5dd3d199e44a 100644
--- a/pkgs/kde/plasma/breeze-grub/default.nix
+++ b/pkgs/kde/plasma/breeze-grub/default.nix
@@ -6,6 +6,8 @@ mkKdeDerivation {
   nativeBuildInputs = [];
   buildInputs = [];
 
+  outputs = ["out"];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index a5b7154e63d6..dbdf6a24951b 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -310,12 +310,18 @@ in rec {
   fzf-tmux-url = mkTmuxPlugin {
     pluginName = "fzf-tmux-url";
     rtpFilePath = "fzf-url.tmux";
-    version = "unstable-2021-12-27";
+    version = "unstable-2024-04-14";
     src = fetchFromGitHub {
       owner = "wfxr";
       repo = "tmux-fzf-url";
-      rev = "1241fc5682850fe41812cad81c76541674ee305b";
-      sha256 = "1270c5nfvgsdajgfahlacqfb5xwg4hwfrciiy0v03d50vg4h0kdi";
+      rev = "28ed7ce3c73a328d8463d4f4aaa6ccb851e520fa";
+      hash = "sha256-tl0SjG/CeolrN7OIHj6MgkB9lFmFgEuJevsSuwVs+78=";
+    };
+    meta = with lib; {
+      homepage = "https://github.com/wfxr/tmux-fzf-url";
+      description = "Quickly open urls on your terminal screen!";
+      license = licenses.mit;
+      platforms = platforms.unix;
     };
   };
 
diff --git a/pkgs/os-specific/darwin/xcode/default.nix b/pkgs/os-specific/darwin/xcode/default.nix
index 54250001d9eb..1b7949dcb124 100644
--- a/pkgs/os-specific/darwin/xcode/default.nix
+++ b/pkgs/os-specific/darwin/xcode/default.nix
@@ -3,7 +3,7 @@
 let requireXcode = version: sha256:
   let
     xip = "Xcode_" + version +  ".xip";
-    # TODO(alexfmpe): Find out how to validate the .xip signature in Linux
+
     unxip = if stdenv.buildPlatform.isDarwin
             then ''
               open -W ${xip}
@@ -14,7 +14,9 @@ let requireXcode = version: sha256:
               rm -rf ${xip}
               pbzx -n Content | cpio -i
               rm Content Metadata
+              rcodesign verify Xcode.app/Contents/MacOS/Xcode
             '';
+
     app = requireFile rec {
       name     = "Xcode.app";
       url      = "https://developer.apple.com/services-account/download?path=/Developer_Tools/Xcode_${version}/${xip}";
@@ -83,4 +85,3 @@ in lib.makeExtensible (self: {
   xcode_15_1 = requireXcode "15.1" "sha256-0djqoSamU87rCpjo50Un3cFg9wKf+pSczRko6uumGM0=";
   xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if (stdenv.targetPlatform ? xcodeVer) then stdenv.targetPlatform.xcodeVer else "12.3")}";
 })
-
diff --git a/pkgs/os-specific/linux/drbd/driver.nix b/pkgs/os-specific/linux/drbd/driver.nix
index d025fd5e229a..106bcf71cd98 100644
--- a/pkgs/os-specific/linux/drbd/driver.nix
+++ b/pkgs/os-specific/linux/drbd/driver.nix
@@ -26,12 +26,12 @@ stdenv.mkDerivation rec {
   # 6.4 and newer provide a in-tree version of the handshake module https://www.kernel.org/doc/html/v6.4/networking/tls-handshake.html
   installPhase = ''
     runHook preInstall
-    install -D drbd/drbd.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
-    install -D drbd/drbd_transport_tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
-    install -D drbd/drbd_transport_lb-tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
-    install -D drbd/drbd_transport_rdma.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+    install -D drbd/drbd.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
+    install -D drbd/drbd_transport_tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
+    install -D drbd/drbd_transport_lb-tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
+    install -D drbd/drbd_transport_rdma.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
     ${lib.optionalString (lib.versionOlder kernel.version "6.4") ''
-      install -D drbd/drbd-kernel-compat/handshake/handshake.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+      install -D drbd/drbd-kernel-compat/handshake/handshake.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
     ''}
     runHook postInstall
   '';
@@ -41,9 +41,13 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace 'SHELL=/bin/bash' 'SHELL=${builtins.getEnv "SHELL"}'
   '';
 
+  # builder.pl had complained about the same file (drbd.ko.xz) provided by two different packages
+  # builder.pl also had complained about different permissions between the files from the two packages
+  # The compression is required because the kernel has the CONFIG_MODULE_COMPRESS_XZ option enabled
   postFixup = ''
-    for ko in $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd/*.ko; do
+    for ko in $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9/*.ko; do
       xz --compress -6 --threads=0 $ko
+      chmod 0444 $ko.xz
     done
   '';
 
diff --git a/pkgs/os-specific/linux/google-authenticator/default.nix b/pkgs/os-specific/linux/google-authenticator/default.nix
index 02ca3d30d238..11791a664c8b 100644
--- a/pkgs/os-specific/linux/google-authenticator/default.nix
+++ b/pkgs/os-specific/linux/google-authenticator/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "google-authenticator-libpam";
-  version = "1.09";
+  version = "1.10";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "google-authenticator-libpam";
     rev = version;
-    hash = "sha256-DS0h6FWMNKnSSj039bH6iyWrERa5M7LBSkbyig6pyxY=";
+    hash = "sha256-KEfwQeJIuRF+S3gPn+maDb8Fu0FRXLs2/Nlbjj2d3AE=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/servers/baserow/default.nix b/pkgs/servers/baserow/default.nix
index 37366183dba0..bfc905175084 100644
--- a/pkgs/servers/baserow/default.nix
+++ b/pkgs/servers/baserow/default.nix
@@ -16,7 +16,7 @@ let
       baserow_premium = self.buildPythonPackage rec {
         pname = "baserow_premium";
         version = "1.12.1";
-        foramt = "setuptools";
+        format = "setuptools";
 
         src = fetchFromGitLab {
           owner = "bramw";
diff --git a/pkgs/servers/dns/nsd/default.nix b/pkgs/servers/dns/nsd/default.nix
index 1f82bde0384c..eecef52e2b4e 100644
--- a/pkgs/servers/dns/nsd/default.nix
+++ b/pkgs/servers/dns/nsd/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nsd";
-  version = "4.8.0";
+  version = "4.9.1";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-gg2k44RyGRX0vK9/K+2YUZ2lY8bkwTDHQsckdg7AKgo=";
+    sha256 = "sha256-psI6U+6BEfpx53t1ZdG49IbqaVdwgWWF+93xTkNn5t8=";
   };
 
   prePatch = ''
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 4a674415d604..52bf366e74ff 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -388,6 +388,13 @@ let
           rev = "refs/tags/${version}";
           hash = "sha256-vi5f4V0nPb9K3nwdmwMDoNE85Or6haOWjMY4d/2Fj2s=";
         };
+        dependencies = with self; [
+          aiohttp
+          async-timeout
+          gql
+          python-dateutil
+          websockets
+        ];
       });
 
       pykaleidescape = super.pykaleidescape.overridePythonAttrs (oldAttrs: rec {
diff --git a/pkgs/servers/imgproxy/default.nix b/pkgs/servers/imgproxy/default.nix
index 3187346c07eb..066265e162cc 100644
--- a/pkgs/servers/imgproxy/default.nix
+++ b/pkgs/servers/imgproxy/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "imgproxy";
-  version = "3.23.0";
+  version = "3.24.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    hash = "sha256-nsXIy/JpI7nDu40dUGPosMAOtFt/OzfSWyxD6JuKA+s=";
+    hash = "sha256-FOut1L4dyPvR1SSQLspA8PakQPewwTP2SgbfyDfWp3c=";
     rev = "v${version}";
   };
 
-  vendorHash = "sha256-KtqXhi8VwH1aZt/vLHuug5MJLchs0t4tqA7PIZUVPHQ=";
+  vendorHash = "sha256-GIMba/XlINwJilRo5Oi2j7HJJTQQpMOa2kPH17T/vLU=";
 
   nativeBuildInputs = [ pkg-config gobject-introspection ];
 
diff --git a/pkgs/servers/komga/default.nix b/pkgs/servers/komga/default.nix
index bb7930213ecf..bfe3f14f51b4 100644
--- a/pkgs/servers/komga/default.nix
+++ b/pkgs/servers/komga/default.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "1.11.0";
+  version = "1.11.1";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-bqWPkD8Pzlryv5wG65cEJNLoFVsu6yCymUgyfhrQR0M=";
+    sha256 = "sha256-L6fdR8j60x2YL5S5g6THN1LL+dy6kzHijjNR47Kuylo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/traefik/default.nix b/pkgs/servers/traefik/default.nix
index 22ad9d0d9429..77fac1c365f7 100644
--- a/pkgs/servers/traefik/default.nix
+++ b/pkgs/servers/traefik/default.nix
@@ -2,23 +2,23 @@
 
 buildGoModule rec {
   pname = "traefik";
-  version = "2.10.7";
+  version = "3.0.0";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    hash = "sha256-I+jmMtqWadWfT7nk2D9im6C2BGpPLts/7cdJ3NHsIks=";
+    hash = "sha256-OX9VJpO+SWIsocaSu+BhF3HT+zrhhgxb5NBvaRTadIY=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-3SyD1mC+tc8cf5MGcw891W5VbX+b7d0cIJQfwNq2NU8=";
+  vendorHash = "sha256-GRVSZB4GojXv2xAdx8Y5RSuhF/3paRhhq7HOWLRmmHE=";
 
   subPackages = [ "cmd/traefik" ];
 
   preBuild = ''
     GOOS= GOARCH= CGO_ENABLED=0 go generate
 
-    CODENAME=$(awk -F "=" '/CODENAME=/ { print $2}' script/binary)
+    CODENAME=$(grep -Po "CODENAME \?=\s\K.+$" Makefile)
 
     buildFlagsArray+=("-ldflags= -s -w \
       -X github.com/traefik/traefik/v${lib.versions.major version}/pkg/version.Version=${version} \
diff --git a/pkgs/tools/admin/aliyun-cli/default.nix b/pkgs/tools/admin/aliyun-cli/default.nix
index 217724e89dfa..dd8c10bb51cb 100644
--- a/pkgs/tools/admin/aliyun-cli/default.nix
+++ b/pkgs/tools/admin/aliyun-cli/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.202";
+  version = "3.0.203";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aliyun";
     repo = pname;
     fetchSubmodules = true;
-    sha256 = "sha256-tZBAu8LiqsWZE12UQcUdAr+6HkOOb7Au6Mg5lo0DXTQ=";
+    sha256 = "sha256-S+go4uMUjzZNvzI5e/h7b2YFNdkzmZbVf7pIXOJeUX0=";
   };
 
-  vendorHash = "sha256-t9ukiREUEmW6KK7m5Uv5Ce6n/1GsBLom9H35eEyOBys=";
+  vendorHash = "sha256-AvlDqaJ5w9oDV1slwArr12KA1d3FKVU9H5WK4s3ePtU=";
 
   subPackages = [ "main" ];
 
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index f354dde039c8..dca993567e1b 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -49,6 +49,9 @@ in stdenv.mkDerivation rec {
     runHook preInstall
 
     mkdir -p $out/google-cloud-sdk
+    if [ -d .install/platform/bundledpythonunix ]; then
+      rm -r .install/platform/bundledpythonunix
+    fi
     cp -R * .install $out/google-cloud-sdk/
 
     mkdir -p $out/google-cloud-sdk/lib/surface/{alpha,beta}
diff --git a/pkgs/tools/admin/winbox/default.nix b/pkgs/tools/admin/winbox/default.nix
index f4a39b2cbbc5..874e9b40d6b7 100644
--- a/pkgs/tools/admin/winbox/default.nix
+++ b/pkgs/tools/admin/winbox/default.nix
@@ -14,10 +14,10 @@ let
   name = "${pname}-${version}";
 
   executable = fetchurl (if (wine.meta.mainProgram == "wine64") then {
-    url = "https://download.mikrotik.com/winbox/${version}/winbox64.exe";
+    url = "https://download.mikrotik.com/routeros/winbox/${version}/winbox64.exe";
     sha256 = "1dxny1qmq4pmdn40j9zk461p3qwwjin5d18ajhczrnqrcr2v1xwi";
   } else {
-    url = "https://download.mikrotik.com/winbox/${version}/winbox.exe";
+    url = "https://download.mikrotik.com/routeros/winbox/${version}/winbox.exe";
     sha256 = "11vmdkwi38y7wkdkgsqpfs4l2bdaj9yg6c8wlgfzp91227gjn5li";
   });
 
diff --git a/pkgs/tools/audio/mpris-scrobbler/default.nix b/pkgs/tools/audio/mpris-scrobbler/default.nix
index a5e7b2483305..13070ea70513 100644
--- a/pkgs/tools/audio/mpris-scrobbler/default.nix
+++ b/pkgs/tools/audio/mpris-scrobbler/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mpris-scrobbler";
-  version = "0.5.0";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "mariusor";
     repo = "mpris-scrobbler";
     rev = "v${version}";
-    sha256 = "sha256-HUEUkVL5d6FD698k8iSCJMNeSo8vGJCsExJW/E0EWpQ=";
+    sha256 = "sha256-Gpgiu3wdxP4XjHzl1S4/wpTh2ZJjqowsD8wpbZuaySs=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/games/ukmm/Cargo.lock b/pkgs/tools/games/ukmm/Cargo.lock
index cda3a9935855..c8c049fef936 100644
--- a/pkgs/tools/games/ukmm/Cargo.lock
+++ b/pkgs/tools/games/ukmm/Cargo.lock
@@ -4595,7 +4595,7 @@ dependencies = [
 
 [[package]]
 name = "uk-content"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "anyhow",
  "indexmap 2.2.6",
@@ -4632,7 +4632,7 @@ dependencies = [
 
 [[package]]
 name = "uk-editor"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "anyhow",
  "eframe",
@@ -4659,7 +4659,7 @@ dependencies = [
 
 [[package]]
 name = "uk-manager"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "anyhow",
  "anyhow_ext",
@@ -4697,7 +4697,7 @@ dependencies = [
 
 [[package]]
 name = "uk-mod"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "anyhow",
  "anyhow_ext",
@@ -4738,7 +4738,7 @@ dependencies = [
 
 [[package]]
 name = "uk-reader"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "anyhow",
  "anyhow_ext",
@@ -4763,7 +4763,7 @@ dependencies = [
 
 [[package]]
 name = "uk-ui"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "catppuccin-egui",
  "color-hex",
@@ -4797,14 +4797,14 @@ dependencies = [
 
 [[package]]
 name = "uk-util"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "once_cell",
 ]
 
 [[package]]
 name = "ukmm"
-version = "0.11.0"
+version = "0.11.1"
 dependencies = [
  "anyhow",
  "anyhow_ext",
diff --git a/pkgs/tools/games/ukmm/default.nix b/pkgs/tools/games/ukmm/default.nix
index 180c060e2d65..f76613ed4a57 100644
--- a/pkgs/tools/games/ukmm/default.nix
+++ b/pkgs/tools/games/ukmm/default.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ukmm";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "NiceneNerd";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-/w1oJVn/JGBKPYhFqbvvY+HlA3owOei64ZqrPUXHu/E=";
+    hash = "sha256-yxF08kTA/IhM3LKFH523kVY3QfqwUElz3ICkjKPAo7E=";
   };
 
   cargoLock = {
diff --git a/pkgs/tools/graphics/hobbits/default.nix b/pkgs/tools/graphics/hobbits/default.nix
index 78cb959a8fc2..db0f30e84690 100644
--- a/pkgs/tools/graphics/hobbits/default.nix
+++ b/pkgs/tools/graphics/hobbits/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hobbits";
-  version = "0.54.0";
+  version = "0.54.1";
 
   src = fetchFromGitHub {
     owner = "Mahlet-Inc";
     repo = "hobbits";
     rev = "v${version}";
-    hash = "sha256-zbpYVoWOffMxx2RS5gXw+rpwdxoRutH/yzZqJIc57UU=";
+    hash = "sha256-SbSuw5e2ll/wU5UBV0MOlvCXb4rvPtsE4l8XzRbBiLI=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-bamboo.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-bamboo.nix
index b8e34332e8ae..b28254ea3c12 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-bamboo.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-bamboo.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fcitx5-bamboo";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "fcitx5-bamboo";
     rev = finalAttrs.version;
-    hash = "sha256-EcpuZN2JU6HSuiQgBPBsoYftdHypiyFlrUxDBlVW6eo=";
+    hash = "sha256-vEc9z7lFqk+LPP5sTzOYgV7u+/mQY2OsaRsTrtcI/EI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-chewing.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-chewing.nix
index e186839dbbb2..008ec44955a9 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-chewing.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-chewing.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-chewing";
-  version = "5.1.2";
+  version = "5.1.3";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-Zl/YlN5qIB8rjL4lPwRcKRoId0i1ovMOLJKGmTUHuwo=";
+    hash = "sha256-1rbpCniRPP9528qCAohN1o5198vypfWmYgCx8sd+NXU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 55a02002e257..6d97581af26f 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -59,7 +59,6 @@
 , python3
 , qemu
 , R
-, radare2
 , sng
 , sqlite
 , squashfsTools
@@ -76,8 +75,26 @@
 , writeScript
 }:
 
+let
+  python = python3.override {
+    packageOverrides = final: prev: {
+      # version 4 or newer would log the followng error but tests currently don't fail because radare2 is disabled
+      # ValueError: argument TNULL is not a TLSH hex string
+      tlsh = prev.tlsh.overridePythonAttrs ({ src, ... }: let
+        version = "3.19.1";
+      in {
+        inherit version;
+        src = src.override {
+          rev = version;
+          hash = "sha256-ZYEjT/yShfA4+zpbGOtaFOx1nSSOWPtMvskPhHv3c9U=";
+        };
+      });
+    };
+  };
+in
+
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
-python3.pkgs.buildPythonApplication rec {
+python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
   version = "265";
 
@@ -124,6 +141,11 @@ python3.pkgs.buildPythonApplication rec {
   # docx2txt <- makes tests broken:
   # > FAILED tests/comparators/test_docx.py::test_diff - IndexError: list index out of range
   # > FAILED tests/comparators/test_docx.py::test_compare_non_existing - AssertionError
+  # radare2
+  # > FAILED tests/comparators/test_elf_decompiler.py::test_ghidra_diff - IndexError: list index out of range
+  # > FAILED tests/comparators/test_elf_decompiler.py::test_radare2_diff - AssertionError
+  # > FAILED tests/comparators/test_macho_decompiler.py::test_ghidra_diff - assert 0 == 1
+  # > FAILED tests/comparators/test_macho_decompiler.py::test_radare2_diff - AssertionError
   #
   # We filter automatically all packages for the host platform (some dependencies are not supported on Darwin, aarch64, etc.).
   pythonPath = lib.filter (lib.meta.availableOn stdenv.hostPlatform) ([
@@ -160,7 +182,7 @@ python3.pkgs.buildPythonApplication rec {
     zip
     zstd
   ]
-  ++ (with python3.pkgs; [
+  ++ (with python.pkgs; [
     argcomplete
     debian
     defusedxml
@@ -203,13 +225,12 @@ python3.pkgs.buildPythonApplication rec {
       procyon
       qemu
       R
-      radare2
       tcpdump
       ubootTools
       wabt
       xmlbeans
     ]
-    ++ (with python3.pkgs; [
+    ++ (with python.pkgs; [
       androguard
       binwalk
       guestfs
@@ -224,7 +245,7 @@ python3.pkgs.buildPythonApplication rec {
     ++ lib.optionals (stdenv.hostPlatform.system != "aarch64-darwin") [ gnumeric ]
   ));
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python.pkgs; [
     pytestCheckHook
   ] ++ pythonPath;
 
diff --git a/pkgs/tools/misc/fwup/default.nix b/pkgs/tools/misc/fwup/default.nix
index d43914685d2c..904aca205214 100644
--- a/pkgs/tools/misc/fwup/default.nix
+++ b/pkgs/tools/misc/fwup/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fwup";
-  version = "1.10.1";
+  version = "1.10.2";
 
   src = fetchFromGitHub {
     owner = "fhunleth";
     repo = "fwup";
     rev = "v${version}";
-    sha256 = "sha256-s2TlxksxGYvRqDwRA7eLlXAyT5uPK2DiL8ma1nNVz5Q=";
+    sha256 = "sha256-SuagtYfLD8yXFpLHNl1J0m5/iapYU+Si6tJl0paStTY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/mise/default.nix b/pkgs/tools/misc/mise/default.nix
index f14d968a4810..280b7adde970 100644
--- a/pkgs/tools/misc/mise/default.nix
+++ b/pkgs/tools/misc/mise/default.nix
@@ -17,13 +17,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2024.4.5";
+  version = "2024.4.8";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-JnPsP19c7oE6bRVOd3Afok0A0Sn/tUOoc1DCjurueW0=";
+    hash = "sha256-bIw7j7KPHlgIucV/onvp92k0OlNgaxqiVq/Cnj0kIuQ=";
 
     # registry is not needed for compilation nor for tests.
     # contains files with the same name but different case, which cause problems with hash on darwin
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoHash = "sha256-trf4nJ2BmpzWvZb2YG/6i540k1xvLJVesc6g/AEgaVk=";
+  cargoHash = "sha256-yMpU39SU4Ut7vUQdzkBjhf8p8yCU350HMYKGm5CCado=";
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
diff --git a/pkgs/tools/misc/moar/default.nix b/pkgs/tools/misc/moar/default.nix
index d8972a89912e..c99c394f100a 100644
--- a/pkgs/tools/misc/moar/default.nix
+++ b/pkgs/tools/misc/moar/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "moar";
-  version = "1.23.10";
+  version = "1.23.11";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ue/ZcIIJJAxUMhsEA3FtrkE5mgtiY626b+GmX62Q8dM=";
+    hash = "sha256-dKsDvtFs1/WToqpfW84dxDAHRN13TUnZKKk26h3pQ18=";
   };
 
   vendorHash = "sha256-1u/2OlMX2FuZaxWnpU4n5r/4xKe+rK++GoCJiSq/BdE=";
diff --git a/pkgs/tools/misc/svtplay-dl/default.nix b/pkgs/tools/misc/svtplay-dl/default.nix
index b665f42413c3..5abdb5bba60d 100644
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@@ -15,7 +15,7 @@ let
     python pytest nose3 cryptography pyyaml requests mock requests-mock
     python-dateutil setuptools;
 
-  version = "4.72";
+  version = "4.73";
 
 in
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    hash = "sha256-kJ+2vedvxZWnKlgALvuwxLSC6Mmk8M1JIArev5m1wx0=";
+    hash = "sha256-e8ewsx2mx62JTUnpMoSRL44EGDllQuk/k9gRztOkWMc=";
   };
 
   pythonPaths = [ cryptography pyyaml requests ];
diff --git a/pkgs/tools/networking/cloudflare-warp/default.nix b/pkgs/tools/networking/cloudflare-warp/default.nix
index ee7070d06dda..7f5c9b18438c 100644
--- a/pkgs/tools/networking/cloudflare-warp/default.nix
+++ b/pkgs/tools/networking/cloudflare-warp/default.nix
@@ -1,22 +1,32 @@
 { stdenv
 , lib
-, fetchurl
-, dpkg
 , autoPatchelfHook
-, makeWrapper
 , copyDesktopItems
-, makeDesktopItem
 , dbus
+, dpkg
+, fetchurl
+, gtk3
+, libpcap
+, makeDesktopItem
+, makeWrapper
 , nftables
 }:
 
 stdenv.mkDerivation rec {
   pname = "cloudflare-warp";
-  version = "2023.3.470";
+  version = "2024.4.133";
+
+  suffix = {
+    aarch64-linux = "arm64";
+    x86_64-linux = "amd64";
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   src = fetchurl {
-    url = "https://pkg.cloudflareclient.com/pool/jammy/main/c/cloudflare-warp/cloudflare-warp_2023.3.470-1_amd64.deb";
-    hash = "sha256-AYnmisEQKFiEB2iRJifEqRbdzAyBcfrU0ITeUokKLag=";
+    url = "https://pkg.cloudflareclient.com/pool/jammy/main/c/cloudflare-warp/cloudflare-warp_${version}-1_${suffix}.deb";
+    hash = {
+      aarch64-linux = "sha256-qua+aL4+yvpTBGCVUS1rzJX1KZ3DeaW9Bce9lYWvWOM=";
+      x86_64-linux = "sha256-xZhyYDMjcv8SLfYwclvWBqPDETbeaxiA6jFCg3Nv5gc=";
+    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
   nativeBuildInputs = [
@@ -28,6 +38,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     dbus
+    gtk3
+    libpcap
     stdenv.cc.cc.lib
   ];
 
@@ -44,12 +56,17 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  autoPatchelfIgnoreMissingDeps = [
+    "libpcap.so.0.8"
+  ];
+
   installPhase = ''
     runHook preInstall
 
     mv usr $out
     mv bin $out
     mv etc $out
+    patchelf --replace-needed libpcap.so.0.8 ${libpcap}/lib/libpcap.so $out/bin/warp-dex
     mv lib/systemd/system $out/lib/systemd/
     substituteInPlace $out/lib/systemd/system/warp-svc.service \
       --replace "ExecStart=" "ExecStart=$out"
@@ -72,6 +89,6 @@ stdenv.mkDerivation rec {
       wolfangaukang
       devpikachu
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 }
diff --git a/pkgs/tools/networking/graphqurl/default.nix b/pkgs/tools/networking/graphqurl/default.nix
index e0b6fa9de9c0..3e7d05ce44e1 100644
--- a/pkgs/tools/networking/graphqurl/default.nix
+++ b/pkgs/tools/networking/graphqurl/default.nix
@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "graphqurl";
-  version = "1.0.1";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "hasura";
     repo = "graphqurl";
     rev = "v${version}";
-    hash = "sha256-0dR8lLD0yatAvE3kA90cNOzVRTFpQmzN1l13hdFr3TM=";
+    hash = "sha256-w7t3p7TOBA0nxUlfRfQkiZ26SCDCwv03A1r+pTgUCqc=";
   };
 
-  npmDepsHash = "sha256-2kLmhNFO/ySa6S9rBNYCePmsYXWz006IxiOJ7ZUkgPw=";
+  npmDepsHash = "sha256-17eRYr0vgnq7eFtlYY2CwvluwhbXWClL3onTNBkDF0c=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/tools/networking/hysteria/default.nix b/pkgs/tools/networking/hysteria/default.nix
index 33b0d9d4c152..5443d2c7f957 100644
--- a/pkgs/tools/networking/hysteria/default.nix
+++ b/pkgs/tools/networking/hysteria/default.nix
@@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
   pname = "hysteria";
-  version = "2.4.1";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = pname;
     rev = "app/v${version}";
-    hash = "sha256-ohqWubYR9Z5KtMEOyqVfxnmNO6SoaSsA3SOMDivVA54=";
+    hash = "sha256-4i3bXtg7WCSPDE7fUWVJnOOFNGLAo1F/a2wbuUH785o=";
   };
 
-  vendorHash = "sha256-DuQwg4vJgwC6IBs+8J5OVdO67OgdhmGTF88zlikHaAQ=";
+  vendorHash = "sha256-dV/bomGPg0Q3OEDuu6vRVsFRveDVzw6Hv0KLla2uZqc=";
   proxyVendor = true;
 
   ldflags =
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index 3b09ddf5694d..b9e23b6548ef 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2024-04-18T16-45-29Z";
+  version = "2024-04-29T09-56-05Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-aEhkk1nB8CGzuZfD8a62RwzcvF2HZTm1LPfb13c6x9Q=";
+    sha256 = "sha256-Fx7D8w5cPrl/TFmMIGZxn00BC0AYaLEh6K1PQ10jTBQ=";
   };
 
-  vendorHash = "sha256-qb4gR//8UzJAJ5WthfyxYwhR3YCwUGxfy8aRMW2MXks=";
+  vendorHash = "sha256-vqPSzzNIvy+9J9bPE4hxWvRPuPKpB8ahuu6ENnFmfJ0=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/networking/slirp4netns/default.nix b/pkgs/tools/networking/slirp4netns/default.nix
index 2b2091d85b27..85c5f36063a7 100644
--- a/pkgs/tools/networking/slirp4netns/default.nix
+++ b/pkgs/tools/networking/slirp4netns/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "slirp4netns";
-  version = "1.2.3";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "rootless-containers";
     repo = "slirp4netns";
     rev = "v${version}";
-    sha256 = "sha256-6kfL0ZjXzcyZl3remLi25RMLWCpg+a8EHC1M5LJE4a4=";
+    sha256 = "sha256-SjdRFcW8xjwJurOcNoHZTp3Ug17DmPrYZu8gcpQL2mE=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/networking/xray/default.nix b/pkgs/tools/networking/xray/default.nix
index e2ac3e2264b3..e2a07cf2d262 100644
--- a/pkgs/tools/networking/xray/default.nix
+++ b/pkgs/tools/networking/xray/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "xray";
-  version = "1.8.10";
+  version = "1.8.11";
 
   src = fetchFromGitHub {
     owner = "XTLS";
     repo = "Xray-core";
     rev = "v${version}";
-    hash = "sha256-Pc3sWVUZTOyCxGHcfKJ3fc0vUKtymPTe5DOEP+dScwg=";
+    hash = "sha256-uOE+Gp42WsqSA5/kQRjk+BKq9igmZCrq/9v1BJMXwFc=";
   };
 
-  vendorHash = "sha256-e+SJQBfwIkuzRblOQPt8ZKZgROBAZy2y5dyh6ykdFeg=";
+  vendorHash = "sha256-7E/H8ctv9BU59wPmywNeDhx1R4mqrjpM9E+Hz+AaPlk=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/nix/nixos-option/default.nix b/pkgs/tools/nix/nixos-option/default.nix
index d6cfc630d6e3..37018ac25a0b 100644
--- a/pkgs/tools/nix/nixos-option/default.nix
+++ b/pkgs/tools/nix/nixos-option/default.nix
@@ -10,10 +10,7 @@
 stdenv.mkDerivation {
   name = "nixos-option";
 
-  src = lib.fileset.toSource {
-    root = ./.;
-    fileset = lib.fileset.fileFilter (file: file.name != "default.nix") ./.;
-  };
+  src = ./.;
   postInstall = ''
     installManPage ${./nixos-option.8}
   '';
diff --git a/pkgs/tools/package-management/pkg/default.nix b/pkgs/tools/package-management/pkg/default.nix
index 83ae30ee22a3..1d0d02180960 100644
--- a/pkgs/tools/package-management/pkg/default.nix
+++ b/pkgs/tools/package-management/pkg/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pkg";
-  version = "1.21.0";
+  version = "1.21.2";
 
   src = fetchFromGitHub {
     owner = "freebsd";
     repo = "pkg";
     rev = finalAttrs.version;
-    sha256 = "sha256-5Yoe0Y2WTBc19OzB1QvJCX8FXtBlgxORyUppX6ZWnAM=";
+    hash = "sha256-iiekjV/X9dAqk9WTxDgi6SK/XkI0aKEfN4Hopgid3Rw=";
   };
 
   setOutputFlags = false;
diff --git a/pkgs/tools/security/biscuit-cli/default.nix b/pkgs/tools/security/biscuit-cli/default.nix
index 74dac8b56586..c5ee1da6b52b 100644
--- a/pkgs/tools/security/biscuit-cli/default.nix
+++ b/pkgs/tools/security/biscuit-cli/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "biscuit-cli";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "biscuit-auth";
     repo = "biscuit-cli";
     rev = version;
-    sha256 = "sha256-Mvrv3BU0Pw85fs8IbjMKSQLIhtU6SKoLC0cuGdhfAYs=";
+    sha256 = "sha256-Aj/s5RnkRFZMOJAHY9tdVtq24DgrgMjaYEq7oA9lXFc=";
   };
 
-  cargoHash = "sha256-tgmM0rswIFrpFyupaASTXYvIyhVu0fXJJN+hg0p+vrQ=";
+  cargoHash = "sha256-TUu+2i+GJiS7PvzVDwWLa+w+RfbYX+k51WG2LbcqINk=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/tools/security/bpb/default.nix b/pkgs/tools/security/bpb/default.nix
deleted file mode 100644
index 88eeb7c254d0..000000000000
--- a/pkgs/tools/security/bpb/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ stdenv
-, lib
-, rustPlatform
-, fetchFromGitHub
-, Security
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "bpb";
-  version = "unstable-2018-07-27";
-
-  src = fetchFromGitHub {
-    owner = "withoutboats";
-    repo = "bpb";
-    rev = "b1ef5ca1d2dea0e2ec0b1616f087f110ea17adfa";
-    sha256 = "sVfM8tlAsF4uKLxl3g/nSYgOx+znHIdPalSIiCd18o4=";
-  };
-
-  cargoSha256 = "7cARRJWRxF1kMySX6KcB6nrVf8k1p/nr3OyAwNLmztc=";
-
-  # a nightly compiler is required unless we use this cheat code.
-  RUSTC_BOOTSTRAP = 1;
-
-  buildInputs = lib.optional stdenv.isDarwin Security;
-
-  meta = with lib; {
-    description = "Tool to automatically sign git commits, replacing gpg for that purpose";
-    homepage = "https://github.com/withoutboats/bpb";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ];
-  };
-}
diff --git a/pkgs/tools/security/cnquery/default.nix b/pkgs/tools/security/cnquery/default.nix
index a5dafec184fd..9c87dab3f1c6 100644
--- a/pkgs/tools/security/cnquery/default.nix
+++ b/pkgs/tools/security/cnquery/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.0.2";
+  version = "11.1.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hWZXt9hUK0IXnmqKvKdowR42NVu+guMPW3krzgI1KqU=";
+    hash = "sha256-99bkEoAfNfejO/M1V8KmAmyP+klrCtmkf1l6aZynEgQ=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-Q1Wz3zHow4UeqgZVP9s9xHuLwrG2LE/tsDUdgs6xMNo=";
+  vendorHash = "sha256-Nb2KSTS85//GC4ikYgrNNoKYJYBYvG9q5GF5RPemklE=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/security/ghauri/default.nix b/pkgs/tools/security/ghauri/default.nix
index fd4a0fa9903f..c4d176eb2a27 100644
--- a/pkgs/tools/security/ghauri/default.nix
+++ b/pkgs/tools/security/ghauri/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ghauri";
-  version = "1.3";
+  version = "1.3.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "r0oth3x49";
     repo = "ghauri";
     rev = "refs/tags/${version}";
-    hash = "sha256-CZhkb8GmXXSA5QqhW7IAirwsxQg6YNFT3RHrGsyqAbk=";
+    hash = "sha256-QO4/dkJU/uhP1AT1kIxDBIGBfLI1rOhOe/cHC8GwhkA=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/libmodsecurity/default.nix b/pkgs/tools/security/libmodsecurity/default.nix
index 61669836f792..f2abaaf7d8a7 100644
--- a/pkgs/tools/security/libmodsecurity/default.nix
+++ b/pkgs/tools/security/libmodsecurity/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   version = "3.0.12";
 
   src = fetchFromGitHub {
-    owner = "SpiderLabs";
+    owner = "owasp-modsecurity";
     repo = "ModSecurity";
     rev = "v${version}";
     sha256 = "sha256-WIFAg9LvKAC8e3gpcIxtNHT53AIfPtUTyrv30woxP4M=";
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "https://github.com/SpiderLabs/ModSecurity";
+    homepage = "https://github.com/owasp-modsecurity/ModSecurity";
     description = ''
       ModSecurity v3 library component.
     '';
diff --git a/pkgs/tools/security/step-cli/default.nix b/pkgs/tools/security/step-cli/default.nix
deleted file mode 100644
index d52a828ca590..000000000000
--- a/pkgs/tools/security/step-cli/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-
-buildGoModule rec {
-  pname = "step-cli";
-  version = "0.26.1";
-
-  src = fetchFromGitHub {
-    owner = "smallstep";
-    repo = "cli";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-BVxdgyQsfCwHw/zjP3AKNib3sRWoBpMlZ7vh71nso94=";
-  };
-
-  ldflags = [
-    "-w"
-    "-s"
-    "-X=main.Version=${version}"
-  ];
-
-  preCheck = ''
-    # Tries to connect to smallstep.com
-    rm command/certificate/remote_test.go
-  '';
-
-  vendorHash = "sha256-Z6wrWkyAGi01gH7+v2+VkyqRNqDwLFVwXm/1FIMzURg=";
-
-  meta = with lib; {
-    description = "A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";
-    homepage = "https://smallstep.com/cli/";
-    changelog = "https://github.com/smallstep/cli/blob/v${version}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ isabelroses ];
-    platforms = platforms.linux ++ platforms.darwin;
-    mainProgram = "step";
-  };
-}
diff --git a/pkgs/tools/text/csview/default.nix b/pkgs/tools/text/csview/default.nix
index 5420591e5842..b85d98b58fd7 100644
--- a/pkgs/tools/text/csview/default.nix
+++ b/pkgs/tools/text/csview/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "csview";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-v+WqiHecps3rCGf6CF0KJDZUWs7zMrFypVPTANR8b6Y=";
+    sha256 = "sha256-Tu/h9jhZgulrc5bTJrwq7Ksg69qUVUBjWNdzve4m9JM=";
   };
 
-  cargoHash = "sha256-v5QxJto9acVJnMUvBK3QdkDH+qO2+wtqitGfSCcaJ5w=";
+  cargoHash = "sha256-ZXLu/6IQ20u8dk0gaZoBh0rt6CGaRBNVHGgrCW5+yzA=";
 
   meta = with lib; {
     description = "A high performance csv viewer with cjk/emoji support";
diff --git a/pkgs/tools/text/diffsitter/default.nix b/pkgs/tools/text/diffsitter/default.nix
index e3c14df85407..8e0a6bbc3d15 100644
--- a/pkgs/tools/text/diffsitter/default.nix
+++ b/pkgs/tools/text/diffsitter/default.nix
@@ -32,17 +32,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "diffsitter";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "afnanenayet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-rB580TlM0/HXYgPvWtm7KMtXrw6i996HyvCrNr3QmNA=";
+    hash = "sha256-XYuX8NMVnVyOo3I2CmMS/TE47wQaigc8sen3ap2geSU=";
     fetchSubmodules = false;
   };
 
-  cargoHash = "sha256-8ajCXoB+mVhHrstVG+QkWYfXJqDk4+XPcO6yjR4TqpQ=";
+  cargoHash = "sha256-re0FRoyENpo+BF88U9ARuB05W03Slgm4nw1yxcpOA4o=";
 
   buildNoDefaultFeatures = true;
   buildFeatures = [
diff --git a/pkgs/tools/virtualization/nixos-container/nixos-container.pl b/pkgs/tools/virtualization/nixos-container/nixos-container.pl
index 854557eb7237..5e504eca749a 100755
--- a/pkgs/tools/virtualization/nixos-container/nixos-container.pl
+++ b/pkgs/tools/virtualization/nixos-container/nixos-container.pl
@@ -171,10 +171,8 @@ sub writeNixOSConfig {
     my $nixosConfig = <<EOF;
 { config, lib, pkgs, ... }:
 
-with lib;
-
 { boot.isContainer = true;
-  networking.hostName = mkDefault "$containerName";
+  networking.hostName = lib.mkDefault "$containerName";
   networking.useDHCP = false;
   $localExtraConfig
 }
diff --git a/pkgs/tools/wayland/hyprland-per-window-layout/default.nix b/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
index 61bca460b0e0..2e9da7634856 100644
--- a/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
+++ b/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprland-per-window-layout";
-  version = "2.9";
+  version = "2.10";
 
   src = fetchFromGitHub {
     owner = "coffebar";
     repo = pname;
     rev = version;
-    hash = "sha256-AhTDcwZnFAaB750PqdXjZvjVrSjwJd3CXv1UtZfcTC0=";
+    hash = "sha256-oCHX9C/TnTGxHfZBtKhwcWJaijZ92MqCOnf6OgviH1o=";
   };
 
-  cargoHash = "sha256-uZsXIDdUNZyrDmfWCHDuibziarzIav74Lpu4yObkGbc=";
+  cargoHash = "sha256-RkIHwIWzKwzpPIFmOkBmOUq07YdLQRVOGblybnACUfs=";
 
   meta = with lib; {
     description = "Per window keyboard layout (language) for Hyprland wayland compositor";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 026d65d45da5..7d1fad806ed0 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -131,6 +131,7 @@ mapAliases ({
   boost174 = throw "boost174 has been deprecated in favor of the latest version"; # Added 2023-06-08
   boost17x = throw "boost17x has been deprecated in favor of the latest version"; # Added 2023-07-13
   boost18x = throw "boost18x has been deprecated in favor of the latest version"; # Added 2023-07-13
+  bpb = throw "bpb has been removed as it is unmaintained and not compatible with recent Rust versions"; # Added 2024-04-30
   bpftool = bpftools; # Added 2021-05-03
   bpytop = throw "bpytop has been deprecated by btop"; # Added 2023-02-16
   bro = throw "'bro' has been renamed to/replaced by 'zeek'"; # Converted to throw 2023-09-10
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1cb18c8a10d9..40a717bbed5a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4386,8 +4386,6 @@ with pkgs;
   bozohttpd = callPackage ../servers/http/bozohttpd { };
   bozohttpd-minimal = callPackage ../servers/http/bozohttpd { minimal = true; };
 
-  bpb = callPackage ../tools/security/bpb { inherit (darwin.apple_sdk.frameworks) Security; };
-
   brasero-original = lowPrio (callPackage ../tools/cd-dvd/brasero { });
 
   brasero = callPackage ../tools/cd-dvd/brasero/wrapper.nix { };
@@ -6277,8 +6275,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) PCSC;
   };
 
-  step-cli = callPackage ../tools/security/step-cli { };
-
   step-kms-plugin = callPackage ../tools/security/step-kms-plugin { };
 
   string-machine = callPackage ../applications/audio/string-machine { };
@@ -15327,6 +15323,8 @@ with pkgs;
   colmap = libsForQt5.callPackage ../applications/science/misc/colmap { inherit (config) cudaSupport; };
   colmapWithCuda = colmap.override { cudaSupport = true; };
 
+  opensplatWithCuda = opensplat.override { cudaSupport = true; };
+
   chickenPackages_4 = recurseIntoAttrs (callPackage ../development/compilers/chicken/4 { });
   chickenPackages_5 = recurseIntoAttrs (callPackage ../development/compilers/chicken/5 { });
   chickenPackages = dontRecurseIntoAttrs chickenPackages_5;
@@ -16675,7 +16673,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
   cargo-clone = callPackage ../development/tools/rust/cargo-clone {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
+    inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
   };
   cargo-codspeed = callPackage ../development/tools/rust/cargo-codspeed {
     rustPlatform = makeRustPlatform {
@@ -24594,8 +24592,6 @@ with pkgs;
 
   stb = callPackage ../development/libraries/stb { };
 
-  stduuid = callPackage ../development/libraries/stduuid { };
-
   steghide = callPackage ../tools/graphics/steghide { };
 
   stegsolve = callPackage ../tools/graphics/stegsolve { };
@@ -31383,8 +31379,6 @@ with pkgs;
 
   goffice = callPackage ../development/libraries/goffice { };
 
-  got = darwin.apple_sdk_11_0.callPackage ../applications/version-management/got { };
-
   gtkterm = callPackage ../tools/misc/gtkterm { };
 
   gtk-pipe-viewer = perlPackages.callPackage ../applications/video/pipe-viewer { withGtk3 = true; };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index b5f51c68d1d8..8a7ad8a70aeb 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1194,6 +1194,8 @@ let
 
     netchannel = callPackage ../development/ocaml-modules/netchannel { };
 
+    ninja_utils = callPackage ../development/ocaml-modules/ninja_utils { };
+
     nonstd =  callPackage ../development/ocaml-modules/nonstd { };
 
     note = callPackage ../development/ocaml-modules/note { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4759c865e04c..2a78003434af 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12898,6 +12898,8 @@ self: super: with self; {
 
   quil = callPackage ../development/python-modules/quil { };
 
+  quixote = callPackage ../development/python-modules/quixote { };
+
   qutip = callPackage ../development/python-modules/qutip { };
 
   qmk-dotty-dict = callPackage ../development/python-modules/qmk-dotty-dict { };